Unique Device Identification UDI
With its Unique Identification System, the EU intends to introduce a mandatory identification and registration of medical devices going way beyond current obligations. Not even stand-alone software is spared from the UDI requirements laid down in the future Medical Device Regulation MDR. Find out here what to expect.
Find out about
What the EU aims at with the Unique Device Identification System
The EU wants to be able to trace back medical devices with little effort - from the manufacturer right through to the user.
This allows for quick incident response as:
- Products are easier to identify (down to the individual device, the batch or a software version),
- The device's location is traceable, facilitating a quick identification of the specific user,
- Locating counterfeit medical devices becomes easier.
Entities affected by the UDI System
Organization: Assigning the Identification Number
One or more organizations shall operate a system assigning UDIs. The organization shall be bound to do so for at least 10 years.
Supplement: According to the transitional provisions in Article 120 (12), GS1, HIBCC and ICCBBA will be considered as the designated issuing entities until the Commission has designated issuing entities pursuant to Article 27 (2).
Manufacturer: UDI on Products and Packaging
Manufacturers shall source a clear identification from the designated issuing entity for every single medical device as well as for each outer packaging (except for containers). The MDR provides an exception exclusively for custom-made devices and devices intended for clinical testing.
Manufacturers must state the base UDI in their declaration of conformity and maintain a list of all issued UDIs as part of each individual medical device's technical documentation.
Users: Retention of UDIs
The EU wants to encourage member states to additionally bind users to retain the UDIs of used or bought medical devices.
EU: Operating the UDI Database
The EU shall operate a database in which all Unique Device Identifications shall be stored. Further, the EU shall determine the attributes of a medical device which must be considered as a minimum requirement. The use of that database (at least the access to it) shall be offered to the public and free of charge.
Manufacturers: Provide and Update Information
Manufacturers must provide the base UDI and all related information such as product name, product version and the classification as sterile or reusable to the database and must update the provided information.
The EU lays down the requirements for the Unique Device Identification System in Article 24 as well as in Annex V.
Annex V consists of several parts:
- Part A
Data elements to be submitted upon the registration of devices, amongst others are
- Manufacturer, distributor, importer
- Product (UDI, type of product, expiration date, country in which the product was placed on the market, category, "binary" attributes such as "single use", "contains tissues" or if it contains certain substances)
- Part B
Core data elements to be provided to the UDI database. These data elements are partly in registry with the ones in Part A.
- Part C
Description of the Unique Device Identification Systems, amongst others are
- When and where the different UDIs (e.g. UDI-DI or UDI-PI; more on that later) must be indicated.
- Human- and machine-readable identification
- Rules imposed on particular types of products such as implantable devices, reusable products, systems, configurable products and software.
UDI-DI and UDI-PI
The MDR differentiates between the two Unique Device Identifiers UDI-DI and UDI-PI:
- UDI-DI: it is the device identification of a particular model and serves as a key within the database. For example, all entities of a particular type of defibrillator would have the same UDI-DI.
- UDI-PI: the production identifier marks each individual entity of a product or batch. Therefore, each defibrillator has its own UDI-PI.
Unique Device Identification for Software
There are specific regulations for stand-alone software.
Assigning a new UDI-DI
A new UDI-DI shall be assigned whenever something is changed that might impact
- Performance and effectiveness
- Interpretation of data.
For software the MDR lists the following examples of data elements causing a new UDI-DI:
- Database structure
- Operating system
- User interface
Assigning a new UDI-PI
In contrast, minor changes like the following examples require "only" a new UDI-PI
- Bug fixes
- Security patches
- User interface (when the changes address only usability and not security)
As a manufacturer, one could say that all changes in the version number's third digit result in a new UDI-PI; all other changes result in a new UDI-DI.
Hence, it is not required to assign an individual UDI for each installation.
The manufacturer must display the UDI(s):
- In case of physical media (USB, DVD, ...), human- and machine-readable UDIs must be provided. The same applies to all overpacks.
- Likewise, the UDI must be visible for users, e.g. under "About" and/or the splash screen. The machine-readable UDI has not to be displayed on the screen.
- If the software has no user interface, the information must be retrievable using an API.
Unique Device Identification from the FDA's perspective
The FDA requires a definite number for medical devices, the Unique Device Identification UDI. This might work well for physical products. Applying labels to packaging or the device itself is no problem. But what about software? Where could the Unique Device Identification be placed on a virtual product? Well, a definite label could be applied to the DVD but not to downloads, which by implication would make virtual copies illegal.
Fortunately, the FDA has substantiated that "unlike most devices, software will only have to exhibit a means of displaying the UDI […] it can also be within the software itself".
Hence, it is sufficient to display the number (Unique Device Identification) within the software. However, displaying this unique number would not be enough for being able to match the number with a customer. For example, to ease reaching out to your customer in case of a product recall. In other words, you will avoid a download without authentication/registration.
When registering, you can assign the unique number (Unique Device Identification) and deposit in the software so that it can be displayed under the menu item "Help > About".
9. UDI FAQs
9.1. General information
- Q: Do the UDI transitional periods in the MDR also apply to the assignment of UDIs?
A: No, the UDI transitional periods established in Article 123 of the MDR apply explicitly to the affixing of the UDI to the device and the packaging levels.
- Q: Are the UDIs also required for the conformity assessment procedure according to the MDD?
A: No, the MDD does not require UDIs.
9.2. Basic UDI-DI
- Q: What are all the places where the Basic UDI-DI has to be given by the manufacturer?
