MDCG 2026-4: why manufacturers are becoming the managers of SS(C)Ps in EUDAMED

Medical devices regulation

15 June 2026

The MDCG 2026-4 guidance, published on June 18, 2026, is one of those documents that could easily go unnoticed.

It’s only a few pages long.

No new requirements under the MDR or the IVDR.

No changes to the obligations applicable to manufacturers.

At first glance, it deals only with a technical change regarding the submission of Summaries of Safety and Clinical Performance (SSCPs) and Summaries of Safety and Performance (SSPs) to EUDAMED.

However, that would be an oversimplification.

The real significance of the document lies not in the simple act of uploading a file. It confirms a more profound shift in European strategy: manufacturers are gradually becoming the operational managers of their own regulatory data.

This shift has been evident for several years.

It already applies to:

the registration of economic operators;
device identification;
UDI data;
certain vigilance information;
certificates;
and now SS(C)Ps.

Taken individually, each of these changes seems minor. Together, they point to a clear trend: EUDAMED is no longer a database primarily populated by notified bodies and competent authorities. It is gradually becoming a platform where manufacturers manage a significant portion of their regulatory documentation.

MDCG 2026-4 marks a new stage in this evolution.

For manufacturers, the issue therefore goes far beyond a new IT feature. It requires adapting internal responsibilities, document governance, and certain quality system processes.

Why was MDCG 2026-4 published?

At first glance, one might think that the guide creates a new regulatory requirement.

This is not the case.

The requirements regarding the Summary of Safety and Clinical Performance (SSCP) already existed in the MDR, while the Summary of Safety and Performance (SSP) is required by the IVDR for certain in vitro diagnostic devices.

Manufacturers remain responsible for drafting these documents, and the notified body continues to verify their content as part of the conformity assessment.

MDCG 2026-4 therefore does not change either the regulatory requirements or the allocation of responsibilities related to their validation.

It addresses a much more practical question:

How should these documents now be managed in EUDAMED?

This distinction is essential.

The guidance does not change the content of the SS(C)P.

It changes how its document lifecycle is managed in the European database.

What is an SS(C)P?

Before examining the changes introduced by the guidance document, it is helpful to review the role of the SS(C)P.

The Summary of Safety and Clinical Performance (SSCP) is required by Article 32 of the MDR for certain medical devices, including implantable devices and Class III devices.

Its equivalent under the IVDR is the Summary of Safety and Performance (SSP).

The objective is to make publicly available key information about a device that has already undergone its conformity assessment.

The document includes, in particular:

the device’s identification;
its intended use;
the expected clinical benefits;
key safety and performance data;
residual risks;
relevant information for users.

The SS(C)P does not replace the instructions for use or the technical documentation.

It is primarily a transparency document intended for healthcare professionals, competent authorities, and, where relevant, patients.

What does MDCG 2026-4 actually change?

Until now, when a notified body registered a certificate in EUDAMED, it also submitted the corresponding SS(C)P or SSP.

The new process reverses this approach.

Manufacturers are now responsible for uploading the “master document” as well as the various translations.

This concept of a master document is based on a document governance framework. The master version serves as the reference validated by the notified body, to which the various translations published in EUDAMED are linked. This structure facilitates updates: when a new version is approved, the manufacturer can identify the affected translations and ensure consistency across all published documents.

However, the notified body continues to play an essential role.

It remains responsible for validating the SS(C)P as part of the certification process and must link the validated version to the corresponding Basic UDI-DI in EUDAMED during the registration or certificate linkage process.

In other words:

the manufacturer becomes responsible for document management;
the notified body remains responsible for regulatory validation.

The transfer therefore concerns data administration, not data evaluation.

Before / After: what’s actually changing

Before MDCG 2026-4	After MDCG 2026-4
The notified body uploads the master document	Manufacturers upload the master document
Translations are managed by the manufacturer	Translations continue to be managed by the manufacturer
Process focused on certificate registration	Process focused on the Basic UDI-DI
Limited document responsibility for the manufacturer	Documentation governance provided by the manufacturer
Workflow primarily managed by the notified body	Workflow shared between the manufacturer and the notified body
Validation by the notified body	Validation remains unchanged

This change does not alter the regulatory balance between manufacturers and notified bodies.

However, it clearly redistributes operational responsibilities.

Why is the Basic UDI-DI becoming central?

