Navigating EUDAMED implementation

Introduction

Submitting and maintaining medical device information in EUDAMED is a new requirement introduced by the European Medical Device Regulations (EU-MDR, EU-IVDR) which will be implemented gradually.
The primary objective of EUDAMED is to establish a centralized database that collects, stores, and circulates relevant information about medical devices (including in-vitro diagnostics) available in the EU market.
EUDAMED's implementation is a complex and multi-phased process. Timelines for go-live and mandatory use of the modules have been postponed various times.
Currently it is expected that by Q4 of 2027 the following modules will become mandatory: Actors registration, Notified Bodies and Certificates (except for public accessible information regarding certificates), Clinical investigations and performance studies, Vigilance and post-market surveillance, and Market surveillance. By Q2 of 2029 all modules should be mandatory.
The implementation of EUDAMED has significant implications for manufacturers throughout the medical device lifecycle, demanding a streamlined approach to information management in line with EUDAMED requirements. Additionally, manufacturers must establish appropriate processes, allocate sufficient resources, and employ suitable technology to facilitate the seamless exchange and maintenance of this data into the EUDAMED database.
Despite the seemingly distant go-live date, manufacturers are strongly recommended to begin preparations on time, given the considerable effort required from a Process, Organization, Technology, and Information (POTI) perspective.
 

Background

The primary objective of EUDAMED is to establish a centralized database that collects, stores, and circulates relevant information about medical devices (including in-vitro diagnostics) available in the EU market. EUDAMED provides a platform for manufacturers to submit data and information related to their medical devices, aiding authorities and stakeholders in making informed safety and compliance decisions. It ensures better traceability of medical devices throughout the device lifecycle; the Unique Device Identification (UDI) system allows for straightforward identification and tracking of medical devices and enables a timely response to safety concerns. Moreover, EUDAMED enhances the efficiency of and optimizes crucial regulatory processes, including actor and device registrations, clinical study application and monitoring, conformity assessment and consultation, and vigilance reporting. It also plays a key role in fostering coordination and proactive market surveillance efforts by equipping competent authorities with enhanced tools for monitoring device performance, identifying trends, and spotting potential safety issues with greater effectiveness. In addition, EUDAMED allows the public to access information about medical devices, enabling them to make informed decisions. This strengthens transparency and enhances patient safety and engagement. Furthermore, EUDAMED facilitates communication channels and information sharing among manufacturers and other Economic Operators, Notified Bodies, Competent Authorities and the European Commission.

EUDAMED Modules

EUDAMED will have six interconnected modules that facilitate data exchange, transparency, and regulatory compliance. EUDAMED will feature two interfaces: one reserved exclusively for EUDAMED actors and another open to the public. Especially Health care providers and patients can benefit from the latter as they are able search across all the devices placed on the market and access information such as: Device information, the Summary of Safety and Clinical performance (SSCP), storage and handling information, expert panel opinions and the written justification provided by Notified Bodies, information on clinical investigations (summary of results of the study conducted) and vigilance information (such as FSNs). This strengthens transparency and enhances patient safety and engagement.

Actor module (ACT module) - currently live

The actor module supports the registration of the various actors (Manufacturers, Authorizes Representatives, Importers and system/procedure pack producers) involved in the medical device lifecycle; every actor is mandated to provide their administrative details during the registration. Through the Actor module, economic operators request an Actor Identifier or Single Registration Number (Actor ID/SRN) and provide the relevant information for this request. Following this, the national competent authority assesses the request for approval. After approval, an Actor ID/SRN is generated and transferred to the requesting economic operator. These Actor ID’s and SRN’s are key to link economic operators to documents and data. Once registered, economic operators (specifically manufacturers, authorized representatives and importers) should confirm the accuracy of their data after one year. Subsequent reviews are required every two years to ensure the data is accurate and up to date.

