US FDA UDI: How Medical Device QR Codes Work with GS1

What is the FDA UDI system for medical devices?

The FDA's unique device identification (UDI) system is a framework that assigns a standardized identifier to each regulated medical device. 

It lets regulatory bodies track, identify, and monitor device safety throughout the entire lifecycle—from distribution to patient use.

The FDA UDI regulation was finalized on September 24, 2013, under 21 CFR Parts 801 and 830.

Devices labeled on or after September 24, 2023, must comply with all UDI requirements, including the prohibition on legacy National Drug Code (NDC) and National Health Related Item Code (NHRIC) identifiers.

The UDI system addresses the traceability gap for medical devices sold in the United States. 

Before standardized identifiers, recalls required broad notifications because manufacturers could not quickly trace a defective lot. 

Now, hospitals can scan a GS1 DataMatrix affixed to a medical device, retrieve details from the UDI database, and recall the correct units faster.

What medical devices are required to have a UDI?

The FDA UDI guidance requires the following kinds of medical devices to have unique identifiers:

• Class I (low-risk): Medical items like bandages, enema kits, and basic surgical tools. Most fall outside UDI labeling under the FDA’s Current Good Manufacturing Practice (CGMP) exemptions.
• Class II (moderate-risk): Items such as pregnancy test kits, surgical drapes, and equipment like powered wheelchairs. This category forms the largest by volume, with the most devices requiring full UDI compliance.
• Class III (high-risk): Medical devices like implantable pacemakers and breast implants. These follow the strictest UDI rules, with rare exemptions for single-use sterilization items.

What is a unique device identifier (UDI)?

A unique device identifier (UDI) is a globally recognized code that is present on the device label. It appears in two formats: plain text (numeric or alphanumeric format) and a machine-readable barcode. 

The UDI number consists of two parts: the Device Identifier (DI) and the Production Identifier (PI). 

Device Identifier (DI)

The DI presents the device model, version, and labeler or manufacturer. It is used as a reference key to access the device record in the FDA’s Global Unique Device Identification Database (GUDID). It never changes for a given product version. 

Production Identifier (PI)

The PI contains production data such as lot number, serial number, manufacturing date, or expiration date. It shifts from batch to batch. Its inclusion depends on whether the production data appears on the physical label.

The combined DI plus PI supports both manual entry by staff and automated scanning by clinical systems. 

Hospital electronic health records parse the information into fields such as inventory, patient records, and billing without manual handling.

How do GS1 standards fit into the US FDA UDI?

GS1 UDI standards are one of the FDA-accredited frameworks for medical device identification. 

Manufacturers can follow their data structure rules to assign identifiers. The GS1 standards translate UDI requirements into specific data elements:

• The DI portion maps to the GS1 Global Trade Item Number (GTIN).
• The PI portion maps to the GS1 Application Identifiers (AIs), each preceded by a numeric prefix.

Here are the five AI codes most relevant to UDI compliance, with a UDI code example for each:

Following GS1 UDI requirements means using these codes consistently across all device labels and GUDID submissions.

The GS1 standards also apply outside the United States. The European Union, Brazil, China, Saudi Arabia, South Korea, and several other markets recognize GS1 as a UDI issuing agency. 

The Health Industry Business Communications Council (HIBCC) and the International Council for Commonality in Blood Banking Automation (ICCBBA) are other FDA-accredited frameworks for medical device identification.

HIBCC serves medical device manufacturers that use the Health Industry Bar Code (HIBC) standard, and ICCBBA serves products of human origin, such as blood and tissue, that use the ISBT 128 standard.

Why GS1 Data Matrix instead of QR codes?

Medical device labels use GS1 DataMatrix as the primary UDI carrier and QR codes as a supplementary layer for digital content.

The distinction matters because the FDA accepts only Automatic Identification and Data Capture (AIDC) formats that encode UDI data fields in accordance with an approved issuing-agency standard. 

A standard QR code linking to a webpage does not satisfy that requirement.

GS1 DataMatrix as the primary UDI barcode

The GS1 DataMatrix wins out over QR codes for four reasons:

• Size efficiency: A DataMatrix as small as 10mm by 10mm remains scannable, while a QR code with the same payload typically requires 25mm by 25mm or larger.
• Higher data density: A compact footprint matters for surgical instruments, vial labels, and small-device packaging.
• Stronger error correction: A fixed Reed-Solomon level of 25 to 33 percent, engineered for the moisture, gloves, disinfectants, and abrasion of hospital environments.
• Healthcare scanner compatibility: Hospital inventory and Electronic Health Record (EHR) scanners are configured to parse GS1 AIs from DataMatrix codes. A QR code linking to a webpage will not be accepted as a UDI carrier by these systems.

QR codes to work secondarily with DataMatrix

QR codes serve secondary use cases tied to digital content delivery, sitting alongside the GS1 DataMatrix rather than replacing it.

• eIFU is accessible by scanning with a smartphone.
• Recall notices redirect dynamically when a batch is affected.
• Patient implant cards with safety details and maintenance schedules.
• Training materials and onboarding videos for clinical staff.
• Post-market communications, such as safety bulletins and product updates.

