Home · Industries · Healthcare & Medical Devices

Healthcare & Medical Device Barcodes: FDA UDI, GS1 Data Matrix & GS1-128 for GUDID Compliance

FDA UDI is the law. Every medical device sold in the US needs Device Identifier (UDI-DI) + Production Identifier (UDI-PI) on the label, registered in GUDID, and scannable in a healthcare setting.

Medical devices are governed by FDA's Unique Device Identification (UDI) rule. Every device that's distributed in the US needs a UDI on its label and package — and for implantable, life-supporting, and Class III devices, on the device itself ('direct part marking'). The UDI has two parts: the Device Identifier (DI, identifies the manufacturer + model) and the Production Identifier (PI, identifies the specific lot/serial/expiry).

Three FDA-accredited issuing agencies handle UDI: GS1 (most common, uses Data Matrix or GS1-128), HIBCC (uses HIBC barcode standard), and ICCBBA (for blood, cellular, and tissue products only). Most medical-device manufacturers go with GS1 because it integrates with their existing supply-chain identification. The chosen format goes on the label AND gets submitted to GUDID — the FDA's public Global UDI Database.

Recommended barcode formats

Data Matrix
FDA's preferred 2D format for medical device UDI. Encodes DI + PI as GS1 Application Identifiers. Required on small device labels where 1D won't fit.
Code 128
GS1-128 for box-level UDI labels — large enough to print 1D and most healthcare scanners read both. Often paired with Data Matrix for redundancy.
UPC-A
Only for retail-distributed OTC medical products (blood pressure cuffs, glucose meters sold at pharmacy). Hospital-dispensed devices don't need UPC.

Regulatory notes

FDA UDI Rule (21 CFR Part 801, Subpart B): All medical devices in US distribution need UDI labeling. Compliance dates were phased by device class — Class III since 2014, Class II since 2016, Class I since 2020 (with limited exceptions).
EU MDR (Medical Device Regulation 2017/745): UDI required in EU since 2021 (May 2021 for Class III, May 2022 for Class IIa/IIb, May 2023 for Class I). EU has its own EUDAMED database.
FDA GUDID submission: Device manufacturers must submit UDI records to FDA's Global UDI Database. Public-facing; patients and clinicians can look up devices by UDI.
Combination products (drug + device): May trigger BOTH UDI (for the device component) AND DSCSA serialization (for the drug component).
ICCBBA ISBT 128 is the only allowed format for blood, cellular therapy, and tissue products — separate from GS1/HIBCC.

Step by step

1
Choose an FDA-accredited issuing agency
GS1 (gs1us.org) for general medical devices — most common choice. HIBCC for legacy HIBC-format users. ICCBBA only for blood/tissue/cellular.
2
Assign Device Identifier (DI) to each device version
Through GS1, the DI is a 14-digit GTIN. Each model + size + configuration gets its own DI. Same model with different sterility-method-validated configurations = different DIs.
3
Generate UDI barcode with DI + PI
Data Matrix format: (01)DI(11)Production-date(17)Expiry(10)Lot(21)Serial. The PI elements vary by device — implantables typically need serial, sterile-packaged disposables need lot + expiry.
4
Submit DI record to GUDID
FDA's Global UDI Database. Required before commercial distribution. Submission includes device name, FDA listing number, GMDN code, sterility info, lot/serial flags, sizes.
5
Apply UDI to label + direct part marking (if applicable)
Implantable, life-supporting, life-sustaining, and Class III devices need UDI directly on the device, not just the label. Laser-etched Data Matrix on metal devices, ink-jet on polymer. Survives sterilization.

Gotchas

GUDID submission can take 30-60 days for first-time submitters — start the regulatory paperwork BEFORE you finalize manufacturing barcoding to avoid launch delays.
Direct part marking on implantables must survive autoclave/sterilization — laser etching with adequate depth is the standard, but it changes device topology and may need additional 510(k) validation.
Combination products (e.g., prefilled syringes) may need UDI on the device + DSCSA serialization on the drug — two separate barcode systems on one product.
Custom-made and investigational devices are exempt from UDI but still need labeling — don't assume 'no UDI' means 'no barcode.'
EU MDR UDI differs from FDA UDI in some details (Basic-UDI-DI for grouping product variants) — global manufacturers maintain dual records.

FAQ

Do all medical devices need UDI?

Almost all Class I, II, and III devices in US distribution need UDI. Limited exceptions: custom devices, investigational devices, devices for clinical research, and certain Class I exempt devices (Class I, non-implantable, no GHTF Annex). When in doubt, check FDA's UDI exemption list.

What's the difference between GS1 and HIBCC?

Both are FDA-accredited issuing agencies for UDI. GS1 uses GTIN (14-digit numeric) and GS1 Application Identifiers — most common, integrates with retail/supply chain. HIBCC uses the HIBC standard, more common with legacy device manufacturers. They're not interchangeable — pick one per product line.

Can I use a UPC as my UDI?

Not directly. UPC-A is 12 digits; UDI Device Identifier under GS1 is 14-digit GTIN. The good news: a 12-digit UPC-A can be expanded to 14-digit GTIN by zero-padding the front, but you still need to submit it as a GS1-formatted DI to GUDID.

How do I encode UDI in Data Matrix?

Use GS1 Application Identifiers with FNC1 prefix. Example for a sterilized implant: (01)00614141999996(11)260601(17)281231(10)LOT123(21)SN9876. Our Data Matrix generator handles GS1 AI parsing when you prefix data with parenthesized AIs.

What's a Basic-UDI-DI?

An EU-MDR concept (not used in FDA UDI). The Basic-UDI-DI groups all variants of the same medical device family — used for EUDAMED registration and CE marking documentation. Each variant still has its own UDI-DI.