Step-by-step guide for UDI
under the EU MDR and IVDR

You have a product that qualifies as a medical device under the EU MDR or as an IVD under the IVDR and want to understand how to implement the Unique Device Identifier (UDI) requirements.
You have read the EU MDCG guidance documents on UDI, the EU Commission factsheet on UDI, browsed the new EU UDI Helpdesk, and are still unsure how to proceed.
Here is everything you need to know.

Replaces the version of July 2021

Key takeaways

  • The Unique Device Identification (UDI) system for medical devices, procedure packs, and systems under the EU MDR and for IVDs under the IVDR is mandatory. Only custom-made devices and investigational devices or IVDs for performance studies are exempt. 
  • Do not mistake the deadlines for affixing UDI carriers on the device label for an overarching deadline to assign UDIs. UDI assignment by manufacturers and procedure pack or system producers applies since the date of application of the EU MDR and IVDR.
  • UDI management is a cumbersome activity that entails registration with a UDI assigning agency, UDI construction, core data management for EUDAMED registration, and labelling changes for UDI carriers. The process requires dedicated personnel and must be part of the quality management system.

Content

What is UDI?

Unique Device Identifier (UDI) is a system intended to unambiguously identify medical devices at the generic group, model, and unit levels, and to allow rapid access to device-related information. 

Although medical device UDI requirements are already in place in many jurisdictions (e.g. USA, China, Brazil, South Korea, Saudi Arabia), there is no harmonized or universal application of UDIs. It is essential to verify the requirements in each geography of interest for the manufacturer.  

The present blog refers only to UDI requirements that apply to medical devices CE-marked under the EU MDR and IVDR. 

UDI is not required for:

  • custom-made devices, 
  • investigational devices and IVDs for performance studies, or 
  • medical devices and IVDs manufactured and used within a healthcare institution.

Simplified requirements apply to “legacy” devices, i.e. those still CE-marked under the former Directives. See chapter: What about “legacy devices”?

Unique Device Identifier (UDI) is a system intended to unambiguously identify medical devices.

There are 3 aspects of the UDI to be considered by a device manufacturer or procedure pack/system producer:

  1. The UDI codes, to be assigned (and maintained) by the manufacturer or procedure pack/system producer under the EU MDR or IVDR. Different types of UDI codes exist for a device model and unit. In addition, overarching UDI codes are required at the generic device group level. Special UDI rules apply to IVD kits, procedure packs/systems, and “configurable” devices.The obligation to assign UDI codes started from the date of application of the EU MDR (26-May-2021) or IVDR (26-May-2022).

  2. The data associated with a UDI code, to be uploaded (and maintained) by the manufacturer or procedure pack/system producer in the EUDAMED database. This entails the initial registration and any updates to information and/or registration of additional UDIs.

  3. The UDI carrier, i.e. Automated Identification for Data Capture (AIDC) and/or human-readable interpretation (HRI) representation of the UDI, to be placed by the manufacturer on the device labels and, for reusable medical devices, on the device itself. Different timelines for UDI carriers are mandated under the EU MDR and IVDR per device risk class.

What UDI codes exist under the EU MDR and IVDR?

UDI codes are unique, alphanumeric codes. The following ones are required under the EU MDR and IVDR:

  1. UDI Device Identifier (UDI-DI): A static code that identifies a device or procedure pack/system model. The UDI-DI is the identifier that must be registered in the UDI module of the EUDAMED database.

  2. UDI Production Identifier (UDI-PI): Different variable (dynamic) codes related to aspects of the production unit. A medical device can contain various UDI-PIs (e.g. serial/lot number, manufacturing date or expiry date). For medical device software (MDSW), the means of manufacture control corresponds to the software release identification. UDI-PIs shall appear on the device labels and the device itself. In the case of MDSW, the label could be an element of the user interface. UDI-PIs are not part of the data that needs to be registered in the EUDAMED database.

