FDA UDI Compliance for Medical Devices: What Manufacturers Need to Know About Labels, Packaging, and QR Codes

A medical device can pass development, testing, and regulatory review, and still run into compliance problems because of its label. A missing identifier, an unreadable code, or outdated UDI data can create issues long after the device itself is ready for market.

For manufacturers, the challenge is rarely understanding FDA UDI requirements in theory. It’s applying them consistently across labels, packaging levels, documentation, and product updates while managing limited space, evolving regulations, and complex supply chains.

That’s where compliance becomes an operational challenge. It’s also where QR codes are increasingly helping manufacturers connect physical labels to digital information without adding complexity to packaging.

This guide explains what manufacturers need to know about FDA compliance for medical devices, including UDI requirements, labeling rules, packaging considerations, and the practical role of QR codes.

What the UDI system requires, and why it matters to production

The FDA established the Unique Device Identification system under 21 CFR Parts 801 and 830 to solve a traceability problem that had plagued healthcare for decades.

When a device caused harm or was recalled, it was often impossible to quickly identify every affected unit in the field. Because there was no standardized way to track a device from production through distribution to patient use.

The UDI system changes that.

It requires a standardized identifier on every regulated medical device (on the label, packaging, and in some cases permanently marked on the device itself) linked to a public database (GUDID) of device attributes. The result is a closed loop when implemented correctly. 

For example, this will enable 

1. A nurse scanning a device in an emergency department to pull up its exact specifications.
2. A regulator investigating a complaint to trace it to a specific production lot.
3. A manufacturer issuing a recall to identify exactly which units are in distribution.

For manufacturers, the compliance and the operational question are the same: How do you get the right information, in the right format, onto the right surface, and keep it accurate across a product’s entire distribution life?

Also read: Louisiana SB 14: QR Code Labeling Mandate for Food Products

The UDI structure: DI, PI, and why they matter

A UDI consists of two components: the Device Identifier (DI) and the Production Identifier (PI).

The DI is the fixed portion that identifies the manufacturer and the specific device model or version. It also serves as the reference point for the device record in the Global Unique Device Identification Database (GUDID).

The PI is the variable portion and may include details such as the lot number, serial number, manufacturing date, or expiration date. Together, the DI and PI enable accurate device identification, traceability, recalls, and regulatory reporting throughout the product lifecycle.

To be compliant, this information must appear in both a human-readable format (HRI) and a machine-readable format (AIDC), ensuring it can be understood by users and captured by scanning systems.

The label in practice: A key part of FDA compliance for medical devices 

The UDI is only one element of a compliant medical device label. Depending on the device, manufacturers may also need to include the manufacturer name and address, sterility information, warnings, expiration dates, and directions for use.

This is where FDA compliance for medical devices becomes a practical packaging challenge. 

On small devices and unit-of-use packaging, every millimeter of label space matters. Required information must remain clear and readable, while machine-readable codes must be large enough to scan reliably throughout storage, distribution, and clinical use.

It’s also important to distinguish between a label and labeling. 

The label refers to the information printed directly on the device or packaging. Labeling includes associated materials such as instructions for use (IFUs), package inserts, and digital resources. Both fall under FDA oversight, meaning compliance extends beyond the physical label to the broader information ecosystem surrounding the device.

Related: QR Code Label: Using a QR Code on Product Packaging

Choosing an AIDC format: Where QR codes fit

The FDA does not require a specific AIDC format. Manufacturers can use standards from FDA-accredited issuing agencies such as GS1, HIBCC, or ICCBBA.

In practice, GS1 DataMatrix is the most common UDI carrier because it is compact and widely supported across healthcare systems.

QR codes can also serve as a UDI carrier if they encode the UDI data in an approved format. However, a standard QR code that simply opens a webpage does not satisfy UDI requirements.

Where QR codes add the most value is as a supplement to the UDI carrier. Paired with the appropriate symbols and labeling, they can provide access to eIFUs, training resources, safety notices, and other digital content without consuming additional label space.

The IFU problem: Why manufacturers are moving to QR-linked eIFUs

Printed IFUs create ongoing costs. Manufacturers must manage printing, translations, version control, packaging inserts, and updates across multiple markets.

Electronic IFUs (eIFUs) help reduce that burden. 

In some markets, manufacturers can use QR codes to provide digital access to instructions, reducing packaging complexity and making updates easier to manage.

For global manufacturers, this often means using both a UDI carrier for traceability and a separate QR code for documentation access. The two codes should be clearly distinguished to avoid scanning errors in clinical settings.

