Visit Website →
← Back to blog

UDI Labeling Requirements: What FDA Expects on Your Labels

November 12, 2026
UDI Labeling Requirements: What FDA Expects on Your Labels

If you market a medical device in the United States, FDA requires a unique device identifier (UDI) on the label and on every package level, in both plain text and machine-readable form. Higher-risk and reusable devices also need a UDI marked on the device itself. The device identifier portion must then be submitted to FDA's GUDID database. This guide walks through each requirement in the order you meet it in practice.

QA-Report
Connect Inspection Reports With Production
QA-Report brings inspection reporting and production tracking together for manufacturers managing quality across parts, batches, and operations.
Visit

TL;DR

  • A UDI has two parts: a fixed device identifier (DI) and a variable production identifier (PI) such as lot, serial number or expiration date.
  • Labels and packages need the UDI in easily readable plain text and in automatic identification and data capture (AIDC) form, usually a barcode. Shipping containers are excluded.
  • Reusable devices that are reprocessed before each use must carry a permanent UDI marking on the device, unless a defined exception applies.
  • GUDID holds the DI and its descriptive data only. You need a DUNS number to open an account, and you must update records when data changes.
  • Keep records of every UDI and its version or model for 3 years after you stop marketing it.

Table of Contents

What a UDI is and what goes into it

Per FDA's UDI Basics page and 21 CFR 801.3, a UDI is a numeric or alphanumeric code made of two segments.

  • Device identifier (DI): mandatory and fixed. It identifies the labeler and the specific version or model of the device.
  • Production identifier (PI): conditional and variable. It carries one or more of the lot or batch number, serial number, expiration date, manufacturing date, or the distinct identification code for an HCT/P regulated as a device.

The word conditional matters. Under 21 CFR 801.40(a), whenever your label shows a lot or batch number, serial number, manufacturing date, expiration date or HCT/P code, the UDI must include a PI segment conveying that information. If your label shows none of them, the UDI is the DI alone.

Dates have a fixed format. FDA states that dates on device labels and packages must use YYYY-MM-DD.

The DI comes from an FDA-accredited issuing agency, and you, the labeler, assign it. A new DI is required when a device becomes a new version or model, or when a new package configuration is created. According to FDA's Small Entity Compliance Guide, a discontinued DI may not be reassigned to a different device, though it can be reused if the same version or model returns.

Which devices and packages need a UDI

Under 21 CFR Part 801 Subpart B, every device label and every device package must bear a UDI. Shipping containers do not need one. Class I devices do not need a PI.

The regulation lists exceptions. The main ones:

  • Class I devices exempt from the part 820 quality system requirements.
  • Devices used solely for nonclinical research, teaching or chemical analysis.
  • Custom devices and investigational devices.
  • Veterinary devices not intended for human diagnosis, treatment or prevention.
  • Export devices.
  • Certain single-use devices packaged together for storage until use, as long as they are not implantable and the package itself carries a UDI.
  • Devices inside a combination-product or convenience-kit container whose label bears a UDI.
  • Strategic National Stockpile devices granted an exception, and specified performance-standard exceptions.
  • Finished devices manufactured and labeled before the compliance date, for 3 years.

Two details save labelers a lot of rework.

First, 21 CFR 801.40(d) says a class I device that carries a Universal Product Code on its label and packages is deemed to meet the subpart B requirements. The UPC then serves as the UDI.

Second, in vitro diagnostic products must meet both the UDI label rules and the labeling rules in 21 CFR 809.10, according to the Small Entity Compliance Guide. The same guide notes that a device exempt from UDI can still follow the rules voluntarily, and voluntary label compliance does not require GUDID submission.

Compliance dates by device class

The phase-in is complete. FDA's compliance dates page lists the following, and the enforcement discretion policies for non-sterile Class III, Class II and implantable or life-supporting devices are no longer in effect.

Device groupLabel and package dateDirect marking date
Class III and PHS Act licensed devicesSeptember 24, 2014September 24, 2016 (reusable, reprocessed)
Implantable, life-supporting, life-sustainingSeptember 24, 2015Not separately listed
Class IISeptember 24, 2016September 24, 2018 (reusable, reprocessed)
Class I and unclassifiedSeptember 24, 2018September 24, 2020 (reusable, reprocessed)

For a device you are launching today, the practical reading is simple: assume the UDI is required from the first commercial label unless one of the listed exceptions clearly applies.

