UDI Assignment and Labelling Requirements Under MDR Article 27 and Annex VI

UDI is a system, not just a barcode

The Unique Device Identification system under MDR is often described in terms of its visible output — the barcode or RFID on the device label. But the barcode is just the endpoint of a structured identification system that starts with how you define your device models, runs through how you assign identifiers at each level of packaging, and connects to your EUDAMED registration. Teams that treat UDI as a labelling task tend to underestimate the work involved, particularly if they have device families with multiple configurations, packaging levels, or software components.

The UDI is made up of two parts: the UDI-DI (Device Identifier) and the UDI-PI (Production Identifier). The UDI-DI identifies the device model — it is tied to the device design and does not change based on the manufacturing run. The UDI-PI contains production-specific information: serial number, batch/lot number, manufacturing date, expiry date, and for software devices the software identification. The combination of UDI-DI and UDI-PI on a label allows the specific unit in a patient's hands to be traced back to its production context. This is the traceability purpose the system was built for.

The UDI-DI must be assigned through an issuing entity — an organisation that MDR recognises as authorised to issue UDI system identifiers. Under MDR Annex VI Part C, the accepted issuing entities include GS1, HIBCC, and ICCBBA (for blood-related products). GS1 is the most common choice for most device categories, using the Global Trade Item Number (GTIN) format. The choice of issuing entity affects the barcode format that will appear on the label. One thing worth noting early: if you have an existing GS1 company prefix from other product lines, your UDI-DI structure can often build on that — but you need to verify the assignment rules specific to medical devices, which have additional UDI-DI change triggers compared to general consumer products.

A UDI-DI must be assigned at each level of packaging that is sold or distributed separately: at the unit level, at the higher-package level (box, carton), and if applicable at the case or shipping level. Each level gets its own UDI-DI. The UDI-PI for each level reflects the batch or lot applicable to that packaging unit. Getting this hierarchy right matters because the EUDAMED device registration requires a UDI-DI entry for each distinct packaging level — and what constitutes a "distinct packaging level" has caused genuine confusion in practice.

The Basic UDI-DI is a separate concept that sits above the individual UDI-DIs. The Basic UDI-DI is assigned at the device model group level and is what appears in the Declaration of Conformity. It is the identifier used in EUDAMED to group related device configurations under a single registration record. A single Basic UDI-DI can cover multiple UDI-DIs (different sizes, configurations) as long as they share the same intended purpose, risk class, essential design and manufacturing characteristics, and applicable standards. When these characteristics diverge, a new Basic UDI-DI is needed. This is a decision that needs to be made deliberately during device registration — regrouping later is operationally painful.

For labelling, MDR Article 27 requires that the UDI carrier (the barcode or RFID) appear on the label of the device and on all higher levels of packaging. The UDI-DI must also be in human-readable format on the label. What does not need to appear in human-readable format on every label is the UDI-PI — but it must be in machine-readable format. Annex VI Part C contains the technical specifications for carrier formats: for linear barcodes, GS1-128 is most common; for 2D symbology, Data Matrix is standard for smaller labels. If your device is implantable, an RFID or similar carrier may also be required.

EUDAMED registration of UDI data is mandatory. For each UDI-DI, the manufacturer (or AR on their behalf) must register specific data elements in the EUDAMED device database: the UDI-DI itself, the Basic UDI-DI it belongs to, the device name, the device description, risk classification, the issuing entity, and other fields set out in Annex VI Part B. A device cannot carry a CE mark and be placed on the EU market without this EUDAMED UDI registration being in place. The EUDAMED registration and the label UDI must be consistent — if there is a mismatch between what is registered in EUDAMED and what is on the device, that is a compliance failure that market surveillance authorities can identify by scanning the device.