Overview of Medical Device UDI Requirements in the US and Europe

Medical device and IVD manufacturers have been using barcodes to track samples and manage inventory for decades. However, only recently has the technology been widely embraced by regulatory authorities to improve traceability of devices throughout the entire device life cycle and distribution chain. The benefits of Unique Device Identifiers (UDI) extend far beyond traceability. UDI can help –

• Distinguish between device versions, sizes, and other characteristics
• Track devices from specific production facilities
• Make it easier for patients and users to report serious incidents
• Simplify recall management
• Improve efficiency by standardizing information in Electronic Health Records (EHR) systems, clinical information systems, and registries
• Reduce medical errors
• Make it harder to conceal counterfeit devices

UDI is required (or proposed) in several countries/regions including Argentina, Australia, Brazil, Canada, China, Europe, India, Japan, Saudi Arabia, Singapore, South Korea, Taiwan, Turkey, United Kingdom, and United States.

On the surface, a medical device UDI looks like any other bar code, but the data it contains falls into two distinct buckets.

The human-readable portion of the UDI is the best way to illustrate how the AI is used. In the code shown above, you will see a (01) and (10) in parentheses. These application identifiers, or AI, are 2-4 digits and define the type of data and field length that follows it. For example, AI (01) is used for the GTIN whereas code (10) is used for a batch/lot number. Other commonly used AI for medical devices include (11) for Manufacturing Date, (17) for Expiration Date and (21) for Serial Number. There are hundreds of application identifiers but only a handful that really apply to device companies.  The  GS1 implementation guideline can help give a better understanding of the AIs applicable to medical devices.

UDI will be applied to most medical devices, including low-risk products (except custom-made and performance study/investigational devices). Devices that are used more than once and those that are reprocessed must have the UDI printed on the device itself, in addition to the outer packaging. Data can be presented as a linear bar code or a matrix (QR code).

The US FDA and European Competent Authorities do not generate or manage Unique Device Identifiers (UDI). Instead, there are a few international “issuing agencies” that generate UDIs for medical devices and IVDs. The most well-known agencies recognized by the US FDA and European regulators include:

• GS1
• HIBCC
• ICCBBA

The US FDA issued a final rule in September 2013 establishing a need of UDI for all medical devices. Except for single-use devices, the UDI must be applied to the labelling and directly on the device itself; unless there is a legitimate reason why it’s not possible (example: contact lenses). While it is necessary to understand the specifics of this regulation, a review of the FDA UDI guidance document is recommended as the first step.

In the US, UDIs are tracked in the Global Unique Device Identification Database (GUDID) where you can set up a GUDID account. The GUDID database only contains company and Device Identifier (DI) information. In October 2021, FDA issued a draft guidance indicating their intent to stop enforcing GUDID submission requirements for unclassified (except implantable, life sustaining/supporting) devices and Class I medical devices that are exclusively sold to consumers and are 510(k) exempt. Although this is draft guidance, it is a safe bet for manufacturers of these devices that it will become final guidance.

Just as the US FDA has the GUDID database, Europe has the EUDAMED database which will eventually be used by all EU Competent Authorities. The public facing version (shown below) can be searched based on UDI-DI number, model number, tradename, or manufacturer name. Unlike GUDID, EUDAMED is a far more comprehensive database that is still under development. Once it is operational, manufacturers will be required to input all device data (including UDI) into EUDAMED.

Article 27 of the EU Medical Device Regulation (2017/745) and Article 24 of the In Vitro Diagnostic Regulation (2017/746) mandate the need to implement UDI for devices sold in Europe. The Regulations only provide the European UDI requirements.  Several guidance documents published by MDCG provide a detailed overview of different aspects of UDI requirements and its implementation (click here for the guidance documents). The European Commission has published more guidance documents (click here).

Legacy devices that were CE Marked under the old Medical Devices Directive (93/42/EEC) or the In Vitro Diagnostic Directive (98/79/EC) can continue to be on the market in Europe until their certificates expire. Labeling requirements under those Directives apply, which means if you are already using UDI, you can reuse the same UDI codes under the MDR or IVDR, provided no changes were made to the device or manufacturing process.

There are some important differences between the US FDA UDI requirements and UDI requirements in Europe. Most notably, Europe uses the concept of the Basic UDI-DI, which exists to track devices more closely in the EUDAMED database. The Basic UDI-DI is not actually used on labelling. Page 12 of this guidance from MedTech Europe explains Basic UDI-DI and other differences in the UDI requirements for EU and US.

*Non-implantable devices

Since UDI is mostly about traceability, some changes would obviously trigger the need for a new UDI. Others are not so obvious. A new UDI is required if changes are made to:

• The device version or model
• The name or tradename
• The quantity of devices contained in a package
• Critical warnings/contraindications
• A device being relabeled as single use

Several devices incorporate software and many regulatory professionals wonder if a new UDI must be issued when software is updated or changed. In general, a new UDI-DI and UDI-PI is required if the change affects the original performance and/or safety of the software, or interpretation of data. This may include changes to the algorithm, database structure, operating platform, architecture, UI changes, etc. If the software update is aimed only at fixing bugs, security patches, or usability enhancements, a new UDI-PI is required, but they DO NOT require a new UDI-DI.

Before you start downloading a bunch of FDA and European guidance documents, start with this UDI Application guide published by the IMDRF. To get a better understanding of what will be required of you based on where you sell and how you package your devices, let us conduct a thorough UDI gap assessment for you. We can help you select an accredited agency, write/implement UDI processes in your quality management system, and much more.