The regulation, quickly
To be clear on what's actually changing: on 27 November 2025, the European Commission confirmed that four EUDAMED modules - Actor Registration, UDI/Device Registration, Notified Bodies & Certificates, and Market Surveillance - met their functional specifications. That publication started a six-month transition clock, which expires on 28 May 2026. From that date, those four modules become mandatory. New MDR and IVDR devices must be registered before first placement on the EU market. Devices already on the market when the deadline hits have until 27 November 2026 to appear in the system. Notified Bodies have until May 2027 to upload certificates issued before the mandatory date. Vigilance and clinical-studies modules are expected to follow.
That's the regulation. As regulations go, it is relatively unambiguous.
The problem isn't the regulation. The problem is that most of the industry is preparing to solve the wrong version of it.
What manufacturers are actually finding
Talk to anyone who has started genuine EUDAMED testing - not the planning, the pushing data into the system - and you hear a consistent story. It usually starts with confidence. We have UDI. We have a device master list. We know our classifications. We've been planning for this for years. And then, once the data starts hitting the EUDAMED schema, things come apart.
Product names differ between ERP and regulatory files. UDI-DI hierarchies don't match what the technical documentation assumes. Device classifications are consistent in one system and aspirational in another. Trade names appear with three variant spellings across four departments. The certificate references the device one way, the labelling another, the internal quality record a third. None of these inconsistencies prevented anyone from getting CE-marked under the current model, because under the current model regulatory data only has to be consistent at submission time. A human reconciles it, cleans it, packages it, sends it. Once the submission goes in, everyone goes back to their own system, and the gaps quietly reopen.
One widely cited figure from early EUDAMED testing puts roughly 60 percent of required device data as missing from manufacturers' internal systems on first upload. It's worth being careful with that number - it comes from vendors who sell readiness tooling, and their sample is not the industry - but the shape of the finding is corroborated by everyone else working in the space. The data isn't lost. It has simply never been structured, normalised, or reconciled across systems, because nothing ever forced it to be.
EUDAMED is the thing that forces it to be.
The shift nobody is naming clearly
Here is what is actually happening underneath the deadline noise: European medtech regulatory compliance is moving from a periodic model to a continuous one. Those are different animals, and the gap between them is where most of the pain is going to live.
Under the periodic model - the one most of the industry was built around - regulatory data was something you produced in concentrated bursts. A technical file, a CER update, a certificate renewal, an annual report. You gathered data, reconciled it, packaged it, submitted it, and then the system went quiet until the next cycle. Between cycles, inconsistencies were survivable, because nobody was looking.
Under a continuous model - which is what EUDAMED, fully implemented, actually creates - regulatory data is live. Twenty-seven national authorities can query it at any moment. It has to stay internally consistent with your technical documentation, your certificates, your labelling, and the vigilance signals that will eventually feed into the later modules. There is no gap between cycles, because there are no cycles. You are always filed.
The closest analogy from another industry is what happened to finance functions when tax authorities moved from annual returns to real-time digital reporting. It didn't change what was taxed. It changed the cadence at which the data had to be correct - from once a year to always - and most finance teams underestimated how much that single change would cost them in systems, process, and headcount. The shift from periodic to continuous is the real transformation. Everything else is implementation detail.
Why current operating models will struggle
In most medical device manufacturers today - and particularly outside the largest players - regulatory data lives where it has always lived: in a constellation of Word documents, Excel workbooks, shared drives, and the memory of whoever has been in the role longest. That wasn't laziness. It was a rational response to a periodic-reporting world where human reconciliation was cheap and software was expensive.
Under EUDAMED, it stops being rational. The person who used to reconcile everything in the three weeks before a submission now has to reconcile everything, forever, in parallel with their day job - and also produce structured data that validates against the EUDAMED schema on the first try, because the alternative is a rejection loop that consumes days at a time across notified bodies and competent authorities who are themselves running short on bandwidth.
There's also a scope problem that has caught a lot of companies off guard. In many organisations, EUDAMED was initially assigned to regulatory affairs as another regulatory reporting obligation. But the data EUDAMED asks for doesn't live in regulatory systems. It lives in PLM, in ERP, in the QMS, in supply chain master data, in labelling tools. Regulatory teams have been discovering, often too late, that they cannot complete the task alone because the task was never purely regulatory.
What good looks like
What the companies moving through this smoothly have in common isn't a bigger regulatory team. It's a different idea of where regulatory data lives. Instead of scattered documents kept in sync by discipline and memory, they maintain something closer to a living dossier - one place where the canonical version of every regulatory fact about a product exists, is updated once, and flows into the systems that need it. Inconsistencies become impossible by construction, not by vigilance.
That phrasing sounds abstract, but the test is concrete. When a device classification changes, how many places in your organisation need to know? And how many of them find out automatically? Under the old model, the honest answer was usually ten places, and none of them find out automatically, and that's why we have a senior RA person to chase it. Under EUDAMED, that answer is no longer survivable, because the version of the truth visible to twenty-seven authorities will diverge from the version visible on your certificate, and the gap will be public.
And EUDAMED is only the first. Cybersecurity reporting is heading in the same direction. So is the IVDR rollout. So, in a different way, are the AI Act obligations for AI-enabled devices. The pattern is unmistakable: more frameworks, shorter cycles, higher scrutiny, and less tolerance for the informal scaffolding that used to hold everything together between submissions.
The real deadline
The right way to read 28 May is not as the finish line of an EUDAMED preparation project. It is the starting line of a different way of working. The teams that will look competent in June aren't the ones who submitted the most data the fastest. They are the ones who stopped treating EUDAMED as a filing and started treating it as the new baseline - a live, structured, interconnected record of their product that stays current without anyone heroically making it current.
Everyone is preparing for a deadline. The harder problem, the one almost nobody is framing clearly, is the discipline the day after.
A note from Artifakt
We are building Artifakt because the shift this piece describes is the one we think will define the next decade of medtech regulatory operations. EUDAMED is the first time the European industry is being asked to maintain a live, connected view of its regulatory data at the cadence of the market, rather than the cadence of an audit. It won't be the last. Our focus is on helping medtech teams move from scattered documents held together by discipline to a single, living dossier where facts stay consistent by construction. If this framing resonates with how you're thinking about 28 May - or, more importantly, 29 May - we'd like to hear how you're approaching it.