The 28 May EUDAMED Mandate Applies to Four Modules, Not Every Workflow

Signals to watch

• A manufacturer or regulatory team cites 28 May 2026 but does not name one of the four modules covered by the functionality decision
• A device or certificate backfill deadline is described as if the module itself were still voluntary
• A project is routed to a manufacturer even though the named action belongs to a notified body or competent authority

The phrase “EUDAMED is mandatory” is accurate only after four facts are attached to it: the module, the Official Journal of the European Union (OJEU) functionality notice, the mandatory-use date and any separate registration window for an existing device or certificate. On 28 May 2026, four modules became mandatory. That date did not make all six modules operational, and a later backfill deadline does not keep a mandatory module voluntary.

This distinction matters to a medical-device regulatory service business-development lead following authorised manufacturer, notified-body and regulatory-affairs Telegram groups. A claim found after an internal deadline can be routed to the wrong specialist: device data may go to an actor-registration team, a certificate action may be assigned to the manufacturer instead of the notified body, or a future vigilance workflow may be sold as a live EUDAMED submission. The source chain should be checked before a proposal is named.

What became mandatory on 28 May 2026

EUDAMED is the European Database on Medical Devices, the information technology system established under the Medical Devices Regulation (MDR) and In Vitro Diagnostic Medical Devices Regulation (IVDR). It contains six interconnected modules, but the gradual rollout lets completed modules become mandatory without waiting for all six.

The European Commission EUDAMED overview states: “As of 28 May 2026, the following 4 modules of EUDAMED became mandatory to use.” It lists:

1. Actor Registration;
2. Unique Device Identification (UDI)/Device Registration;
3. Notified Bodies and Certificates (NB/CRF); and
4. Market Surveillance (MSU), for competent authorities and the Commission.

The same page identifies Commission Decision (EU) 2025/2371, published in the OJEU on 27 November 2025, as the notice declaring the first four modules functional. Regulation (EU) 2024/1860 had amended the MDR and IVDR so obligations related to a confirmed module apply six months after that notice. The Commission therefore records 28 May 2026 as the mandatory-use date.

As of 18 August 2026, the Commission lists the two remaining modules, Vigilance and Post-Market Surveillance (VGL), and Clinical Investigations and Performance Studies (CI/PS), as under development. They were not part of the 2025 functionality decision. “Four modules mandatory” must not be shortened to “all EUDAMED workflows are live.”

Why one transition claim can contain three different dates

The first date, 27 November 2025, is the OJEU publication that starts the statutory six-month transition. The second, 28 May 2026, is when the covered module obligations become mandatory. A third date may apply to backfilling an object that existed before mandatory use.

That third date depends on the object and event:

Claim being checked	Correct date route	Responsible record owner
Actor needs access to a mandatory module	Actor registration mandatory from 28 May 2026, subject to the actor and role rules	Economic operator and competent authority
First unit of a Regulation device is placed on the market on or after 28 May 2026	Register the applicable device before the first unit is placed	Manufacturer or responsible device-data owner
First unit was placed before 28 May, and additional units under the same identifier are placed afterward	Applicable legacy or Regulation device registration deadline is 28 November 2026	Manufacturer or system/procedure-pack producer, as applicable
MDR/IVDR certificate is issued after 28 May 2026	Register it in NB/CRF under the mandatory process	Notified body
Applicable MDR/IVDR certificate was issued before mandatory use	Commission backfill timeline ends 28 May 2027	Notified body
Market Surveillance action is named	MSU data are managed by competent authorities	Competent authority, not manufacturer sales or data team

The Commission’s current diagrams provide 28 November 2026 for the applicable device transition and 28 May 2027 for applicable pre-mandatory MDR/IVDR certificates. These dates should be read with the Commission Q&A, not applied to every record. Devices no longer placed on the market after mandatory use may not need UDI/Device registration unless a later post-market surveillance or vigilance action creates a requirement. Custom-made, investigational and performance-study devices also have distinct treatment.

For certificates, the Q&A says the 18-month backfill applies to Regulation devices that need to be or are registered in UDI/Device. It calls for the latest certificate version and, where applicable, the latest notified-body decision. New certificate issues, and updates or decisions made after mandatory use, follow the mandatory NB/CRF route. The 2027 backfill date does not mean NB/CRF remains optional until 2027.

A five-link source check prevents misrouting

When an authorised group fragment says a transition is “still open,” use this sequence before assigning a specialist:

1. Recover the dated claim. Preserve the message date, named deadline and linked document. An undated screenshot can describe the voluntary period even after it ended.
2. Identify the module. Map the activity to ACT, UDI/DEV, NB/CRF, MSU, VGL or CI/PS. “EUDAMED registration” is not a module name.
3. Find the functionality notice. Decision (EU) 2025/2371 covers the first four modules. If the module is absent, do not borrow the 28 May date.
4. Apply the module’s mandatory date. The OJEU notice triggered the six-month period. Record the legal provision and the owner affected by it.
5. Test the object-specific window. Ask when the first unit was placed, whether additional units will be placed, whether the device is legacy or Regulation, and when the certificate or later decision was issued.

This source check is distinct from the EUDAMED object-handoff workflow, which diagnoses a failed actor, device or certificate record after the correct route is known. For an actor-specific identity problem, use the SRN actor-state recovery. If the claim arrives without an official link, follow the official-source ladder.

Unknowns that must remain visible

A useful review note does not infer facts absent from the thread. It records the economic-operator role, exact module, source and retrieval date, device type, first placement date, planned later units, UDI-DI or other identifier, legacy or Regulation status, certificate issue and update dates, notified body, competent authority and intended submission.