A: Registration in EUDAMED, declaration of conformity, short report on safety and clinical performance, technical documentation, certificates of free sale. The Basic UDI-DI is not affixed to the device or the packaging levels. Therefore, a machine-readable format is not required for the Basic UDI-DI.
- Q: We sell packaged sterile and non-sterile class IIb medical devices. Except for the sterilization, all the specifications and process steps involved in production are identical. Can I assign just one BASIC UDI-DI to these devices or do I need two – one for the implants supplied sterile and another for the non-sterile ones?
A: In this case it would make sense to assign the same Basic UDI-DI for the two variants (sterile/non sterile), and then enter the information “labeled as sterile” at the device UDI-DI level in EUDAMED rather than the Basic UDI-DI level.
- Q: Do all devices that share a Basic UDI-DI have to described in common technical documentation?
A: We cannot find a requirement in the MDR for there to be only one set of technical documentation for each individual Basic UDI-DI. Therefore, it should be possible to have several sets of technical documentation for the same Basic UDI-DI.
- Q: When I assign the UDI-DI using GS1, I can use the first number to define the number of units in a pack (e.g., 0 for 1 unit, 2 for 10 units, etc.). Do I have to do this or can I also assign new UDI-DIs as I also have a different REF number?
A: This is optional. You can also assign completely new UDI-DIs.
- Q: What is the procedure for an accessory for a medical device?
A: Accessories, as defined by the MDR, must have their own UDI.
- Q: Our medical device has wear parts that are regularly replaced. How are the UDIs for spare parts assigned in such cases?
A: Wear/spare parts do not have to have their own UDI as long as they are not accessories according to the MDR.
9.5. Affixing the UDI and UDI carriers
- Q: Is it sufficient to affix the data matrix to the device, or are the numerical codes also required for direct readability? If so, where can I this specification in the MDR for reference?
A: The MDR requires both the machine-readable and human-readable forms in Annex VI 4.1: “The UDI carrier (AIDC and HRI representation of the UDI) shall be placed on the label or on the device itself and on all higher levels of device packaging. Higher levels do not include shipping containers.”
In the event of there being significant space constraints, only the machine-readable form (e.g., data matrix) has to be provided. “4.7 If there are significant constraints limiting the use of both AIDC and HRI on the label, only the AIDC format shall be required to appear on the label.”
- Q: Can both linear barcodes and 2D barcodes be used? Or do you have to decide on a type and use this type consistently?
A: Different UDI carriers and issuing entities can be used for different devices.
9.6. Special case: standalone software
- Q: Where does the UDI have to appear in standalone software and in what form?
A: According to MDR Annex VI 6.5.4, the UDI can be provided within the software, e.g., “on a readily accessible screen for the user in an easily-readable plain-text format, such as an ‘about’ file, or included on the start-up screen.” This includes, for example, a help menu, an about box or a splash screen. The UDI only has to be displayed in human-readable format.
- Q: What does the UDI-PI have to contain for software?
A: According to Annex VI 6.5.1 of the MDR, the software identification is considered to be the manufacturing control mechanism and must be displayed in the UDI-PI. Therefore, the UDI-PI typically contains at least the software version number.
9.7. Special case: implants
- Q: As far as I understand, the requirement for the direct marking of the device with the UDI carrier only exists for reusable devices that require cleaning, disinfection, sterilization, or processing between uses on patients. How should implants (plates, screws, nails, etc.) that are placed on the market non-sterile be handled in this regard? These implants are not intended for reuse, but processing is obviously necessary before the first use. Furthermore, these implants are usually sterilized and prepared for surgery in storage systems, sometimes together with the instruments required. These systems often contain a number of implant variants, of which only some are used. The rest are sent for reprocessing so that they are available again for the next operation, just like the instruments, which without a doubt have to be directly marked.
The non-sterile implants are therefore devices that cannot be reused, but are reprocessed again and again. I would currently say that you do not have to directly mark them with a UDI as the main criterion is reuse. But this probably runs contrary to the intention to provide a system for tracking processing cycles?
Now to the specific question: Are implants placed on the market non-sterile, as described above, subject to the UDI direct marking requirements?
A: Direct marking is indeed only mandatory for reusable devices where reprocessing is necessary between uses. For implants, the UDI only has to be affixed to the direct packaging. However, the MDR requires the UDI of implantable devices to be identifiable prior to implantation (Annex VI, 6.1.3 MDR). This would no longer be the case if there was no direct marking, so in this situation, only direct marking would seem to make sense.
9.10. Special case: systems and treatment units
- Q: If I have a combination of products that constitutes a system according to the MDR in my product range, I have to identify this system with a UDI. Which UDI-PI (of which device) do I have to use on the system packaging? The one for the device whose expiry date is the soonest?
A: The system has its own UDI. Therefore, a separate UDI-PI is assigned. This could contain, for example, the “date of manufacture” of the system or a batch number.
- Q: What is meant by a “convenience kit” in the context of UDIs (US FDA)?
A: There is a detailed description with several examples in this FDA guidance document: https://www.fda.gov/media/95120/download
- Q: The UDI-PI is not entered in EUDAMED, what about GUDID?
A: The UDI-PI is not entered in GUDID either.
- Q: Is the “US UDI” (GTIN) also applicable in the European Economic Area after the MDR enters into effect?
A: There is no US UDI in this respect. GS1 with GTIN is also accredited in the EU as a UDI issuing entity under the MDR. Therefore, a GTIN can also be used as the UDI-DI within the EU.
9.12. Is your question and its answer missing?
The Johner Institute helps manufacturers to meet the regulatory UDI requirements quickly and reliably. Our micro-consulting service answers short questions in particular on a regular basis free of charge.
How helpful was this article?