GUDID Compliance Guide for Device Manufacturers and Labelers

Understanding GUDID and FDA UDI Requirements

Overview

The United States Food and Drug Administration (FDA) established the Unique Device Identification (UDI) System to improve the identification, traceability, and post-market surveillance of medical devices throughout their lifecycle. At the center of this framework is the Global Unique Device Identification Database (GUDID), which serves as the FDA’s repository of identifying information for medical devices distributed in the United States.

Rather than storing production information for individual devices, GUDID contains standardized information associated with each Device Identifier (DI). This information enables healthcare providers, distributors, regulators, and other stakeholders to identify medical devices consistently while supporting device recalls, adverse event reporting, supply chain management, and patient safety initiatives.

Successful GUDID compliance extends beyond assigning a UDI to a device. Manufacturers must establish processes to prepare accurate device data, submit compliant Device Identifier records to the GUDID, maintain current information throughout the product lifecycle, and manage ongoing regulatory updates in accordance with FDA requirements.

Understanding the FDA UDI System

The FDA UDI System consists of two complementary components:

• Unique Device Identifier (UDI) — A unique identifier that appears on the device label and, where applicable, on the device itself.
• Global Unique Device Identification Database (GUDID) — The FDA database that stores identifying information associated with each Device Identifier (DI).

The UDI itself consists of two parts:

• Device Identifier (DI) – The fixed portion that identifies the specific version or model of a device and serves as the primary key within GUDID.
• Production Identifier (PI) – The variable portion that may include one or more production identifiers such as:
  • Lot or batch number
  • Serial number
  • Manufacturing date
  • Expiration date

Unlike the DI, the Production Identifier is not submitted to GUDID because it varies between individual production units.

The Purpose of GUDID

GUDID serves as the FDA’s authoritative source of identifying information for medical devices marketed in the United States.

The database supports:

• Accurate identification of medical devices
• Improved product traceability
• More efficient device recalls
• Enhanced adverse event reporting
• Supply chain visibility
• Healthcare provider access to standardized device information
• Public access to key device identification data

By maintaining standardized device information, GUDID improves consistency throughout the healthcare ecosystem while reducing ambiguity associated with product identification.

Device Identifier Records

Each Device Identifier (DI) is associated with a single Device Identifier Record within GUDID.

A Device Identifier Record typically includes information such as:

• Device Identifier (DI)
• Issuing Agency
• Device description
• Brand name
• Version or model
• Company information
• Device status
• FDA premarket submission information where applicable
• Package configurations
• Clinical size
• MRI safety information
• Sterility information
• Single-use status
• Direct marking information
• Commercial distribution status

Each DI represents a distinct version or model of a device. When changes require a new DI under FDA UDI requirements, a new Device Identifier Record must also be created.

Devices Subject to GUDID Requirements

Most medical devices distributed within the United States are subject to FDA UDI requirements, with compliance requirements phased according to device classification and applicable regulatory requirements.

Generally, GUDID requirements apply to:

• Class III medical devices
• Class II medical devices
• Class I medical devices
• Certain unclassified medical devices

Certain device categories and situations may qualify for exemptions, exceptions, or alternative requirements under FDA regulations. Manufacturers should evaluate each product individually to determine whether GUDID submission requirements apply.

Relationship Between GUDID and Device Labeling

Although closely related, device labeling and GUDID submissions serve different purposes.

The UDI carrier printed on the device label identifies the device in the marketplace, while GUDID stores the identifying information associated with the Device Identifier.

Successful compliance therefore requires manufacturers to ensure that:

• Device labels contain the correct UDI
• The Device Identifier submitted to GUDID matches the identifier appearing on the label
• GUDID records remain synchronized with approved labeling throughout the product lifecycle

Maintaining consistency between labeling and GUDID helps support accurate device identification while reducing regulatory and operational risk.

Recognized FDA Issuing Agencies

Manufacturers must obtain Device Identifiers from an FDA-accredited issuing agency.

Currently recognized issuing agencies include:

• GS1
• HIBCC
• ICCBBA

Each issuing agency establishes its own identifier structure while complying with FDA UDI requirements.