It also records what remains unknown. A manufacturer reference does not prove who owns a certificate action. “Legacy” does not prove an exemption from registration. A date in a presentation does not prove it came from the OJEU notice. A future VGL or CI/PS action cannot be routed through a module that the Commission still identifies as under development.

TOP Prospect can preserve source material and analysis output within supported workflows for Telegram groups the user deliberately connects and is authorised to access. Saving a new matching target stores configuration only. In current production it does not start an automatic run or create new candidates. Single-source analysis is a separate workflow that the user must trigger. The product cannot access EUDAMED, interpret the law for a specific device, submit records, contact the writer or read private or unauthorised sources. The Telegram business-Signal workflow shows where human review begins.

Key facts

• Decision (EU) 2025/2371 was published in the OJEU on 27 November 2025 and confirmed functionality of the first four modules.
• The six-month transition resulted in mandatory use from 28 May 2026 for ACT, UDI/DEV, NB/CRF and MSU.
• VGL and CI/PS were still the two remaining modules under development on 18 August 2026.
• The device backfill date in the Commission timeline is 28 November 2026 for the specified pre-mandatory placement scenario.
• The certificate backfill date is 28 May 2027 for applicable MDR/IVDR certificates issued before mandatory use.
• Devices first placed from 28 May 2026 follow registration-before-placement where the rule applies.
• MSU data are managed by competent authorities, so not every mandatory-module task belongs to a manufacturer.
• A backfill window changes the deadline for a specified existing object; it does not postpone mandatory use of the module.

Frequently asked questions

Which modules became mandatory on 28 May 2026?

Actor Registration, UDI/Device Registration, Notified Bodies and Certificates, and Market Surveillance. The Market Surveillance module is managed by competent authorities.

Did the decision make all six modules mandatory?

No. It covered the first four. As of 18 August 2026, the Commission still described VGL and CI/PS as the remaining modules under development.

What is the deadline for a device first placed before mandatory use when more units follow?

For the applicable legacy or Regulation device or system/procedure pack scenario, the Commission timeline gives 28 November 2026. Verify the identifier, continued placement and exclusions before applying it.

What is the certificate backfill deadline?

The Commission gives 28 May 2027 for applicable MDR/IVDR certificates issued before mandatory use. New certificates and later updates or decisions use the mandatory NB/CRF process.

Does “EUDAMED mandatory” establish a consultancy project?

No. A scope needs the module, responsible actor, affected object, source date, deadline and missing output. Without them, it is a claim to verify, not a qualified project.

The fastest correct handoff is a four-line receipt: OJEU notice, module, mandatory-use date and object-specific window. That receipt tells the consultancy whether the next owner is an economic operator, notified body or competent authority, without competing with the separate work of repairing the actual EUDAMED record.

Reviewed by TOP Prospect Editorial Team on 18 August 2026. Dates and module status were checked against the European Commission overview, Decision (EU) 2025/2371, Regulation (EU) 2024/1860 and the Commission’s gradual-rollout Q&A and transition timeline. Device and certificate facts require case-specific regulatory review.

Frequently asked questions

Which EUDAMED modules became mandatory on 28 May 2026?

Actor Registration, UDI/Device Registration, Notified Bodies and Certificates, and Market Surveillance became mandatory. The Commission states that Market Surveillance data are managed by competent authorities, with notified-body viewing access where applicable.

Did Decision (EU) 2025/2371 make all six EUDAMED modules mandatory?

No. It confirmed functionality of the first four modules. As of 18 August 2026, the Commission describes Vigilance and Post-Market Surveillance and Clinical Investigations and Performance Studies as the two remaining modules under development.

What is the EUDAMED deadline for a device first placed before 28 May 2026 when more units will be placed afterward?

For an applicable legacy or Regulation device, or system or procedure pack, the Commission timeline gives 28 November 2026 as the UDI/Device registration deadline when the first unit was placed before mandatory use and additional units under the same identifier are placed afterward. Device type and exceptions still require review.

What is the deadline for certificates issued before mandatory use of the NB/CRF module?

The Commission timeline gives 28 May 2027 for applicable MDR/IVDR certificates issued before mandatory use. The Q&A limits this backfill rule to Regulation devices that need to be or are registered in UDI/Device and calls for the latest certificate version and, where applicable, the latest notified-body decision.

Does a post saying “EUDAMED is mandatory” establish a regulatory-service project?

No. The post must be matched to the exact module, responsible actor, device or certificate event, official source date and unresolved output. A general statement cannot show whether the task is actor registration, device backfill, certificate action, authority work or an untriggered future module.

Sources and further reading

• European Commission, EUDAMED overview and module status, accessed 18 August 2026↗
• Commission Decision (EU) 2025/2371 on the functionality of certain EUDAMED electronic systems, OJ publication 27 November 2025↗
• Regulation (EU) 2024/1860 enabling gradual rollout of EUDAMED modules, OJ publication 9 July 2024↗
• European Commission, Q&A on the gradual rollout of EUDAMED, accessed 18 August 2026↗
• European Commission, EUDAMED devices and certificates transition timeline, accessed 18 August 2026↗

RESEARCH & DEFINITIONS

How a Signal worth attention is found

See how Top Prospect finds and organizes Signals worth checking, keeps the original Telegram context, removes duplicates, and helps you decide what to review first. You decide whether to follow up and what to do next.

Open the methodology and core definitions →