EUDAMED Exposure Map
4–6 weeks, depending on portfolio scope
A device-level reconciliation of your EU portfolio against EUDAMED registration status and certificate expiry, delivered as a single view showing which products are exposed, on what date, and against how much revenue.
Current timing: The Actor, UDI/Device, Notified Bodies & Certificates, and Market Surveillance modules became mandatory to use on 28 May 2026. For applicable legacy devices and Regulation devices first placed on the market before mandatory use, the European Commission transitional timeline identifies 28 November 2026 as the device-registration deadline. The applicable position should be confirmed device by device.
Nobody can answer the question in one page
Device records sit across regulatory databases, PLM systems, quality records and regional spreadsheets, owned by different people in different functions. Asked which products are exposed and on what date, most organisations need weeks to assemble an answer. Even then, the answer that emerges is usually incomplete.
Two assumptions make it worse. The first is that registration is automatic. The second is that the notified body or the authorised representative is handling it. Neither holds: The manufacturer is responsible for ensuring the required UDI and device information is correctly submitted and maintained in EUDAMED. A Notified Body or authorised representative does not automatically assume that responsibility.
General Manager or P&L owner
Needs the exposure stated in revenue terms and by quarter, not in regulatory terms.
VP Regulatory Affairs
Accountable for registration status, and for the answer when leadership asks what is exposed.
Head of Regulatory Operations
Owns the device data that the registration depends on, and knows where it does not reconcile.
This is the right engagement if
- You cannot produce a single view of every EU device with its registration status and certificate expiry.
- You hold an SRN but are unsure how many of your devices are actually registered against it.
- Device data sits in more than two systems with no designated master.
- You have devices under an open vigilance action and are unsure how that affects the registration position.
- You have assumed your notified body or authorised representative is handling registration.
- An acquisition brought in devices whose registration status nobody owns.
What we do
Portfolio reconciliation. Consolidation of device records held across regulatory databases, PLM systems, quality records and regional spreadsheets into a single device-level register keyed to Basic UDI-DI.
Registration status verification. Assessment of what is actually recorded in EUDAMED against what is actually on the market, including actor registration, legacy device records, and linkage between legacy and MDR device entries.
Data readiness assessment. Review of UDI and device attribute data against EUDAMED field requirements to identify the records that will fail submission, and why. Registration failure is a data problem before it is a system problem.
Exposure quantification. Certificate expiry dates and registration gaps mapped against revenue by product line and by quarter, so the exposure is stated in commercial terms.
What you receive
Six named outputs. Every finding carries a source reference.
Device-Level Exposure Register
One row per device, with EUDAMED registration status, certificate expiry date, data-readiness flag and attached revenue. The single view the organisation does not currently have.
Six-Category Finding Classification
Every device classified into exactly one category: clean, inconsistent, unregistered with the transitional period applying, unregistered with it void, out of scope, or beyond registration. The classification is what turns a register into a decision instrument.
Data Readiness Gap List
Records requiring correction before submission, ranked by effort and by date exposure, with an owner assigned to each. Includes the specific field-level failures that would cause a submission to be rejected.
Revenue Exposure View
Exposure quantified by product line and by quarter. Where no SKU-to-UDI-DI mapping exists, revenue is attached at product-family level and stated as such.
Registration Critical Path
A dated work-back from the 28 November 2026 transitional registration deadline, where applicable, showing the last responsible start date for each remaining action, calculated against your own approval and change-control cycles rather than idealised durations.
Executive Readout
A sixty-minute session with the leadership team, structured as decisions required rather than findings presented. Owners and dates named in the room. One round of written follow-up questions included for thirty days.
How it runs
Delivery window. The 4–6 week delivery window includes intake, access setup, assessment and executive readout. The one- and two-week assessment periods below begin after the required device data and system access are complete.
-
01
Before the clock starts
Intake list issued, and read-only EUDAMED Viewer access granted under your actor registration. Access provisioning is the item that most often delays a start date, so it is arranged before the engagement begins.
-
02
Week 1
Kickoff with regulatory and quality leads together. Vigilance list reviewed first. Devices under an open action require immediate attention and are raised on day one, not held for the readout. Certificate register built. Device records consolidated and registration status verified against EUDAMED.
-
03
Week 2
Data readiness testing against EUDAMED field requirements. Revenue attached. Remediation sequenced and the critical path dated.
-
04
End of Week 2
Register handover and executive readout with the decision set.
What is not included
- Performing registrations in EUDAMED or submitting records on the manufacturer’s behalf is not included. The manufacturer remains responsible for ensuring the required device information is correctly submitted and maintained.
- Correcting or remediating device master data. The assessment identifies what must be corrected and by when; execution sits with your team or a data-management partner.
- Technical documentation review, clinical evidence assessment or notified body submission strategy. These are separate engagements.
Scope
Family Review: one legal entity, one to three Basic UDI-DI groups, one week. The right starting point where the data condition is unknown, or where a scoped first engagement is preferred.
Portfolio Segment: one legal entity, up to fifteen Basic UDI-DI groups, two weeks. The standard engagement for a single-entity manufacturer.
Phased Portfolio: two or more legal entities, delivered as a sequence of single-entity engagements, highest-exposure entity first, with a consolidated view following the final phase.
Each is fixed-fee, confirmed in a written statement of work following the confidential strategy discussion.
Questions
We think we are already registered. Is this still worth doing?
Often, yes. The answer usually arrives within the first hour. Comparing registered device count against portfolio count is a fast check, and the more common finding is not absence of registration but inconsistency between what is recorded in EUDAMED and what appears on the label, the Declaration of Conformity and the certificate. Such mismatches can cause submission failure, rework, or delay and should be identified before registration activity begins.
What if our device data is in poor condition?
That is established at the confidential strategy discussion, not discovered mid-engagement. Where data requires reconstruction rather than reconciliation, the engagement is scoped accordingly and the additional effort is stated in the proposal before it is incurred.
What happens if required documents or access arrive late?
The delivery date moves accordingly. The engagement timeline assumes the agreed documents, data and access are available when intake closes. If required inputs arrive late, SHOTUNE will confirm the revised delivery date rather than compress the review.
Start with a confidential strategy discussion
Thirty minutes. Structured questions about the portfolio, the deadline, the condition of your data, and who has to make the decision. No fee is quoted on the call, and you will be told if this is not the right fit.