Benefits of GUDID

By establishing a centralized national device identification database, GUDID helps:

• Improve medical device traceability
• Strengthen patient safety
• Support more effective recalls and field actions
• Improve adverse event reporting
• Enable standardized device identification
• Increase transparency across the healthcare supply chain
• Support interoperability across healthcare systems
• Improve regulatory oversight of marketed devices

Determining Scope and Understanding FDA UDI Requirements

Overview

Before preparing Device Identifier records for submission to GUDID, manufacturers should determine whether their devices are subject to FDA UDI requirements and understand how the FDA defines and manages Unique Device Identifiers. Correctly identifying the applicable UDI requirements early helps manufacturers establish compliant labeling, prepare accurate GUDID records, and maintain consistent device information throughout the product lifecycle.

Although many UDI concepts are harmonized globally, the FDA has its own regulatory requirements governing device labeling, Device Identifier records, package configurations, and lifecycle management. Manufacturers should therefore evaluate their products against FDA-specific requirements rather than assuming compliance with another jurisdiction automatically satisfies U.S. obligations.

Devices Subject to UDI Requirements

Most medical devices distributed in the United States are subject to FDA UDI requirements unless an exemption, exception, or alternative applies. In vitro diagnostic (IVD) products are medical devices under FDA regulations and are also subject to applicable UDI and GUDID requirements.

UDI requirements generally apply to:

• Class III medical devices and IVDs
• Class II medical devices and IVDs
• Class I medical devices and IVDs, subject to applicable exceptions
• Certain unclassified medical devices
• Combination products containing device constituents, as applicable
• Convenience kits and other device configurations, as applicable

Certain devices may qualify for exemptions, exceptions, alternative requirements, or FDA enforcement policies. Labelers should therefore assess each device individually to determine the applicable UDI labeling, direct marking, and GUDID submission requirements.

Understanding the FDA UDI Structure

Each UDI consists of two components:

Device Identifier (DI)

The Device Identifier (DI) is the fixed portion of the UDI assigned by an FDA-accredited issuing agency. It identifies a specific version or model of a device and serves as the primary identifier within GUDID.

Each DI is associated with one Device Identifier Record, which contains the identifying information registered in the FDA database.

Production Identifier (PI)

The Production Identifier (PI) is the variable portion of the UDI and may include one or more of the following production elements:

• Lot or batch number
• Serial number
• Manufacturing date
• Expiration date
• Distinct Identification Code for certain Human Cells, Tissues, and Cellular and Tissue-Based Products (HCT/Ps)

Unlike the DI, Production Identifiers are not submitted to GUDID because they identify individual production units rather than the device model itself.

Package Configurations

Each packaging configuration may require its own Device Identifier.

Manufacturers should determine whether different package levels require separate Device Identifiers and ensure that package relationships are accurately represented within GUDID.

Examples include:

• Individual device
• Box
• Carton
• Case

Maintaining accurate package hierarchies improves traceability while supporting healthcare providers, distributors, and supply chain operations.

Unit of Use Device Identifier

Certain devices require a Unit of Use Device Identifier.

The Unit of Use DI identifies an individual device that is intended to be used separately from the labeled package and supports accurate identification within clinical environments.

Manufacturers should determine whether Unit of Use requirements apply based on how the device is packaged and used.

Direct Marking Requirements

Certain reusable medical devices that are intended to be reprocessed between uses must bear a permanent UDI directly marked on the device itself in addition to the UDI appearing on the device label.

Manufacturers should evaluate:

• Whether Direct Mark requirements apply
• Appropriate marking technology
• Device durability
• Readability throughout the expected service life
• Applicable FDA exceptions

Direct marking supports long-term device identification when labels or packaging are no longer available during clinical use.

FDA-Accredited Issuing Agencies

Manufacturers must obtain Device Identifiers from an FDA-accredited issuing agency.

Currently recognized issuing agencies include:

• GS1
• HIBCC
• ICCBBA

Each issuing agency establishes identifier structures according to its own standards while complying with FDA UDI regulations.

