Articles Technical Documentation

Updated May 31, 2023

How to Get a UDI (Unique Device Identifier) For MDR Compliance

Sören Hornof

When to get your UDI?

The UDI (Unique Device Identification) is mandatory for medical devices according to the MDR as of now. However, there are different grace periods depending on the classification:

(MDR Art. 123 para. 3f)

(IVDR Art. 113 para. 3e)

Where to get an UDI?

You can get UDIs here:

The companies do not issue UDIs per se, but they do issue their own standardized numbers and codes, which then translate to the UDI requirements. So don’t despair when searching for the button where to buy the UDI. There is none. Instead, you will find buttons to buy e.g. GTINs (GS1) or PPNs (IFA).

Which provider to choose?

It depends on your plans and your budget. If you’re planning to sell your device in many different markets, e.g. in the EU and the USA, it makes sense to go with GS1. You can reuse the GS1 numbers as your FDA-UDIs.

GS1 standards are acknowledged by most of the countries (incl. USA, EU, India, China, Japan) whereas for example IFA standards are only accepted in the EU. For HIBCC and ICCBBA it would make sense to check whether those standards are accepted in your target markets.

Pricing-wise, GS1 is rather expensive. You will need to buy GS1 Complete (smalles package is 230€) and they charge an annual fee of 150€ (if you’re a small company). With IFA, you pay only 50€ per year and every UDI-DI costs 3€. So that’s much cheaper.

In this article, I’ll explain how to get your UDIs from both GS1 and IFA.

Which UDI to get?

It would be too simple if you could just order one number for your device, wouldn’t it? So here you go:

At first, you need a Basic UDI-DI.
Then, you need the UDI-DI.
And then you need a UDI-PI, but you cannot buy this one. You need to come up with this yourself.

You only need one Basic UDI-DI per device, but the UDI-DI changes with every significant update, so it makes sense to buy several of them.

The confusion is virtually pre-programmed, as the regulators were once again not particularly creative when it came to inventing the terminology. Just try to avoid mixing up Basic UDI-DI and UDI-DI.

How do the crazy codes translate to UDIs?

I’ll only look at GS1 and IFA here. For HIBCC and ICCBBA, I won’t list how their codes translate to the EU requirements because their websites are either hardcore vibing vintage or they were literally built in 1998. I couldn’t find any helpful information there. Don’t use them!

UDI-PI AI no equivalent

How to get my UDI from GS1?

If you’ve decided to go with GS1, at first, you need to order GS1 Complete. Then, within 2 working days, you’ll get access do your GCP (GS1 Company Prefix) and your GLN (Global Location Number). You need them later to generate your UDIs.


From GS1, you can use the GMN <(Global Model Number) as Basic UDI-DI.

Generating the GMN (Basic UDI-DI):

GMN Calculator

The calculation that has been done is reflected in the “check pair”, which is the red “X8” in our example. You can enter the X8 in the text box above and “validate” it. I’m not sure why you’d ever want to do that.


A new UDI-DI is required whenever there is a change that could lead to misidentification of the device and/or ambiguity in its traceability; in particular, any change of one of the following UDI database data elements shall require a new UDI-DI:

A new UDI-DI shall be required whenever there is a modification that changes:

The UDI-DI therefore changes for significant modifications to the device.

In GS1 this number is the GTIN (Global Trade Item Number). It should appear in EUDAMED and on the product label.

Working with GS1 Germany, the GTIN is composed of the Basisnummer, the Produktreferenz (an internal numbering of the product variant in question) and a check digit, which is automatically calculated. The Basisnummer consists of the first digits of your GLN (Global Location Number). You can set a GLN in the GLN Manager.

In other countries, e.g. GS1 US, the GTIN is composed of the GCP (Global Company Prefix), a numbering of the product variant and a check digit. You can find your GCP in you GCP certificate or in the GEPIR database.

To set a new GTIN (UDI-DI), navigate to the GTIN Manager. If you’re not in Germany, it might have a different name. GS1 UK calls it NumberBank for example.

There, you can enter the details of your new product variant:

GTIN Calculator


For the UDI-PI you can use the GS1 Application Identifier (AI). It does not have to be generated. Instead, you just use the gs1-predefined-identifiers.

Combined, the UDI-PI would look like this:


The UDI-PI represents the device’s serial number, lot number, software identification, and date of manufacture or expiration, or both.