UDI / Device Registration Module (UDI/Device module) - currently live

The purpose of the UDI / Device module is to ensure that each device can be uniquely identified and traced throughout its lifecycle. Manufacturers must enter data for all devices they offer in the EU market into the UDI module. This includes information such as Basic UDI, UDI characteristics and other details, Device classification, Device Trade name(s), Model(s), Reference/Catalogue number and CE certificate number.
The Basic UDI and UDI-DI, assigned to devices by manufactures, are key in EUDAMED and essential to achieve traceability. The Basic UDI serves as the primary gateway to device related information stored within EUDAMED, it is the main key for linking devices to documents and data. It is used in relevant documentation (such as the Declaration of Conformity (DoC), Technical Documentation and the Summary of Safety and Clinical performance (SSCP). The purpose of the Basic-UDI is to establish connections between devices that share the same intended purpose, risk class and design/manufacturing characteristics. The UDI-DI provides access to the information for a specific device. The Basic UDI and UDI-DI are also used in CI/PS module, Post Market Surveillance and Vigilance modules where applicable.
 

Notified Bodies (NB) & Certificates Module (NB/Certificate module) - currently live

The purpose of the NB/Certificate module is linking devices to independent conformity assessment results, certificates and consultations. Within this module, NBs must register information about their operations and keep a record of CE-mark certificates they have issued, denied or updated.
If a manufacturers application is refused or a manufacturer withdraws their application, before a decision is reached, the relevant Notified Body enters this in EUDAMED so that all other Notified Bodies will be able to access this information via this module. The Clinical Evaluation Consultation Procedure (CECP) will also be managed through this module and it enables the NB to provide full justification in its conformity assessment report where it has not followed the advice of the expert panel.
In addition, NB’s can also upload the Summary of Safety and Clinical Performance (SSCP) for medical devices (i.e. implantable and Class III devices) and the Summary of Safety and Performance (SSP) for IVDs (Class C and D devices).
 

Clinical Investigation and Performance Studies Module (CI/PS module) - not live yet

This module is dedicated to the registration and tracking of clinical investigations/performance studies as well as Post-market clinical follow-up (PMCF)/ Post-market Performance Follow-up (PMPF) for medical devices and In-vitro diagnostics respectively, providing a centralized platform for stakeholders to access and share information with and between Competent Authorities (CA’s) about ongoing and completed studies. Sponsors must register in the Actor module upon using the CI/PS module. Each submitted study will be assigned a unique Single Identification Number (SIN); this number will be used for all relevant communications.
Updates to the studies such as substantial modifications will also be tracked in this module, and competent authorities can approve or reject these in the system. In addition, adverse events that occur in the studies must be reported via this module. For PMCF investigations /PMPF studies, Sponsors must provide a notice to the Member States concerned including all required data and documentation at least 30 days prior to its commencement.
 

Post market Surveillance (PMS) & Vigilance Module (PMS/Vigilance module) – not live yet

The PMS/Vigilance module aims to monitor the safety and performance of medical devices after they have been made available for use in the EU. The module assists manufacturers in implementing post-market surveillance activities which involve monitoring the device's performance, detecting any adverse events, and assessing whether the device continues to meet its intended purpose safely and effectively. Manufacturers are required to submit serious incidents, PSUR’s (for high-risk devices) Field Safety Corrective Actions (FCSAs) as well as Field Safety Notices (FSNs), Periodic Summary reports (PSRs) and Trend reports (TRs).
CA’s will utilize this module for sharing details regarding the assessment results, outcomes, and any necessary corrective measures related to severe incidents and/or FSCAs. This module will additionally serve as a means to oversee post-market surveillance and vigilance data, with the objective of promptly detecting emerging trends, patterns, and signals that may unveil new risks or safety issues requiring communication to the European Commission (EC), CAs, and Coordinating CAs (CCAs).
 