Manufacturers should consistently apply identifiers from the selected issuing agency across labeling and GUDID submissions.

When a New Device Identifier Is Required

Manufacturers should establish procedures for determining when product changes require a new Device Identifier.

Examples of changes that may require a new DI include:

• Significant changes to the device version or model
• Changes affecting device identification
• Packaging changes requiring a new package configuration
• Other changes identified by the issuing agency’s allocation rules

Whenever a new DI is assigned, a corresponding new Device Identifier Record must also be created within GUDID

Maintaining Device Identifier Records

One-time registration of a Device Identifier Record is not the end of the GUDID compliance process.

Manufacturers and labelers should establish procedures to:

• Update existing Device Identifier records when permitted
• Register new Device Identifier records when new DIs are assigned
• Retire Device Identifier records when devices are no longer commercially distributed
• Maintain consistency between GUDID and approved device labeling

Effective lifecycle management helps ensure that GUDID remains an accurate representation of devices available on the U.S. market.

FDA Labeler Responsibilities

Overview

Under the FDA UDI Rule, the Labeler is responsible for complying with UDI labeling requirements and submitting Device Identifier (DI) records to GUDID. While the Labeler is often the device manufacturer, it may also be a specification developer, single-use device reprocessor, convenience kit assembler, or another entity that causes a device label to be applied or modified with the intent that the device will be commercially distributed in the United States.

Organizations should clearly determine who is the FDA Labeler for each device, as this entity is responsible for ensuring that UDI information is accurate, submitted on time, and maintained throughout the device lifecycle.

Who Is the FDA Labeler?

The FDA defines the Labeler as the person or entity that causes a label to be applied to a device, or causes the label of a device to be modified, with the intent that the device will be commercially distributed without any subsequent replacement or modification of the label.

Depending on the product and commercial arrangement, the Labeler may be:

• The legal manufacturer
• A specification developer
• A single-use device reprocessor
• A convenience kit assembler
• A private label distributor, where applicable
• Another entity that meets the FDA definition of a Labeler

Organizations should evaluate each product individually to determine the appropriate Labeler responsible for GUDID compliance.

Labeler Responsibilities

The Labeler is responsible for ensuring that devices comply with applicable FDA UDI requirements.

Key responsibilities include:

• Assigning Device Identifiers (DIs) through an FDA-accredited issuing agency
• Applying compliant UDI carriers to device labels and, where required, directly to the device
• Preparing complete and accurate Device Identifier records
• Registering Device Identifier records to GUDID before commercial distribution, as required
• Maintaining accurate GUDID information throughout the product lifecycle
• Determining when product changes require a new Device Identifier
• Updating or retiring Device Identifier records when appropriate
• Ensuring consistency between device labeling and GUDID records

Although operational activities may be delegated, the Labeler remains responsible for the accuracy and maintenance of the information submitted to GUDID.

FDA Account Administration

Before submitting Device Identifier records, the Labeler must establish the necessary FDA account structure and GUDID access.

This typically includes:

• Registering the Labeler organization within the FDA’s electronic systems
• Obtaining the required organizational identifiers
• Establishing the GUDID account
• Assigning appropriate administrative and submission roles
• Maintaining current organization and user information

Organizations should periodically review account information to ensure continued access and appropriate user permissions.

GUDID User Roles

GUDID uses role-based access to control administrative and submission activities.

Typical roles include:

• GUDID Coordinator – Manages the Labeler’s GUDID account, user access, and administrative settings.
• Labeler Data Entry (LDE) User – Creates, edits, submits, and maintains Device Identifier records.

Organizations should assign responsibilities according to internal governance policies while ensuring appropriate segregation of duties between administrative and operational activities.

Delegating Operational Activities

Many Labelers rely on external partners or internal shared service teams to support GUDID compliance.

Examples include:

• Regulatory Affairs teams
• Regulatory consultants
• Software vendors
• System integrators
• Bureau service providers

Although these parties may prepare or submit Device Identifier records, the FDA Labeler remains accountable for ensuring that submitted information is complete, accurate, and compliant with FDA requirements.

