Häufig gestellte Fragen
Is a generic standard ERP sufficient for medical technology manufacturers, or do I need an industry-specific solution?
A generic ERP rarely covers typical functions such as UDI management, EUDAMED connectivity and post-market surveillance without additional modules, so industry-specific adaptations or complementary eQMS systems usually become necessary. For validation purposes, most ERP platforms are considered GAMP 5 category 4 (configured standard products), where validation targets the configuration rather than the base product. How deep the adaptations go depends on the risk class, breadth of the product range and the manufacturer's historically grown IT landscape. A blanket answer is therefore not possible; suitability must be checked case by case against your own process catalogue.
By when must legacy devices be certified under the EU MDR?
Regulation (EU) 2023/607 extended the transition periods on a risk-dependent basis: Class III and implantable Class IIb devices may, under certain conditions, continue to be placed on the market until 31 December 2027, while the remaining Class IIb devices, all Class IIa devices and sterile Class I devices or those with a measuring function have until 31 December 2028 (certain well-established implants such as sutures, staples or dental fillings also fall under the 2028 deadline). Prerequisites include, among other things, a valid legacy certificate, no significant change in design or intended purpose, an application to an MDR-designated notified body by 26 May 2024 and a contract by 26 September 2024. The former sell-off date was abolished, so legacy devices lawfully placed on the market may continue to be marketed without any time limit. The ERP should document the respective regulatory status and the deadlines per product group in a traceable manner.
What does the EUDAMED obligation from 2026 mean for my ERP system?
Commission Decision (EU) 2025/2371 of 26 November 2025 established that the four central EUDAMED modules (actors, UDI/devices, notified bodies/certificates and market surveillance) must be used on a mandatory basis from 28 May 2026. New devices must be registered before being placed on the market from that date, while devices already placed on the market must be back-registered by 28 November 2026 at the latest. Manufacturers, authorised representatives and importers also require actor registration with a Single Registration Number (SRN) before placing devices on the EU market. A capable ERP should hold the master data required for this in structured form and support the data transfer to EUDAMED.
How do the IVDR deadlines for in-vitro diagnostics differ from the MDR deadlines?
The IVDR (Regulation (EU) 2017/746) provides staggered deadlines for legacy IVDs by risk class: Class D until 31 December 2027, Class C until 31 December 2028, and Class B and sterile Class A until 31 December 2029. Regardless of class, all affected legacy IVDs already had to align their quality management system with the IVDR by 26 May 2025. Many devices that could be self-certified under the old IVDD fall into higher classes under the IVDR and require a notified body for the first time, so the more demanding class logic applies to them. Manufacturers of IVD devices should therefore gear their ERP to the class and deadline logic that differs from the MDR.
What requirements does UDI labelling place on master data in the ERP?
The UDI consists of the Device Identifier (UDI-DI) for the manufacturer and device model and the Production Identifier (UDI-PI) with batch, serial number and expiry date; separate from these is the higher-level Basic UDI-DI, which groups devices with the same intended purpose and risk class and appears only in EUDAMED and the technical documentation, not on the label. The codes are assigned by one of the four EU-designated issuing agencies GS1, HIBCC, ICCBBA or IFA. On the label and packaging, the UDI must appear as a machine-readable data carrier (such as a 1D/2D barcode, DataMatrix or RFID) and, as a rule, as human-readable plain text. The ERP must maintain these identifiers in the material and batch master data, print them, trace them and make them available for EUDAMED reporting.
Does a medical technology ERP have to be validated, and what role does 21 CFR Part 11 play?
Under ISO 13485:2016, validation of all computerised systems used in QMS-regulated processes is mandatory, usually following the GAMP 5 framework with risk-based IQ, OQ and PQ qualifications as well as a documented validation plan and report. For an ERP as a category 4 system, validation focuses on configuration, workflows and reports, while the vendor's platform evidence can be reused. Anyone exporting to the USA should additionally observe 21 CFR Part 11, which requires secure, computer-generated and time-stamped audit trails as well as access controls for electronic records and signatures, whereby changes must not overwrite previous entries. The specific validation scope results from a risk assessment and should be coordinated with the notified body and, where applicable, FDA expectations.