UDI: what does it mean for your product and your QMS?

Unique Device Identification (UDI) has been introduced in the European medical device field in 2013. The EU has strongly contributed to the preparation of the IMDRF guidance regarding unique device identification for medical devices.

The European Commission also issued its recommendation regarding a UDI system for medical devices in April 2013. This set the basis for further developments regarding this topic.

As expected, UDI is one of the important "new" topics that have been introduced in formal European legislation by the EU 2017/745 Medical Device Regulation (MDR) and EU 2017/746 In Vitro Diagnostics Regulation (IVDR).

The aim of the UDI system is to facilitate traceability of medical devices and to improve the post-market related activities. It is applied to all medical devices except custom-made and investigational devices.

UDI: structure and content

A UDI consists of two parts: the Device Identifier (UDI-DI) and the Production Identifier (UDI-PI).

UDI = UDI-DI + UDI-PI

UDI-DI

The UDI-DI is a unique numerical or alphanumerical code that is specific to the model of a specific medical device. It is a fixed code and represents the manufacturer's specific product and packaging configuration of a device.

There are 4 recognized UDI issuing agencies for European UDI:

• GS1 

• HIBC 

• ICCBBA 

• IFA

It is up to the manufacturer to contact either of them and make arrangements to obtain the proper UDI-DI codes for its devices. Also note that even though Europe talks about UDI-DI and UDI-PI, the UDI issuing agencies might have their own nomenclature which can be different, but still cover the requirements.

UDI-PI

The UDI-PI is a numerical or alphanumerical code that represents the unit of device production. This includes:

• lot or batch

• serial number

• expiry date

• manufacturing date

• version (in case of software)

• distinct identification code (applicable for medical products of human origin)

UDI Carrier

The UDI in general has to appear in a human readable format (HRI) and a machine readable format (Automated Identification for Data Capture (AIDC)). The AIDC is "any technology that conveys the unique device identifier or the device identifier of a device in a form that can be entered into an electronic patient record or another computer system via an automated process". Examples of AIDC are bar codes, smart cards, biometrics and RFID.

These shall appear on the device itself or on the label and all higher levels of device packaging. Shipping containers are exempted from the requirement of having a UDI.

In case it's not possible to have both the HRI and the AIDC together, the AIDC format is required on the label, except for devices that are intended to be used outside health care facilities. There the HRI format is mandatory if only one of the two formats can be put on the label.

Further specific requirements on how the UDI information should appear can be found in Annex VI part C of the MDR.

UDI Timelines

According to the UDI - FAQ document issued by the European Commission, the timelines look like this:

UDI in your QMS

Next to requirements to put UDI on the device/label/packaging and to enter the required info in the EUDAMED database, there is as well a requirement to integrate UDI into the QMS of the manufacturer.

Article 10 of the MDR states the following requirements for the Quality Management System:

The quality management system shall address at least the following aspects:
(a) a strategy for regulatory compliance, including compliance with conformity assessment procedures and procedures for management of modifications to the devices covered by the system;
(b) identification of applicable general safety and performance requirements and exploration of options to address those requirements;
(c) responsibility of the management;
(d) resource management, including selection and control of suppliers and sub-contractors;
(e) risk management as set out in in Section 3 of Annex I;
(f) clinical evaluation in accordance with Article 61 and Annex XIV, including PMCF;
(g) product realisation, including planning, design, development, production and service provision;
(h) verification of the UDI assignments made in accordance with Article 27(3) to all relevant devices and ensuring consistency and validity of information provided in accordance with Article 29;
(i) setting-up, implementation and maintenance of a post-market surveillance system, in accordance with Article 83;
(j) handling communication with competent authorities, notified bodies, other economic operators, customers and/or other stakeholders;
(k) processes for reporting of serious incidents and field safety corrective actions in the context of vigilance;
(l) management of corrective and preventive actions and verification of their effectiveness;
(m) processes for monitoring and measurement of output, data analysis and product improvement

Whereas Article 27 describes several requirements for UDI, 27(3) states that you need to make sure UDI is correctly applied to the device, Article 29 describes the registration requirements.

So this means that you need to integrate these activities of creating, applying and registering the UDI for your devices into your procedures, similar to procedures you might have regarding affixing the CE mark.

Recently, the Medical Device Coordination Group (MDCG) issued a guidance document to assist organizations with this integration of the UDI concept in their QMS. 

From this one line in Article 10 of the MDR, there is impact on several different parts of the QMS.

UDI in Design and Development

It is required to assign a UDI-DI before bringing a product to the market or presenting your documentation to a Notified Body => This should be described in the relevant processes about creating the proper documentation

Some changes in the product, might trigger a new UDI-DI, others not => This should be included in your change control process

UDI-DI and UDI-PI are part of the label => This should be described in your labeling process

The level of serialization, which is linked to the UDI-PI, is done based on the risk assessment => This should be included in the risk management process

UDI in Documentation retention

You are required to keep a list of all UDI-DIs and UDI-PIs. This is part of your technical documentation, which means you need to keep this for a period of at least 10 years after the last device covered by the Declaration of Conformity has been placed on the market (15 years for implantable devices).

UDI in Production

As the UDI needs to appear on the device itself or its label, it's important to consider and plan this beforehand to make sure this is possible from a technical point of view.

This label/printing process has to be validated.

If you're using any software to implement the UDI system (e.g. for labeling or for automatically uploading UDI information to EUDAMED), you need to make sure this software is validated.

UDI in Adverse event reporting

As UDI is a reference number, it is part of the communication to authorities or in case of Field Safety Corrective Actions. This means that this requirement should be integrated in the relevant processes related to this topic.

UDI in Purchasing

Parts or components are not covered by UDI requirements unless they are put on the market as devices on their own. If so, registration of UDI into your own systems is important for traceability purposes.

UDI in Certificates, Declarations and Documentation

The UDI information becomes one of the central references used to identify devices. Therefore, it has to appear on many different official documents.

UDI-DI:

• Vigilance and PMS reports

• Declaration of Conformity

• Technical documentation

• Summary of Safety and Clinical Performance

• Certificate of free sale

• CE certificates

UDI-DI + UDI-PI:

• labels or device itself + higher levels of packaging

• technical documentation

Logically, all processes that describe how to create the above documents, should include UDI information as part of it as well.

UDI in EUDAMED

UDI-DI information needs to be uploaded in EUDAMED. This information needs to be updated at all times. This should be described in the appropriate processes.

UDI in Quality records

It's clear that UDI will appear in several processes or procedures, but not only in there. The output of such processes, the records should as well contain the appropriate UDI information

UDI in Training and Audits

Implementing a UDI system is something that affects many different parts of the QMS. As required by ISO 13485, people that are involved in these processes need to be trained to make sure the UDI system is implemented and maintained correctly. Internal audits will also cover this implementation and training.

Conclusion

UDI is not only important to identify a device and maintain traceability in a more efficient way. It is a whole system that carefully needs to be implemented by manufacturers of medical devices. It is important to not only look at it from a technical point of view, but as well from a QMS point of view. Don't wait to update your processes and make sure everyone involved is trained.

If you would would like to see how MatrixQMS can be used to document your processes and trainings or how MatrixALM can help you document your product requirements, don't hesitate to contact us!