In the European Union, the case for QR codes on medical devices grew stronger in July 2025.

Commission Implementing Regulation (EU) 2025/1234, effective July 16, 2025, expanded eligibility for electronic instructions for use to nearly all medical devices and accessories intended for professional users under the Medical Device Regulation 2017/745.

Manufacturers selling into the EU now have a clear path to replace bulky multi-language paper inserts with a QR code linking to a controlled eIFU portal.

GS1 Digital Link as an emerging option

Some QR code implementations use GS1 Digital Link.  It formats the UDI data as a web link. The same code works for hospital scanners and smartphones used to access eIFU or product information.

How it works:

Traditional GS1 syntax encodes the UDI as an element string. Only supply chain scanners understand this format. GS1 Digital Link encodes the same data as a URL. Both scanners and smartphones process it.

Traditional UDI: (01)00850006000012(10)ABC123(17)280629

GS1 Digital Link: https://id.example.com/01/00850006000012/10/ABC123?17=280629

A hospital inventory system scans the code and extracts the GTIN and lot data. A clinician scans the same code with a phone and lands on the manufacturer's eIFU or safety notice page.

GS1 QR codes are separate from the GS1 DataMatrix UDI carrier requirement but increasingly relevant for manufacturers consolidating supplemental QR codes.

What is direct part marking, and when does it apply?

Direct Part Marking (DPM) refers to permanent UDI marking on the device itself, not on the packaging or label. DPM applies to reusable devices that undergo reprocessing between patient uses.

Devices requiring DPM include:

• Surgical instruments such as forceps, scalpels, retractors, and clamps.
• Endoscopes and other reusable diagnostic equipment.
• Powered surgical handpieces and reusable drill components.
• Reusable orthopedic instruments used across patient procedures.

DPM survives the cleaning and sterilization cycles the device endures over years of service. The two most common methods are laser etching and electrochemical etching.

Other approaches include dot peen, abrasive blast, and ink-based bonding for non-intrusive applications.

GS1 DataMatrix is the only data carrier endorsed for medical device DPM under the GS1 General Specifications Standard. The mark creates a durable device identity.

Once the original label and packaging are gone, the mark on the instrument itself still carries the UDI and links back to the GUDID record.

How GUDID submissions tie into label compliance

Every device subject to UDI requirements has a corresponding record in the GUDID, often referred to informally as the FDA UDI database.

The labeler submits this record through the FDA's online portal via an HL7 Structured Product Labeling (SPL) upload or through a third-party data pool, and then maintains accuracy throughout the entire product lifecycle.

GUDID submissions include device attributes such as:

• Brand name, product name, and device version or model.
• Device classification and regulatory pathway.
• Sterilization method and shelf life.
• Magnetic Resonance Imaging (MRI) safety classification and labeling.
• Packaging configuration at each level (unit-of-use, intermediate, case).

When does a device need a new GTIN?

A label change does not always require a new GTIN, but several specific changes do. According to GS1 Healthcare US, manufacturers assign a new GTIN when:

• The device specifications, performance, size, or composition change beyond defined limits.
• The package quantity changes, or a new package configuration is added.
• The package shifts between sterile and non-sterile.
• The labeling language or certification marks change for a different market.
• The outside package dimensions change.

Each of these triggers a new GUDID record, not just an update to the existing one. Build this check into your label change-control process before the change goes to print.

When the physical label and the GUDID record drift apart, compliance suffers. Hospitals scanning the code expect the database to match the printed text. 

Mismatches signal mislabeling, which carries enforcement consequences under FDA misbranding rules.

Failure to include a UDI on labels under 21 CFR 801.20(a) and 21 CFR 830 ranks among the more common FDA inspection observations for medical devices.

How to choose the right barcode for your device class

Barcode selection depends on three questions: device class, scanning environment, and whether production data appears on the label. Each combination points to a specific format.

Common UDI compliance mistakes to avoid

Manufacturers run into the same pitfalls in FDA audits, warning letters, and internal compliance reviews. Recognizing the patterns helps you avoid them in your own labeling program.

• Using a web link QR code as the UDI carrier: A QR code that opens a browser does not satisfy the FDA AIDC requirement. The barcode must encode UDI data fields, not a redirect URL. Hospital scanners parse data strings, not URLs.
• Forgetting intermediate packaging levels: The UDI applies at every level entering distribution: unit-of-use, intermediate, and shipping case. Even if a unit is correctly labeled but is packed in an unlabeled outer carton, it is noncompliant.
• Treating GUDID as a one-time submission: The database record must reflect the current physical label. Drift between the two constitutes a violation, even when both look fine individually. Build GUDID review into every label change-control process.
• Skipping print quality validation: A code on the label still fails if it is smudged, undersized, or applied to a curved surface. Print quality is not a quality nicety. It is part of the compliance requirement.
• Ignoring direct marking on reusable devices: Reusable instruments require DPM in addition to label marking. The mark survives reprocessing cycles and links back to the GUDID record once the label is gone.