The Basic UDI-DI is not the identifier that appears on a device’s label.

It is the primary identifier used in EUDAMED to group all regulatory information associated with a single family of devices: certificates, UDI data, regulatory documentation, and now SS(C)P.

MDCG 2026-4 confirms this approach.

The SS(C)P is no longer associated solely with a certificate issued by the notified body. It is now linked to the Basic UDI-DI, which becomes the primary reference linking all related regulatory information published in EUDAMED.

For manufacturers, this underscores the importance of rigorous document governance and perfect consistency between the Basic UDI-DI, the certificate, and the corresponding SS(C)P.

This guide reveals a much broader evolution of EUDAMED

Beyond the SS(C)P alone, MDCG 2026-4 illustrates a fundamental trend.

For several years now, each update to EUDAMED has gradually entrusted manufacturers with more operational responsibilities.

Previously, this involved the registration of economic operators.

Then it was devices.

Then UDI data.

Today, it’s SS(C)Ps.

It’s reasonable to assume that this trend will continue with other regulatory processes.

The manufacturer is no longer just the company that develops and markets a medical device.

It also becomes the permanent manager of its regulatory data throughout the product’s lifecycle.

In our view, this is likely the true message of MDCG 2026-4.

The guidance is interesting not so much for what it mandates as for what it reveals: mastery of EUDAMED is gradually becoming a regulatory competency in its own right.

Manufacturers who still view this platform as merely a document repository risk quickly finding themselves faced with a different reality.

Why this change directly affects your Quality System

At first glance, the transfer of SS(C)P uploads may seem to fall exclusively under the purview of Regulatory Affairs.

In practice, however, its implications extend far beyond that function.

Submitting an SS(C)P to EUDAMED is not simply a matter of uploading a document. The manufacturer must now ensure that the uploaded version exactly matches the one validated by the notified body, that the Basic UDI-DI is correctly filled out, that the translations are consistent with the master version, and that the entire document remains aligned with the technical documentation.

Uploading therefore becomes a controlled regulatory activity, integrated into the quality system.

For many manufacturers, this change will require a review of several internal procedures:

the EUDAMED management procedure;
the division of responsibilities among Regulatory Affairs, Quality, and, where applicable, the translation teams;
document checks prior to each upload;
version and translation management;
traceability between the validated SS(C)P, the corresponding certificate, and the Basic UDI-DI;
the integration of these checks into periodic quality system reviews.

In other words, the upload of SS(C)Ps should no longer be considered an administrative task, but rather a regulatory process in its own right.

New SS(C)P management workflow in EUDAMED

Manufacturer

│

▼

Prepares the master document

and translations

│

▼

Upload the documents

to EUDAMED

│

▼

Notified body

links the validated version

to the Basic UDI-DI

│

▼

Publication in EUDAMED

In just a few steps, this diagram illustrates the real change introduced by MDCG 2026-4: responsibility for the content remains shared, but the operational management of the document is now handled by the manufacturer.

What new quality risks does this transfer create?

The guidance does not explicitly address the risks associated with this new organizational structure.

However, these are often the first questions that Regulatory Affairs and Quality managers ask themselves.

The challenge is no longer simply to obtain an SS(C)P validated by the notified body. It is now necessary to ensure that the document actually published in EUDAMED is indeed the one that was approved, in the correct version, in all relevant languages, and linked to the correct Basic UDI-DI.

A few examples illustrate these new challenges.

Risk	Potential Consequence	Recommended Check
Uploading an outdated version	Publication of an SS(C)P different from the validated one	Independent document review prior to publication
Translation not updated	Inconsistencies between the different language versions	Synchronized translation management process
Incorrect Basic UDI-DI	Incorrect SS(C)P association in EUDAMED	Cross-check with the certificate and technical documentation
Version error following a clinical update	Loss of document traceability	Version management and revision history
Publication prior to internal validation	Distribution of uncontrolled information	Quality approval prior to upload

These risks are not new from a regulatory standpoint.

However, MDCG 2026-4 clearly shifts responsibility for managing them to the manufacturer. The more regulatory data is managed directly in EUDAMED, the more the robustness of the documentation system becomes a factor in compliance.

What steps should be taken now?

Even though the new features will be rolled out gradually, waiting until they are available in production would likely be a mistake.

Manufacturers can already begin preparing for this change.