Organizations should establish documented agreements defining:

• Roles and responsibilities
• Data ownership
• Approval workflows
• Submission responsibilities
• Change management procedures
• Ongoing lifecycle maintenance

Coordinating Cross-Functional Responsibilities

Successful GUDID compliance requires collaboration across multiple business functions.

Typical responsibilities include:

Function	Typical Responsibilities
Regulatory Affairs	FDA compliance, GUDID submissions, lifecycle management
Quality Assurance	Data integrity, validation, change control, audit readiness
Product Management	Device specifications and product changes
Packaging and Labeling	UDI carrier implementation and label updates
Master Data (PIM/MDM)	Source master data management and governance
IT and Integration	GUDID connectivity, system integration, security, and monitoring

Clearly defined ownership helps ensure that device information remains accurate and synchronized across enterprise systems and GUDID.

Managing Product Changes

Organizations should establish formal change control procedures to assess whether product changes affect UDI labeling or Device Identifier records in GUDID.

Changes that should trigger regulatory review include:

• New device models or versions
• Packaging configuration changes
• Device description updates
• Sterility changes
• MRI safety information changes
• Commercial distribution status changes
• Labeling revisions
• Changes requiring a new Device Identifier under the issuing agency’s allocation rules

Embedding GUDID impact assessments into product change processes helps ensure that UDI information remains current and compliant.

Preparing Device Data for GUDID Submission

Overview

Accurate GUDID submissions begin with complete, validated, and well-governed device data. Before registering a Device Identifier (DI) record, manufacturers should ensure that all required information has been collected, validated, and reconciled against approved labeling and applicable FDA requirements.

Device information is often distributed across multiple enterprise systems, including Product Lifecycle Management (PLM), Enterprise Resource Planning (ERP), Regulatory Information Management (RIM), Quality Management Systems (QMS), labeling systems, and Master Data Management (MDM) platforms. Establishing a controlled process for aggregating and preparing Device Identifier records helps improve data quality, reduce submission errors, and support efficient lifecycle management.

Understanding GUDID Device Attributes

Each Device Identifier (DI) record contains standardized information describing a specific version or model of a medical device.

Depending on the device, the record may include information such as:

• Device Identifier (DI)
• Issuing agency
• Brand name
• Device description
• Version or model
• Company information
• FDA premarket submission number, where applicable
• Device classification
• MRI safety information
• Sterility information
• Single-use status
• Device count
• Unit of Use DI
• Direct Mark status
• Commercial distribution status
• Package configurations

Manufacturers should ensure that every attribute accurately reflects the approved device labeling and current regulatory status of the medical device before submission.

Identifying Authoritative Data Sources

Preparing a complete Device Identifier record typically requires information from multiple enterprise systems. For example:

Data Category	Typical Source
Device Identifier	PLM, PIM
Brand name and model	PLM, PIM, ERP
Device description	PLM, PIM
FDA premarket submission	RIM, PLM
Device characteristics	PLM, PIM, technical documentation
Sterility and reuse information	QMS, PLM
Package hierarchy	ERP, supply chain, packaging systems
Labeling information	Labeling management system
Commercial distribution status	Regulatory or commercial systems

Each data element should have a clearly defined authoritative source to ensure consistency across enterprise systems, product labeling, and GUDID.

Conducting a UDI Data Readiness Assessment

Before creating Device Identifier records in GUDID, manufacturers should assess their product portfolio to identify:

• Missing mandatory attributes
• Invalid code values
• Incorrect Device Identifier formats
• Incomplete package configurations
• Missing Unit of Use DIs
• Incorrect Direct Mark information
• Inconsistent device descriptions
• Missing FDA premarket submission information, where applicable
• Duplicate Device Identifier records
• Differences between approved labeling and device master data

Identifying and correcting data quality issues before registration reduces submission failures and minimizes the need for last minute updates.

Preparing Package Configurations

Manufacturers should accurately represent how devices are commercially distributed.

