From The Editor | October 2, 2013

FDA's New UDI Rule: What Device Makers Need To Know

By Jim Pomager, Executive Editor

Sample UDI Label

At long last, the FDA has issued its final rule for a national unique device identification (UDI) system. The long-awaited rule, requisitioned just over six years ago under the Food and Drug Administration Amendments Act of 2007, was held up for the last three months pending approval by the White House Office of Management and Budget (OMB).

Now that the wait is finally over, it's time for medical device makers to get to work on understanding the official UDI rule and its key requirements (good and bad), how it will affect your operations, and what you need to do to prepare… if you haven't started already. After all, the initial compliance deadlines are less than a year away.

UDI Basics
In his blog post announcing the UDI final rule, Jeffrey Shuren, director of the FDA's Center for Devices and Radiological Health (CDRH), summarized the purpose of the new system well, saying it will "provide a consistent and standard way to identify medical devices throughout their distribution and use." More specifically, the goal of the UDI system is to facilitate the development of a National Postmarket Surveillance System that would: make adverse event reporting more accurate and specific, speed identification of product problems, improve recall targeting, protecting the supply chain (preventing counterfeiting and diversion), and ultimately improve patient safety.

As its name implies, the UDI system will require most medical devices to carry a unique device identifier (or UDI) on their label and packaging, and in some cases on the devices themselves (known as direct part marking). This code will consist of two main components. The first is a device identifier, which indicates the product's version/model number and its manufacturer or labeler. The second is a production identifier, denoting the lot/batch number, manufacture date, expiration date, and other product-specific information. The UDI must be both human (numeric) and machine (bar code) readable, and device makers must obtain codes from FDA-accredited agencies. For a fictitious example of a UDI label, click on the thumbnail image above.

The rule will also establish an FDA-administered database of all UDI-labeled devices. The Global Unique Device Identification Database (GUDID, pronounced "good ID") will contain basic identifying elements for each device, and most of its contents will be accessible by the general public. (The GUDID will not store any patient information.) Coinciding with the release of the UDI final rule, the FDA issued draft guidance for the GUDID, giving labelers an overview of the database and encouraging comments and suggestions.

When You Need To Be In Compliance
The FDA will phase in the UDI system over the next seven years, starting with the highest risk devices. Below is an overview of the compliance deadlines. (Note: GUDID data for each class of device is due by the same date as the labeling deadline.)

1 Year (September 24, 2014): Class III devices must carry a UDI on their labels and packaging.

2 Years (September 24, 2015): Implantable, life-saving, and life-sustaining Class I and II devices must carry a UDI on their labels and packaging.

3 Years (September 24, 2016): Class II devices must carry a UDI on their labels and packaging; Class III devices that require direct part marking must carry a permanent UDI on the device itself.

5 Years (September 24, 2018): Class I devices (and unclassified devices, as required) must carry a UDI on their labels and packaging; Class II devices that require direct part marking must carry a permanent UDI on the device itself.

7 Years (September 24, 2020): Class I devices (and unclassified devices, as required) that require direct part marking must carry a permanent UDI on the device itself.

Some devices will be exempt from the rule, including devices not intended for clinical use (e.g. research, education, etc.), custom devices, and investigational devices. Consult the UDI final rule to determine whether your device is subject to the requirements.

The Good News About The Final Rule
Before you start hyperventilating over the implications of the UDI rule on your job or business, you should know that it could have been worse. The FDA took great pains to make the final rule palatable to the medical device industry, understanding that it will be a major undertaking for manufacturers. In fact, there are many aspects of the final UDI rule that are more lenient to manufacturers than the proposed UDI rule the FDA published last year.

"I would characterize the final UDI rule as reasonable — the FDA certainly could have been more restrictive with it," Judy Bunch, senior regulatory affairs consultant at QA Consulting, told me. "However, the whole point of the UDI rule is to simplify access to postmarket information, so to that end they wanted to make it as easy as possible for manufacturers to comply."

Here are some areas Bunch pointed out where the FDA relaxed its proposed requirements in the final rule:

  • Class I, II, and III single-use devices within a multipack will not need to be individually labeled — only the package will require a UDI  — unless they are implantable devices. (The proposed rule required individual labeling for Class II and III devices in multipacks.)
  • Speaking of implantable devices, they will not require direct part marking — only the label/package requires a UDI. (The proposed rule required direct part marking for implantables.)
  • The deadline for shifting to the new date format (YYYY-MM-DD) on labels is the same as the corresponding UDI deadline for a device. (In the proposed rule, all labels were to switch to the new format by one year from the publication of the final rule.)
  • When a change is made to a device, a new UDI is required when the manufacturer considers it a new model or version. (The proposed rule defined the types of changes that constitute a new model.)
  • Devices already in commercial distribution are exempted from compliance. (The proposed rule was unclear on this point.)
  • Manufacturers have three years from a device's compliance date to deplete existing inventories, e.g. in a warehouse or consignment. (The proposed rule did not address this matter.)
  • Constituent parts of a combination product or convenience kit do not need to bear a UDI, as long as the combination product or kit does. (Under the proposed rule, certain parts of combination products and convenient kits were to carry UDIs, in addition to having a UDI on the combination product and kit.)

One other change that should please Class III device makers: The FDA may grant a one-year extension to Class III devices, to devices licensed under the Public Health Service Act, or in situations where doing so is "in the best interest of the public health."

The Not-So-Good News About The Final Rule
Not all changes to the proposed UDI rule were favorable to device makers (though the list is much shorter). For instance, in a statement on the UDI final rule, AdvaMed's Janet Trunzo questioned the need for including the day of the month in expiration dates, "when expiration testing generally does not include the day of the month." And QA Consulting's Bunch pointed out that the proposed rule only required direct part marking for reusable devices that must be sterilized before each use, but the final rule broadens the scope to include reusable devices that are "reprocessed" before each use.

What You Should Do To Prepare
Whether you work for a large, multinational corporation or five-person startup, implementing the necessary changes for UDI compliance will be a major undertaking, and one that will touch almost every aspect of your organization — from design and validation, to purchasing and distribution, to manufacturing… you name it. "I hope people will consider the system-wide requirements that this is going to involve," Bunch said. "It's not simply sticking a number on a label."

So where should you begin? Bunch believes that the first thing you need to do is develop a quality plan that addresses the whos, whats, and whens of UDI implementation. Some steps she says will be necessary include:

  • Choose an accredited agency (GS1, HIBCC, or ICCBBBA).
  • Incorporate the new date format and UDI into device design using a design control process, including design requirements, design outputs, verification and validation, and design history files.
  • Consider UDI in risk management activities.
  • Define the format of your UDI, the printing processes and equipment, and the affixing process.
  • Define a process for when and how to obtain a new UDI.
  • Define your process for gathering, validating, and maintaining the GUDID master dataset.
  • Incorporate the UDI into your procedures for complaints, medical device reporting (MDR), corrections and removals, recalls, and service reports — validate as necessary.
  • Develop training for UDI implementation.
  • Update your recordkeeping requirements for records required by the UDI and by new processes.
  • Update supplier and distributor agreements.
  • Include UDI in internal audit plans.

Perhaps most important, though, is to commit a dedicated regulatory resource to understanding the requirements for UDI. You might find that person within your organization, or you might outsource the capacity. But either way, implementing UDI in your quality system is a complicated enough — and important enough — venture to warrant the investment.

Additional Resources:


Judy Bunch can be reached at info@qaconsultinginc.com.