Medical Devices

Medical Device Coordination Group Document MDCG 2021-19

MDCG 2021-19

Guidance note integration of the UDI

within an organisation’s quality
management system

July 2021

This document has been endorsed by the Medical Device Coordination Group
(MDCG) established by Article 103 of Regulation (EU) 2017/745. The MDCG is
composed of representatives of all Member States and it is chaired by a
representative of the European Commission.

The document is not a European Commission document and it cannot be regarded

as reflecting the official position of the European Commission. Any views expressed
in this document are not legally binding and only the Court of Justice of the European
Union can give binding interpretations of Union law.

Page 1 of 10
Medical Devices
Medical Device Coordination Group Document MDCG 2021-19

Introduction

The Unique Device Identification (UDI) System1 should allow the identification of medical
devices, facilitate appropriate traceability of medical devices, enhance the effectiveness of
the post-market safety-related activities for devices, improve incident reporting, enhance
targeting field safety corrective actions, lead to better surveillance, reduce medical errors,
and help fight against falsified devices. As such the UDI system is intended to be
incorporated into the life-cycle of the device.

In accordance with Article 27 of Regulation (EU) 2017/745 (MDR) and Article 24 of the
Regulation (EU) 2017/746 (IVDR), the Unique Device Identification system as described in
Part C of Annex VI MDR/IVDR , shall allow the identification and facilitate the traceability of
devices, other than custom-made, investigational or performance study devices. The
purpose of this document is to provide guidance on the integration of the UDI and the
implementation of the UDI obligations as part of an organisation’s Quality Management
System (QMS) as required by Article 10(9)(h) MDR and 10(8)(h) IVDR. Economic operators
concerned include manufacturers, in the case of Article 16(1) MDR/IVDR a distributor,
importer or any other natural or legal person that assumes the obligations incumbent on
manufacturers, and in case of Article 22(4) MDR the natural or legal persons that assumes
the obligations incumbent on manufacturers.

This document should be read in conjunction with other available MDCG UDI Guidance
documents.2

Integration of UDI in the Quality Management System

Amongst the applicable MDR/IVDR provisions to be included in the QMS of the manufacturer
is Article 10(9)(h)/Article 10(8)(h) ‘verification of the UDI assignments made in accordance
with Article 27(3)/24(3) to all relevant devices and ensuring consistency and validity of
information provided in accordance with Article 29/26’. When implementing the requirements
of the MDR/IVDR related to the QMS, manufacturers should therefore consider how the UDI
System and obligations can also be integrated.

UDI (composed of the UDI-DI and UDI-PI) and Basic UDI-DI assignment, and management
of the UDI-related information can impact many other lifecycle QMS processes.3 The
manufacturer could establish a UDI implementation plan, and use appropriate
implementation tools as described in its QMS to allow correct assessment/decisions to be
made and the proper documented evidence to be created, to ensure compliance with the
Regulations regarding the UDI-system. Elements of such a plan may include:

1
See recital (41) Regulation (EU) 2017/745. For definitions, please refer to relevant articles of the
MDR/IVDR and Annex VI.
2
In particular MDCG 2018-3 Rev. 1, MDCG 2018-4, MDCG 2018-5, MDCG 2018-6 and MDCG 2018-
7. All MDCG Guidance document can be found on the European Commission Medical devices website
dedicated section. Please also see for additional information the IMDRF Guide ‘Unique Device
Identification system (UDI system) Application Guide - DOCX’.
3
These aspects should be taken into particular consideration when setting the appropriate level of
management of UDI implementation

Page 2 of 10
Medical Devices
Medical Device Coordination Group Document MDCG 2021-19

 analysis of expectations and needs of different stakeholders such as economic

operators, healthcare institutions/professionals, patients/users, insurance providers.
 analysis of the relevant issuing entities’ standards;
 choice of a designated issuing entity4;
 definition of internal responsibilities for the implementation and subsequent
management of the project plan;
 management and, if necessary, updates of the project plan implementation;
 description of methods and use cases, by which the proper running and continuous
compliance of UDI-related QMS processes can be verified.
The manufacturer may also assess the applicable UDI responsibilities when determining and
documenting external roles (e.g. third party suppliers, authorised representative, importers,
distributors, systems and procedure packs producers).