Where the UDI must appear

The UDI goes on the device label and on all packaging levels intended for commercial distribution. That includes the individual unit box, an inner carton and a case that a hospital might scan at receiving. Only shipping containers are exempt.

UDI requirements across packaging levels

Direct marking on the device

Under 21 CFR 801.45(a), a device that must bear a UDI on its label must also carry a permanent marking of the UDI on the device itself if it is intended to be used more than once and reprocessed before each use. Think surgical instruments that go through sterilization cycles. The direct-marked UDI may match the label UDI or be a different one that distinguishes the unpackaged device from its package.

The direct marking requirement does not apply when, per 801.45(d):

  1. Any type of direct marking would interfere with the device's safety or effectiveness.
  2. Direct marking is not technologically feasible.
  3. The device is a single-use device that undergoes additional processing and manufacturing for another single use.
  4. The device was already marked under paragraph (a).

If you rely on an exception, document the basis in your design and development files, as required by 801.45 and 820.10(c). An auditor will ask where that rationale lives.

For directly marked devices, 801.45(c) allows the UDI to be provided in either or both forms, or through any alternative technology that provides the UDI on demand.

Stand-alone software

Software regulated as a device has no physical label. According to the Small Entity Compliance Guide, it must show its UDI as plain text when the software starts, through a menu command such as About, or both. If it is not distributed in packaged form, the version number must be part of the PI.

Human-readable and machine-readable formats

FDA's Form and Content guidance restates the 801.40(a) rule: the UDI must appear in two forms on the label and on device packages.

  • Easily readable plain text, so a person can read and key in the UDI.
  • AIDC technology, which a barcode scanner or other automatic capture tool can read.

FDA recommends presenting the AIDC form as one segment. It may be split into several segments in near proximity. If the AIDC technology is not visually evident, the label or package must disclose that it is there.

Choosing a barcode symbology

The regulation does not name a single barcode. Your issuing agency's standard drives the choice. Under the GS1 system, the GS1 US implementation guideline points out a practical difference: GS1 DataMatrix needs imaging-based scanners, while GS1-128 linear barcodes can be read by imaging scanners or traditional linear scanners.

That difference can decide a launch. Some healthcare trading partners still use linear scanners and may not read a DataMatrix. The same guideline advises supply chain partners to talk before you switch, so the right scanners are in place on both ends.

One more production tip from that guideline: many production systems prefer a consistent serial number length instead of letting it vary between one and 20 characters. A fixed length fits package artwork constraints and simplifies quality assurance checks.

Choosing a barcode symbology

A label verification routine

Before a label design is released to production, check these items against the master record:

  1. The DI matches the version or model in your records.
  2. Every PI element printed on the label is also encoded in the barcode.
  3. Dates use YYYY-MM-DD in plain text.
  4. Plain text and barcode agree character for character.
  5. The barcode scans with the equipment your customers use.
  6. Every package level carries its own correct UDI.

This is also where traceability pays off. If lot numbers and serial numbers are assigned consistently on the shop floor, the PI printed on the label is the PI recorded in the device history. Our guides on serial number tracking and batch traceability cover how to keep those identifiers consistent from route card to finished lot.

GUDID data submission

Labeling and database submission are separate duties. Under 21 CFR 830.320(b), submission is electronic, in a format FDA can process, review and archive, unless you hold a waiver.

What GUDID holds

FDA explains that GUDID contains only the DI, which is the key to the device information. It does not include the PI. Your lot numbers and serial numbers stay on the label and in your own records.

Setting up an account

According to the GUDID User Manual (December 2024), you must first create a GUDID Organization account using a DUNS number. The organization DUNS number is the primary key for the account and represents the highest corporate level of the labeler, either the headquarters or the parent DUNS number. GUDID pulls the company name and address from the D&B DUNS database, so manage company information there.