  3. Basic UDI-DI (BUDI): Also a static code, like the UDI-DI, the BUDI applies to a generic device group encompassing device models from the same manufacturer (same Single Registration Number, SRN) that have the same intended purpose, the same risk class, and same essential design and manufacturing characteristics. For procedure packs or systems, the BUDI shall group those that encompass the same type of components and intended purpose, regardless of the original components manufacturers. The BUDI can be viewed as the “family” code. The BUDI is the main access key for device-related information in the EUDAMED database and in relevant device documentation, e.g. EU certificates issued by Notified Bodies, EU Declaration of Conformity, Technical Documentation, Summary of Safety and Clinical Performance, Vigilance and Post-Market Surveillance reports, Free Sales certificates. Per guidance document MDCG 2018-1, a UDI-DI shall be associated with only one BUDI. Moreover, a BUDI cannot be referenced in different EU product certificates and should not be referenced in different sets of Technical Documentation or different EU Declarations of Conformity. The BUDI is not required to appear on the device itself or its labeling.

In addition, a new type of code has been introduced under the EU MDR: the Master UDI-DI (MUDI). The MUDI replaces the UDI-DI for contact lenses, which are devices with a high level of individualization, and the requirements shall be mandatory from 9-Nov-2025. A bespoke guidance document, MDCG 2024-14, has been published to guide manufacturers on the designation and use of MUDI. 

What is EUDAMED and how does it relate to UDIs?

EUDAMED is the EU database developed by the European Commission to implement the EU MDR and IVDR. It is structured around six interconnected modules:

  • ACT module, for registration of relevant Economic Operators as “Actors”
  • UDI/DEV module, for registration of devices (incl. Procedure packs and Systems)
  • NB/CRF module, for registration of Notified Body’s certificates and activities.
  • CI/PS module, for registration of clinical Investigations under the EU MDR and performance studies under the IVDR
  • VGL module, for reporting Vigilance cases and uploading post-market surveillance information
  • MSU module, for market surveillance activities by competent authorities

Under the EU MDR and IVDR, a device manufacturer or a procedure pack/system producer shall provide and continuously maintain up-to-date the following data in the EUDAMED database:

  • Information about its Economic Operator role relative to the devices and procedures packs or systems placed on the market, per EU MDR/IVDR Annex VI, Part A. Upon successful registration of the manufacturer or procedure pack/system producer in EUDAMED, a Single Registration Number (SRN) is assigned to the entity.
    Details on how to register and maintain the manufacturer or procedure pack/system producer in EUDAMED’s Actor module are provided in the EU Commission’s EUDAMED User Guide – Economic Operators – Actor module.

  • The so-called “core data elements”, a number of device-related data fields in EUDAMED that the manufacturer shall register together with the UDI-DI, per EU MDR/IVDR Annex VI, Part B. Core data elements include, for example: whether the product is a procedure pack or system, whether the device is sterile or single use or it contains latex or CMR substances.
    Details on how to register and maintain the information in the numerous fields of EUDAMED’s UDI module are provided in the EU Commission’s EUDAMED User Guide – UDI Devices.

EUDAMED’s UDI helpdesk has been established to support Economic Operators in all aspects of the UDI system under the EU MDR/IVDR, i.e. UDI assignment, labelling and registration of devices.

In practice, what do you need to do?

If you have not started, make UDI a priority. The obligation for UDI assignment for non-legacy devices applies from the date of application of the EU MDR (i.e. 26 May 2021) or IVDR (i.e. 26 May 2022).

The following steps will help you deploy your UDI project.

8 steps to deploy your UDI project

Let’s see more in detail what each step entails.

STEP 1 – Register with an EU-accredited agency for UDI assignment

UDI codes must be issued under the rules of an EU-accredited assigning agency. The EU Commission has designated the following entities, per Implementing Decision (EU) 2019/939:

  • GS1 AISBL
  • Health Industry Business Communications Council (HIBCC)
  • International Council for Commonality in Blood Banking Automation (ICCBBA)
  • Informationsstelle für Arzneispezialitäten GmbH (IFA)

Once registered with your agency of choice, you will be granted the company prefix, e.g. GS1 Global Company Prefix (GCP), the individual identification key that gives you access to the system. In case of changes in the legal status of your company (e.g. name change, merger, acquisition, spin-off), you must notify the agency.

