FDA UDI Compliance: The Complete Guide

What Is the Unique Device Identification (UDI) System?

The Unique Device Identification (UDI) system is a regulatory framework established by the FDA under the Food and Drug Administration Amendments Act of 2007 (FDAAA) and codified in 21 CFR Part 830. The system was designed to adequately identify medical devices through distribution and use, improve the accuracy of adverse event reports, enable more rapid identification of devices involved in recalls, and reduce medical errors caused by device misidentification.

Under the UDI rule, every medical device label and package must bear a unique identifier in both human-readable plain-text and machine-readable automatic identification and data capture (AIDC) format, such as a barcode or RFID tag. Device labelers must also submit identifying information about each device to the FDA's GUDID database. The final UDI rule was published on September 24, 2013, and compliance deadlines were phased in by device risk class over the following decade.

The UDI system is analogous to the National Drug Code (NDC) system used for pharmaceutical products, but with additional production-level tracking capabilities. While the NDC identifies a drug by labeler, product, and package configuration, the UDI goes further by incorporating lot numbers, serial numbers, expiration dates, and manufacturing dates into the identifier structure.

Core Objectives of the UDI System

• Enable rapid and precise identification of devices in adverse event reports
• Streamline recall actions by pinpointing affected lots, models, and serial numbers
• Reduce medical errors associated with device misidentification
• Facilitate integration of device data into electronic health records (EHRs)
• Create a single, authoritative source of device identification data (GUDID)

The UDI system applies to all medical devices commercially distributed in the United States, including those manufactured domestically and those imported from foreign establishments. Devices regulated as both a drug and a device (combination products) are also subject to UDI requirements for the device component.

Who Is Considered a "Labeler"?

Under the UDI regulation, the "labeler" is the entity responsible for UDI compliance. A labeler is defined as any person who causes a label to be applied to a device, or who causes the label of a device to be modified, with the intent that the device will be commercially distributed without any subsequent replacement or modification of the label. This definition captures domestic manufacturers, specification developers, single-use device reprocessors, repackers, relabelers, and foreign exporters whose name appears on the device label. Contract manufacturers that produce devices under another company's brand are generally not the labeler—the brand owner is.

UDI Components: Device Identifier and Production Identifier

Every UDI is composed of two parts: the Device Identifier (DI) and the Production Identifier (PI). Together, these form the complete UDI string that appears on labels, packages, and direct marks.

A PI is required on a device label only when the label already includes one or more of those data elements under existing FDA labeling rules (21 CFR Part 801). For example, if a device is labeled with a lot number and an expiration date, both must be encoded in the UDI's PI segment.

FDA-Accredited Issuing Agencies

Labelers must obtain their DI from one of the FDA-accredited issuing agencies. Each agency provides its own standard for encoding the UDI into AIDC formats. A labeler is free to choose any accredited agency, and different product lines within the same company may use different agencies. However, once a DI is assigned to a device by a particular agency, the AIDC encoding must follow that agency's specifications.

GUDID Database Submission Requirements

The Global Unique Device Identification Database (GUDID) is the FDA's publicly searchable repository for UDI device information. Before a device bearing a UDI can be commercially distributed, the labeler must submit the DI record and associated device attributes to GUDID via the FDA's HL7 SPL format or the GUDID web interface.

Required GUDID Data Elements

Each GUDID submission must include the following core data elements defined in 21 CFR 830.310:

• Primary device identifier (DI) issued by an accredited agency
• Brand name under which the device is marketed
• Company name (labeler name as registered with FDA)
• Device version or model number
• Device description sufficient to identify the device
• Whether the device is labeled as containing natural rubber latex
• Whether the device is labeled as single use
• MRI safety information (MR Safe, MR Conditional, MR Unsafe, or not labeled)
• FDA premarket submission number (510(k), PMA, De Novo, or HDE number)
• FDA product code(s) and device classification
• Whether the device is labeled as sterile
• Quantity of devices per package configuration (package DI hierarchy)

GUDID Submission Methods

Labelers can submit data to GUDID through two primary methods: the GUDID web interface (for manual, low-volume submissions) and the HL7 SPL (Structured Product Labeling) electronic format for automated, high-volume submissions. Large labelers with thousands of device models typically use SPL-based submissions via the FDA's Electronic Submissions Gateway (ESG). The FDA also provides a GUDID Sandbox environment for testing submissions before production use.

