The FDA’s Unique Device Identification (UDI) system improves traceability and patient safety. Learn what a UDI is, labeling requirements under 21 CFR 801, GUDID submissions, and how manufacturers must integrate UDI into packaging and systems for compliance.
In recent years, the FDA has implemented the Unique Device Identification (UDI) system to improve the traceability and safety of medical devices. The UDI system was established by regulation (the UDI Rule) with the goal of adequately identifying devices from manufacture through distribution to patient use. For manufacturers and labelers, this means that most medical devices now must include a UDI on their labels and packages, and corresponding device information must be submitted to an FDA database. Let’s break down the key requirements and how to integrate UDI into your device labeling process.
A Unique Device Identifier is a code that consists of two parts: a Device Identifier (DI) and a Production Identifier (PI). The DI is a fixed portion that identifies the specific version or model of the device and the company that manufactured it. In essence, it’s the part of the code that says “this is Acme Corp’s model XYZ device.” The PI is a dynamic portion that carries information specific to the particular unit or batch of the device, such as the lot or batch number, serial number, expiration date, manufacture date, or other identifiers for that production run. Not every PI element is required for every device – which PIs are included depends on what information is applicable (for example, an implant might include lot number and expiration date, whereas a piece of equipment might include a serial number). Together, the DI+PI make a UDI that is unique to that device model and production set.
The FDA’s rule (21 CFR 801 subpart B) specifies that, unless excepted, the label of every medical device must bear a UDI in both human-readable plain text and in a machine-readable form (like a barcode or RFID). Typically, companies use a barcode or QR code that encodes the UDI, alongside printed text of at least the DI portion (and often the whole UDI). The UDI should be placed on the device’s primary label and any higher levels of packaging (up to the lowest level of packaging that is a shipping container). For devices intended to be reused and reprocessed, there is an additional requirement: the UDI must also be directly marked on the device itself (per 21 CFR 801.45), so that it remains identifiable even if separated from its packaging. There are some exceptions and extensions (for example, certain Class I devices that are low-risk have been exempted, and there were phased compliance dates based on device class), but by 2025 nearly all devices on the market are expected to comply with UDI labeling.
Manufacturers don’t invent UDIs from scratch. FDA has accredited several Issuing Agencies (such as GS1, HIBCC, and ICCBBA) to provide the framework for UDIs. Companies typically choose one of these agencies and follow their standard to create the codes. For instance, if using GS1, the DI might be a GTIN (Global Trade Item Number). The UDI code format will differ slightly depending on the issuing agency’s system, but all are recognized by FDA. What’s important is that the UDI is in a format that FDA accepts and that it encodes the required information. The label should also indicate the appropriate identifiers, often through application identifiers or other prefix codes that distinguish the parts of the UDI. For example, in a GS1 barcode, “(01)” might precede the DI portion in the data string, “(17)” the expiration date, “(10)” the lot, etc., making it parseable.
In addition to placing the UDI on the label, the device “labeler” (usually the manufacturer) must submit device information to the FDA’s Global Unique Device Identification Database (GUDID). The GUDID is essentially FDA’s master catalog of device identifiers. For each DI (which identifies the device model), certain data must be provided – such as the brand name, version or model, company name, device description, MRI safety status, and many other attributes. Importantly, no production identifiers (lot, serial, etc.) are uploaded, just the DI and static information about that device version. The public can search much of this info via AccessGUDID. The requirement is that when you start labeling a device with a particular UDI, you must have already submitted its DI record to GUDID (or at least do so within a very short window). FDA provides an account system for companies to upload this data, either manually via a web interface or programmatically. Compliance with GUDID submission is tracked – having the code on the label alone is not enough; regulators expect the database entry to be there to match it.
Implementing UDI can be a significant project for a device manufacturer. It touches multiple parts of the organization: regulatory (assigning and registering codes), labeling/packaging (printing the codes on labels), IT systems (potentially upgrading manufacturing execution systems or inventory systems to handle UDI data), and quality assurance (procedures to control and verify UDI). From a label design standpoint, you will need to reserve space for the barcode and ensure your label printing hardware/software can generate it correctly. Many companies use label management software that can pull in the device’s lot number or serial number automatically at the time of packaging to include it in the UDI code. Label integrity checks become even more critical – you want to be sure the right UDI is on the right product. (This links with the Quality System Regulation requirement in 21 CFR 820.120 that labeling operations include controls to avoid mislabeling.)
The UDI rule was phased in by device class. Class III devices were first, then Class II, and Class I last. As of late 2020, UDI labeling is required for Class II and III devices (with very few exceptions), and Class I devices had deadlines into 2021 (though FDA provided enforcement discretion for certain low-risk devices like non-sterile Class I until 2022). By now (2025), essentially all devices should have UDIs on their labels, except those explicitly exempted (like custom devices, or devices sold before certain dates). If you have legacy products that are exempt (like a low-risk Class I device that falls under an exemption), you must ensure you document that exemption. Otherwise, not providing a UDI when required could be viewed as a labeling violation.
From a compliance perspective, UDI is mandatory – but it’s worth noting the benefits of UDI integration. UDIs allow for quick identification in the event of recalls or safety alerts, as each device version has a unique code. They improve the healthcare supply chain by enabling better inventory tracking and reducing errors (scanning a barcode is more reliable than manual entry of product codes). UDIs also feed into post-market surveillance; for example, when reporting adverse events, hospitals now include UDI information, which helps FDA and manufacturers analyze if specific lots or models are causing issues. All these benefits tie back to the rationale for the rule – to adequately identify devices through their life cycle.
In summary, to comply with UDI requirements, a device manufacturer or labeler must: assign a UDI via an accredited agency, place the UDI correctly on labels/packaging (and device if needed), and submit the device information to GUDID. Integrating this into your labeling process is now a standard part of launching and maintaining a medical device in the U.S. market. Companies who haven’t fully implemented UDI need to prioritize it, as it’s a regulatory requirement (and an important patient safety measure). With UDIs in place, we next turn to another modern challenge in device marketing – the realm of digital and social media compliance.
