Here’s our guide on how to get your MDR UDI! But first off, if you’re actually looking for an overview over the whole topic, check out our overview article here first.
When to get your UDI?
The UDI (Unique Device Identification) is mandatory for medical devices according to the MDR as of now. However, there are different grace periods depending on the classification:
- MD Class III: May 26, 2021
- MD Class II: May 26, 2023
- MD Class I: May 26, 2025
(MDR Art. 123 para. 3f)
- IVD Class D: May 26, 2023
- IVD Class B & C: May 26, 2025
- IVD Class A: May 26, 2027
(IVDR Art. 113 para. 3e)
Where to get an MDR UDI?
You can get UDIs here:
The companies do not issue UDIs per se, but they do issue their own standardized numbers and codes, which then translate to the UDI requirements. So don’t despair when searching for the button where to buy the UDI. There is none. Instead, you will find buttons to buy e.g. GTINs (GS1) or PPNs (IFA).
Which MDR UDI Provider To Choose?
It depends on your plans and your budget. If you’re planning to sell your device in many different markets, e.g. in the EU and the USA, it makes sense to go with GS1. You can reuse the GS1 numbers as your FDA-UDIs.
GS1 standards are acknowledged by most of the countries (incl. USA, EU, India, China, Japan) whereas for example IFA standards are only accepted in the EU. For HIBCC and ICCBBA it would make sense to check whether those standards are accepted in your target markets.
Pricing-wise, GS1 is rather expensive. You will need to buy GS1 Complete (smalles package is 230€) and they charge an annual fee of 150€ (if you’re a small company). With IFA, you pay only 50€ per year and every UDI-DI costs 3€. So that’s much cheaper.
In this article, I’ll explain how to get your UDIs from both GS1 and IFA.
Which MDR UDI to get?
It would be too simple if you could just order one number for your device, wouldn’t it? So here you go:
At first, you need a Basic UDI-DI.
Then, you need the UDI-DI.
And then you need a UDI-PI, but you cannot buy this one. You need to come up with this yourself.
You only need one Basic UDI-DI per device, but the UDI-DI changes with every significant update, so it makes sense to buy several of them.
The confusion is virtually pre-programmed, as the regulators were once again not particularly creative when it came to inventing the terminology. Just try to avoid mixing up Basic UDI-DI and UDI-DI.
How Do The Crazy Codes Translate To UDIs?
I’ll only look at GS1 and IFA here. For HIBCC and ICCBBA, I won’t list how their codes translate to the EU requirements because their websites are either hardcore vibing vintage or they were literally built in 1998. I couldn’t find any helpful information there. Don’t use them!
| GS1 | IFA | |
|---|---|---|
| Basic UDI-DI | GMN | BUDI |
| UDI-DI | GTIN | PPN |
| UDI-PI | AI | no equivalent |
How to get my MDR UDI from GS1?
If you’ve decided to go with GS1, at first, you need to order GS1 Complete. Then, within 2 working days, you’ll get access do your GCP (GS1 Company Prefix) and your GLN (Global Location Number). You need them later to generate your UDIs.
BASIC UDI-DI
From GS1, you can use the GMN <(Global Model Number) as Basic UDI-DI.
Generating the GMN (Basic UDI-DI):
- Go to the GS1 GMN Generator.
- Take your GCP (GS1 Company Prefix), which is the “Basic number” in your GS1 Dashboard.
- Provide an arbitrary name for your product class as “Internal number, or model reference”. Watch out: It’s case-sensitive.
- Hit “Calculate”.
The calculation that has been done is reflected in the “check pair”, which is the red “X8” in our example. You can enter the X8 in the text box above and “validate” it. I’m not sure why you’d ever want to do that.
UDI-DI
A new UDI-DI is required whenever there is a change that could lead to misidentification of the device and/or ambiguity in its traceability; in particular, any change of one of the following UDI database data elements shall require a new UDI-DI:
- (a) name or trade name,
- (b) device version or model,
- (c) labelled as single use,
- (d) packaged sterile,
- (e) need for sterilization before use,
- (f) quantity of devices provided in a package,
- (g) critical warnings or contra-indications: e.g. containing latex or DEHP.
A new UDI-DI shall be required whenever there is a modification that changes:
- (a) the original performance;
- (b) the safety or the intended use of the software;
- (c) interpretation of data.
- Such modifications include new or modified algorithms, database structures, operating platform, architecture or new user interfaces or new channels for interoperability.
The UDI-DI therefore changes for significant modifications to the device.
In GS1 this number is the GTIN (Global Trade Item Number). It should appear in EUDAMED and on the product label.
Working with GS1 Germany, the GTIN is composed of the Basisnummer, the Produktreferenz (an internal numbering of the product variant in question) and a check digit, which is automatically calculated. The Basisnummer consists of the first digits of your GLN (Global Location Number). You can set a GLN in the GLN Manager.
In other countries, e.g. GS1 US, the GTIN is composed of the GCP (Global Company Prefix), a numbering of the product variant and a check digit. You can find your GCP in you GCP certificate or in the GEPIR database.
