UDI

What is UDI?

UDI (Unique Device Identification) is a system that gives every medical device a unique, standardised code that appears on its label and in a central database, so the product can be traced from factory to patient. The code consists of a fixed part that identifies the device type and a variable part carrying production data such as the batch number, expiry date or serial number. UDI is mandatory under the European Medical Device Regulation (MDR, Regulation (EU) 2017/745), the In Vitro Diagnostics Regulation (IVDR, 2017/746) and the UDI Rule of the US FDA. The system makes recalls faster and more targeted, helps fight counterfeiting and improves patient safety.

UDI = the passport of every medical device, from production to patient.

For OT convergence, UDI is a textbook example: the code is born in the master data of the ERP system, printed and verified on the production line, carried through the WMS and distribution, and scanned again in the hospital.

🧠 How is a UDI structured?

A UDI consists of two parts that appear together on the label, both as a machine-readable barcode (AIDC) and as human-readable text (HRI). In the EU a third, administrative key is added.

Every packaging level gets its own UDI-DI: a single catheter, a box of ten and a case of one hundred each carry a different code. This allows scanning at every level without opening the packaging. For highly individualised devices, the MDR provides a Master UDI-DI that groups comparable variants: introduced in 2023 for contact lenses and extended in 2025 to spectacle frames, spectacle lenses and ready-to-wear reading spectacles.

🔧 Which issuing entities and code formats exist?

A manufacturer does not invent the UDI itself but uses the numbering system of a designated issuing entity. The EU designated four in Implementing Decision (EU) 2019/939, a designation extended by Implementing Decision (EU) 2024/2120 until 27 June 2029. The FDA accredits GS1, HIBCC and ICCBBA.

In human-readable form, a GS1 UDI looks like this:

These data are encoded in a 2D DataMatrix or a linear GS1-128 barcode. DataMatrix is the usual choice for small packaging and directly marked instruments, because it takes up little space and stays readable when damaged. RFID is allowed as an additional carrier but does not replace the barcode.

⚖️ Which legislation and deadlines apply?

In Europe, Article 27 of the MDR and Article 24 of the IVDR establish the UDI system. Manufacturers have had to assign a UDI since 26 May 2021 (MDR) and 26 May 2022 (IVDR); the obligation to put the UDI carrier on the label was phased in by risk class:

The corresponding database is EUDAMED. Following Regulation (EU) 2024/1860, it can become mandatory module by module. On 27 November 2025 the Commission published that the first four modules are functional, including actor registration and UDI/device registration. Since 28 May 2026, a new device must be registered in EUDAMED before it is placed on the market; devices already on the market must be registered by 28 November 2026.

In the United States, the FDA UDI Rule was published on 24 September 2013. Implementation was phased from class III devices in 2014 to class I and unclassified devices, for which the FDA has enforced the labelling requirements since 24 September 2022. Data go to the GUDID (Global Unique Device Identification Database), and dates on the label must use the YYYY-MM-DD format. The international foundation is the IMDRF UDI guidance of 2013, on which countries such as China, South Korea and Saudi Arabia also base their own UDI rules.

🏭 Who has which obligation?

In the Netherlands, the Health and Youth Care Inspectorate (IGJ) supervises compliance. Dutch hospitals also record implants in the national implant register (Landelijk Implantatenregister), for which a UDI scan is the fastest and most reliable source. During a recall (FSCA), a hospital can see within minutes which patient received which implant from which batch.

🔄 How does UDI touch IT and OT?

UDI is not just a labelling issue but a chain of systems that must pass the same data on without errors:

• Master data - UDI-DIs and Basic UDI-DIs are managed in the ERP or a PLM system and uploaded to EUDAMED and GUDID via XML or a machine-to-machine connection.
• Production line - the MES takes the UDI-DI from the order, generates batch and serial numbers and drives the printer or laser.
• Verification - a camera or vision system reads back every code, checks content and print quality (ISO/IEC 15415 for 2D, 15416 for linear) and rejects deviating products.
• Aggregation and distribution - case, carton and pallet codes are linked; the WMS scans on receipt and dispatch.
• Healthcare and laboratories - hospitals scan on receipt and at implantation, and laboratories record the IVD reagent used in their LIMS.

Because UDI data serve as evidence in audits and incidents, the same requirements apply as for any quality record: data integrity, audit trails and, for US manufacturers, electronic records under 21 CFR Part 11.

🛠️ How do you implement UDI step by step?

1. Choose an issuing entity - for most manufacturers this is GS1; GS1 Netherlands issues GTIN prefixes in the 870–879 range.
2. Inventory the portfolio - determine the risk class, the Basic UDI-DI groups and all packaging levels for each product.
3. Assign and record codes - keep one source of truth in ERP or PLM; never reuse a GTIN for a different product.
4. Adapt labels and lines - label design with AIDC and HRI, printers, lasers for direct marking and verification cameras.
5. Validate - test the line, the interfaces and the readability as part of your quality management system; in a GMP environment this requires formal validation.
6. Register and maintain - upload to EUDAMED and GUDID and manage changes: a new model, different pack quantities or a major software change requires a new UDI-DI.

This makes UDI the backbone of tracking and tracing in the healthcare chain, linking it to supply chain management.

❓ Frequently asked questions

Is a UDI the same as a barcode?

No, the UDI is the unique code itself and the barcode is only its carrier. A UDI must appear on the label both as a barcode or RFID tag and as human-readable text. The same UDI can therefore be stored in a DataMatrix, a GS1-128 barcode or an RFID tag.

What is the difference between UDI-DI and Basic UDI-DI?

The UDI-DI identifies one specific model at one packaging level and appears on the label. The Basic UDI-DI is a European administrative key that links a group of devices with the same intended purpose, risk class and design to certificates and documentation. The Basic UDI-DI does not appear on the label.

Does UDI also apply to medical software?

Yes, software that qualifies as a medical device also needs a UDI under the MDR. For software, the version is the key element of the UDI-PI. A major change in functionality or safety requires a new UDI-DI, while a minor bug fix only requires a new UDI-PI.

Do hospitals have to store UDIs?

Under the MDR, hospitals must store the UDI of class III implantable devices they supply or receive, preferably electronically. Member states may extend that obligation to other devices. In practice, many hospitals scan UDIs more broadly because it simplifies recalls and inventory management.

When must a medical device be registered in EUDAMED?

Since 28 May 2026, a new medical device must be registered in the UDI/device module of EUDAMED before it is placed on the EU market. Devices that were already on the market before that date have until 28 November 2026 to be registered. The obligation follows from the gradual roll-out of EUDAMED under Regulation (EU) 2024/1860.

Is a UDI the same worldwide?

The principle is the same worldwide, because most countries follow the IMDRF guidance and recognise the same issuing entities. The details differ: the Basic UDI-DI exists only in the EU and the FDA prescribes its own date format. A GS1 code can, however, serve several markets at once.

📌 In summary

UDI gives every medical device a unique code with a fixed part (UDI-DI) and a production part (UDI-PI), printed on the label and registered in EUDAMED or GUDID.

The MDR, IVDR and the FDA make UDI mandatory, with labelling deadlines phased in by risk class between 2021 and 2027 and EUDAMED registration required since 28 May 2026. Setting up UDI properly links master data, the production line, verification and healthcare systems into a single chain, achieving both compliance and reliable traceability.