Dynamic QR codes are especially valuable because the destination content can be updated without changing the printed label. This simplifies document management and helps maintain version control across product lines.

They can also provide scan visibility, helping manufacturers understand how documentation, safety notices, and training materials are being accessed in the field.

Packaging at every level: The multi-tier UDI requirement

The UDI requirement doesn’t live only on the unit-of-use label. It applies at every level of packaging that enters distribution, and each level carries its own compliance obligation.

Unit-of-use packaging (the package the end user or clinician handles directly) must carry the full UDI. This is the non-negotiable baseline.

For Intermediate packaging, such as a box of 10 individually wrapped devices, or a tray of single-use instruments, requires its own UDI. This may be a different DI from the unit-level UDI, particularly if the intermediate package is configured specifically for distribution.

Shipping cases and pallets in the distribution chain also require UDI marking, with formats appropriate to distribution scanning systems.

Manufacturers who implement UDI at the unit level and assume the obligation ends there have an incomplete compliance program. An FDA inspection that finds correctly labeled units inside an unlabeled shipping case has found a violation.

For reusable devices (surgical instruments, endoscopes, powered equipment that undergoes high-level disinfection or sterilization between patients) the UDI must also be permanently marked directly on the device under 21 CFR 801.45. 

The mark must survive the reprocessing cycles the device is designed for. Laser etching and electrochemical etching are the most common methods. The direct mark creates a durable identity for the device, which is important for instruments that may remain in service for years.

Also read: How to Use QR Codes for Smart Packaging?

GUDID: The ongoing compliance obligation

Every device subject to UDI requirements must have a corresponding record in GUDID, making database accuracy an essential part of FDA compliance for medical devices. 

The initial submission is often straightforward. The greater challenge is keeping the record accurate over time.

Any change that affects device information, labeling, or identification should trigger a review of the GUDID entry. If the database and the physical label no longer match, compliance risks increase and traceability suffers.

For this reason, GUDID maintenance should be built directly into label and packaging change-control processes.

How UDI improves recall management

The value of UDI becomes especially clear during a recall. 

Before UDI, manufacturers often had to notify a broad range of distributors and pull more inventory than necessary because product tracking was limited.

With UDI, the DI and PI capture details such as lot numbers, serial numbers, and expiration dates in a standardized, machine-readable format. This allows manufacturers to identify affected products more precisely, often down to a specific batch or serial range.

The result is faster recalls, a smaller impact on unaffected inventory, and lower operational costs. Hospitals can also use UDI data to identify affected devices more quickly, improving patient safety and supporting the traceability the UDI system was designed to provide.

Managing label changes without reprinting: Where dynamic QR codes solve a real problem

Label changes are operationally expensive in medical device manufacturing. 

A revision to the IFU, a new storage condition, an updated country-of-origin declaration – each triggers a redesign, regulatory review, print file updates, a new production run, and old-label inventory management. Lead times are typically weeks to months.

Dynamic QR codes create a separation between what’s printed and what’s communicated. The code on the box points to a manufacturer-controlled URL. When content changes, the destination is updated centrally without any reprint or inventory disruption. The audit trail lives in the QR platform.

This doesn’t replace physical UDI AIDC symbols or mandatory printed elements. It handles the content layer that benefits most from being dynamic, such as documentation, training materials, post-market communications, and safety updates. 

For global manufacturers managing content across multiple languages and markets, the value compounds with every SKU in the catalog.

Related: Food & Beverage Transparency: What a QR Code on Food Packaging Can Now Tell You

What enforcement looks like, and what it costs

The enforcement spectrum for labeling noncompliance runs from administrative to criminal.

A Form 483 observation documents conditions found during an FDA inspection. Labeling and UDI were among the top five Form 483 citation categories in 2025. Observations don’t automatically become enforcement actions, but inadequate responses do.

A Warning Letter requires a written response within 15 working days. Five warning letters in 2025 specifically cited UDI or GUDID noncompliance.

Beyond warning letters, the FDA can pursue import alerts blocking products at the border, seizure of misbranded devices, injunctions, and civil monetary penalties. 

A device is legally misbranded if its label is false or misleading, if required information is missing, or if it lacks a required UDI. Misbranded devices cannot be distributed in the U.S. 

That’s a market access problem, not a line item on a balance sheet.

Supplier coordination: Keeping everyone’s version of the label in sync

Most medical device manufacturers don’t operate in isolation. 