The following sections should be considered when integrating the UDI obligations in the
different areas of the Quality Management System.

Design and Development

According to Article 27 (3) MDR and Article 24 (3) IVDR, before placing a device, other than
a custom-made, investigational or performance study device, on the Union market, the
manufacturer shall assign to the device and, if applicable, to all higher levels of packaging, a
UDI created in compliance with the rules of the issuing entities designated by the
Commission in accordance with paragraph 2 of the above mentioned Articles.

Moreover, according to Article 29 MDR and 26 IVDR, before placing a device, other than a
custom made device, or a system or procedure pack on the market, the manufacturer or
producer shall assign a Basic UDI-DI. For devices that are subject to a conformity
assessment, the assignment of a Basic UDI-DI shall be done before the manufacturer
applies to a notified body for that assessment.

Manufacturers should consider the objectives and anticipated effects of the UDI system
when designing and developing products5. The manufacturer should assure assignment of
UDI-DIs prior to placing a device on the market or submitting a Technical Documentation to a
notified body for conformity assessment, by using the rules of the issuing entities. In addition,
the UDI-PI should properly replicate the production identifiers per MDR/IVDR Annex VI, Part
C, 3.5 and 6 respectively, which have been assigned to a device label based on risk
management or regulatory requirement. In addition to traceability, the appropriate level of
product serialisation should also be done on the basis of proper risk management,
consideration of regulatory requirements (e.g. active implants require serial numbers6) and
expectations or requirements of other stakeholders/national regulators such as registries7.

4
The issuing entities have been designated on 6 June 2019 in the Commission Implementing
Decision (EU) 2019/939.
5
Example: successful implementation of the UDI system may be facilitated if critical safety
parts/components are identified and the handling in case of field safety corrective actions is
considered in advance. The life-cycle approach to the UDI integration would allow a more effective
root cause analysis, and better traceability of such critical safety parts/components.
6
Annex I, Chapter III, section 23.2, point (s) MDR.
7
For example, national registries for implantable devices.

Page 3 of 10
Medical Devices
Medical Device Coordination Group Document MDCG 2021-19

Procedures used for the assignment of UDI, the change of UDI8 and the corresponding
degree of traceability (grouping of devices under a Basic UDI-DI or definition of their UDI-PI)
should be appropriately documented.

Product documentation and retention

As part of the technical documentation, the manufacturer shall keep up-to-date a list of all
UDIs (UDI-DIs and UDI-PIs) that it has assigned (Article 27(7) MDR, Article 24(7) IVDR).
According to Article 10(8) MDR and Article 10(7) IVDR, manufacturers shall keep the
technical documentation available for the competent authorities for a period of at least 10
years after the last device covered by the EU declaration of conformity has been placed on
the Union market. In the case of implantable devices, the period shall be at least 15 years
after the last device has been placed on the Union market.

Production and process

Manufacturers may consider using the UDI, from the outset of the production phase to
ensure the effective product information management. For example, the UDI-DI may be used
as reference or catalogue number.

The manufacturer should decide for each individual type/model when, where, and how the
UDI carrier should be applied following various timelines per risk class, as required by the
MDR/IVDR.

8
For more information, please see MDCG 2018-1 v4 ‘Guidance on basic UDI-DI and changes to UDI-
DI’

Page 4 of 10
Medical Devices
Medical Device Coordination Group Document MDCG 2021-19

As the UDI carrier may have an impact on manufacturing processes, in case of directly
marked devices, it should be determined in advance if any exemptions in accordance with
Point 4.10, Part C of Annex VI apply, to ensure that the requirements are fulfilled at the time
the device is placed on the Union market. For example, there are exemptions under
MDR/IVDR as regards direct marking, in case it cannot be performed on certain devices 9.
Such exemptions should be documented, preferably in the technical documentation.

