What changes when the EUDAMED vigilance module goes live?

Vigilance is the one EUDAMED module people most often assume is already running, and it is not. Serious incidents and field safety corrective actions are not publicly searchable in EUDAMED today, and they will not be until the module is released and made mandatory. What is very much running is the obligation — the 2, 10 and 15-day reporting clocks apply now, through national channels. The plumbing is pending; the duty is not.

What applies today

Under Article 87 of the MDR (Regulation (EU) 2017/745), manufacturers report serious incidents and field safety corrective actions to the competent authority. The clocks run from the moment the manufacturer becomes aware:

Situation	Deadline
Serious public-health threat	Immediately, and no later than 2 days
Death, or unanticipated serious deterioration in health	10 days
Any other serious incident	15 days

Around that sit the rest of the post-market obligations: trend reporting for statistically significant increases in non-serious incidents or expected undesirable side effects, periodic safety update reports for higher-risk classes, and the manufacturer's post-market surveillance system feeding all of it.

None of this is waiting on EUDAMED. A manufacturer that reads "the vigilance module isn't live" as "reporting isn't required yet" has misread it in the most expensive possible direction. The module rollout schedule — four modules mandatory since 28 May 2026, vigilance and clinical investigations still in development — is set by Regulation (EU) 2024/1860 and tracked on the Commission's EUDAMED overview; it governs where you file, never whether you must.

What the module will change

Three things, when it arrives:

One route instead of many. Today a manufacturer selling across the EU reports through the channels of each relevant national authority, in their formats. The module replaces that with a single EU submission point — which is the actual efficiency argument for the whole thing.

One home for field safety notices. An FSCA currently surfaces through the manufacturer, the distributors, and national authority pages that vary enormously in how findable they are. A single EU location is a material improvement for anyone doing device due diligence.

A public summary layer becomes possible. This is the change most consequential for transparency, and the most uncertain in its detail: once incident data lands in one system, publishing summary information over it becomes technically possible in a way it simply is not today. What exactly is published, and at what granularity, is a matter for the Commission and the implementing rules — do not assume a device-level incident feed.

What the module will not change

Worth stating plainly, because vendors will tell you otherwise:

• The deadlines. 2, 10 and 15 days are set by the regulation, not by the system. A new submission route does not buy time.
• Who is responsible. Reporting, trend analysis, PMS and the decision to launch a corrective action remain the manufacturer's. A database does not assume any of it.
• The need for national engagement. Competent authorities keep their market surveillance role under the regulation; a common system changes where the data goes, not who acts on it.

Reading a device's safety record in the meantime

This is the practical consequence for anyone doing supplier or device due diligence, and it is easy to get wrong.

You cannot check a device's incident history in EUDAMED. At all. No amount of searching will surface it, because it is not there. So a device that looks clean in EUDAMED is not a device with a clean safety record — it is a device whose safety record lives somewhere else. For that, you still go to national competent-authority databases and published field safety notices.

What EUDAMED's live modules do give you is the surrounding context, and it is worth using properly:

• Who made it, and are they registered. Start from the registered manufacturers and confirm the actor record exists — an unregistered manufacturer placing devices after 28 May 2026 is itself a finding.
• What is certified, and by whom. The indexed certificate records show what a notified body has signed off, and a certificate that is suspended or withdrawn is a real signal — suspension is reversible, withdrawal is not.
• What the device actually is. The device corpus plus the device's EMDN term tells you what family it sits in, which is how you find comparable devices to check against.

Three of the six modules give you actors, devices and certificates. The fourth mandatory module — market surveillance — is largely non-public. Vigilance and clinical investigations are pending. Knowing that map — set out in full in what are the EUDAMED modules — is what keeps you from over-reading a quiet search result.

As always, MD Atlas indexes the public modules as an indexed subset of EUDAMED, not the complete database — one more reason a missing record is a question to pursue rather than an answer to rely on.