You are free to choose which information to provide in the UDI-PI. For software it makes sense to use the software version number. This is usually sufficient information. You may not want to include the third digit patch number and change your labeling design for every patch release, but again: this is up to you.

The MDR recommends: If there is only a manufacturing date on the label, this shall be used as the UDI-PI, which makes perfect sense in case of bug fixes etc.

Minor software revisions are generally associated with bug fixes, usability enhancements that are not for safety purposes, security patches or operating efficiency.

Minor software revisions shall be identified by a manufacturer-specific form of identification.

The UDI (combined UDI-DI + UDI-PI) of the device should:

Automatic identification and data capture (“AIDC”)

AIDC is a technology used to automatically capture data. AIDC technologies include bar codes, smart cards, biometrics and RFID. There is a requirement to also provide machine-readable labels in the MDR. However, this does not apply to standalone software products:

MDR Annex VI part C, 6.5.4 (d) only the human readable portion of the UDI shall be required in electronic displays of the software. The marking of UDI using AIDC shall not be required in the electronic displays, such as ‘about’ menu, splash screen etc.;

Getting your UDI from IFA

Hallo, you are in Germany now. IFA is a German institution that usually provides the identification numbers for medicines sold in German pharmacies. It is not completely digital and you might have to send contracts via email to them. Sometimes you will be confronted with German language although you’re on the English version of their website.

You’ll get your PPN quite quickly.

The Basic UDI-DI (BUDI)

Here you go, BUDI. Navigate to the BUDI Generator.

The CIN you should have gotten from IFA via E-Mail after sending them the contract and forms.

The Device Group Code is entirely up to you. You can put anything that will identify the “Device Group” in your company. It can consist of capital letters, numbers, or a period (.). So, your Device Group Code could be MYSOFTWARE. Or it could be AWESOMEWARE2.0. But it doesn’t really make sense to put the version number of your software here. If the version number increases, your UDI-DI will change, but here you’re generating the Basic UDI-DI and that one will stay the same, no matter the version of your software. So I would recommend to just put the name of your software here, without the version number.


The IFA sends you the PPN via E-Mail. Here’s the structure of a PPN:

Structure of a PPN

So, a PPN consists of three parts, the PRA code (always 11 for IFA), the PZN, and the Check Character. Your PPN is your UDI-DI.


You need to order a new PPN with Auftragstabelle A whenever you make a significant update to your product.


The UDI-PI can be determined by you. It’s usually the Software Version number or the Release Date.

The “label” of your software (usually the About page) should contain the UDI-DI and the UDI-PI. The Basic UDI-DI is not necessary on the label.

Why all this?

The UDI is intended to serve several purposes: Products should be easier to identify, traceability should be given, especially with regard to post-market surveillance data, and illegally marketed products should be easier to detect. The fact that a number is useful in the assignment to incident reports and that a grouping of medical devices makes sense is immediately obvious. However, why we need a Basic UDI-DI and a UDI-DI remains a big mystery, especially for software products. Also, the validity of the numbers is not necessarily immediately understandable. With the corresponding publicly available calculators, one can calculate one’s Basic UDI-DI oneself. Validation would only make sense if you could not perform the calculation yourself beforehand. In addition, medical devices are still grouped according to UMDN or EMDN. This could also have been made a bit simpler (getting rid of yet another grouping/classification system).

Helpful Resources

On a slighty different note: You want to get your medical software certified under MDR but don't know where to start? No worries! That's why we built the Wizard. It's a self-guided video course which helps you create your documentation yourself. No prior knowledge required. You should check it out.

Or, if you're looking for the most awesome (in our opinion) eQMS software to manage your documentation, look no further. We've built Formwork, and it even has a free version!

If you're looking for human help, did you know that we also provide some limited consulting? It's limited because we are not many people. We guide startups from start to finish in their medical device compliance.

Congratulations! You read this far.

Get notified when we post something new.

Sign up for our free newsletter.

Sören Hornof

Hi! I am a Pharmacist with great enthusiasm for technology and innovation. Health has always been my major passion and I strongly believe that medical devices will change the world of care. Therefore, I am very happy to be able to work with progressive startups and contribute to this development.

Digital Health Jobs No Cookie For You Privacy Policy Imprint
No QMS on this planet will save you from creating crappy software.