Market Surveillance Module (MSU module) – not live yet

All European competent authorities are expected to perform checks to ensure the conformity of devices made available in the EU. The market surveillance module enhances cooperation among competent authorities throughout the European Union. This module is designed to empower competent authorities to engage in joint market surveillance efforts by granting them access to inspection reports, assessments of conformity, notifications concerning devices with unacceptable risks, and supplementary data concerning noncompliance.
Competent Authorities will be responsible for reporting and sharing the outcomes of their surveillance efforts to fellow CAs. Moreover, they will engage in follow-up actions concerning devices that pose unacceptable health and safety risks.
 

EUDAMED Timeline

EUDAMED's implementation has been a complex and multi-phased process. While the original deadline for full implementation was set for May 2020, multiple factors, including technical and resource challenges and the COVID-19 pandemic, delayed the launch.

Before EUDAMED becomes mandatory, three key steps should be completed in accordance with the transitional provisions of the EU-MDR:

1. EUDAMED should be fully functional
2. An independent audit should be conducted, and results should be presented to the Medical Devices Coordination Group (MDCG).
3. After this, the publication of a Commission notice in the Official Journal of the European Union (OJEU) should take place.

Currently, it is anticipated that the independent audit of all modules, except the Clinical Investigation and Performance Studies (CI/PS) module, will start in Q2’24 and is expected to be completed by Q1’25. Afterwards, an audit of the CIPS module will start in Q3’26 and be completed in Q1’27. The CI/PS audit will also include a global audit of all six modules together.

Following the publication of the notice in the OJEU by Q2’27, there will be two transitional periods during which economic operators can exchange all the necessary information before it becomes a mandatory requirement to enter information in different EUDAMED modules:

• By Q4 of 2027, six months after the publication in the OJEU, the use of the following modules will become mandatory: Actors registration, Notified Bodies and Certificates (except for public accessible information regarding certificates), Clinical investigations and performance studies, Vigilance and post-market surveillance, and Market surveillance.
• By Q2 of 2029, 24 months after the publication in the OJEU, the use of the UDI/Devices Registration module and the entire Notified Bodies and Certificates module will be mandatory.
   

Impact of EUDAMED on Manufacturers Processes, Organization, Technology and Information (POTI)

The implementation of EUDAMED has considerable implications for medical device manufacturers in various areas that affect their Processes, Organization, Technology landscape and Information (data) (POTI).

Processes

Manufacturers are required to exchange a wide range of data and information related to their medical devices with the different modules of EUDAMED. It is critical to start with an assessment to identify what processes need to be created or updated. After this, missing procedures and work instructions must be established. For example: submitting, verifying and maintaining data and information to ensure ongoing compliance; this includes EUDAMED user tasks and activities such as requesting registration for economic operators, creation and termination of user accounts, UDI assignments, registration of devices and submitting/ verifying related device information, registering clinical studies, submitting serious incidents, and many more. It is important to set up standardized formats for data submissions to ensure data accuracy and completeness. Moreover, appropriate change management processes should be in place to update and maintain the data in EUDAMED when necessary. As the UDI/Device registration module and the Actor module are already operational, manufacturers can review its requirements and initiate process setup immediately. Although the clinical investigation, post-market surveillance and vigilance modules are not yet active, manufacturers can prepare by examining the functional specifications published by the European Commission to anticipate their upcoming requirements (md_eudamed_fs_v7_2_en.pdf (europa.eu)).

Organization

Personnel engaged in EUDAMED tasks and activities must possess a comprehensive understanding of both EU Medical Device Regulations and the associated EUDAMED requirements. A robust data governance framework is critical to ensure regulatory compliance, data accuracy, completeness, and consistency. Significant emphasis should be given to establishing well-defined roles and responsibilities for EUDAMED related activities; clear data ownership and accountability are established through data governance. In addition user access profiles must be defined. Appropriate resources need to be allocated for data management and submission activities, as well as for IT support in case of queries or technical issues. Resources dedicated to these tasks should receive comprehensive training to ensure effective execution. Ongoing training and education programs are imperative to ensure that employees remain well-informed and up-to-date on EUDAMED and pertinent regulatory updates.

