What Is Actually in the UDI Barcode on a Medical Device
Unique Device Identification defines three identifiers, and one of the most persistent errors in the field is assuming all three live in the barcode. They do not. Two are encoded in the carrier on the label; the third never appears on a product at all. Getting that boundary right is the difference between a label that survives an audit and one that does not — and there is a registration deadline ten weeks away.
Pick up any regulated medical device sold in the European Union and there will be a barcode on the label — usually a GS1 DataMatrix, sometimes a linear symbol, occasionally both. It carries the device's Unique Device Identifier, and there is a reasonable chance that the person who specified it, the person who printed it and the person who has to defend it in an audit each hold a slightly different idea of what is inside.
The confusion has a single root. The UDI system defines three identifiers with confusingly similar names, and only two of them go in the barcode. The third — the Basic UDI-DI, the one that appears on your Declaration of Conformity and your certificates — is not on the product at all, and was never meant to be.
This matters more than usual right now. EUDAMED became mandatory on 28 May 2026, and devices already on the market before that date have to be registered in its UDI/Device module by 28 November 2026 — about ten weeks from now.
The Short Answer
- UDI = UDI-DI + UDI-PI. Those two, together, are what the barcode encodes.
- The UDI-DI is the fixed part: which device this is. Under GS1 it is a GTIN, carried in application identifier
(01). - The UDI-PI is the variable part: which production unit this is. Lot, serial, expiry, manufacture date — each its own application identifier.
- The Basic UDI-DI is not in the barcode. It is a regulatory grouping key for documentation and EUDAMED. Under GS1 it is a Global Model Number, not a GTIN.
- Both machine-readable and plain-text forms are required — AIDC and HRI, on the same label.
- A new UDI-DI is not optional when certain device attributes change, and the regulation's rules override GS1's own allocation rules.
Three Identifiers, Two of Them on the Label
The cleanest way to hold these apart is by asking what each one identifies — a family, a model, or a thing.
| Identifier | Identifies | Under GS1 | In the barcode? |
|---|---|---|---|
| Basic UDI-DI | A group of devices sharing the same intended purpose, risk class and essential design — a family | Global Model Number (GMN) | No |
| UDI-DI | One specific device model, version and packaging configuration | GTIN | Yes — AI (01) |
| UDI-PI | The individual unit or production run in front of you | AIs for lot, serial, expiry, manufacture date | Yes — one AI per element |
Why the Basic UDI-DI is deliberately absent
It is easy to read its absence as an oversight. It is the opposite: it is doing a different job in a different place.
The Basic UDI-DI is the key that links a device family to its regulatory paperwork — the Declaration of Conformity, certificates, technical documentation, vigilance reporting. It is the identifier a regulator uses to ask "what else is in this family, and what evidence supports it".
A barcode on a box answers a different question: what is this, and which one is it? Nobody scanning a device at a bedside needs the family key, and encoding it would consume symbol capacity to no clinical purpose. So the Basic UDI-DI lives in EUDAMED and in your documentation, and the label carries the two identifiers that describe the object in someone's hand.
The practical test: if you find something that looks like a Basic UDI-DI encoded in a device barcode, that is a finding, not a feature. It usually means a GMN was pasted into a field expecting a GTIN.
What the Carrier Actually Encodes
Under GS1 — by far the most common issuing entity for devices, though HIBCC, ICCBBA and IFA are also designated — the UDI is encoded as a series of application identifiers. Each AI is a short numeric prefix that declares what the following characters mean and, for fixed-length elements, how many of them to read.
| AI | Element | Part of | Format |
|---|---|---|---|
(01) |
GTIN | UDI-DI | 14 digits, fixed |
(11) |
Production date | UDI-PI | 6 digits, YYMMDD |
(17) |
Expiry date | UDI-PI | 6 digits, YYMMDD |
(10) |
Batch or lot number | UDI-PI | Up to 20 characters, variable |
(21) |
Serial number | UDI-PI | Up to 20 characters, variable |
Which production identifiers are required depends on the device. An implant that is tracked individually needs a serial number; a box of sterile consumables needs a lot number and an expiry date. The regulation ties the choice to how the device must be traced, not to preference.
A worked example, read left to right
Here is a typical element string for a sterile, lot-controlled device with an expiry date:
(01)04012345678901(17)271130(10)LOT2026A
(01)— the next fourteen digits are the GTIN. 04012345678901. This is the UDI-DI. Its final digit,1, is a check digit computed from the other thirteen, so a transposition anywhere in the number is arithmetically detectable.(17)— the next six digits are an expiry date in YYMMDD. 271130 is 30 November 2027.(10)— a batch number, variable length, running to the end of the data. LOT2026A.
Read that way, the whole string is self-describing: this model of device, expiring on this date, from this batch. Together those are the UDI.
The separator problem, which is where most decoding bugs live
Notice that the batch number came last. That was not an accident, and it is the single most common source of malformed UDI data.
(01) and (17) are fixed-length: a reader knows to take exactly fourteen and exactly six characters. (10) and (21) are variable-length, so a reader has no way to know where they end. If a variable-length element is followed by anything else, the encoder must insert a group separator — the FNC1 character, transmitted as ASCII 29 — to mark the boundary.
