A bar code in the background, a pole with direction signs, UDI-DI and UDI-PI written on it, symbolizing the UDI system, enhancing traceability .

Traceability of Medical Devices

Scandals of breast and hip implants in the past triggered the need of a traceability system for medical devices during the entire lifecycle. Therefore, regulators world-wide request the use of Unique Device Identifier (UDI), i.e. a product number for the unambiguous identification of medical devices on the market.

The traceability of medical devices should improve the effectiveness of recalls and other field actions, incident reporting and market surveillance. Furthermore, positive impacts on the fight against product counterfeiting, the reduction of medical malpractice and the procurement, storage and disposal of medical devices are expected.

Although the benefits of traceability are beyond question, meeting the UDI requirements in Europe and the USA is a significant effort for the entire organization of the manufacturer. In this article we summarize the main steps to introduce UDI.

European Regulation of the UDI System

Already in April 2013, the EU Commission published a recommendation for a system of unique device identification for medical devices. The European UDI system for manufacturers of medical devices will become mandatory with the entry into force of the Medical Devices Regulation (EU MDR) on 26 May 2021. The provisions for the European UDI system are defined in Art. 27, 28, 29 and 31 as well as in Annex VI of the EU MDR. Similar requirements exist in the European In-Vitro Diagnostic Regulation (EU IVDR), but in this article we focus on the EU MDR.

How is the European UDI-Based Traceability System Built up?

The European UDI system consists of three parts.

  1. The Unique Device Identifier (UDI), i.e. the UDI code, which consists of the static UDI Device Identifier (UDI-DI) for product identification and the variable UDI Production Identifier (UDI-PI) containing data on the production unit (e.g. batch and serial numbers as well as the manufacturing or expiration date) (Part C Annex VI EU MDR).
  2. The UDI carrier that contains the UDI information in machine- and human-readable form (Part C Annex VI EU MDR).
  3. The UDI database that is part of the EUDAMED database (Art. 28).

Essential Components of Unique Device Identification System

Note, that the “basic UDI-DI” is defined as the “primary identifier of a device model” and, thus, can be regarded as registration number for a group of devices with same intended purpose, risk class, essential design and manufacturing  characteristics. It plays the main role for connecting specific information in the EUDAMED database with a certain medical device (see below for more details). Do not use the basic UDI-DI on the label or on the product!

How is the UDI Code Used by the Manufacturer?

The manufacturer receives a range of numbers for the UDI-DI from so-called issuing entities for:

  • any product (including software and components) that is commercially available,
  • the lowest packaging level and, if applicable, further higher packaging levels,
  • configured products as well as
  • systems and treatment units.

The manufacturer is responsible for mapping the UDI-DI with his internal product numbering system and related data.

Note that any change to the data elements relating to the medical device (e.g. trade name, product version, or model) may require a new UDI-DI to be assigned. The UDI-PI is assigned by the manufacturer himself.

The EU Commission has officially designated the issuing entities in an implementing decision: GS1, HIBCC, ICCBBA and IFA GmbH.  These organizations have developed standards for the uniform use of machine-readable information such as identification keys, data attributes and barcodes. An example of the UDI-DI is the GS1 GTIN (Global Trade Item Number). These standards are referenced by standardization organizations like ISO (ISO/IEC 15417 and ISO/IEC 16022).

The manufacturer must then affix the UDI to the product and package in both machine-readable and human-readable form. Furthermore, the manufacturer must provide the respective data to the EUDAMED database (Art. 31 (1)). Otherwise, he is not allowed to market the medical device. In total 24 central data elements must be reported to EUDAMED (Part B of Annex VI). In turn the manufacturer (or authorized representative / importer) obtains a single registration number (SRN) that is used for the conformity assessment procedure and the application for access to EUDAMED (Art. 31 (2-3)). Further requirements concern the obligation to update the data and to ensure their accuracy as well as the partial public accessibility of the data (Art. 31 (4-7)).

Usage of the Basic UDI-DI

The basic UDI-DI is used in conjunction with information related to the respective medical device:

  • Declaration of conformity (Art. 27 (6)) and accompanying conformity certificates issued by the Notified Body,
  • Technical documentation (Annex II 1.1b),
  • Product registration (Art. 29 (1-4)),
  • Summary of safety and clinical performance for implantable and class III devices (Art. 32 (2a)), and
  • Certificate of free sale (Art. 60 (1)).

