Who Can Legally Upload Data to EUDAMED? Let’s Get This Clear Once and For All.

Richard Houlihan | EudaMed.com | Also published on LinkedIn

---

Here at EudaMed.com we speak with a lot of medical device manufacturers every week. Non-EU manufacturers in particular. And one question comes up again and again, sometimes phrased as a simple enquiry, sometimes as a near-panic: “Can our Authorised Representative upload our device data to EUDAMED for us?”

The answer is no. Categorically, legally, unambiguously no. And the MDCG has put this in writing. Let me explain exactly why, who can upload data, and what your practical options actually are — because that is what matters most to companies who need to get this right before EUDAMED becomes mandatory on 28th May 2026.

---

First, a Little Context

I have read a lot of articles on this topic over the years. Many of them do a reasonable job of explaining the legal framework. What they often miss is the practical angle — what does this mean for your company day-to-day, and what do you do about it? At EudaMed.com, we are less about lecturing and more about helping. In this article, I want to give you both legal clarity and a practical path forward.

---

The Manufacturer’s Obligation is Non-Delegable — The MDCG Has Said So

Let us start with the regulation itself. Under the MDR (Regulation (EU) 2017/745) and the IVDR (Regulation (EU) 2017/746), the obligation to register devices and upload data to EUDAMED sits firmly with the manufacturer. This is set out in Articles 27 and 29 of the MDR and Articles 24 and 26 of the IVDR.

Now, where it gets interesting — and where I see companies consistently getting tripped up — is the role of the Authorised Representative (AR) in all of this.

The MDCG published MDCG 2022-16: Guidance on Authorised Representatives, and it is required reading for any non-EU manufacturer or AR operating under MDR or IVDR. The guidance is explicit on this point. Under the section dealing with the AR’s obligations toward manufacturers, it states:

“Article 11(3)(c) of the Regulations also outlines the authorised representative’s obligation to verify that the manufacturer has complied with its UDI and devices registration obligations in EUDAMED, as set out in Articles 27, 29 MDR and Articles 24, 26 IVDR. It is noted that in line with Article 11(4) of the Regulations, the manufacturer’s obligation to register its information and devices in EUDAMED cannot be delegated to the authorised representative.“

📎 MDCG 2022-16 is available here: https://health.ec.europa.eu/system/files/2022-09/mdcg_2022-16_en.pdf

Read that again. Cannot be delegated. This is not a grey area. This is not open to interpretation in a contract between a manufacturer and their AR. The MDCG has drawn a clear line.

---

So, What Can the Authorised Representative Actually Do in EUDAMED?

This is where a lot of confusion creeps in, and I understand why. ARs interact with EUDAMED — they have their own actor registration, they appear on device records associated with their manufacturer clients, and they have a genuine EUDAMED obligation of their own. So it is easy to assume they can simply “do the EUDAMED bit” for the manufacturer.

They cannot. Here is the distinction that matters:

The AR’s role in EUDAMED is verificatory. They check that the manufacturer has done what the manufacturer is legally required to do. They are not the ones doing it. Think of it like a quality check rather than the production line itself. The MDCG guidance makes clear that the AR must verify compliance — but that verification obligation is fundamentally different from the data entry obligation, which remains with the manufacturer.

To be precise about what an AR can and cannot do in EUDAMED:

The AR can register themselves as an actor in EUDAMED and obtain their own SRN. The AR can verify the accuracy and completeness of the manufacturer’s EUDAMED data as part of their legal obligations. The AR cannot upload device registration data on behalf of the manufacturer. The AR cannot enter UDI information on the manufacturer’s behalf. The AR cannot fulfil the manufacturer’s Articles 27 and 29 MDR or Articles 24 and 26 IVDR registration obligations. Full stop.

---

What About Importers?

Importers are another economic operator who often end up in these conversations. I have seen companies assume that because the importer is physically present in the EU and handles the product, they must have some role to play in EUDAMED data entry. They do not — not for the manufacturer’s data.

Under Article 30 MDR and Article 28 IVDR, importers are required to register themselves as economic operators in EUDAMED. That is their EUDAMED obligation. It relates to their own identity as an importer, not to the manufacturer’s device data. The MDCG’s guidance on economic operators, including MDCG 2021-25 (Questions and Answers on the EUDAMED Actor Module), makes clear that each economic operator role has a distinct and separate scope within the system.

📎 MDCG 2021-25 is available here: https://health.ec.europa.eu/system/files/2021-10/mdcg_2021-25_en.pdf

Importers register themselves. Manufacturers register their devices. These are two entirely separate obligations belonging to two separate parties.

---

Who Can Legally Upload Data to EUDAMED on a Manufacturer’s Behalf?