Before submission, it is important to verify:

• Individual device DIs
• Package Device Identifiers
• Package quantities
• Parent-child package relationships
• Unit of Use DIs where required
• Consistency with approved packaging and labeling

Accurate package information improves traceability and supports downstream healthcare and supply chain processes.

Preparing Labeling Information

Because GUDID reflects information associated with the UDI appearing on the device label, manufacturers should confirm that submitted information matches approved labeling.

Before submission, verify:

• Device Identifier accuracy
• Brand name
• Version or model
• Device description
• Labeling claims
• Sterility information
• MRI safety status
• Direct Mark information
• Commercial distribution status

Any discrepancies between labeling and GUDID should be resolved before submission.

Preparing for M2M HL7 SPL Submission

Organizations using HL7 Structured Product Labeling (SPL) for M2M submission should ensure that messages comply with FDA technical specifications before transmission.

Preparation activities should include:

• Validating HL7 SPL message structure
• Confirming required data elements
• Verifying identifier formats
• Reviewing package relationships
• Testing interface mappings
• Validating XML against the applicable FDA implementation guide
• Confirming successful integration with enterprise systems

Organizations using the GUDID Web Interface should similarly validate their data before manual entry to reduce submission errors.

Establishing a Validated Submission Dataset

Before registering Device Identifier records in GUDID, organizations should reconcile the proposed submission dataset against:

• Approved device labeling
• Technical documentation
• FDA clearance or approval documentation, where applicable
• Packaging specifications
• Enterprise master data
• Current FDA GUDID data requirements

Only validated and approved device information should be submitted to GUDID.

Best Practices

Organizations should:

• Establish authoritative sources for every GUDID data element
• Validate device information before creating Device Identifier records
• Ensure consistency between labeling and GUDID
• Review package configurations and Unit of Use relationships
• Validate HL7 SPL messages before submission
• Implement formal review and approval workflows
• Maintain complete audit trails for data maintenance activities
• Regularly assess data quality against the latest GUDID specifications

GUDID Access and Submission Methods

Overview

Before Device Identifier (DI) records can be submitted to GUDID, the FDA Labeler must establish the necessary organizational accounts, assign appropriate user roles, and select a submission method. The FDA supports multiple submission methods to accommodate organizations of different sizes and technical capabilities, ranging from manual data entry through the GUDID Web Interface to fully automated HL7 Structured Product Labeling (SPL) submissions.

The most appropriate submission method depends on factors such as the size of the product portfolio, submission frequency, available technical resources, and the level of automation required.

Establishing GUDID Access

Before submitting Device Identifier records, the Labeler must establish access to the FDA’s electronic systems and create a GUDID account.

This typically includes:

• Registering the Labeler organization
• Obtaining the required organizational identifiers
• Creating a GUDID account
• Assigning administrative and submission roles
• Maintaining current organization and user information

Organizations should periodically review account information and user access to ensure only authorized personnel can manage Device Identifier records.

GUDID User Roles

GUDID uses role-based access to manage administrative and submission activities.

The primary user roles include:

• GUDID Coordinator – Manages the Labeler’s GUDID account, user access, and administrative settings.
• Labeler Data Entry (LDE) User – Creates, edits, submits, and retires Device Identifier records.

Organizations should establish internal approval processes and periodically review user permissions to support appropriate segregation of duties and regulatory governance.

Submission Method 1: GUDID Web Interface

The GUDID Web Interface provides a browser-based application for manually creating and maintaining Device Identifier records.

It is best suited for:

• Small device portfolios
• Low submission volumes
• Individual Device Identifier updates
• Organizations without automated submission capabilities

The Web Interface performs data validation during data entry, allowing users to identify and correct issues before registering Device Identifier records.

Submission Method 2: HL7 Structured Product Labeling (SPL)

Manufacturers with larger portfolios or higher submission volumes can submit Device Identifier records electronically using HL7 Structured Product Labeling (SPL).