Omit it and the symbol still scans perfectly. It just decodes wrong: the batch number swallows the AI that follows it, and you get a lot number of LOT2026A21000123 and no serial number at all. Nothing anywhere reports an error. The label looks fine, the scanner beeps, and the data is silently corrupt.
This is worth testing rather than assuming, because it is invisible to visual inspection. Paste a decoded string into our UDI barcode decoder and it will split the element string into its application identifiers, separate the UDI-DI from the UDI-PI, and show you where it thinks each field ends — which is exactly the disagreement you are looking for. It also names the issuing agency, so a HIBCC or ICCBBA string is identified rather than forced through GS1 rules. For the full GS1 identifier set beyond the UDI subset, the general GS1 barcode decoder covers logistics, measures and origin as well. The two dates are also worth eyeballing: (11) and (17) are easy to transpose in a template, and a production date in the future is a defect nobody catches downstream.
AIDC and HRI: Both, Always
The UDI must appear on the label in two forms: AIDC, the machine-readable carrier, and HRI, the human-readable interpretation printed in plain text.
The HRI is not decoration and it is not merely a courtesy to the reader. It is the fallback when the symbol is damaged, obscured by a label over-sticker, or simply on a device in a setting with no scanner. A clinician who needs to record what was implanted can read the text.
The failure mode here is a mismatch — HRI showing something subtly different from what the AIDC encodes, usually because the two are generated by different parts of a label template and only one of them was updated. That is a genuine audit finding, and it is trivially detectable: scan the label and compare the decode against the printed line beside it.
The Deadline Ten Weeks Away
EUDAMED — the European database for medical devices — has been voluntary for years. That ended in 2026.
| Date | What applies |
|---|---|
| 28 May 2026 | EUDAMED use becomes mandatory. Economic operators must be registered, and devices newly placed on the market must be registered in the UDI/Device module first. |
| 28 November 2026 | Devices placed on the market before 28 May 2026 must be registered — the twelve-month transitional window for legacy devices closes. |
The label requirements ran ahead of the database on their own staircase, by risk class: implantable and Class III devices first, then Class IIa and IIb, with Class I devices required to carry a UDI carrier on the label from 26 May 2025. Direct marking of reusable devices follows two years behind each of those, which puts reusable Class I devices at 26 May 2027.
Direct marking means the UDI carrier is on the device itself rather than its packaging, and it must survive cleaning, disinfection, sterilisation or refurbishment between patients — readable for the device's whole intended lifetime. That is why laser-etched Data Matrix dominates on surgical instruments: a printed label would not last a single autoclave cycle. The requirement is waived where any form of direct marking would interfere with the device's safety or performance, or where it is not technologically feasible.
If you are marking small stainless instruments, the practical constraint is symbol size against module size, and it is unforgiving — our guide to GS1 DataMatrix covers why that symbology wins on small and direct-marked parts.
When You Must Assign a New UDI-DI
This is where UDI diverges from ordinary trade-item practice, and where teams used to GS1's commercial rules get caught: the MDR and IVDR requirements supersede the GS1 Healthcare GTIN allocation rules. If your GS1 rulebook says you may keep a GTIN and the regulation says you must change it, the regulation governs.
The governing principle sits in Annex VI: a new UDI-DI is required whenever a change could lead to misidentification of the device or ambiguity in its traceability. Specific triggers include a change to any of:
- Name or trade name
- Device version or model
- Whether it is labelled as single-use
- Whether it is packaged sterile
- Whether it needs sterilisation before use
- The quantity of devices provided in a package
- Critical warnings or contra-indications
That sixth one is the trap. Changing a pack from five units to ten is, commercially, a minor line extension. Under UDI it requires a new UDI-DI for the package, because a clinician scanning it must not be able to receive the same identifier for two packs containing different quantities.
Each packaging level gets its own UDI-DI, too. The unit of use, the carton and the shipper are different trade items with different identifiers, and the relationship between them is declared in the database rather than inferred from the number. If you need to move between the GTIN-13 on a unit carton and the GTIN-14 on the shipper, our GTIN converter handles the padding and recomputes the check digit, and the barcode validator will confirm a candidate number is arithmetically sound before it reaches a label template.
Three Things That Go Wrong
1. The Basic UDI-DI in the barcode
Covered above, and common enough to lead with. A GMN is not a GTIN, it has a different structure, and it belongs in EUDAMED and on your Declaration of Conformity rather than in a symbol.
2. A missing group separator after a variable-length field
Silent, invisible, and it corrupts every downstream record rather than failing loudly. If your element string has a lot or serial number anywhere other than at the end, the separator is load-bearing.
3. Assuming the database and the label can drift apart
The UDI-DI you register in EUDAMED and the GTIN in (01) on the carton are supposed to be the same number. They diverge when a device is revised, a new identifier is correctly allocated for the label, and the registration is not updated — or the reverse. With the 28 November 2026 legacy deadline in play, the reconciliation is worth doing against scanned labels rather than against the spreadsheet that was supposed to describe them.
