FDA UDI Compliance: What Medical Device Companies Must Know to Stay Ahead of Enforcement

FDA UDI Compliance Is Not Optional — And Enforcement Is Catching Up

If your medical device is on the U.S. market and you haven't fully implemented a Unique Device Identification (UDI) system, you are operating with significant regulatory exposure. The FDA's UDI rule, codified under 21 CFR Part 830 and implemented through a phased rollout that began in 2014, is now fully in effect for virtually all device classes — including Class I devices. Yet a surprising number of small and mid-sized manufacturers remain non-compliant, often because they misunderstand the scope of what UDI actually requires.

This post breaks down the core compliance obligations, common failure points, and what your team should prioritize right now.

The Regulatory Foundation: What 21 CFR Part 830 Actually Requires

The UDI rule under 21 CFR Part 830 establishes a system to identify medical devices through their distribution and use. The regulation requires manufacturers to do three distinct things:

• Label devices with a UDI — a unique numeric or alphanumeric code that includes a Device Identifier (DI) and a Production Identifier (PI). The DI identifies the specific version or model; the PI conveys lot number, serial number, manufacturing date, and/or expiration date as applicable.
• Submit device data to the Global Unique Device Identification Database (GUDID) — FDA's publicly accessible database administered under 21 CFR Part 830, Subpart E. Manufacturers must submit and maintain accurate records for each device version they place into commercial distribution.
• Use FDA-accredited issuing agencies — Labelers must obtain their UDIs through an FDA-accredited issuing agency. Currently, GS1, HIBCC, and ICCBBA are the three accredited agencies. The choice of agency depends on your device type and existing supply chain systems.

Additionally, 21 CFR 801.20 through 801.57 govern the UDI labeling requirements themselves, including format, placement, and the requirement to include the UDI in both plain text and Automatic Identification and Data Capture (AIDC) technology — typically a barcode or RFID.

Class I Devices: No Longer Exempt from GUDID Submission

One of the most common misconceptions we encounter at ADB Consulting & CRO is the belief that Class I device manufacturers have limited UDI obligations. This is no longer accurate. While Class I devices were the last group phased into the UDI requirements, the compliance deadline passed in 2020. Class I manufacturers must now label devices with a UDI and submit data to GUDID — with limited exceptions for devices that are also exempt from 510(k) premarket notification and meet specific criteria outlined in 21 CFR 830.10.

If you are a startup commercializing a Class I device and assuming UDI doesn't fully apply to you, that assumption needs to be re-evaluated immediately.

GUDID Submission: Where Most Companies Get Into Trouble

Submitting to GUDID is not a one-time event. It is an ongoing regulatory obligation. The FDA's Labeler Registration and Device Listing guidance and the GUDID Data Elements guidance document (most recently updated in 2023) outline what data must be submitted and when updates are required.

Common GUDID compliance failures include:

• Failing to update GUDID records when device labeling changes — even minor changes that affect the DI require updated submissions.
• Incorrect or incomplete Production Identifier configuration, particularly for combination products or devices with multiple packaging configurations.
• Allowing GUDID records to go stale after product discontinuation without properly flagging device status.
• Not accounting for all packaging levels — the UDI rule requires labeling and GUDID records for each distinct packaging configuration, including individual units, intermediate packaging, and cases.

During FDA inspections, investigators routinely cross-reference physical device labeling with GUDID records. Discrepancies are a straightforward path to a Form 483 observation and, in repeat cases, Warning Letter issuance.

Special Considerations: Combination Products, SaMD, and Reprocessed Devices

If your portfolio includes combination products, the UDI obligations can be layered and complex. The FDA's UDI for Combination Products guidance (2020) clarifies that the combination product as a whole must have a UDI assigned to the device constituent part, with specific rules depending on whether the product is prefilled, co-packaged, or cross-labeled.

For Software as a Medical Device (SaMD), FDA's current position — informed by the Digital Health Center of Excellence's UDI guidance — requires UDI labeling for standalone SaMD that meets the device definition. Compliance teams at SaMD companies should carefully assess their labeling architecture to ensure UDI is embedded in electronic labeling and accompanying materials appropriately.

Third-party reprocessors of single-use devices carry their own distinct UDI obligations under 21 CFR 830.35, effectively becoming the labeler of record upon reprocessing.

Building a Defensible UDI Compliance Program

A robust UDI compliance program requires integration across quality, regulatory, and operations functions. At minimum, your program should include:

• A documented procedure governing UDI assignment, GUDID submission, and change control triggers
• A defined process owner accountable for GUDID record maintenance
• Integration of UDI review into your design change and labeling change workflows
• Periodic internal audits that cross-reference physical labels with live GUDID records
• Training records confirming that relevant personnel understand UDI obligations under 21 CFR Part 830

FDA has signaled that UDI enforcement will continue to intensify as the agency works toward its broader goal of a fully interoperable medical device traceability ecosystem. Companies that treat UDI as a checkbox exercise rather than a living compliance system will find themselves exposed.

Work With Experts Who Know the Details

UDI compliance is one of those areas where the details matter enormously — and where a gap between what your labels say and what GUDID reflects can create significant regulatory and commercial risk. At ADB Consulting & CRO Inc., we work directly with medical device startups and established manufacturers to audit current UDI programs, remediate gaps, and build submission-ready GUDID records that hold up under FDA scrutiny.

Whether you are preparing for a first commercialization, navigating a post-market labeling change, or preparing for an FDA inspection, we are here to help you get it right. Book a free discovery call with Andre Butler today at adbccro.com and let's assess exactly where your UDI compliance program stands — and what it will take to get it where it needs to be.