The EU has regulated medical devices for decades. In the early 1990s, the Directive on Active Implantable Medical Devices (90/385/EEC)1 and the Medical Device Directive (93/42/EEC)2 were introduced, followed by the In Vitro Diagnostic Medical Devices Directive (98/79/EC)3 in 1998. Building on those directives, the EU instituted in 2017 the Medical Device Regulation (MDR 2017/745)4 and the In Vitro Diagnostic Medical Device Regulation (IVDR 2017/746).5

A regulation is a binding legislative act applicable in all EU member states without the need of transposition into national law, whereas a directive sets out goals that all EU countries must achieve. Therefore, it is often faster to put a regulation in place, as countries do not have to come up with their own laws on how to achieve a common goal. It can also avoid discrepancies in application.6 The general application dates of the two regulations are 26 May 2021 for medical devices and 26 May 2022 for in vitro diagnostic medical devices; however, different timelines apply for certain specific provisions.

This article focuses on the UDI part of the new regulations. It does not cover all MDR and IVDR requirements for entering medical device data in the European database on medical devices (EUDAMED).

What’s New in MDR and IVDR?

To advance the safety of medical devices, MDR and IVDR introduce a variety of new or reinforced requirements, ranging from stricter ex ante (fore-cast-based) control for devices via a new premarket scrutiny mechanism to more postmarket surveillance requirements for manufacturers. Compared to the directives, the new regulations have an extended scope (i.e., they include certain aesthetic devices and certain products specifically intended for the cleaning, disinfection, or sterilization of devices). They also provide more transparency and better coordination mechanisms between EU countries as well as a new risk classification system.

Among the major changes that impact medical device production, assembling, and packaging, as well as data management related to medical devices, are new traceability requirements based on UDI and rules for reporting medical device information to EUDAMED. UDI is intended to help track and trace medical devices throughout the entire product life cycle, increase transparency at all levels, and combat counterfeiting.

What is EUDAMED?

EUDAMED is the EU database developed to implement MDR and IVDR. This database will be much larger than the one that currently exists under the medical devices directives, and it is expected to improve transparency and coordination of information regarding medical devices available on the EU market.

The system will be multipurpose. It will function as a registration system, a collaborative tool, and a notification and dissemination system that is open to the public.

EUDAMED is structured around six interconnected modules and a public website (Figure 1).7 The modules are:

• Actors registration
• UDI/devices registration
• Notified bodies and certificates
• Clinical investigations and performance studies
• Vigilance and postmarket surveillance (related to the device quality when on the market and after)
• Market surveillance (related to the device market)

UDI System Components

According to MDR and IVDR, device identification applies to multiple levels of devices and packaging, but does not include logistics units. Part C of Annex VI of MDR4 and IVDR5 defines the different components of the UDI system, which relies on three identification elements:

• Basic UDI-DI, which identifies a group of products
• UDI-DI, which identifies a specific device
• UDI-PI, which identifies the production set of the device

The vocabulary seems a bit confusing, but it is intended to cover the complexity of the medical devices sector.

Basic UDI-DI

The primary EU identifier of a device model is the Basic UDI-DI; this is the device identifier at the level of the device unit of use.4^, 5 (Note that Basic UDI-DI does not exist in the US regulation.)

It is important to note that “unit of use” is not the unit of sale (the unit used by the healthcare professional or customer/patient). Rather, Basic UDI-DI is an identifier at the model level, covering a family of devices. According to European Commission guidance,8 “Any Basic UDI-DI shall identify the devices (group) covered by that Basic UDI-DI in a unique manner,” meaning it covers all devices in a family/group whether they are single or multi-packaged, differently colored, and so on. Therefore, the Basic UDI-DI is independent/separate from the packaging and labeling of devices and does not appear on any trade item.

The Basic UDI-DI will be used as the main key in the EUDAMED medical devices database and on relevant documentation related to the device group, such as certificates, the declaration of conformity, technical documentation, and summary of safety and clinical performance. It connects devices with same intended purpose, risk class, and essential design and manufacturing characteristics.

The Basic UDI-DI is assigned by an issuing entity chosen by the manufacturer. UDI-issuing entities selected by the European Commission under Article 27.2 of the MDR4 and Article 24.2 of the IVDR5 are:

• GS1 (GS1 AISBL Association International Sans But Lucratif)
• HIBCC (Health Industry Business Communications Council)
• ICCBBA (International Council for Commonality in Blood Banking Automation)
• IFA GmbH (Informationsstelle für Arzneispezialitäten)

UDI-DI

Each UDI-DI is unique for the type of packaging of a device. It is a numeric or alphanumeric code (depending on the issuing agency’s specifications) and is not case sensitive. This is the static part of the UDI code.

