What are the EUDAMED modules, and which ones are mandatory?

EUDAMED is not one database — it is six modules, released and made mandatory on separate schedules. Four are mandatory today: actor registration, UDI/device registration, notified bodies and certificates, and market surveillance. Two are not: vigilance and post-market surveillance, and clinical investigations and performance studies. Knowing which is which tells you what you are legally obliged to file, what you can look up, and — just as important — what is not in there yet.

Why it is modular at all

The MDR (Regulation (EU) 2017/745) set EUDAMED up under Article 33 as a single database integrating a set of distinct electronic systems. The original design assumed the whole thing would go live at once, tied to the regulation's date of application. It did not — the build ran years late, which is why Regulation (EU) 2024/1860 introduced a gradual, module-by-module rollout: each module becomes mandatory six months after the Commission publishes a notice confirming it is functional.

Commission Decision (EU) 2025/2371, published 27 November 2025, was that notice for the first four. Six months later — 28 May 2026 — those four became mandatory to use.

The four mandatory modules

Actor registration. Every manufacturer, authorised representative, importer and system/procedure-pack producer registers here, and this is where the SRN comes from (Articles 30 and 31). Distributors do not register. This module is the spine: nothing else attaches without it. It is public — you can browse the registered actors without a login.

UDI / device registration. Devices, systems and procedure packs, keyed by Basic UDI-DI and UDI-DI (Articles 28 and 29). Registration happens before the device is placed on the market. Public — this is the device corpus most people mean when they say "search EUDAMED".

Notified bodies and certificates. The certificates issued by notified bodies are recorded here, alongside the bodies themselves and their designations. Note the direction of the relationship: notified bodies issue certificates; EUDAMED records them. Largely public — you can read the indexed certificate records and trace each back to its issuing body.

Market surveillance. The competent-authority oversight module. This one is mandatory but largely non-public — it carries authority-to-authority coordination, not a consumer-facing register. If you are looking for a public feed of enforcement actions here, you will not find one.

The two that are not live yet

Vigilance and post-market surveillance. This is the module people most often assume is already there, and its absence is the single most consequential gap. Serious incidents and field safety corrective actions are not publicly searchable in EUDAMED today.

Be precise about what that does and does not mean: the obligations still apply. Manufacturers must report serious incidents and FSCAs to the competent authority under Article 87 — the 15-day general deadline, 2 days for a serious public-health threat — they simply route through national channels rather than a live EUDAMED module. The duty is unchanged; only the plumbing is pending.

Clinical investigations and performance studies. Sponsor-facing, still handled through national authorities. For an IVDR (Regulation (EU) 2017/746) performance study or an MDR clinical investigation, EUDAMED is not yet where the submission lands.

Two deadlines still ahead

The 28 May 2026 date was a start line, not a finish: two grace periods from Regulation (EU) 2024/1860 are still running — 28 November 2026 for devices already on the market, and 27 May 2027 for pre-existing notified-body certificates. Both dates and the arithmetic behind them are worked through in is EUDAMED mandatory now; the Commission's EUDAMED overview is the place to track any change.

What this means when you are reading the data

Three practical consequences fall out of the module map, and all three are ways people misread EUDAMED:

1. Absence is not evidence. A device with no certificate record may be a Class I device that needs none, a legacy device, or a device whose notified body has not yet uploaded under the 2027 grace period. "Not in EUDAMED" and "not compliant" are different statements.
2. You cannot check a safety history here yet. With vigilance not live, no amount of searching EUDAMED tells you whether a device has had incidents. For that you still go to national authority databases and field safety notices.
3. The public/non-public split is per module, not per record. Actor, device and certificate data are broadly public; market surveillance is not. That is the design, not a gap in indexing.

MD Atlas indexes the public modules — an indexed subset of EUDAMED, not the complete database — which is why the counts here are ours as of July 2026 rather than EU-wide totals, and why we can show you actors, devices and certificates but not vigilance data that does not exist publicly to show.