Technology

Manufacturers should verify the adequacy of their systems for managing essential EUDAMED data. Moreover, they should adequately prepare to ensure their readiness for submitting EUDAMED data in the most optimal manner. There are three potential solutions to exchange data with EUDAMED:

1) The EUDAMED User Interface: This option is the simplest one from a data handling/manipulation/implementation point of view. The user only needs a PC with Internet connection and a browser to connect to EUDAMED.

2) Bulk XML upload: In this option the user will need to provide (upload) the data in XML format to EUDAMED. This will allow bulk upload of existing information by uploading the XML files through the User Interface.

3) Machine-to-machine Data exchange: In this case, the data will be automatically transmitted between an external system and EUDAMED. To achieve this, the external system must be extended to convert its data into the XML format requested by EUDAMED DTX and implement a specific data exchange protocol.
 

Choosing the right solution for the organization depends mainly on the number of devices, frequency of updating data in EUDAMED, and potential costs. Figure 3 provides requirements, pro’s and con’s and conditions for each of these solutions to aid in determining the best solution.
Larger organizations with a substantial inventory of medical devices, might want to look into opportunities of outsourcing parts of the data management and exchange process. After choosing the best solution, processes should be established and implemented within the organization.
Additionally, it is important to guarantee that any patient or sensitive data submitted to EUDAMED conforms to data privacy and security regulations, such as the GDPR (General Data Protection Regulation). Technology solutions within the organization should be able to support this.
 

Information

The information needed for EUDAMED comes from various sources and systems within the organization. Manufacturers must adopt appropriate procedures, methods and tools to correctly collect, validate, and remediate information, and to exchange this information with EUDMAED in a secure and timely manner. Therefore, effective information management, protection and timely availability of the right information is essential. It is recommended to perform a data readiness assessment to define current and target state of data required for EUDAMED submissions. Manufacturers should systematically gather and validate required data for each device, ensuring strict adherence to standardized formats and terminologies. Any data that deviates from these standards should be evaluated and corrected. Furthermore, it is crucial to verify that the data submitted to EUDAMED seamlessly harmonizes with other systems, as well as documentation.
EUDAMED is also available in a Playground environment, serving exclusively to experiment with the application: https://webgate.training.ec.europa.eu/eudamed-play. You can use this for example to test data exchange (e.g. testing XML uploads).
 

Starting the EUDAMED compliance journey

EUDAMED go-live might seem far away, and with the two transitional periods previously mentioned, it may seem that there is plenty of time to prepare. However, it is crucial to realize that there are many complex tasks that need to be executed before this time. Manufacturers face the challenging job of carefully improving their processes, preparing the organization, their technology, and information landscape. This involves a lot of effort and time, especially because it is important to take a thorough and proactive approach to make sure that you can successfully comply with EUDAMED requirements.
A good resource to start the EUDAMED compliance journey is the EUDAMED information centre: Welcome to the EUDAMED information centre (europa.eu). Information such as infographics, guidance documents for the different modules and information on data exchange can be found here.
 

Have questions? Consult our experts!

Deloitte offers comprehensive support to medical device manufacturers in their EUDAMED preparedness and implementation. We provide all-encompassing EUDAMED Readiness Assessments to gauge your preparedness for EUDAMED integration, thoroughly examining your internal processes, organizational structure, technological infrastructure, data and documentation practices for compliance with EUDAMED requirements.
EUDAMED readiness is a significant task which often demands considerable time and resources. To alleviate this, Deloitte provides tailored assistance, including data collection, validation, and remediation for submissions, establishment and implementation of EUDAMED processes, and the setup of a robust Data Governance Framework. We also assist in evaluating the requirements of a new tool, selecting, and implementing the most suitable one for EUDAMED data management and submissions. Our ultimate goal is to help manufacturers meet the EUDAMED requirements in a timely manner, ensuring the continuous presence of their medical device(s) in the European Market.