A typical production ecosystem involves a contract manufacturer building the device, a packaging vendor producing the boxes, a label printer generating the physical labels, and a regulatory consultant managing GUDID submissions and change control documentation. 

Each party holds a piece of the compliance picture, and the gaps between them are where violations happen. The most common failure happens due to version drift. 

A label revision approved in-house gets communicated to the label printer but not the packaging vendor, so the outer carton still reflects old lot number formatting. GUDID gets updated, but the contract manufacturer’s production floor is still running old label artwork. The QR code destination is updated, but the regulatory consultant’s change log doesn’t reflect it.

Preventing this requires explicit alignment across every party on four data points that must always agree: the DI and PI on the physical label, the corresponding GUDID submission, the packaging artwork at every level, and the digital content the QR code resolves to. 

Contractual language should assign clear responsibility for each, with defined notification requirements whenever any element changes. A shared change log that all parties can reference eliminates most version drift before it reaches a production run. 

For manufacturers using dynamic QR codes, the platform’s audit trail becomes a single source of truth that any party can verify.

Common UDI compliance mistakes, and why they keep happening

These are the errors that show up most consistently in FDA inspections, warning letters, and internal audits. Most are the result of process gaps rather than regulatory ignorance.

Treating GUDID as a one-time submission: Manufacturers submit at launch, then let the record sit. When the label changes (sterilization method, device size, MRI safety classification) the GUDID entry doesn’t. The physical label and the database drift apart, creating a compliance violation and a traceability failure simultaneously.

Using a URL-linked QR code as the UDI AIDC carrier: A QR code that opens a webpage is not a UDI carrier. Hospital-grade scanning systems parse UDI data strings; they don’t open browsers. A web-link QR code produces a null read or an error in those workflows, and the device is effectively unidentified in the system.

Forgetting intermediate packaging levels: The UDI requirement applies at every level of packaging that enters distribution, not just the unit-of-use label. A correctly labeled inner package inside an unlabeled outer carton is a noncompliant product.

Failing to validate AIDC scan performance: A code that’s technically present but too small, printed on a reflective surface, or placed on a curve that distorts the symbol may fail to scan reliably. Print quality validation against the issuing agency’s standards is a compliance requirement, not a quality nicety.

Allowing label artwork and database records to drift across supplier handoffs: Version drift between contract manufacturers, packaging vendors, and label printers is the most common source of label-GUDID discrepancies. Without a shared change log and explicit notification requirements, updates made by one party simply don’t reach the others.

Also read: What Is Sunrise 2027 and How Does It Impact Businesses?

Pre-shipment compliance checklist

Before a device enters distribution, manufacturers should be able to confirm each of the following:

• UDI issued under an FDA-accredited issuing agency (GS1, HIBCC, or ICCBBA)
• DI and applicable PI present on the label in both HRI and AIDC formats
• AIDC symbol meets minimum dimension and print quality standards
• GUDID submission complete, accurate, and consistent with the physical label
• All packaging levels labeled (unit-of-use, intermediate, shipping case)
• Direct mark present and legible on any reusable, reprocessed device
• eIFU QR code (if present) clearly differentiated from UDI AIDC carrier with ISO 15223-1 symbol
• eIFU QR code is dynamic, with version-controlled destination content and audit trail
• Label change control process confirms GUDID review is triggered by any relevant revision
• IFU, promotional materials, and other labeling reviewed for consistency with cleared intended use

Ready to build compliant QR code infrastructure for your medical device labels?

QR codes have moved from optional to essential in medical device label architecture for eIFU delivery, supplemental safety content, post-market communications, and global packaging strategies. As FDA compliance for medical devices becomes increasingly tied to traceability, digital documentation, and lifecycle management, how manufacturers implement QR codes is just as important as whether they use them.

QRCodeChimp’s dynamic QR code platform is built for exactly this kind of use case. Create QR codes that link to manufacturer-controlled content, update destination URLs without reprinting labels, maintain version-controlled audit trails for every code, manage multiple SKUs and markets from a single dashboard, and operate on SOC 2 Type II and GDPR-compliant infrastructure.

When a label change would otherwise require a reprint, and updated information needs to reach the field without waiting for the next packaging cycle, dynamic QR codes provide a practical way to support FDA compliance for medical devices while simplifying content management at scale.

Disclaimer: This article is for informational purposes only and does not constitute legal or regulatory advice. Manufacturers should consult qualified regulatory affairs professionals and legal counsel for compliance guidance specific to their devices and markets.

Frequently asked questions