A pragmatic approach could include the following steps:

Identify the owner of the SS(C)P process within the organization.
Update the EUDAMED procedure to incorporate the new responsibilities.
Define a clear RACI matrix among the Regulatory Affairs, Quality, Translation, and, if necessary, IT teams.
Implement a document review process before each upload to confirm:

the version of the master document;
the consistency of the translations;
the relevant certificate;
the associated Basic UDI-DI.

Prepare translations in advance so that they do not become a bottleneck during the rollout of new features.
Train the teams that will be using EUDAMED so that the upload process is well-managed.

These actions represent a limited investment.

However, they will help prevent a backlog of updates once the new features become fully operational.

What transition period does MDCG 2026-4 provide for?

The transfer of responsibilities will not take place immediately.

The guide provides for a transition period to allow manufacturers and notified bodies to gradually adapt their practices.

During this phase:

notified bodies will continue to submit master versions in accordance with current procedures;
manufacturers remain responsible for translations;
new features will be made available gradually before their production deployment.

This approach aims to ensure the continuity of SS(C)P publication while giving manufacturers time to update their internal procedures.

Timeline

Deadline	Update
May 28, 2026	Mandatory use of the first EUDAMED modules
July 2026	New features made available in the Playground environment
October 2026	Scheduled deployment to the production environment
February 27, 2027	Recommended date for submitting SS(C)P submissions for devices already on the market

This transition period should not be considered an extension of the deadline.

Above all, it provides an opportunity to test new workflows, clarify responsibilities, and ensure the reliability of documentation processes before they are used routinely.

Case Study #1 – Updating the SS(C)P following a new Clinical Evaluation

A manufacturer of implantable devices updates its clinical evaluation following new post-market follow-up data.

This revision results in changes to the SS(C)P that had already been validated by the notified body.

The challenge is no longer simply to have this new version approved.

It is now necessary to manage the entire documentation cycle:

updating the master document;
verify the impact on all existing translations;
ensuring that only the approved version is uploaded to EUDAMED;
maintaining traceability between the different versions of the document, the relevant certificate, and the Basic UDI-DI.

The real risk, therefore, is not drafting the SSCP.

It lies in managing the document’s lifecycle.

Case Study #2 – Managing a portfolio of more than 100 SS(C)Ps

A manufacturer has more than a hundred devices subject to the SSCP requirement.

All the documents already exist.

The real challenge now is to organize their gradual integration into EUDAMED.

Rather than waiting for regulatory deadlines, the company is implementing a full-scale migration project:

a single person in charge of the process;
an upload schedule by device family;
a preliminary verification of language versions;
systematic verification of the links between certificates, Basic UDI-DIs, and published documents;
regular coordination with its notified body.

This organizational structure minimizes the risk of errors while spreading the workload over several months.

The guide does not describe this approach.

However, it makes it practically indispensable.

Mini FAQ

Does MDCG 2026-4 create a new regulatory requirement?

No. The guide does not change the requirements of the MDR or the IVDR regarding the content of SS(C)Ps or their validation by the notified body. It does, however, transfer to the manufacturer the operational responsibility for uploading the master document and its translations to EUDAMED.

Do manufacturers need to update their quality management system in accordance with ISO 13485?

In most cases, yes. The new workflow must be integrated into the quality management system through documented procedures, clearly defined responsibilities, and appropriate controls. For many manufacturers, this will involve, in particular, reviewing EUDAMED management, document control, and traceability between the SS(C)P, the Basic UDI-DI, and the associated certificate.

Should uploading an SS(C)P now be considered a document control activity?

In practice, yes. Uploading is merely the final step in a document management cycle. Before any publication, the manufacturer must ensure that the approved version is used, that translations remain consistent with the master document, and that the SS(C)P is linked to the correct Basic UDI-DI.

Who should be responsible for the SS(C)P publication process within the company?

The regulations do not specify any particular department. However, the manufacturer should designate a process owner responsible for coordinating publications, ensuring document integrity, and maintaining consistency between EUDAMED, the technical documentation, and the quality system.

What is the main compliance risk introduced by MDCG 2026-4?

The main risk no longer lies in obtaining a validated SS(C)P, but in managing its lifecycle. An outdated version, an inconsistent translation, or an incorrect link to the Basic UDI-DI can compromise the compliance of the published information. These situations primarily reflect weaknesses in document governance and the quality system.