Regulatory due diligence: the deadlines and registers against which a data room is measured (MDR Art. 120, IVDR Art. 110, EUDAMED, Art. 16 and 10a)

A regulatory due diligence reads the data room, but it measures it against something else: against the dates and conditions written in the legal text, and against the registers kept outside the data room. A certificate is a claim about a cut-off date, a transition plan a claim about a contract with a notified body, and a documented CAPA status has to be verified against the available regulatory inspection and compliance information and the company's underlying evidence. This article names the places where those claims are tested and the dates that have to be on file.

MDR Art. 120: which legacy devices may still be sold

Art. 120(2), second subparagraph, MDR extends certificates under Directives 90/385/EEC and 93/42/EEC that were issued from May 25, 2017, were still valid on May 26, 2021 and have not been withdrawn beyond their printed date, up to the dates in paragraph 3a: December 31, 2027 for all class III devices and class IIb implantable devices, "except sutures, staples, dental fillings, dental braces, tooth crowns, screws, wedges, plates, wires, pins, clips and connectors"; December 31, 2028 for the remaining class IIb devices, for class IIa and for sterile or measuring class I devices. Paragraph 3b gives devices whose conformity assessment under Directive 93/42/EEC did not require a notified body, which need one under the MDR and whose declaration of conformity was drawn up before May 26, 2021, the same December 31, 2028.

The first checkpoints are the certificate's issue and expiry dates. A certificate that expired before March 20, 2023 is considered extended only if, before expiry, the manufacturer and a notified body "have signed a written agreement in accordance with Section 4.3, second subparagraph, of Annex VII", or an authority granted a derogation under Art. 59(1) or required the manufacturer under Art. 97(1) to carry out the conformity assessment. If neither exists, that device has had no valid certificate since the expiry, whatever the data room records as transition status.

The second checkpoint is the set of five conditions in paragraph 3c, all of which have to be met: the devices continue to comply with the Directive; "there are no significant changes in the design and intended purpose"; they present no unacceptable risk; the manufacturer has, "no later than 26 May 2024", put in place "a quality management system in accordance with Article 10(9)"; and the manufacturer has lodged a formal application with a notified body no later than May 26, 2024, with the written agreement signed no later than September 26, 2024. For the due diligence that means three dated documents: the quality management system evidence, the application and the agreement. If one is missing or carries a later date, the transition period does not carry the device.

Paragraphs 3d and 3e describe what already applies during the transition: post-market surveillance, market surveillance, vigilance and registration under the MDR "in place of the corresponding requirements in Directives 90/385/EEC and 93/42/EEC", and surveillance by the notified body that signed the agreement, no later than September 26, 2024. Paragraph 3f gives class III custom-made implantable devices May 26, 2026, under the same application and agreement dates. And paragraph 4 allows devices lawfully placed on the market to continue to be made available: the target company's stock is not worthless after the cut-off date, but from that date no new batch may be placed on the market.

IVDR Art. 110: the same logic with different dates

For in vitro diagnostics the parallel provision is Art. 110 IVDR as amended by Regulation (EU) 2024/1860. Certificates under Directive 98/79/EC issued from May 25, 2017 and valid on May 26, 2022 remain valid until December 31, 2027; those that expired before July 9, 2024 only under the same two conditions as in the MDR (there Art. 54(1) and Art. 92(1) IVDR). Devices that did not need a notified body under the Directive, whose declaration of conformity was drawn up before May 26, 2022 and which need one for the first time under the IVDR may be placed on the market under paragraph 3b until December 31, 2027 (class D), December 31, 2028 (class C) and December 31, 2029 (class B and sterile class A). Paragraph 3c requires a quality management system under Art. 10(8) by May 26, 2025 and staggers application and agreement: application by May 26, 2025, May 26, 2026 or May 26, 2027, agreement by September 26, 2025, September 26, 2026 or September 26, 2027, depending on the class. A class C IVD portfolio without a legacy certificate for which no written agreement with a notified body existed on September 26, 2026 (paragraph 3c, point (f)(ii)) is therefore a dated finding, not a future risk; for class C with a legacy certificate, paragraph 3a and paragraph 3c, points (e)(i) and (f)(i), already set May 26, 2025 and September 26, 2025.

EUDAMED: no longer a question of readiness since May 28, 2026

With Decision (EU) 2025/2371 of November 26, 2025, published on November 27, 2025, the Commission confirmed that four electronic systems of EUDAMED "have achieved functionality and meet the functional specifications": the registration of economic operators, the UDI database with device registration, the system on notified bodies and certificates, and the system on market surveillance. Under Art. 123(3), point (d), MDR the related obligations apply six months after publication; the Commission names May 28, 2026. Point (e) gives manufacturers twelve months for the information under Art. 29, that is until November 28, 2026, expressly also for legacy devices under Art. 120(3), (3a) and (3b), "provided that those devices are also placed on the market", counted from six months after the date of publication of the notice. The deadline therefore only reaches devices whose placing on the market continues on or after May 28, 2026; a legacy device whose last batch was placed on the market before that date is not covered and may continue to be made available under Art. 120(4). Vigilance and clinical investigations are not among the four systems. For the due diligence this means: the target company's actor registration and the registration status of its devices have been obligations since May 28, 2026, and their fulfillment can be evidenced with a date.