HL7 SPL supports automated submission of XML messages directly to GUDID and is well suited for organizations that:

• Register large numbers of devices
• Frequently introduce new products
• Require automated updates
• Integrate PLM, ERP, RIM, PIM, or MDM systems with GUDID

Organizations should validate HL7 SPL messages against the applicable FDA implementation specifications before submitting them to production.

Choosing the Appropriate Submission Method

The most appropriate submission method depends on an organization’s operational requirements.

Submission Method	Best Suited For	Primary Considerations
GUDID Web Interface	Small portfolios and occasional submissions	Manual entry with built-in data validation
HL7 SPL	Medium and large portfolios	Automated XML-based submission

Validation During Submission

Regardless of the submission method, Device Identifier records are validated against the latest GUDID specifications.

Validation includes verification of:

• Required attributes
• Device Identifier format
• Package relationships
• Permitted values
• Data consistency
• HL7 SPL message structure, where applicable
• Business rule compliance

Organizations should review data validation results promptly and resolve any issues to avoid compliance delays.

GUDID Web Services

The FDA also provides GUDID Web Services, allowing organizations to retrieve published Device Identifier information programmatically.

Web Services support activities such as:

• Retrieving Device Identifier records
• Searching published GUDID data
• Synchronizing internal systems with publicly available GUDID information
• Supporting downstream reporting and analytics

Unlike the HL7 SPL submission process, GUDID Web Services are intended for data retrieval rather than publishing Device Identifier records.

Best Practices

Organizations should:

• Establish GUDID accounts well before planned submissions
• Assign GUDID Coordinator and LDE roles according to documented governance processes
• Select the submission method that best aligns with portfolio size and operational needs
• Validate HL7 SPL messages before submission
• Test interface mappings and integrations thoroughly
• Review data validation results promptly and resolve errors before resubmission
• Periodically review user access and administrative permissions
• Maintain documented procedures for account management, submissions, and lifecycle updates

Best-Practice GUDID Submission Process

Overview

Achieving sustained GUDID compliance requires more than one-time submission of Device Identifier (DI) records. Manufacturers should establish a structured and repeatable process that ensures device information is accurately prepared, validated, submitted, and maintained throughout the product lifecycle.

Whether Device Identifier records are submitted through the GUDID Web Interface or via HL7 Structured Product Labeling (SPL), the same underlying principles apply: trusted source data, controlled review and approval processes, pre-submission data validation, and ongoing lifecycle management. A standardized submission process helps improve data quality, reduce submission errors, and ensure that GUDID data remains synchronized with approved device labeling.

Step 1: Confirm Device Scope

Before preparing a Device Identifier record, determine whether the device is subject to FDA UDI requirements.

This assessment should confirm:

• Whether the device is subject to FDA UDI requirements
• The applicable device classification
• Whether any FDA exemptions or exceptions apply
• The appropriate Device Identifier
• Whether Unit of Use or Direct Mark requirements apply
• Applicable package configurations

Confirming scope early helps ensure that the correct UDI requirements are applied before submission activities begin.

Step 2: Prepare Device Data

Compile the information required for the Device Identifier record from approved source systems.

This should include, where applicable:

• Device Identifier (DI)
• Brand name
• Device description
• Version or model
• Issuing agency
• Device characteristics
• MRI safety information
• Sterility information
• Single-use status
• Commercial distribution status
• Package configurations
• Unit of Use DI
• Direct Mark information
• FDA premarket submission information

Device information should be reconciled against approved labeling and current regulatory documentation before proceeding.

Step 3: Validate Submission Readiness

Before submitting Device Identifier records, validate that the submission dataset complies with GUDID’s business and technical requirements.

Data validation should include:

• Mandatory data elements
• Device Identifier formats
• Package relationships
• Unit of Use information
• Direct Mark status
• Permitted values
• FDA business rules
• HL7 SPL message structure, where applicable
• Consistency with approved labeling

Performing comprehensive data validation before submission significantly reduces rejected records and rework.

Step 4: Review and Approve Device Information

Device Identifier records should undergo a documented review and approval process before submission.

