Serialisation and UDI for medical parts

What a UDI is

A unique device identifier is a code that identifies a medical device through distribution and use. It is made of two parts. The device identifier, or DI, identifies the model and the manufacturer. The production identifier, or PI, identifies the unit or batch: a lot number, a serial number, a manufacturing date or an expiry date.

The identifier is carried on the label in a machine-readable form, usually a barcode or a data matrix, and sometimes in human-readable text. The same identifier is submitted to a regulator's database, so a hospital, a distributor or a regulator can look it up.

The purpose is traceability. If a device is subject to a field safety notice, the UDI should let the supply chain find the affected units quickly. That only works if the label, the database and the manufacturer's records agree.

Device identifier and production identifier

The DI is stable for a device version. It is assigned by the manufacturer or by an issuing agency, and it is the key that links the label to the database record. The PI changes with the production unit. A lot number, a serial number, a date of manufacture and an expiry date are all production identifiers.

Not every device carries every PI. A single-use device with a shelf life may carry a lot and an expiry date. An implantable device may carry a serial number. A reusable instrument may carry a lot and a manufacturing date. The regulatory framework and the device risk decide the combination.

The DI and PI must be printed together in a way that a scanner can read. A common failure is a label where the DI is correct but the PI is printed from a different system, so the two do not match the production record.

The anatomy of a compliant label

A UDI label carries the identifier, the machine-readable carrier, the human-readable interpretation and the surrounding device information. Each element has a job, and each one can fail on its own.

The carrier must be readable after the sterilisation, transport and storage conditions the device will see. The human-readable text must match the encoded data. The label substrate and adhesive must survive the same conditions without lifting or fading.

The label also needs a clear link to the device name, the manufacturer and any storage or handling symbols. A scanner may read the code, but a clinician still needs to identify the product without a database lookup.

The database is part of the label

A UDI is not complete when the label is printed. The device identifier must be submitted to the relevant regulator database, such as the US GUDID or the EU EUDAMED system, with the device attributes the framework requires. The entry must match the label and the technical file.

Database records change when the device changes. A new model, a new package configuration, a new sterilisation method or a change of manufacturer can require a new DI. A change that does not affect the identifier still needs a review, because the attributes in the database may no longer be accurate.

The practical risk is drift. The label is updated, the database is not, or the database is updated and the old label stock is still in the stores. A change control step that covers both, with a check before the first shipment, prevents most of this.

Assign a named owner for the database entry. In many companies the label sits with production, the technical file with regulatory and the database with a regional affiliate. Without an owner, each group can believe the other has made the update.

Serialisation on the production line

At production, the identifier must be generated from controlled data, printed once and verified before the unit moves on. A print-and-verify step should read the code back and compare it with the intended record, not just confirm that something was printed.

The batch record should capture the DI, the PI values, the printer or laser settings, the verification result and any reprint or void. A reprinted label needs its own record, because two labels for one unit is a traceability risk.

Where the device is sterilised or packed by a third party, the identifier and the associated records must follow the unit. The contract should say who prints, who verifies, who holds the label stock and who reports a non-conforming label.

Change control triggers

Treat any change to the device, the packaging, the label or the manufacturing site as a UDI review trigger. The review should ask whether the DI changes, whether the database entry changes and whether existing label stock can still be used.

A new DI is not a paperwork event. It affects the label artwork, the printer data, the database submission, the distributor catalogue and the customer's own records. Plan the cutover so that old and new identifiers do not mix in the same carton unless the customer has agreed it.

Keep the old identifier in the record after the change. A field safety notice or a complaint may refer to a device shipped under the previous DI, and the traceability chain has to survive the transition.

What a component supplier should provide

A component supplier rarely owns the device UDI. It supplies a part, a sub-assembly or a sterilised pack, and the device maker holds the identifier. The supplier's job is to provide the records the device maker needs and to protect any identifier that has been applied on the maker's behalf.

That usually means lot traceability, a certificate of conformity, a record of any label or marking applied, and a change notification before a process or material change. If the supplier prints a UDI on the maker's behalf, the contract should define the data source, the verification method and the response to a print failure.

The quality agreement should also cover retention. A device with a long service life may need records kept for years after the last shipment. A supplier that archives records for a shorter period can leave the device maker unable to answer a traceability request.

Where the supplier holds label stock on the maker's behalf, treat it as controlled material. Count it in, count it out and destroy obsolete stock under a record. Leftover labels from an old revision are one of the simplest ways to put the wrong identifier on a device.

Errors that show up in audits

The most common finding is a label that reads correctly but does not match the batch record. The second is a database entry that was never updated after a packaging change. The third is a print verification step that checks the printer, not the code.

Other findings include human-readable text that differs from the encoded data, a data carrier that cannot be read after sterilisation, and a reprint process with no record. None of these are cosmetic. Each one breaks the link between the device and its history.

The fix is usually procedural rather than technical. Define the data source, verify the printed code, record the verification and review the identifier whenever the device changes. A simple control, applied every time, is what an audit is looking for.