GUDID Submission Timeline

Labelers must submit DI records to GUDID before the date on which a device must bear a UDI on its label. Records must be kept current—labelers are required to update GUDID within 10 business days after any change to the required data elements, and to report when a DI is retired (i.e., no longer used on new device labels).

UDI Label and Package Marking Rules

The UDI must appear on the label and on all higher levels of device packaging. If a device has a unit package, an intermediate package, and a shipping container, each packaging level requires its own distinct UDI (each with its own DI referencing that specific packaging configuration in GUDID).

Human-Readable and AIDC Format

The FDA requires that every UDI appear in two distinct forms on the device label. Both forms must carry the same information and must be on the same label or package. The AIDC form is critical for clinical workflows because it allows healthcare providers to scan and electronically record the device identifier at the point of use.

Every UDI must be presented in two forms on the label:

• Plain-text (human-readable): The full UDI string printed in characters readable without machine aid.
• AIDC (machine-readable): The UDI encoded in an automatic identification and data capture technology such as a linear barcode, 2D barcode (DataMatrix, QR code), or RFID tag.

Label Space Considerations

The FDA acknowledges that label space is limited, particularly for small devices. The AIDC format may be placed on the outside of the package even if the human-readable form appears on the device label itself. If the device package is too small for both formats, the labeler may request an exception or alternative from the FDA under 21 CFR 801.55.

Package Hierarchy

Each packaging level must have a unique DI submitted to GUDID. The GUDID record for each package level identifies how many devices or lower-level packages are contained within. For example, a case of 24 individually packaged surgical gloves requires one DI for the individual glove package and a separate DI for the case containing 24 units. Failure to submit all packaging-level DIs is one of the most common UDI violations cited by FDA.

Combination Products and Kit Labeling

For convenience kits containing multiple devices, the kit itself must bear its own UDI and have a separate GUDID record. The individual devices within the kit must also bear their own UDIs unless they are not individually distributed. For device-drug combination products, the UDI requirement applies to the device constituent part, and the National Drug Code (NDC) number must also appear on the label per 21 CFR 207.

Compliance Deadlines by Device Class

The FDA implemented UDI requirements on a phased timeline based on device risk classification. Higher-risk devices were required to comply first, with progressively later deadlines for lower-risk categories. The phased approach gave the medical device industry time to implement the operational changes necessary for UDI compliance, including updating label artwork, procuring barcode printing equipment, training personnel, and establishing GUDID submission workflows.

All compliance dates have now passed. Any device commercially distributed in the United States without a compliant UDI label and corresponding GUDID entry is in violation of 21 CFR Part 830 and may be subject to FDA enforcement including warning letters, import alerts, and seizure.

Devices Entering the Market After the Deadline

New devices entering the market for the first time must comply with UDI requirements before the device is commercially distributed, regardless of device class. This means the labeler must obtain a DI from an accredited issuing agency, submit the DI record and all required attributes to GUDID, and apply the complete UDI (in both human-readable and AIDC form) to the device label and all packaging levels before shipping. For devices requiring direct marking, the direct mark must also be applied before distribution.

Foreign manufacturers exporting devices to the US market should note that UDI compliance is verified at the point of import. Devices arriving without compliant UDI labeling may be detained under FDA's import alert system. Assurentry recommends that foreign labelers verify their GUDID submissions and label formatting before shipment to avoid costly port-of-entry delays.

Direct Marking Requirements

Direct marking refers to placing a permanent UDI directly on the device itself, not just on its label or packaging. Under 21 CFR 801.45, direct marking is required for devices that are intended to be used more than once and intended to be reprocessed before each use.