In addition, device package levels will need to have the UDI carrier.

Some labelling considerations:

 Manufacturers should ensure that, as part of their quality management system, the
label printing process is verified and validated, and the equipment is used and
maintained in accordance with relevant procedures.
 Changes to validated processes need to be assessed for impact on device labelling.
 The software used in implementing the UDI system (e.g. UDI labelling of devices and
packaging, machine to machine automatic upload of UDI data to EUDAMED) should
remain in a validated state in accordance with relevant procedures.
Serious incidents and field safety corrective actions

According to Article 27(5) of the MDR and Article 24(5) of the IVDR, the UDI shall be used for
reporting serious incidents and field safety corrective actions in accordance with Article 87
MDR and Article 82 IVDR. The organisation’s internal procedures should detail these
requirements.

Purchasing controls

While components/parts of purchased components10 are not subject to UDI obligations

unless they are regulated as medical devices in accordance with Article 23 MDR and Article
20 IVDR, a review of the purchasing procedures should be undertaken based on the
following considerations:

 Manufacturers should investigate existing purchase activities and their controls to

identify materials and equipment which may have an impact on the compliance of the
UDI-system. This may include label material, printer, and scanner.
 In addition, purchase activities need to be investigated to identify parts, materials and
equipment which are placed on the market as a device and for which the organization
assumes the obligations incumbent on manufacturers in cases of Articles 16(1),
17(2), 22(4) or 23(2) MDR.11
 Moreover, purchase of goods which are subject to UDI obligations should be
identified and processed/recorded accordingly.
Documentation and records

9
Please refer to Annex VI Part C, 4.10 MDR/IVDR for further information on direct marking.
10
IVDR/MDR Annex VI Part C 3.6. Each component that is considered to be a device and is
commercially available on its own shall be assigned a separate UDI unless the components are part of
a configurable device that is marked with its own UDI.
11
Article 16(1) MDR & IVDR describes cases in which obligations of manufacturers apply to importers,
distributors and other natural or legal persons.

Page 5 of 10
Medical Devices
Medical Device Coordination Group Document MDCG 2021-19

The Basic UDI-DI of the device should appear on:

 the Vigilance and Post-Market Surveillance Reports (such as MIR and PSUR),
 the EU Declaration of Conformity, (Annex IV MDR/IVDR),
 the technical documentation (Annex II MDR/IVDR),
 the Summary of Safety and Clinical Performance (Article 32(2) MDR, Article 29(2)
IVDR),
 the Certificate of free sale (Article 60 MDR, Article 55 IVDR),
 and certain types of EC Certificate, i.e. EU technical documentation assessment
certificates (Annex IX MDR/IVDR), EU Type-examination certificates (Annex X
MDR/IVDR) and EU product verification certificates (Annex XI MDR/IVDR). The UDI
shall be included on the implant card, in accordance with Article 18 of the MDR 12.
Internal procedures should reference the appearance of the Basic UDI in the
abovementioned cases.
The UDI (UDI-DI + UDI-PI)13 of the device should:

 appear on the labels or on the device itself, as applicable, and all higher levels 14 of
packaging,
 be referenced in the technical documentation.
Whilst the Basic UDI-DI and UDI-DI should be provided to the UDI database in EUDAMED
(Article 28, 29, Annex VI, Part B MDR/Article 25, 26, Annex VI Part B IVDR), the UDI-PI
should be provided to EUDAMED only in case of vigilance issues.15

Enterprise Resource Planning

If the manufacturer uses an Enterprise Resource Planning system to capture the UDI data
(Basic UDI-DI, UDI-DI and UDI-PI), it should maintain validation documentation for linking the
operations printers’ software, collecting UDI metadata and creating the UDI, including the
linear or 2D and Human Readable Indication identifiers, validating M2M connectivity to
EUDAMED, and other steps.