Under Annex V,4^, 5 a new UDI-DI is required each time there is a change to a name/trade name, version/model, use, sterilization requirements, quantity in packaging, or indications/warnings. The new UDI-DI is still linked to the same Basic UDI-DI. For example, a single-device package and a bulk pack have different UDI-DIs but the same Basic UDI-DI. Similarly, if the same device is packaged with different languages on the packaging or is manufactured with various cosmetic differences, each variation has its own UDI-DI but all variations share a Basic UDI-DI.

Like the Basic UDI-DI, the UDI-DI is generated by the manufacturer in accordance with the allocation rules defined by the EU issuing entity chosen by the manufacturer.

UDI-PI

Under MDR and IVDR Annex VI part C,4^, 5 the UDI-PI is a numeric or alphanumeric code, not case sensitive, that identifies the unit of device production. The UDI-PI must be applied to all grouping (or packaging) levels for production traceability purposes. This is the dynamic part of the UDI code.

There are different types of UDI-PIs, and a medical devices manufacturer is, depending on the risk class their devices fall under, free to choose which type of UDI-PI to use:

• Serial number
• Lot number
• Software identification (for software classified as medical device)
• Manufacturing or expiry date or both types of date

Note that under US regulations of medical devices, if the expiry date and manufacturing date are available, both dates can be included in the UDI-PI.9 According to EU regulations, if the expiry date and manufacturing date are available on the label, only the expiry date must be included in the UDI-PI; if only one date is available, this date must be included.

In EUDAMED, the manufacturer must indicate the UDI-PI type they have chosen together with other reportable UDI data. Specific UDI-PIs are not part of EUDAMED reportable data, except when adverse events or counterfeiting are reported in the Vigilance EUDAMED module.

Visualizing UDI Data Flows and Responsibilities

Among the tools produced by the ISPE France Affiliate’s UDI Medical Device Work Group for UDI stakeholders are a graphical presentation of the flow of UDI components and a RACI responsibility assignment matrix, where R stands for responsible (in charge of the flow), A stands for accountable (controlling the flow), C stands for consulted (part of the flow), and I stands for informed (aware of the result, but not part of the action).

In these tools, we take into account both legal manufacturers and system and procedure pack producers (SPPPs). The legal manufacturer is the legal entity with final approval authority on design changes and assumes quality systems responsibility for the development, design, and manufacture of the product.

When referring to SPPPs, procedure pack means a combination of products packaged together and placed on the market with the purpose of being used for a specific medical purpose, and system means a combination of products, either packaged together or not, which are intended to be interconnected or combined to achieve a specific medical purpose.

The following sections use the work group’s tools to help answer important questions about UDIs.

Who Is in Charge of Basic UDI-DI?

The Basic UDI-DI will be used for communications between stakeholders, such as technical documentation provided to the notified body in a conformity assessment application, the EU declaration of conformity, the product certificate, the certificate of free sale, the summary of safety and clinical performance (SSCP) for medical devices, the summary of safety and performance (SSP) for IVDs, vigilance and postmarket surveillance reports, and clinical investigation forms for postmarket studies. As noted previously, the Basic UDI-DI shall never appear on the packaging labeling or on the product itself.

The Basic UDI-DI is mainly the responsibility of the legal manufacturer (Figure 2). They are accountable and responsible for the code attribution and must communicate the code to the notified body and EUDAMED. This responsibility applies whether or not the legal manufacturer is in the EU.

The legal manufacturer is free to assign the Basic UDI-DI to a group of items, using the Basic-UDI-DI code structure it obtains from an issuing entity of their choice.

SPPPs are natural or legal persons that combine medical devices with other medical devices or with other products that are not medical devices. To place a combination on the market as either a system or a procedure pack, the SPPP must act as legal manufacturers. They are responsible for ensuring that the medical devices in the combination bear a Conformité Européenne (CE) mark, the combination is intended to achieve a specific medical purpose, and the devices and combination are compliant with all applicable legislation.

When the legal manufacturer is based outside of the EU, they must provide the Basic UDI-DI code to their authorized representative in the EU, which will verify the code in EUDAMED.

Who Is in Charge of UDI-DI?

The static part of the UDI, the UDI-DI, will be used for communication among the stakeholders and appears on the packaging labeling and/or on the product itself.

The legal manufacturer is responsible for the UDI-DI code attribution and the code registration in EUDAMED (module: UDI/Devices registration).

The legal manufacturer will assign one unique UDI-DI to a model of device (identifying form, fit, and function). UDI-DI is specific to a legal manufacturer (or brand owner in the GS1 standard) and a device. UDI-DI will be used throughout the supply chain.

The legal manufacturer obtains the code structure for the UDI-DI from an issuing entity of their choice. See Figure 3 for the UDI-DI RACI chart and data flow for legal manufacturers in the EU.

The responsibilities for legal manufacturers outside the EU are the same as those for EU-based manufacturers. In addition, manufacturers outside of the EU need to communicate the UDI-DI code to their authorized representative (see Figure 4). The importer must verify that UDI-DI has been assigned by the legal manufacturer and that the device is registered in EUDAMED.

UDI-DI will be used by actors all along the supply chain, including the importer.