What you submit for each DI

Per 21 CFR 830.310, the labeler contact provides the labeler name, a telephone number or email address and the issuing agency used. For each version or model, you submit:

  • The DI portion of the UDI and the brand or trade name.
  • The version or model number.
  • Sterile and natural rubber latex statements, where applicable.
  • MRI safety information.
  • Size with unit of measure, if offered in more than one size.
  • The type of production identifiers on the label.
  • The premarket submission number or exemption statement, and the FDA listing number.
  • The GMDN term or code.
  • The total number of individual devices in the package.

Timing and updates

Per 21 CFR 830.330, submit the information no later than the date the label must bear a UDI. When information changes, submit an update no later than the date a device is first labeled with the changed information. If the changed data does not appear on the label, the update is due within 10 business days.

The GUDID manual also describes a grace period after you publish a DI record. During it you can edit all data element values except the publish date. After it ends, the record is released to the public on AccessGUDID and OpenFDA, and edits to the data elements that trigger a new DI are restricted. Review each record carefully before you publish.

Our perspective: treat UDI as a traceability problem

We see UDI mistakes start long before the label printer. A wrong lot number on a barcode is rarely a printing error. It is a record that never matched the product.

The DI is the easy part: assigned once per version or model and filed in GUDID. The PI is where quality teams get hurt, because it depends on lot, serial and date data created across receiving, machining, inspection and release. If those records live in separate spreadsheets, the label is only as reliable as the weakest copy.

That is why we built QA-Report as one platform: inspection reports linked to ballooned drawings, batch and serial tracking, route cards and a document vault in the same place. When the identifier on the part, the inspection result and the production record come from one source, label verification becomes a check against a single record, not a hunt.

Our advice for teams preparing for an audit: write down which record is the master for each PI element, lock the label template to it, and keep the version-to-DI table next to your device history. A broken link in that chain is easy to find in a design review and expensive to find in an inspection.

Michael Chen

Keeping labels and records compliant over time

UDI work does not end at launch. Build these habits into your quality system.

  • Keep a DI register. 21 CFR 830.360 requires you to retain records of all UDIs used and the version or model tied to each DI, and to submit them on FDA's request. Retention runs for 3 years from the date you stop marketing that version or model.
  • Trigger a DI review on every change. A new version, model or package configuration means a new DI, so connect your change control process to the register.
  • Update GUDID on a schedule. Assign an owner and check records whenever labeling or product data changes, keeping the 10 business day rule in mind.
  • Tie the label to the device history. Our device history record guide shows how lot and serial data support the PI you print.
  • Control electronic records. If you keep label and inspection data digitally, see how 21 CFR Part 11 clauses map to inspection evidence.

Where QA-Report fits

QA-Report is a cloud inspection and quality management platform for manufacturers in regulated industries, including medical devices. It supports first article and dimensional inspection reports, batch and serial tracking, a document vault and role-based access, so the lot and serial data behind your PI stays tied to inspection results. See our MES software for machine shops for route cards and batch tracking.

You can start on the Free plan at $0 per month, move to Basic at $49.99 per month or PRO at $149.99 per month, or ask about On-Premise and Enterprise options on the pricing page.

QA-Report

FAQ

Does every medical device need a UDI?

Nearly all do, but not all. Under 21 CFR Part 801 Subpart B, exceptions include class I devices exempt from part 820, research-only devices, custom and investigational devices, export devices and certain veterinary devices. Class I devices with a UPC on the label and packages are deemed compliant.

Does the UDI have to be on the device itself?

Only for devices intended to be used more than once and reprocessed before each use. Even then, exceptions apply when marking would affect safety or effectiveness, is not technologically feasible, or the device was already marked. Document any exception in your design and development files.

Is the production identifier submitted to GUDID?

No. FDA states that GUDID contains only the device identifier and its descriptive data. The PI, such as lot, serial number or expiration date, appears on the label and in your own records.

What do I need to open a GUDID account?

A DUNS number. The GUDID User Manual explains that the organization DUNS number is the primary key for the account, and company name and address are pulled from the D&B database. You then request the account from FDA before submitting DI records.

How long must I keep UDI records?

Under 21 CFR 830.360, keep records of all UDIs used and the version or model each identifies for 3 years from the date you cease marketing that version or model. FDA can request them.

Sources