The direct mark must be permanent and readable throughout the entire useful life of the device, including after the maximum number of validated reprocessing cycles. Common methods include laser etching, chemical etching, dot peen marking, and permanent ink printing with a protective coating.

Direct Mark Content Requirements

The direct mark must include both the DI and applicable PI elements. However, for devices where only the DI can practicably be placed on the device, the FDA permits the DI alone on the direct mark provided the full UDI (DI + PI) appears on the device label and packaging. The AIDC form (barcode) is preferred but not always feasible for small instruments. When AIDC is not possible, the human-readable plain-text form must be permanently affixed.

Reprocessing Validation

Manufacturers must validate that the direct mark remains machine-readable after the maximum number of reprocessing cycles specified in the device's instructions for use. This validation should account for the cleaning agents, sterilization methods (steam, ethylene oxide, hydrogen peroxide plasma), and temperatures specified in the reprocessing instructions. Testing protocols should be documented and available for FDA inspection.

UDI Exceptions and Exemptions

While the UDI system applies broadly to all medical devices, the FDA has established several categories of devices that are exempt from UDI labeling requirements or eligible for alternative compliance approaches. These exemptions are defined in 21 CFR 801.30, 801.35, and 801.128. Labelers should carefully review these provisions to determine whether any of their devices qualify, as misapplying an exemption can result in enforcement action.

Exempt Device Categories

• Custom devices manufactured per an individual physician's order under 21 CFR 812.3(b), provided they are not generally available in finished form
• Investigational devices used in clinical trials under an approved IDE per 21 CFR Part 812
• National security devices used exclusively by the Department of Defense or intelligence agencies
• Devices manufactured and used within a single healthcare facility that are not commercially distributed
• Class I devices not individually packaged and sold in bulk configurations (e.g., boxes of tongue depressors)
• Devices sold exclusively for export under Section 801(e) of the FD&C Act

Requesting an Alternative or Exception

Labelers can request a UDI exception or alternative from FDA by submitting a written request to CDRH (Center for Devices and Radiological Health). The request must describe the specific device(s), explain why the labeler cannot comply with standard UDI requirements, and propose an alternative approach that achieves the goals of UDI—namely, traceability, adverse event identification, and recall facilitation. The FDA evaluates requests on a case-by-case basis and may grant full or partial exceptions.

An exemption request does not automatically suspend the compliance deadline. Labelers must continue to comply with existing UDI requirements while the FDA reviews the exception request, unless the FDA grants an interim exception in writing.

Common UDI Compliance Mistakes

Based on FDA warning letters, Form 483 observations, and enforcement actions issued since UDI requirements took effect, the following are the most frequently cited UDI compliance failures. Understanding these common pitfalls can help labelers proactively address gaps in their UDI programs before an FDA inspection or import review.

Each of these violations can trigger FDA enforcement ranging from untitled letters and warning letters to import detention and device seizure. Repeat or systemic violations may result in consent decrees or injunctions. The FDA has increased UDI enforcement activity since all device classes became subject to UDI requirements in 2022, and UDI-related observations have appeared with growing frequency in Form 483 inspection reports.

How Assurentry Validates UDI Data

Assurentry provides automated UDI data validation as part of our medical device registration and listing service. When you register a device through our platform, we validate UDI compliance at multiple checkpoints.

Validation Checks

You can also use our standalone Device UDI/GUDID Validator tool to check individual UDI strings, verify barcode format compliance, and preview how your data will appear in GUDID.

End-to-End Device Compliance

UDI validation is one component of a broader device compliance workflow. When you use Assurentry for medical device registration, our platform also handles establishment registration (21 CFR Part 807), device listing, annual registration fee tracking, and US Agent designation for foreign establishments. This ensures that your UDI data, device listing records, and establishment registration are all consistent and current with the FDA.

Related Services

Frequently Asked Questions