UDI data to be provided to EUDAMED database

According to MDR and IVDR respectively, before a device, other than a custom-made,
investigational or performance study device, is placed on the Union market the manufacturer
should ensure that the information referred to in Part A and Part B of Annex VI MDR/IVDR
relevant to the device in question is correctly submitted and transferred to the UDI database
in EUDAMED16. The manufacturer should keep the information submitted to EUDAMED
updated.

12
Please also refer to MDCG 2019-8 v2, ‘Guidance on Implant cards relating to the application of
Article 18 MDR’
13
For further information and definitions, please see Annex VI Part C MDR/IVDR.
14
Higher levels of packaging do not include shipping containers.
15
Please see Article 27(5) of the MDR and Article 24(5) of the IVD ‘the UDI shall be used for reporting
serious incidents and field safety corrective actions in accordance with Article 87 MDR and Article 82
IVDR’.
16
Please see ‘MDR UDI and device data sets’ and ‘IVDR UDI and device data sets’ for further
clarification on data to be submitted to EUDAMED.

Page 6 of 10
Medical Devices
Medical Device Coordination Group Document MDCG 2021-19

Appendix I - QMS process implementing UDI at the manufacturer’s site

The manufacturer should establish, define, maintain and document the UDI related
processes of the Quality Management system. The following steps could be taken into
account when implementing UDI specific processes into the QMS:

1. Plan for product traceability

Whilst the manufacturer should refine their strategies and activities regarding traceability
considering the provisions of Art. 25 and 27(8) MDR and 22 and 24(8) IVDR, some elements
for consideration may include:
a. legal requirements,
b. internal production process needs that could be impacted by the implementation
of the UDI,
c. facilitation of compliance of other stakeholders (including the different logistic
pathways),
d. liability aspects,
e. patient needs.

2. UDI assignment process

a. Manufacturers should identify systematically devices, parts, components,

systems, procedure packs which require a Basic UDI-DI and UDI-DI assignment.
This should include parts, materials and equipment which are placed on the
market as a device and for which the organization assumes the obligations
incumbent on manufacturers in cases of Articles 16(1), 17(2), 22(4), or 32(2)
MDR. This could involve collaboration with personnel in engineering, Quality and
Supply Chain management, Service and Regulatory Affairs.
b. Procedures should be in place to ensure the uniqueness of the assigned UDI.
c. Training should be provided and documented (internally audited) to ensure that
the UDI assignment is done in accordance with rules provided by the issuing
entities and the legislation.
d. The Manufacturer should review the production control method used with each
device to allow one of the following production identifiers:
 Serial Number
 Lot Number
 Expiration Date
 Manufacturing Date (only required if this is the exclusive PI)
 Software version

3. Placing UDI Carrier and direct marking

a. The manufacturer should define the format, specifications and location of the UDI
Carrier on the label or permanent marking (if and when required on the device) in
compliance with Annex VI Part C of the MDR/IVDR.
b. The manufacturer should implement a procedure for placing the UDI Carrier on
the label and if appropriate to directly mark the device.

Page 7 of 10
Medical Devices
Medical Device Coordination Group Document MDCG 2021-19

c. Procedures to place UDI Carriers on the label and if appropriate directly on the
device, should cover the general requirements as well as those for specific device
types (e.g. implantable, Systems and Procedure packs, configurable devices,
software as medical device).
d. Durability of the UDI marking during normal use of the device and the whole
lifetime of the device should be ensured.