STEP 2 – Set up a UDI Management procedure

The manufacturer’s Quality Management System (QMS) should include a UDI Management procedure encompassing at a minimum the following aspects, in alignment with MDCG 2021-19:

  • The structure of the manufacturer’s UDI-DIs (or Master UDI-DIs, MUDIs, for contact lenses) and UDI-PIs, including for third-party components that are medical devices or IVDs and for which the manufacturer takes on regulatory responsibility.
  • The process and criteria for grouping devices (including IVD kits and “configurable” devices) or procedure packs/systems under the same BUDI.
  • UDI-PI labelling process (unless described in the general device labelling procedure), with particular consideration of the impact on production processes when direct device marking is required (i.e. for reusable medical devices). In addition, the IT and logistics aspects of barcodes need to be thoroughly considered.
  • UDI-DI and BUDI change management process, i.e. criteria triggering a new code per EU MDR/IVDR Annex VI Part C and MDCG 2019-5 (unless described in the general change management procedure).
  • UDI data master maintenance (process for establishing and keeping up to date the list of all BUDIs, UDI-DIs/MUDIs and their associated core data). In addition, a list of all UDI-DIs/MUDIs and UDI-PIs assigned shall be part of the device’s Technical Documentation, as required by EU MDR Article 27(7) and IVDR Article 24(7), and shall be subject to the same retention periods as for the Technical Documentation.
  • The process for electronic transmission and consolidation of UDI data in EUDAMED and/or in any bespoke national databases (for example, swissdamed in Switzerland).

Unless your company has experience with GTIN management, it is recommended that you appoint a dedicated individual, with regulatory and technical knowledge, to oversee the UDI process throughout the device lifecycle, particularly if AIDC needs to be implemented.

STEP 3 – Assign the individual UDI-DIs or Master UDI-DIs (for contact lenses)

The UDI-DI shall be assigned by the manufacturer at the device or procedure pack/system model level. Each level of packaging as commercially available (excluding shipping containers) shall be assigned its own UDI-DI. 

In the case of “configurable” devices (those that consist of several components which can be assembled by the manufacturer in multiple configurations), a configurable device UDI-DI shall be assigned to groups of configurations, i.e. the collection of possible configurations for a given device as described in the technical documentation.

A Master UDI-DI (MUDI) shall be assigned to a given combination of contact lens design parameters, as defined by the manufacturer, including at least the ‘Base Curve’ and ‘Diameter’, and completed with other relevant parameters as indicated on the contact lens labelling.

GS1’s Global Trade Item Number (GTIN) corresponds to the UDI-DI. The structure of the UDI-DI includes the company prefix, e.g. GS1 Global Company Prefix (GCP), the manufacturer’s internal code for the product (e.g. model number), and ends with 1 check digit that is automatically calculated by the system.

An example of UDI-DI structure, built through the GS1 system is shown below.

Example of UDI-DI structure based on GS1 system

EU MDR/IVDR Annex VI, Part C, sections 3 and 6 shall be considered when assigning/updating all UDI-DIs, as special rules apply in certain cases. In addition, any relevant standards and guidelines of the UDI issuing agency chosen would need to be followed.

STEP 4 – Assign the Basic UDI-DI (BUDI)

If you only have one or a few device variants, grouping their UDI-DIs on the basis of BUDI criteria (same risk class, same intended purpose, and same design/manufacturing characteristics) is a no-brainer. Just bear in mind that a UDI-DI (GTIN) shall not be used as a replacement for the Basic UDI-DI (GMN). 

Grouping diverse device models (different risk classes, intended purposes, or technical characteristics), “configurable” devices, and procedure packs/systems under different BUDIs needs to be carefully considered and documented, bearing in mind plans for future device portfolio extensions or feature additions. 

If your devices were already CE-marked under the previous Directives (MDD, AIMDD, IVDD), you have certainly realized that the device families/grouping used for CE-marking under those Directives might not be suitable device groups for BUDI criteria. MedTech Europe’s Guidance on Basic UDI-DI Assignment provides useful tips on how to make grouping decisions.