Now for the part that actually helps you move forward.

Option 1: The Manufacturer Directly

This is the cleanest option and the one the Regulations were designed around. The manufacturer registers as an actor in EUDAMED, obtains their SRN (Single Registration Number), and their own team manages the data entry. This is perfectly achievable with the right preparation, tools, and support.

Option 2: A Third-Party Specialist — Acting as the Manufacturer’s Agent

The Regulations do not prevent a manufacturer from engaging a specialist regulatory affairs firm, a regulatory consultant, or a dedicated EUDAMED data service provider to upload data on their behalf. The critical distinction here is that the third party acts as an extension of the manufacturer’s own function, under the manufacturer’s SRN and mandate, with the manufacturer retaining full legal accountability for the accuracy and completeness of the data submitted.

This is fundamentally different from an AR or importer acting under their own separate regulatory identity. A contracted data specialist is not exercising an independent regulatory mandate — they are doing the operational work that the manufacturer is responsible for. That is a legally sound arrangement, and it is one that many manufacturers — particularly those managing large device portfolios or complex UDI datasets — use very effectively.

At EudaMed.com, this is precisely the kind of service we provide. We upload manufacturer data to EUDAMED on behalf of our clients, under their mandate, using M2M or Bulk Upload methods. We validate the data first, convert it to the required XML format, handle batch management, and deliver it directly to the European Commission’s EUDAMED system. The manufacturer retains full accountability. We do the heavy lifting.

Option 3: An Internal Group Function

For larger medical device groups, a group-level regulatory function — which may sit in a different legal entity — can manage EUDAMED data entry on behalf of group companies, provided this is done under proper legal arrangements, using the manufacturer’s SRN, and with accountability remaining firmly with the manufacturer.

---

A Quick Reference for Who Does What

Actor	Registers Themselves in EUDAMED?	Uploads Device/UDI Data for Manufacturer?
Manufacturer	✅ Yes	✅ Yes — primary legal obligation
EudaMed.com – Contracted specialist	N/A	✅ Yes — as manufacturer’s agent under manufacturer’s mandate
Authorised Representative	✅ Yes (own registration only)	❌ No — explicitly prohibited under Article 11(4) MDR/IVDR
Importer	✅ Yes (own registration only)	❌ No — outside their mandate
Distributor	✅ Yes (own registration only)	❌ No — outside their mandate

---

The Practical Reality Facing Non-EU Manufacturers Right Now

I want to be direct here, because we see this playing out every week. Many non-EU manufacturers have, for years, relied on their Authorised Representative as their primary regulatory interface with the EU. That made a certain practical sense under the old MDD framework. Under MDR and IVDR and with EUDAMED now becoming mandatory, that approach simply does not work anymore — not legally.

Your AR cannot be your EUDAMED solution. They can be part of your compliance picture — verifying your data is correct, flagging issues — but the obligation to get that data into EUDAMED, in the right format, on time, is yours as the manufacturer.

The good news is there are practical, cost-effective ways to meet that obligation. You do not have to build everything from scratch internally. You do not need to spend a fortune on M2M infrastructure. You just need the right partner who understands EUDAMED inside out and can manage the data entry process for you — as your agent, under your mandate, the way the Regulations intend.

---

What You Should Do Now

If you are a non-EU manufacturer who has been relying on your AR for EUDAMED data entry, review your current arrangement immediately. If you are an AR who has been entering manufacturer device data, you need to reconfigure that service model — your role is verification, not data entry.

EUDAMED is mandatory from 28th May 2026. That is not far away, and getting compliant takes longer than most companies expect once they understand the volume and complexity of data involved. The time to sort this out is now, not in April 2026.

If you need help understanding your EUDAMED obligations, want to see how our software services can manage your data submission, or would like to talk through your specific situation, please do get in touch. We are here to help with real, practical solutions — not just regulatory theory.

📞 Book a free EudaMed introductory meeting here

For everything EUDAMED, EudaMed.com is here to help you.

---

Key MDCG References:

• MDCG 2022-16 (Authorised Representatives): https://health.ec.europa.eu/system/files/2022-09/mdcg_2022-16_en.pdf
• MDCG 2021-25 (EUDAMED Actor Module Q&A): https://health.ec.europa.eu/system/files/2021-10/mdcg_2021-25_en.pdf
• Full MDCG guidance library: https://health.ec.europa.eu/medical-devices-topics-interest/mdcg-endorsed-documents-and-guidance_en

---

Richard Houlihan is the founder of EudaMed.com, MedDevMarket.com, and EirMed, Europe’s leading EUDAMED specialists. This article is for informational purposes. For regulatory advice specific to your circumstances, please consult a qualified regulatory professional.

---