4. UDI linkage to applicable quality records

a. Procedures should be implemented in order to ensure linkage between the UDI of

medical devices and the applicable quality records. The responsible function
should:
i. Ensure link between the UDI and the device manufacturing quality
records.
ii. Ensure link between the UDI in the service records.
iii. Ensure link between the UDI in the Complaint records.
iv. Ensure link between the UDI in the required Post Market reports.
v. Ensure link between the UDI in the trend reporting.
vi. Ensure link between the UDI and the vigilance records.
vii. Ensure link between the UDI and the reports and records of corrections
and removals.
viii. Ensure link between the UDI and the medical device tracking
requirements.

b. Where appropriate, when a new UDI has been assigned to a device, the previous
device UDI should be recorded within the quality records17.

5. UDI information in EUDAMED

Procedures should be implemented and documented:

a. To ensure that UDI/Device data as referred to in Annex VI, Part A, section 2 &
Part B MDR/IVDR are provided to EUDAMED.
b. To ensure that where a change of a device affects the data attributes associated
with a UDI-DI, the corresponding UDI data are updated in EUDAMED.

17
Please note that this requirement is of particular relevance in case of repackaging or relabelling of
already produced and (UDI) labelled devices. In this case the original device UDI should be recorded
within the quality records of the repackaged/relabelled device to support repackaging or relabelling
activities and ensure a link to the original quality record.

Page 8 of 10
Medical Devices
Medical Device Coordination Group Document MDCG 2021-19

Appendix II - Example of a UDI implementation plan

Note: This is meant as illustration. Manufacturers are responsible for how they incorporate
these elements.

1. Read and assess the MDR/IVDR UDI requirements. Identify additional documents such
as, guidance documents from the MDCG. Documents published by the IMDRF may also
be used as input18.
2. Define the roles and responsibilities with respect to legal requirements in your
organisation.
3. Define the responsibilities within your organisation and the interfaces. Make sure that all
internal procedures that are affected by the UDI requirements are identified. Make sure
that all affected departments are involved in the implementation process.
4. Determine the classification of each of devices and accessories (limited to medical
devices in their own right) – this will help establish when the label and packages will need
to be UDI compliant or when direct marking of the reusable device is needed.
5. Develop an accurate stock keeping units (SKUs) list of all such devices and accessories
and their packages.
6. Determine where the device manufacturing quality records are located and who owns
that data.
7. Review current labels and packages to determine where and how UDI will be applied.
8. Determine which type of UDI carrier will be used for the purposes of UDI – UDI carriers
include, inter alia, ID/linear bar code, 2D/Matrix bar code, RFID.
9. Develop appropriate barcode implementation strategies, including barcode verification.
10. Select a designated issuing entity.
11. Quality System - Review current Standard Operating Procedures and systems for the
inclusion of the UDI System. New Standard Operating Procedures may need to be
generated to cover all requirements.

18
Please see, MDCG 2021-10 - The status of Appendixes E-I of IMDRF N48 under the EU regulatory
framework for medical devices.

Page 9 of 10
Medical Devices
Medical Device Coordination Group Document MDCG 2021-19

Auditing the implementation of the UDI system

The Notified Body should ensure that its personnel involved in auditing the UDI
requirements, as defined by the regulations, have the knowledge of these requirements. The
documented assessment procedures should clearly outline the topics regarding the UDI
system that needs to be covered by the auditors.

All applicable requirements of the UDI-system are part of the processes that are audited by
the Notified Body. Those processes include but are not limited to the following aspects:

- selection of an issuing entity for the UDI codes;

- structure of the UDI-DI system (e.g. granularity of the Basic UDI-DI, grouping of UDI-
DI);
- assignment of the UDI-DI codes;
- definition of UDI-PI and applicability to the product types;
- registration process into the UDI Database;
- record keeping procedures;
- issuing the EU Declaration of Conformity with the Basic UDI-DI;
- Change management of the UDI system, including update of the database
- labelling process, including barcode reference code and software validation
- maintenance of printing equipment,
- training of personnel on UDI system,
- processes used in post market surveillance and other monitoring activities.
In order to ensure that the UDI System meets the requirements, it is recommended that the
Notified Body considers the elements listed above when assessing the quality system of the
manufacturer .

Page 10 of 10