Once you have decided on the necessary BUDIs for your portfolio, you can build the corresponding codes. A BUDI code assigned by the manufacturer shall have a maximum of 25 characters (the maximum length of the UDI-DI as established by the issuing entities). Its structure includes the company prefix, e.g. GS1 Global Company Prefix (GCP), and the manufacturer’s internal code for the device group (which can be numeric or alphanumeric, and is case-sensitive), and it incorporates a 2-digit check character, based on an algorithm defined by the issuing entity.

An example of BUDI structure, built through the GS1 system is shown below:

Example of Basic UDI-DI (BUDI) structure based on GS1 system

STEP 5 – Build the UDI-PIs

The UDI-PIs are numeric or alphanumeric codes used to label the unit of device production. Basically, they correspond to the serial number or lot number (depending on the “manufacturing control mechanism” applied for a given type of medical device by the manufacturer), with additional information on manufacturing or expiry dates. They allow the unambiguous identification of each device unit. The Application Identifiers (AI) of the issuing agency are used to generate the UDI-PIs. 

For medical device software, the “manufacturing control mechanism” is considered to be the software identification (i.e. release version) and shall be part of the UDI-PI, per EU MDR, Annex VI, Part C, section 6.5.1 and IVDR, Annex VI, Part C, section 6.2.1. This means that the AI for batch or lot number would be used in the MDSW UDI-PI preceding the software release version. If provided in a physical medium (e.g. CD or USB key), UDI-PIs are also required on the labels.

The example below shows the UDI-DI and UDI-PIs represented in 1D (linear) barcode and a 2D (data matrix) barcode, both readable with a barcode scanner, as well as in human-readable format (concatenating the UDI-DI and UDI-PIs parts, preceded by the corresponding GS1’s AIs).

Example of UDI-DI and UDI-PIs represented in GS1 linear and DataMatrix barcodes

For details on the AIs from each UDI issuing entity, refer to Appendix A of IMDRF’s UDI WG application guide N48 FINAL: 2019.

STEP 6 – Register and upload UDI data in EUDAMED

As a preliminary step to product registration in EUDAMED, the manufacturer (and also any producer of Procedure Packs or Systems) needs to complete the Economic Operator registration in the corresponding module of the EUDAMED database and obtain the Single Registration Number (SRN) for its role under the EU MDR. The SRN uniquely identifies a company’s role and it is assigned by the national competent authority upon the company’s registration request in EUDAMED. The SRN structure includes the ISO code for the country where the company is established, the Economic Operator’s role abbreviation (i.e. “MF” for manufacturer, “PR” for Procedure Pack or System producer, “AR” for EU Authorized Representative, or “IM” for EU importer), and a 9-digit company identification.

An SRN example for a German manufacturer is shown below:

Example of Single Registration Number (SRN) in EUDAMED

For companies established outside the EEA, the EU Authorized Representative is responsible for verifying the company’s registration request prior to submitting it to the national competent authority. This also concerns Swiss manufacturers and producers of Procedure Packs or Systems, since Switzerland is considered a third country to the effects of the EU MDR since 26 May 2021 and of the IVDR since 26 May 2022

Although the UDI/DEV module of EUDAMED has been available for voluntary use since October 2021, product registration is only expected to become mandatory in 2026, and is dependent on the notice confirming the functionality of this module that shall be published in the Official Journal of the EU (OJEU)

For product registration in EUDAMED, you will need the BUDI and all UDI-DIs or MUDIs generated, as well as the associated core data elements, per EU MDR/IVDR Annex VI, Part A. The EU Commission’s Q&A on the gradual roll-out of EUDAMED provides more information. It is important to highlight that, the full registration of devices will be a prerequisite for the notification of serious incidents or Field Safety Corrective Actions (FSCA) in EUDAMED.

Depending on the number of devices, procedure packs and systems registration in EUDAMED’s UDI module can be done manually (model by model), through bulk XML uploads, or via machine-to-machine data exchange. The below flowchart from the EU Commission’s Guidelines on Data Exchange with EUDAMED illustrates the conditions and implications for each option.

