Unique Device Identification UDI
With its Unique Identification System, the EU intends to introduce a mandatory identification and registration of medical devices going way beyond current obligations. Not even stand-alone software is spared from the UDI requirements laid down in the future Medical Device Regulation MDR. Find out here what to expect.
Find out about
What the EU aims at with the Unique Device Identification System
The EU wants to be able to trace back medical devices with little effort - from the manufacturer right through to the user.
This allows for quick incident response as:
- Products are easier to identify (down to the individual device, the batch or a software version),
- The device's location is traceable, facilitating a quick identification of the specific user,
- Locating counterfeit medical devices becomes easier.
Entities affected by the UDI System
Organization: Assigning the Identification Number
One or more organizations shall operate a system assigning UDIs. The organization shall be bound to do so for at least 10 years.
Supplement: According to the transitional provisions in Article 120 (12), GS1, HIBCC and ICCBBA will be considered as the designated issuing entities until the Commission has designated issuing entities pursuant to Article 27 (2).
Manufacturer: UDI on Products and Packaging
Manufacturers shall source a clear identification from the designated issuing entity for every single medical device as well as for each outer packaging (except for containers). The MDR provides an exception exclusively for custom-made devices and devices intended for clinical testing.
Manufacturers must state the base UDI in their declaration of conformity and maintain a list of all issued UDIs as part of each individual medical device's technical documentation.
Users: Retention of UDIs
The EU wants to encourage member states to additionally bind users to retain the UDIs of used or bought medical devices.
EU: Operating the UDI Database
The EU shall operate a database in which all Unique Device Identifications shall be stored. Further, the EU shall determine the attributes of a medical device which must be considered as a minimum requirement. The use of that database (at least the access to it) shall be offered to the public and free of charge.
Manufacturers: Provide and Update Information
Manufacturers must provide the base UDI and all related information such as product name, product version and the classification as sterile or reusable to the database and must update the provided information.
The EU lays down the requirements for the Unique Device Identification System in Article 24 as well as in Annex V.
Annex V consists of several parts:
- Part A
Data elements to be submitted upon the registration of devices, amongst others are
- Manufacturer, distributor, importer
- Product (UDI, type of product, expiration date, country in which the product was placed on the market, category, "binary" attributes such as "single use", "contains tissues" or if it contains certain substances)
- Part B
Core data elements to be provided to the UDI database. These data elements are partly in registry with the ones in Part A.
- Part C
Description of the Unique Device Identification Systems, amongst others are
- When and where the different UDIs (e.g. UDI-DI or UDI-PI; more on that later) must be indicated.
- Human- and machine-readable identification
- Rules imposed on particular types of products such as implantable devices, reusable products, systems, configurable products and software.
UDI-DI and UDI-PI
The MDR differentiates between the two Unique Device Identifiers UDI-DI and UDI-PI:
- UDI-DI: it is the device identification of a particular model and serves as a key within the database. For example, all entities of a particular type of defibrillator would have the same UDI-DI.
- UDI-PI: the production identifier marks each individual entity of a product or batch. Therefore, each defibrillator has its own UDI-PI.
Unique Device Identification for Software
There are specific regulations for stand-alone software.
Assigning a new UDI-DI
A new UDI-DI shall be assigned whenever something is changed that might impact
- Performance and effectiveness
- Interpretation of data.
For software the MDR lists the following examples of data elements causing a new UDI-DI:
- Database structure
- Operating system
- User interface
Assigning a new UDI-PI
In contrast, minor changes like the following examples require "only" a new UDI-PI
- Bug fixes
- Security patches
- User interface (when the changes address only usability and not security)
As a manufacturer, one could say that all changes in the version number's third digit result in a new UDI-PI; all other changes result in a new UDI-DI.
Hence, it is not required to assign an individual UDI for each installation.
The manufacturer must display the UDI(s):
- In case of physical media (USB, DVD, ...), human- and machine-readable UDIs must be provided. The same applies to all overpacks.
- Likewise, the UDI must be visible for users, e.g. under "About" and/or the splash screen. The machine-readable UDI has not to be displayed on the screen.
- If the software has no user interface, the information must be retrievable using an API.
Unique Device Identification from the FDA's perspective
The FDA requires a definite number for medical devices, the Unique Device Identification UDI. This might work well for physical products. Applying labels to packaging or the device itself is no problem. But what about software? Where could the Unique Device Identification be placed on a virtual product? Well, a definite label could be applied to the DVD but not to downloads, which by implication would make virtual copies illegal.
Fortunately, the FDA has substantiated that "unlike most devices, software will only have to exhibit a means of displaying the UDI […] it can also be within the software itself".
Hence, it is sufficient to display the number (Unique Device Identification) within the software. However, displaying this unique number would not be enough for being able to match the number with a customer. For example, to ease reaching out to your customer in case of a product recall. In other words, you will avoid a download without authentication/registration.
When registering, you can assign the unique number (Unique Device Identification) and deposit in the software so that it can be displayed under the menu item "Help > About".