Unique Device Identification: 6 Proven Rules Article 27 Sets

Unique device identification is usually explained as a barcode on a label. That description misses most of what MDR Article 27 requires — including a declaration of conformity field, a technical documentation list, and a storage duty that falls on your customers rather than on you.

The Article is short and unusually precise. Read literally, it settles several arguments that come up in every implementation.

The two halves of a unique device identification

Article 27(1)(a) splits the identifier in two:

• a UDI-DI, a device identifier specific to a manufacturer and a device, which provides access to the information laid down in Annex VI Part B; and
• a UDI-PI, a production identifier that identifies the unit of device production and, if applicable, the packaged devices.

The distinction is what makes unique device identification work as traceability. The DI answers “what is this?”, the PI answers “which one is this?” — and it is the PI that lets a field safety corrective action target three lots rather than a whole product family.

Custom-made and investigational devices sit outside the unique device identification system entirely.

Where the unique device identification carrier goes

Article 27(4) is one sentence and it settles a recurring packaging argument: UDI carriers shall be placed on the label of the device and on all higher levels of packaging — and then, higher levels of packaging shall not be understood to include shipping containers.

So every level of packaging a customer opens carries a UDI. The outer box a courier handles does not. Teams that treat the shipping carton as “the highest level” and label it are doing unnecessary work; teams that stop at the primary pack are non-compliant.

Article 27(3) sets the timing and the database duty together. Before placing a device on the market, the manufacturer assigns a UDI to the device and, if applicable, to all higher levels of packaging, using the rules of a Commission-designated issuing entity — and ensures the Annex VI Part B information is correctly submitted and transferred to the UDI database.

Unique device identification reaches your declaration of conformity

Two obligations sit outside the label entirely, and they are the ones most often discovered late.

Article 27(6): the Basic UDI-DI shall appear on the EU declaration of conformity. The Basic UDI-DI is not the UDI-DI on the label — it is the higher-level access key that groups devices sharing the same intended purpose and design. A declaration of conformity issued without it is incomplete on its face, which is a cheap finding for an auditor and an expensive one to remediate across a portfolio.

Article 27(7): as part of the technical documentation under Annex II, the manufacturer shall keep up to date a list of all UDIs that it has assigned. Not the current catalogue — all of them, maintained. Every superseded UDI-DI stays on the list.

Article 27(5) adds the operational tie: the UDI shall be used for reporting serious incidents and field safety corrective actions under Article 87. Vigilance and unique device identification are the same dataset, so a UDI assignment process that is not connected to the vigilance process will produce reports the authority cannot match.

The unique device identification duty that lands on other people

Article 27(8) and 27(9) push the obligation down the chain.

Economic operators shall store and keep, preferably by electronic means, the UDI of devices they have supplied or been supplied with — for class III implantable devices, and any others determined by measure.

Health institutions shall do the same for class III implantable devices. For everything else, Member States shall encourage, and may require, health institutions and healthcare professionals to store and keep UDIs.

Read that last clause commercially rather than legally. “May require” means the practical scope is national and expanding, and hospitals that have built UDI capture for implantables will extend it. A manufacturer whose UDI data is incomplete or inconsistent in the database becomes the supplier whose products are awkward to scan — which is a procurement problem long before it is a regulatory one.

Who issues unique device identification codes

Article 27(2) has the Commission designate one or more issuing entities to operate UDI assignment systems. The criteria are worth knowing because they explain the stability you are relying on: the entity must have legal personality, its system must identify a device throughout distribution and use, it must conform to relevant international standards, it must give access on predetermined and transparent terms, and it must undertake to operate its system for at least 10 years after designation.

You choose your unique device identification issuer among designated entities. You do not invent a scheme, and you should not treat the choice as reversible — re-issuing identifiers across a portfolio is not a small project.

How unique device identification connects

Where to start

1. Fix the Basic UDI-DI first, because it drives grouping and appears on the declaration of conformity.
2. Map your packaging levels and stop at the shipping container, in both directions.
3. Check your declarations of conformity for the Basic UDI-DI, across the whole portfolio.
4. Build the assigned-UDI list in the technical documentation, and keep superseded entries.
5. Connect UDI to vigilance, since Article 27(5) requires it for incident and FSCA reporting.
6. Treat data quality as commercial, because hospitals are the ones storing your identifiers.

This guide reflects Regulation (EU) 2017/745 as published on EUR-Lex, read at 16 August 2026. Annex VI Part C carries the technical detail of the unique device identification system, and implementing acts govern issuing entities — confirm the current designations before assigning.

The EU MDR Toolkit provides 68 editable templates covering the UDI assignment procedure, the Annex VI data records, the declaration of conformity and the technical documentation structure Article 27 depends on — and the EU IVDR Toolkit covers the Article 24 equivalent.