Three years into EU MDR enforcement, the same compliance gaps keep surfacing. EUDAMED registrations are incomplete. eIFU position paper requirements are misunderstood. UDI data has errors that weren't caught during initial submission. Here's what manufacturers are still getting wrong — and what to do about it.
1. EUDAMED Registration Is Not "Set and Forget"
Most manufacturers treated EUDAMED registration as a one-time migration task. It isn't. EUDAMED requires ongoing data maintenance — UDI-DI records must reflect current labeling, attributes must match the physical product, and changes must be submitted within defined timelines.
The most common finding: product attribute fields that haven't been updated to reflect labeling changes approved through change control. A label updated in Agile PLM with no corresponding EUDAMED update is a compliance gap that will surface in a notified body review.
Action item: Establish a formal EUDAMED change trigger in your change control process. Every approved label change should trigger an automatic EUDAMED update review.
2. eIFU Compliance Is More Than a Website Link
EU MDR allows electronic instructions for use (eIFU) as the primary delivery mechanism for certain device classes — but the conditions are strict. The MDCG eIFU position paper defines specific requirements for when eIFU can replace paper IFUs, what information must still appear on the label, and how the eIFU must be accessible.
Common gaps we see:
- eIFU website URLs not printed on physical labels
- eIFU accessibility not maintained for the full device lifetime
- eIFU position paper gap analyses not performed or not documented
- No formal procedure for eIFU website maintenance and version control
3. UDI Data Accuracy — The Hidden Audit Risk
UDI-DI data submitted to EUDAMED feeds downstream systems — clinical databases, post-market surveillance systems, procurement platforms. One wrong data attribute doesn't just affect your submission — it propagates downstream.
The most error-prone fields: quantity per package, expiry date format, storage temperature, single use designation, and MRI safety status. These are often populated from historical paper-based product specification documents that haven't been formally reviewed against the physical product.
Action item: Run a systematic UDI attribute reconciliation — cross-reference EUDAMED submissions against current product labels, IFUs, and technical documentation. Prioritize Class IIb and III devices first.
4. GSPR Documentation Is Incomplete for High-Risk Devices
The General Safety and Performance Requirements (GSPR) checklist under EU MDR is more comprehensive than the old AIMDD/MDD Essential Requirements. Many manufacturers carried over legacy GSPR checklists without performing a rigorous gap assessment against the full EU MDR Annex I requirements.
Notified bodies are finding GSPR gaps particularly in chemical, physical, and biological safety sections — areas that expanded significantly under EU MDR versus MDD.
The Common Thread: Regulatory Data Is Not Being Treated as a Compliance Asset
Every EU MDR finding we've described has a common root cause: regulatory data — EUDAMED records, UDI attributes, eIFU positions — is being treated as an administrative task rather than a compliance asset that requires structured maintenance, ownership, and audit trails.
Fixing this requires a systematic approach: structured regulatory data ownership, clear change triggers connected to your QMS, and regular accuracy reviews — not just submissions.