Summary

• The US FDA UDI applies to every regulated medical device, in both human-readable text and machine-readable format.
• GS1 DataMatrix is the standard barcode for the primary UDI on most device labels.
• QR codes supplement the DataMatrix for eIFU, recall updates, and supplemental digital content.
• GUDID submission is required for each labeled device, with updates triggered by any label change.
• Direct part marking applies to reusable devices that undergo reprocessing between patient uses.

Your next step in US FDA UDI compliance

Every regulated medical device on the US market now carries a UDI. For most manufacturers, this pairs GS1 DataMatrix as the primary carrier with a QR code for everything else.

Build a label workflow around both formats. DataMatrix for identification and QR code for the digital content around it.

As a certified GS1 Digital Link solution partner in the US, UK, and Singapore, QR TIGER helps manufacturers create dynamic QR codes, run scan analytics, and update destination content without reprinting labels.

A GS1 DataMatrix feature is on the way. Soon, both formats will run on one platform: DataMatrix for the primary UDI, QR code for the digital layer.

Get started today.

Common questions about UDI compliance

What is the difference between GS1 and UDI?

UDI is the FDA regulatory concept, a unique identifier required on every regulated medical device. GS1 is one of three FDA-accredited standards organizations that manufacturers use to structure their UDI, alongside HIBCC and ICCBBA.

Is UDI part of GTIN?

The relationship works the other way. GTIN is part of UDI, not the reverse. For manufacturers using GS1 standards, the GTIN serves as the Device Identifier (DI) portion of the UDI and is then combined with Production Identifiers like lot number and expiration date.

Can you use the same UDI numbers for the US and the EU?

Partially. If you use GS1 standards, the same GTIN works as the Device Identifier in both markets. The EU requires an additional identifier, the Basic UDI-DI, which groups devices by product family and is not used in the US system.

Can QR codes be used for FDA UDI?

Yes, but only as a supplement. The FDA requires a machine-readable barcode that encodes UDI data under an approved issuing agency standard, and GS1 DataMatrix fills that primary role.

Terms and definitions

recall: A formal action to remove or correct a medical device that fails to meet safety and quality standards.

Reed-Solomon: A method of error correction built into 2D barcodes like GS1 DataMatrix. It lets the scanner read the QR code even when parts of it are damaged or smudged.

GS1 DataMatrix: A 2D barcode that follows GS1 standards. It carries the primary UDI on most medical device labels because the format fits a lot of data in a small space.

Automatic Identification and Data Capture (AIDC): Any technology that lets a machine read data from a physical item without a person typing it in. Examples include QR codes, barcodes, and RFID tags.

Electronic Health Record (EHR): A digital patient chart used by hospitals and clinics. It stores medical history, medications, and lab results.

electronic instructions for use (eIFU): A digital version of the paper user guide that comes with a medical device.

European Article Number (EAN): The 13-digit product identifier standard used in retail globally, originally called European Article Number. EAN is now formally known as GTIN-13 under GS1 standards.

GS1 Application Identifiers (AIs): Short numeric codes that tell a scanner what kind of data follows. Example: AI (10) signals that the next characters are a lot number.

Global Trade Item Number (GTIN): A GS1-issued identifier for products, from single units to case packs. It serves as the Device Identifier in the UDI.

Global Unique Device Identification Database (GUDID): The FDA’s central database that holds records for every medical device with a UDI.

Health Industry Bar Code (HIBC): It is the identifier standard managed by the HIBCC. It uses alphanumeric codes to identify medical devices in supply chains.

HL7 Structured Product Labeling (SPL): A structured data format published by Health Level Seven International (HL7). Manufacturers use SPL files to submit device data to the FDA in bulk rather than via manual entry through the online portal.

National Drug Code (NDC): A 10-digit identifier for pharmaceutical products. NDC is still in use for drugs, but is no longer allowed on new UDI-labeled devices.

National Health Related Item Code (NHRIC):  A 10-digit identifier the FDA used for medical products before UDI.

Universal Product Code (UPC): A retail barcode standard used primarily in the US and Canada. UPC-A is the common 12-digit version scanned at checkout.

Regulations

Code of Federal Regulations (CFR): The written body of rules published by federal agencies in the US. Each rule is grouped by title, part, and section.

• 21 CFR 801.20(a): A federal rule setting UDI requirements. It sets the UDI labeling requirement on medical devices.
• 21 CFR 830: It covers the broader UDI system, including the GUDID database.

Current Good Manufacturing Practice (CGMP): FDA rules for how medical devices and drugs are designed, made, packaged, and stored.

Medical Device Regulation 2017/745: The European Union’s rulebook for how medical devices are sold in the EU.

Organizations

Food and Drug Administration (FDA): The US federal agency responsible for regulating medical devices, drugs, food, and cosmetics. The FDA defines and enforces the UDI rule.

Global Standards (GS): A nonprofit organization developing global supply chain standards, including barcodes, product identifiers, and Digital Links.

Health Industry Business Communications Council (HIBCC): A nonprofit issuing UDI identifiers using the HIBC standard.

International Council for Commonality in Blood Banking Automation (ICCBBA): An organization that manages the ISBT 128 standard.