Moreover, for traceability purposes we recommend to include the UDI-PI also in all documents regarding clinical trials, market surveillance, and vigilance.

Step-by-step UDI Application in the EU

The manufacturer must transfer the basic data to EUDAMED already until 26 May 2021 except that the start of the database is delayed. However, the deadline for the UDI application vary for the different risk classes.

An important prerequisite is the designation of the issuing entities and the provision of the medical device nomenclature for the UDI database.

Roadmap UDI

Are There Special Provisions for Medical Software Concerning UDI?

Yes, the Part C of Annex VI contains provisions especially for software:

  • the software identification on the label is part of the UDI-PI,
  • the UDI is assigned at the system level of the software,
  • after certain software changes a new UDI-DI must be assigned, and
  • the UDI is attached according to certain criteria.

However, some provisions needed a clarification. In October 2018 the Medical Devices Coordination Group (MDCG) issued five guidance documents on UDI. The document “MDCG 2018-5 UDI Assignment to Medical Device Software” deals with the UDI provisions for software. Until now, it was unclear for manufacturers which changes to medical device software would require a new UDI-DI. The MDCG now clarifies that in the specific case of software:

  • any change of the basic UDI-DI,
  • any changes which impact the original performance, safety, or the interpretation of data,
  • a change to the name or trade name, version or model number, critical warnings or contra-indications, user interface language

requires a new UDI-DI. Therefore, you need to assess any changes for the need of a new UDI-DI!

Minor software revisions, e.g. bugfixes without relation to safety and security, require a new UDI-PI and not a new UDI-DI. But you are encouraged to document the minor revisions!

Since software does not exist physically and no label or similar can be attached to it, there is a special aspect to the affixing of the UDI. The human-readable form can be stored in software menus. If there is no user interface other ways have to be used, e.g. an application programming interface (API).

Traceability System for Medical Devices in the U.S.

Already in 2013 the Food and Drug Administration (FDA) published the rule on the UDI system and a guidance for Global Unique Device Identification Database (GUDID) a year later. Manufacturers must comply in the US with the UDI system dependent on the risk class since 2014.

There are substantial differences between the UDI systems in Europe and the U.S. For example, the GUDID contains only UDI data and not, like EUDAMED, data on market surveillance. In addition, there are special requirements in the EU MDR for certain product groups such as active implants or exceptions for limited space on product labels. There is nothing comparable in the U.S.

Taken together, manufacturer are advised to examine carefully what they can and cannot adopt from the requirements in U.S.

Our Recommendation

We recommend these steps that the manufacturer should follow when using a UDI-based traceability system.

Step 1: Analysis of Regulatory Requirements

  • When will my products be affected?
  • What requirements do apply for my products?
  • Which coding systems do I want to introduce (GS1, HIBCC or ICCBBA)? Do I have already experience with using a coding system for other economic areas?

Step 2: Review of the Company’s Current Situation and Gap Analysis

  • Which departments and processes in the company are affected and need to be involved (Development, IT, Quality Management, Regulatory Affairs, Production, Marketing, Sales…)?
  • Which labelling procedures already exist at which packaging levels?
  • What are the requirements of my sales partners? When will the sales partners switch to the UDI system?
  • Are data carrier systems already in use? Or do they have to be introduced first?
  • Are my basic data administration and processes able to meet the new requirements? Is the continuous updating of basic data guaranteed both internally and externally?

Step 3: Set-up of the UDI Project

  • Plan the project for the implementation of all necessary measures. Are all work packages planned with enough time buffer and responsible persons?
  • Consider the extra financial and personal capacities for the introduction of UDI.
  • Train first key personal and then all further involved staff on the UDI requirements.
  • Adapt all relevant company processes. Especially, pay attention to the traceability requirements of the quality management standard ISO 13485.
  • Engage the Notified Body in time.
  • Contact the issuing entity early enough.
  • Communicate UDI-related measures and timeline also to your sales partners.
  • Monitor the implementing legislation of the EU commission.