After the initial product registration, manufacturers and procedure pack/system producers must maintain the UDI information in EUDAMED continuously up-to-date, and to register new products (i.e. new UDI-DI or MUDI with or without new BUDI) prior to launch. Any changes made to a core data element, which do not entail a new UDI-DI, shall be updated within 30 days of the change being made.

STEP 7 – Select and affix the appropriate UDI carrier

The obligation to place the UDI carrier on the device labeling or directly on the device (for reusable medical devices) applies in phases, according to the below timelines in EU Commission’s FAQ on the UDI system:

Timelines for affixing the UDI carrier on packaging and devices

The following special cases need to be considered for UDI carriers:

  • For implantable devices, the UDI carrier shall be affixed in AIDC format at the lowest level of packaging. The UDI-PI shall be identifiable prior to implantation.
  • For reusable medical devices and reusable components of IVD kits requiring cleaning, disinfection, sterilisation or refurbishing between uses, the UDI carrier shall be placed on the device itself, in addition to their packaging, and the UDI-PI shall remain readable after each reprocessing cycle.
  • For contact lenses, the placement of UDI carriers (that shall include the Master UDI-DI) on the packaging shall comply with the requirements in the EU MDR, specifically space constraints and sales unit requirements in Annex VI, Part C, sections 4.2 and 4.3.
  • For procedure packs and systems, the devices contained shall bear the UDI carrier on their packaging or on the device itself, except when the type of device is exempted from UDI carrier or is an individual single-use disposable device, the use of which is generally known to the users are not intended for use outside the context of the procedure pack/system.
  • For “configurable” devices, the UDI carrier shall be placed on the assembly that is most unlikely to be exchanged during the lifetime of the configuration, and shall be identified as the configurable device UDI.
  • For medical device software (MDSW), UDI placing criteria are clearly established in EU MDR/IVDR Annex VI, Part C. Three situations are possible:
    • For MDSW delivered on a physical medium (e.g. CD, USB key), each packaging level shall bear both the human-readable and machine-readable (i.e. AIDC) representation of the complete UDI-PI. The UDI-PI applied to the physical medium containing the MDSW and its packaging shall be identical to the UDI-PI assigned to the system level software.
    • For MDSW not delivered on a physical medium but having a user interface (e.g. mobile apps, webtools), only the human-readable interpretation (HRI) of the UDI-PI shall be required. It shall be provided on a readily accessible screen for the user in an easily-readable plain-text format (e.g. on the ‘about’ file, splash screens, or included on the start-up screen).
    • For MDSW lacking a user interface (e.g. middleware for image conversion), the human-readable representation of the UDI-PI shall be conveyed through an application programming interface (API).

In either case, the human-readable format of the UDI-PI shall include the Application Identifiers (AI) for the standard used by the issuing entity, to assist the user in identifying the UDI and determining which standard is being used to create the UDI.

The UDI-PI code should be on each applicable packaging level, from the unit of use to the highest package level, except logistics units. It is important to highlight that the implementation of a UDI-PI carrier constitutes a complex project for a company and that it can only be successfully achieved when implemented in the company’s Enterprise Resource Planning (ERP) system and with dedicated IT and logistic resources. The costs and timelines of such a project need to be assessed as early as possible. Although not a EU MDR/IVDR requirement, verification of the barcode’s print quality is recommended to help ensure readability throughout the supply chain. To that end, standard series ISO 15415 provides relevant requirements for 2D and linear barcodes.

STEP 8 – Maintain UDIs throughout the device lifecycle

As part of the manufacturer’s change management process, device changes shall be assessed in consideration of the criteria for generating a new UDI-DI set forth in EU MDR/IVDR Annex VI, Part C, as well as in guidance document MDCG 2018-5 on UDI assignment to medical software. 

Per guidance document MDCG 2018-1, a new UDI-DI shall be required whenever there is a change that could lead to misidentification of the device and/or ambiguity in its traceability. 

For MDSW, EU MDR Annex VI, Part C, section 6.5.2 and IVDR Annex VI, Part C, section 6.2.2 require a new UDI-DI “whenever there is a modification that changes:

  • the original performance,
  • the safety or the intended use of the software
  • the interpretation of data.