Three public registers for regulatory due diligence

Art. 111(6) of Directive 2001/83/EC obliges the Member States to enter their GMP and GDP certificates "in a Union database managed by the Agency on behalf of the Union", and states: "The database shall be publicly accessible." Paragraph 7 adds that the outcome of an inspection finding that an entity does not comply with the principles and guidelines of good manufacturing or distribution practice is also entered there. Whoever examines a pharmaceutical target reads EudraGMDP before opening the data room and compares the certificate dates with the inspection reports the company presents.

The FDA keeps its Warning Letters in a public database with filters by issuing office, issue date, company and subject, and by response and closeout letters. A Warning Letter without a closeout letter calls for a closer review of the status of its handling and of the effectiveness of the corrective actions taken. The absence of a closeout letter alone does not mean that the violations still exist. For the US market the QMSR has applied since February 2, 2026: § 820.10 requires a documented quality management system that meets the applicable requirements of ISO 13485, and a target company whose procedures still mirror the structure of the former QSR has to show that its system has met those requirements since that date; records from before February 2, 2026 may keep the old terms according to the FDA's own answer.

The public EUDAMED module "Notified Bodies & Certificates" can be used to look up information on MDR and IVDR certificates, including their status and any restrictions, suspensions or withdrawals. The database thus allows an independent check of the certificate information presented in the data room. Legacy certificates still require a separate review of the certificates and of their validity under the transitional provisions.

What passes to the buyer after closing

Three provisions decide what integration costs in regulatory terms. Art. 16(1)(a) MDR: whoever makes a device available "under its name, registered trade name or registered trade mark" assumes the obligations of the manufacturer, unless an agreement provides that the manufacturer remains identified as such on the label and responsible. A brand migration after closing is therefore a regulatory decision. For legacy devices under Art. 120 MDR, a distinction has to be made between administrative changes at the existing legal manufacturer and the transfer of manufacturer responsibility to another legal entity. Under MDCG 2020-3 Rev. 1, a change of the manufacturer's name or legal form is in principle not a significant change in design or intended purpose. The transfer of a device to another legal manufacturer, by contrast, has to be assessed separately, in particular with regard to the continued validity of the existing certification and the transitional provisions. Under the conditions of Art. 16(2), certain translation and repackaging activities do not result in the manufacturer's obligations under Art. 16(1)(c) being assumed, but under paragraphs 3 and 4 they require a quality management system, a notification to the manufacturer and the authority "at least 28 days" before the device is made available, and a certificate from a notified body on that system.

Art. 10a MDR, inserted by Regulation (EU) 2024/1860: where a manufacturer anticipates, for a device other than a custom-made device, an interruption or a discontinuation of supply that "could result in serious harm or a risk of serious harm to patients or public health", it informs the competent authority and the economic operators, health institutions and healthcare professionals it directly supplies, stating the reasons; the information must, "other than in exceptional circumstances, be provided at least 6 months before the anticipated interruption or discontinuation". Under Art. 120(13) MDR and Art. 110(11) IVDR this also applies to legacy devices in their transition period. A portfolio clean-up after closing therefore has a lead time that belongs in the integration plan.

Art. 85 and 86 MDR: manufacturers of class IIb and III devices update the PSUR "at least annually", class IIa manufacturers "at least every two years"; for class III and implantable devices the report goes under paragraph 2 through the electronic system of Art. 92 to the notified body, which evaluates it and records its evaluation there. That form of submission applies under Art. 123(3), point (d), only once the vigilance module is declared functional, and Decision (EU) 2025/2371 does not cover it. Class I manufacturers keep the PMS report and make it available "to the competent authority upon request". Under Art. 120(3d) these obligations also apply to legacy devices. A missing or overdue PSUR in the data room is therefore not a formality but a dated breach. Until use of the corresponding EUDAMED module becomes mandatory, manufacturers of MDR-certified class III and implantable devices submit their PSURs by a route agreed with the notified body. For legacy devices, PSURs are to be kept outside EUDAMED and made available to the competent authorities or notified bodies on request (MDCG 2022-21).

What follows for practice

A red flag report carries six entries per device: the certificate's issue and expiry dates and their classification under Art. 120(2) or Art. 110(2); the route under paragraph 3a or 3b with its end date; the dates of quality management system, application and written agreement against the cut-off dates of paragraph 3c; the EUDAMED registration status; the cycle and date of the last PSUR; and the hits in EudraGMDP and in the Warning Letter database with the status of the closeout letter. Added to this is the integration question of whether the buyer becomes the manufacturer under Art. 16 and which devices trigger a notification period under Art. 10a. Whatever is missing is not open but dated, and that is exactly what makes it relevant to the purchase price. A missing closeout letter alone does not prove that an objection is still outstanding; it calls for a further status check.

Entourage checks approval status, transition status, quality management system and authority history before signing in Regulatory Due Diligence and supports own brands, relabeling and the assumption of manufacturer obligations after closing in M&A & PMI.