UDI Is Not One Global System
A device sold in both the EU and the United States carries identifiers that look identical and are governed separately. The FDA's UDI rule and its GUDID database, and the EU's MDR/IVDR requirements with EUDAMED, use the same GS1 building blocks and the same accredited issuing entities — but they are distinct legal regimes with their own registration obligations, their own data elements and their own timetables. A GTIN registered in GUDID is not thereby registered in EUDAMED.
The same split runs through pharmaceuticals, where the EU's Falsified Medicines Directive and the US DSCSA both put a 2D code on a pack and verify it through entirely separate infrastructure. Our guide to the FDA's 12-digit NDC and 2D drug barcode rule covers the US side of that divergence.
Frequently Asked Questions
What is the difference between UDI-DI and Basic UDI-DI?
The UDI-DI identifies one specific device model and packaging configuration, and it goes in the barcode — under GS1 it is a GTIN in application identifier (01). The Basic UDI-DI identifies a family of devices sharing intended purpose, risk class and essential design, and it does not go on the product at all. Under GS1 it is a Global Model Number, and it lives in EUDAMED, on the Declaration of Conformity, on certificates and in technical documentation.
Is the Basic UDI-DI in the barcode?
No. It is a regulatory grouping key, not a product identifier, and it is not encoded in the UDI carrier. Finding something that looks like a GMN inside a device barcode usually means it was pasted into a field that expected a GTIN.
What does UDI-PI contain?
The production identifiers that distinguish one unit or production run from another: lot or batch number, serial number, expiry date, manufacture date, and for some products a software identification. Which ones are required depends on how the device must be traced — an individually tracked implant needs a serial number, a box of sterile consumables needs a lot number and an expiry date.
What are the GS1 application identifiers used in a UDI?
(01) for the GTIN, which is the UDI-DI; then (11) production date, (17) expiry date, (10) batch or lot, and (21) serial number, which make up the UDI-PI. (01), (11) and (17) are fixed length; (10) and (21) are variable and need a group separator if anything follows them.
What is the deadline for registering devices in EUDAMED?
EUDAMED use became mandatory on 28 May 2026. Devices newly placed on the market must be registered before they are placed. Devices already on the market before that date must be registered by 28 November 2026, when the twelve-month transitional window closes.
When did the UDI carrier become mandatory on labels?
By risk class, on a staircase: implantable and Class III devices first, then Class IIa and IIb, with Class I devices required to carry a UDI carrier on the label from 26 May 2025. Direct marking of reusable devices follows two years behind each class, putting reusable Class I devices at 26 May 2027.
Does the UDI have to be human-readable as well as scannable?
Yes. Both AIDC and HRI are required. The plain-text form is the fallback when the symbol is damaged, over-stickered or read in a setting with no scanner. A mismatch between the two is an audit finding, and it is detectable by scanning the label and comparing the decode against the printed text.
When do I have to assign a new UDI-DI?
Whenever a change could cause misidentification or traceability ambiguity. Named triggers include name or trade name, device version or model, single-use labelling, sterile packaging, a need for sterilisation before use, the quantity of devices in a package, and critical warnings or contra-indications. Note that the MDR and IVDR requirements supersede the GS1 Healthcare GTIN allocation rules where the two disagree.
Does changing the pack quantity really need a new UDI-DI?
Yes. Going from five units to ten in a package requires a new UDI-DI for that package, because a scan must not return the same identifier for packs containing different quantities. It is the trigger that most often surprises teams, because commercially it reads as a minor line extension.
Is a GS1 DataMatrix the only permitted carrier?
No, but it is the most common. The system is carrier-agnostic within the rules of the issuing entity — GS1, HIBCC, ICCBBA and IFA are designated — and linear GS1-128 symbols are also used, particularly on larger packaging. DataMatrix dominates where space is tight or the code is marked directly onto the device.
Is EU UDI the same as FDA UDI?
No. They share GS1 building blocks and the same accredited issuing entities, which makes the identifiers look alike, but they are separate legal regimes with separate databases — GUDID in the US, EUDAMED in the EU — and separate registration obligations and timetables. Registering in one does not register you in the other.
Where is the authoritative source?
Regulation (EU) 2017/745 (MDR) and Regulation (EU) 2017/746 (IVDR), particularly Annex VI, together with the MDCG guidance on UDI and the European Commission's UDI helpdesk material. This article is a technical explanation of the identifiers and their encoding, not regulatory advice; where any summary disagrees with the Official Journal text or current MDCG guidance, those govern.
The Short Version
UDI is three identifiers doing three jobs. The Basic UDI-DI groups a family for paperwork and never appears on a product. The UDI-DI says which device this is, and it is a GTIN in (01). The UDI-PI says which unit, through lot, serial and dates. The barcode carries the last two, in both machine-readable and plain-text form.
Almost every UDI defect worth finding is a boundary error: the family key in the product symbol, a missing separator after a variable-length field, HRI that no longer matches the AIDC, a registration that drifted from the label. All four are visible the moment someone scans a real label and reads the decode back — which, with the legacy registration deadline on 28 November 2026, is a better use of the next ten weeks than another pass over the spreadsheet.