Such modifications include new or modified algorithms, database structures, operating platforms, architecture, user interfaces and new channels for interoperability.”

In accordance with EU MDR Annex VI, Part C, point 6.5.3 and IVDR Annex VI, Part C, section 6.2.3, minor software revisions (which would only require a new UDI-PI and not a new UDI-DI) are considered to be those “generally associated with bug fixes, usability enhancements that are not for safety purposes, security patches or operating efficiency. Minor software revisions shall be identified by a defined manufacturer-specific form of identification.”

More specifically, guidance document MDCG 2018-5 considers that, in order to guarantee the traceability and correct identification of MDSW, the following types of software changes would require a new UDI-DI:

  • Any change of the Basic UDI-DI.
  • Any changes which impact the original performance, safety, or the interpretation of data.
  • A change to the name or trade name, version or model number, critical warnings or contra-indications, user interface language.

What about “legacy devices”?

“Legacy devices”, i.e. medical devices that remain in conformity with the former Directives (MDD, AIMDD or IVDD) after the date of application of the corresponding Regulation (i.e. 26-May-2021 for the EU MDR and 26-May-2022 for the IVDR), are not subject to UDI obligations but they should be registered in the UDI/DEV module of EUDAMED.

Regulation (EU) 2024/1860 establishes the rules for the registration of legacy devices in EUDAMED. In brief, the EU Commission has decided to use:

  • a Eudamed-DI to be assigned to the device instead of the Basic UDI-DI. The Eudamed DI could be either entirely generated by EUDAMED or the manufacturer could partly assign the DI code. 

  • a Eudamed-ID to be assigned instead of the UDI-DI. The Eudamed ID will be automatically and fully generated by EUDAMED, from the Eudamed DI code, i.e. manufacturers do not need to register with an issuing agency. And, contrary to the UDI-DI, Eudamed-IDs do not need to be indicated on the label of the legacy device.

Legacy devices are not subject to UDI obligations.

More information on the operational aspects of EUDAMED registration for “legacy devices” is available in the guidance document MDCG 2019-5. Alternatively, we recommend our blog article on the topic of “Legacy Devices”.

Do UDI and EUDAMED apply in Switzerland?

The Swiss Medical Device Ordinance (SR 812.213, MedDO) and the Swiss In-vitro Diagnostic Ordinance (SR 812.219, IvDO) carry over most of the requirements in the EU MDR and IVDR, respectively. Moreover, the Swiss competent authority, Swissmedic, mostly follows the positions of the Medical Device Coordination Group (MDCG) in the interpretation and implementation of requirements.

Therefore, UDIs are also mandated under the MedDO and IvDO with exactly the same definitions, conditions and requirements as under the EU MDR and IVDR.

Because Switzerland is viewed as a third-country since the disruption of the Mutual Recognition Agreement with respect to the EU MDR (from 26-May-2021) and IVDR (from 26-May-2022), Swissmedic has been excluded from access to EUDAMED. A parallel and analogous database has been established in Switzerland for the registration of Swiss-based Economic Operators and of all devices and procedure packs or systems placed on the Swiss market: swissdamed. Whereas registration of Economic Operators in the Actors module is already mandatory, the UDI module has not yet been released and registration of devices is not expected to become compulsory before July 2026. For more details about the regulatory situation in Switzerland, read our blog article on the role of the Swiss Authorised Representative.

How Decomplix can help

Decomplix provides assistance in each step of the medical CE certification process for product manufacturers, including UDI assignment and management. You can learn more about our services here.

Decomplix also acts as Swiss Authorised Representative (CH-REP) for foreign manufacturers of medical devices and IVDs. If you are interested in a non-binding quote for these services, please consult our dedicated CH-REP webpage.

Further reading

The scope of this article has been expanded beyond medical device software (MDSW), to cover UDIs for any type of devices under the EU MDR and IVDR, and the contents have been updated to the most recent developments in EUDAMED’s UDI module as well as with regard to the introduction of the Master UDI-DI for contact lenses.

Wie hilfreich war dieser Beitrag?

Bitte bewerten Sie:

 

More articles