Who Can See UDI-DI Information?

To increase transparency for end users and patients, large amounts of information registered in EUDAMED, including the Basic UDI-DI and UDI-DI of de-vices, will be publicly accessible.

Transparency is such an important element of the new regulations that the European Commission intends to develop two interfaces for each module of EUDAMED, one for the actors (member states, operators, and notified bodies) and one accessible to the public. It is anticipated that the public mod-ule of EUDAMED will be available at ec.europa.eu/eudamed.

Who Is in Charge of UDI-PI?

The dynamic part of the UDI, the UDI-PI, will be used for communication among the stakeholders and appear on the packaging labeling and/or on the product itself.

The UDI-PI is key data for EUDAMED vigilance and market surveillance modules. Individual UDI-PIs are not registered in EUDAMED except when ad-verse events or counterfeiting are reported.

The UDI-PI is mainly the responsibility of the legal manufacturer, beginning with the manufacturing subcontractor for the code attribution.

The manufacturer will assign one unique UDI-PI to each unit of device production.

The UDI-PI is specific to a legal manufacturer (or brand owner in GS1 standard) and a unit of device production. The manufacturer can choose whether to use lot number, serial number, software version identification, manufacturing date, and/or expiry date as the UDI-PI. The UDI-PI will be used for tracking and tracing throughout the supply chain.

The legal manufacturer will obtain the structure to generate the UDI-PI from an issuing entity of their choice. Third-party logistics will use the data included in the UDI-PI for the logistics management of the device. See Figure 5 for the UDI-PI RACI chart and data flow for EU-based manufacturers.

If the legal manufacturer is not located within the EU, they have the same responsibilities as an EU manufacturer. In addition, manufacturers outside of the EU must communicate the UDI-PI to the importer (Figure 6). The UDI-PI code will be used throughout the supply chain, including by the importer.

Do Manufacturers Have to Serialize All Devices?

Some confusion has arisen about EU regulations regarding the serial numbers of medical devices.

As stated previously, the manufacturer chooses how they control production of their devices. According to MDR Annex VI,4 part C, point 6, serialization only applies to “specific devices”:

6.1.1. Implantable devices shall, at their lowest level of packaging (“unit packs”), be identified, or marked using AIDC [automatic identification and data capture (a technology to read barcodes)], with a UDI (UDI-DI + UDI-PI).

6.1.2. The UDI-PI shall have at least the following characteristics: (a) the serial number for active implantable devices, (b) the serial number or lot number for other implantable devices.

This means that the MDR requires serialization only for active implantable devices. The serial numbers for active implantable devices need to appear on the label or device itself.

Implantable devices fall into the highest risk class for medical devices, and faulty implantable devices can have severe consequences for the health and safety (or even the life) of the patient. Therefore, active implantable devices require the highest level of traceability, which can only be achieved with the help of unit-level identification, and at least batch-level identification is required for not-active implantable devices. As previously noted, the batch- or unit-level identification information does not need to be reported to EUDAMED, but the manufacturer must keep track of it and state the unit- or batch-level identifier on the device label.

Like in the EU serialization requirements for pharmaceutical products (Falsified Medicines Directive10, the unique identification of an active implantable medical device is based on the link between the device’s identifier and its serial number (e.g., in the GS1 framework, the link between the global trade item number [GTIN] and the serial number). However, unlike the management of prescription drugs in Europe, there is no need to decommission the implantable medical device’s serial number when the device is used, although hospitals must register the serial number in an internal repository.

Note that for reusable implantable medical devices, MDR requires direct marking on the device itself (direct part marking). Local authorities can re-quire identification at the unit of use level for reusable devices.

Also note that the IVDR Annex VI rules for UDIs of reusable devices that are part of kits and require cleaning, disinfection, sterilization, or refurbish-ing between uses5 differ from the UDI rules for reusable implantable devices in Annex VI of the MDR.4 IVDR states:

6.1.1. The UDI of such devices shall be placed on the device and shall be readable after each procedure to make the device ready for the next use;

6.1.2. The UDI-PI characteristics such as the lot or serial number shall be defined by the manufacturer.

Conclusion

MDR and IVDR are complex regulations with complex implementation challenges. Stakeholders need to create multidisciplinary teams including commercial, manufacturing, quality assurance, data management, regulatory affairs, logistics, information technology, and other stakeholders to thoroughly implement the requirements of the new regulations. Device identification is a global development, and stakeholders cannot ignore the regulatory changes.

UDI will bring a common language for the whole supply chain, improving the efficiency of the transactions as well as improving customer/supplier relationships. The new EU regulations will increase transparency for consumers and healthcare professionals alike and, most important, will improve the security of medical devices for end users/patients.

This article presents only a part of the work being done by the ISPE France Affiliate’s UDI MD Work Group. We have also created, for example, a UDI glossary and an analysis of the management of incident reporting. The work group is available to share further details and exchange ideas about this article.