The Wait is Over: The UDI Rule is Finally Here

By Jennifer D. Newberger –

At long last, it is here: FDA has issued the final rule implementing the unique device identifier (UDI) requirements, originally required by the Food and Drug Administration Amendments Act of 2007 (FDAAA) and then again by the Food and Drug Administration Safety and Innovation Act (FDASIA), enacted in July 2012 (see here at pages 39-40).  The stated purpose of the rule is to “lead to more accurate reporting of adverse events by making it easier to identify the device prior to submitting a report. . . [and to] allow FDA, health care providers, and industry to rapidly extract useful information from adverse event reports, pinpoint the particular device at issue and thereby gain a better understanding of the underlying problems, and take appropriate, better-focused, corrective action.”  Product information will be maintained in FDA’s Global Unique Device Identification Database (GUDID), unless subject to an exemption.  On the same day FDA issued the final rule, it also released a draft guidance, Global Unique Device Identification Database (GUDID), to provide information to device labelers about submitting information to the database.

Each medical device subject to the UDI requirements will be required to bear a UDI on the label and device package of each medical device.  Each UDI must be provided in a plain-text version and in a form that uses automatic identification and data capture (AIDC) technology.  If a device is intended to be used more than once and to be reprocessed before each use, it must also be directly marked with the UDI, so that the identifying information is available even when separated from the original label or packaging. 

Some of the principal changes between the amended proposed rule of November 19, 2012 (see our previous post here) and the final rule include:

• FDA may grant a one-year extension of the compliance date applicable to a Class III device or a device licensed under the Public Health Service Act (PHS Act) when in the best interest of the public health.
• The final rule provides an exception for a finished device that is manufactured and labeled prior to the compliance date that applies to the device, but the exception expires three years after the compliance date.
• A Class I device labeled with a Universal Product Code (UPC) may use the UPC as its UDI, but is still subject to GUDID reporting requirements.
• Each device constituent part of a combination product need not bear a UDI so long as the combination product bears a UDI.  Additionally, any combination product that properly bears an NDC on its label need not bear a UDI.
• Unlike the proposed rule, which would have required the label and device package of each device packaged in a convenience kit to bear its own UDI, distinct from that of the convenience kit, the final rule does not require devices contained within a convenience kit to bear a UDI but does require the label and each device package of every convenience kit to bear a UDI.
• The proposed rule would have required an implantable device to bear a permanent marking providing the UDI; the final rule removed this provision, and does not require an implantable device to be directly marked with a UDI.
• Legacy FDA identifiers for devices, such as National Health-Related Item Code (NHRIC) and NDC numbers, will be rescinded by September 24, 2018.  However, continued use of a labeler code issued under an FDA-accredited system for the issuance of UDIs will be permitted, so long as the use is permitted by the issuing agency that administers the system, and the label submits a request for continued use of the code.  FDA must receive requests for continued use of labeler codes no later than September 24, 2014.
• The proposed rule would have exempted Class I single use devices from the UDI requirements; the final rule extends that to all classes of single use devices, except implants.
• Stand-alone software would have been subject to direct marking in the proposed rule; the final rule does not require direct marking, but is subject to certain specified requirements.  For example, stand-alone software that is not distributed in packaged form (e.g., downloaded from a website), will meet the UDI requirements if a plain-text statement of the UDI is displayed whenever the software is started or through a menu command.  When distributed in package form, the label and device package of the software must include a UDI in plain text and AIDC.
• In addition to the device identifier and production identifier required on the majority of devices, HCT/Ps regulated as devices will also have to include the distinct identification code required by 21 C.F.R. § 1271.290(c). 

The compliance dates for the final rule are unchanged from those described in the amended proposed rule of November 19, 2012, and are as follows:

• September 24, 2014
  • The labels and packages of Class III devices and devices licensed under the PHS Act must bear a UDI;
  • Class III stand-alone software must provide its UDI;
  • Data for these devices must be submitted to the GUDID database.
• September 24, 2015
  • The labels and packages of implantable, life-supporting, and life-sustaining devices must bear a UDI;
  • A device that is a life-supporting or life-sustaining device that is required to be labeled with a UDI must bear a UDI as a permanent marking if the device is intended to be used more than once and intended to be reprocessed before each use;
  • Stand-alone software that is a life-supporting or life-sustaining device must provide its UDI;
  • Data for implantable, life-supporting, and life-sustaining devices that are required to be labeled with a UDI must be submitted to the GUDID database.
• September 24, 2016
  • Class III devices required to be labeled with a UDI must bear a UDI as a permanent marking if the device is a device intended to be used more than once and intended to be reprocessed before each use;
  • The labels and packages of Class II devices must bear a UDI;
  • Class II stand-alone software must provide its UDI;
  • Data for Class II devices required to be labeled with a UDI must be submitted to the GUDID database;
• September 24, 2018
  • A Class II device required to be labeled with a UDI must bear a UDI as a permanent marking on the device if the device is intended to be used more than once and intended to be reprocessed before each use;
  • The labels and packages of Class I devices and unclassified devices must bear a UDI;
  • Class I stand-alone software must provide its UDI;
  • Data for Class I and unclassified devices must be submitted to GUDID.
• September 24, 2020
  • Class I devices and unclassified devices that are required to be labeled with a UDI must bear a UDI as a permanent marking if the device is intended to be used more than once and intended to be reprocessed before each use.

This phased-in approach should allow device manufacturers sufficient time to comply with the rule.  There will undoubtedly be complications, questions, and challenges as manufacturers begin to comply with the rule.  After all the waiting and debating, it will be interesting to see what the impact of the UDI system will be on FDA, industry, and the public.