To set a new GTIN (UDI-DI), navigate to the GTIN Manager. If you’re not in Germany, it might have a different name. GS1 UK calls it NumberBank for example.
There, you can enter the details of your new product variant:
UDI-PI
For the UDI-PI you can use the GS1 Application Identifier (AI). It does not have to be generated. Instead, you just use the gs1-predefined-identifiers.
- Expiration date AI(17) – e.g. 141120
- Batch – lot AI(10) – e.g. 1234AB
- Serial number AI(21) – e.g. 12345XYZ
- Manufacture date AI(11) – e.g. 250717
Combined, the UDI-PI would look like this:
(17)141120(10)1234AB(21)12345XYZ(11)250717
The UDI-PI represents the device’s serial number, lot number, software identification, and date of manufacture or expiration, or both.
You are free to choose which information to provide in the UDI-PI. For software it makes sense to use the software version number. This is usually sufficient information. You may not want to include the third digit patch number and change your labeling design for every patch release, but again: this is up to you.
The MDR recommends: If there is only a manufacturing date on the label, this shall be used as the UDI-PI, which makes perfect sense in case of bug fixes etc.
Minor software revisions are generally associated with bug fixes, usability enhancements that are not for safety purposes, security patches or operating efficiency.
Minor software revisions shall be identified by a manufacturer-specific form of identification.
The UDI (combined UDI-DI + UDI-PI) of the device should:
- appear on the labels or on the device itself, as applicable, and all higher levels14 of packaging,
- be referenced in the technical documentation.
Automatic identification and data capture (“AIDC”)
AIDC is a technology used to automatically capture data. AIDC technologies include bar codes, smart cards, biometrics and RFID. There is a requirement to also provide machine-readable labels in the MDR. However, this does not apply to standalone software products:
MDR Annex VI part C, 6.5.4 (d) only the human readable portion of the UDI shall be required in electronic displays of the software. The marking of UDI using AIDC shall not be required in the electronic displays, such as ‘about’ menu, splash screen etc.;
Getting your MDR UDI from IFA
Hallo, you are in Germany now. IFA is a German institution that usually provides the identification numbers for medicines sold in German pharmacies. It is not completely digital and you might have to send contracts via email to them. Sometimes you will be confronted with German language although you’re on the English version of their website.
- Step 1: Navigate to the New Customers page.
- Step 2: Note the Customer Contract. Even though it has space for a signature at the end, you don’t need to sign it.
- Step 3: Print(!), sign and scan the Onboarding Application for Conclusion of the IFA Supplier Contract. This contract is entirely in German.
- Step 4: Download and enter your address data to IFA – Auftragstabelle D1 (entirely in German)
- Step 5: Download Auftragstabelle A, it’s in German, and make sure to put a “ja” in column J (PPN als UDI-DI verwenden). It’s weird though that in this document where you’re requesting to get a UDI-DI, you are asked to put your device’s UDI-DI. Hm.
- Step 6: Send the documents + a Trade Register Excerpt or Business Registration document to [email protected]
You’ll get your PPN quite quickly.
The Basic UDI-DI (BUDI)
Here you go, BUDI. Navigate to the BUDI Generator.
The CIN you should have gotten from IFA via E-Mail after sending them the contract and forms.
The Device Group Code is entirely up to you. You can put anything that will identify the “Device Group” in your company. It can consist of capital letters, numbers, or a period (.). So, your Device Group Code could be MYSOFTWARE. Or it could be AWESOMEWARE2.0. But it doesn’t really make sense to put the version number of your software here. If the version number increases, your UDI-DI will change, but here you’re generating the Basic UDI-DI and that one will stay the same, no matter the version of your software. So I would recommend to just put the name of your software here, without the version number.
The UDI-DI (PPN)
The IFA sends you the PPN via E-Mail. Here’s the structure of a PPN:
So, a PPN consists of three parts, the PRA code (always 11 for IFA), the PZN, and the Check Character. Your PPN is your UDI-DI.
PPN = PRA + PZN + CC = UDI-DI
You need to order a new PPN with Auftragstabelle A whenever you make a significant update to your product.
The UDI-PI
The UDI-PI can be determined by you. It’s usually the Software Version number or the Release Date.
The “label” of your software (usually the About page) should contain the UDI-DI and the UDI-PI. The Basic UDI-DI is not necessary on the label.
Why All This?
The UDI is intended to serve several purposes: Products should be easier to identify, traceability should be given, especially with regard to post-market surveillance data, and illegally marketed products should be easier to detect. The fact that a number is useful in the assignment to incident reports and that a grouping of medical devices makes sense is immediately obvious. However, why we need a Basic UDI-DI and a UDI-DI remains a big mystery, especially for software products. Also, the validity of the numbers is not necessarily immediately understandable. With the corresponding publicly available calculators, one can calculate one’s Basic UDI-DI oneself. Validation would only make sense if you could not perform the calculation yourself beforehand. In addition, medical devices are still grouped according to UMDN or EMDN. This could also have been made a bit simpler (getting rid of yet another grouping/classification system).