Organizations should verify that:

• Device information is complete
• Regulatory documentation supports all submitted data
• Labeling matches the Device Identifier record
• Product changes have been incorporated
• Internal approvals have been completed

Controlled approval processes strengthen data governance while helping ensure submission accuracy.

Step 5: Submit Device Identifier Records

After approval, submit Device Identifier records using the selected submission method:

• GUDID Web Interface
• HL7 Structured Product Labeling (SPL)

Organizations should ensure that only approved Device Identifier records are submitted to GUDID.

Step 6: Review Submission Results

Following submission, organizations should confirm that:

• The Device Identifier record was successfully published
• Data validation completed successfully
• Required package relationships were established
• Published information accurately reflects the approved submission
• No outstanding data validation issues remain

Prompt review of submission results helps identify issues before they affect downstream users of GUDID data.

Step 7: Correct Validation Errors

When validation errors occur, organizations should investigate the underlying cause before resubmitting corrected device information.

Common causes include:

• Missing mandatory attributes
• Invalid data values
• Incorrect Device Identifier formats
• Package relationship errors
• HL7 SPL formatting issues

Organizations should address root causes within upstream business processes whenever possible to reduce recurring submission errors.

Step 8: Maintain Device Identifier Records

Submitting Device Identifier records is only one stage of the GUDID compliance process.

Manufacturers should establish procedures to maintain records throughout the product lifecycle, including:

• Updating Device Identifier records when permitted
• Submitting new records when a new Device Identifier is assigned
• Retiring Device Identifier records when devices are no longer commercially distributed
• Maintaining consistency between approved labeling and GUDID
• Monitoring changes that affect regulatory information

Ongoing lifecycle management helps ensure that GUDID continues to reflect the current status of marketed devices.

Monitor Submission Activities

Organizations should routinely monitor:

• Published Device Identifier records
• Submission success rates
• Data validation errors
• Devices requiring updates
• Retired Device Identifier records
• Data quality metrics

Regular monitoring supports continuous improvement while helping maintain accurate regulatory information in GUDID.

Best Practices

Successful GUDID submissions are supported by disciplined operational processes. Organizations should:

• Confirm device scope before preparing Device Identifier records
• Establish authoritative data sources for all GUDID attributes
• Validate data before submission
• Ensure approved labeling matches GUDID records
• Implement documented review and approval workflows
• Monitor submission results and resolve validation issues promptly
• Investigate recurring validation errors and address root causes
• Maintain Device Identifier records throughout the product lifecycle
• Periodically review submission performance and data quality metrics

System Quality, Validation, and Security Requirements

Overview

Successful GUDID compliance depends not only on preparing accurate Device Identifier (DI) records but also on maintaining systems that support secure, reliable, and controlled regulatory processes. Organizations should establish appropriate quality, validation, and security controls for the systems used to create, validate, submit, and maintain Device Identifier records throughout the product lifecycle.

Whether Device Identifier records are submitted through the GUDID Web Interface or via HL7 Structured Product Labeling (SPL), manufacturers remain responsible for ensuring the integrity, accuracy, and security of the information submitted to the FDA.

Maintaining Data Integrity

Trusted GUDID records begin with trusted device data.

Organizations should establish controls that ensure UDI information remains:

• Attributable to an authorized source
• Accurate and complete
• Consistent across enterprise systems, approved labeling, and GUDID
• Protected from unauthorized modification
• Available throughout the required retention period
• Traceable through all updates and lifecycle changes

Computer System Validation

Organizations should apply a risk-based Computer System Validation (CSV) approach to systems supporting GUDID submission activities.

Systems used to create, transform, approve, or transmit Device Identifier records should be validated according to their intended use and potential impact on regulatory compliance.

Validation activities may include:

• User Requirements Specifications (URS)
• Functional and configuration specifications
• Risk assessments
• Interface and integration testing
• HL7 SPL message validation
• User Acceptance Testing (UAT)
• Data migration verification
• Traceability between requirements and test evidence
• Controlled deployment and change management

Many manufacturers apply GAMP 5 principles to implement scalable validation approaches that align validation effort with system risk while supporting efficient system lifecycle management for UDI compliance.

Electronic Records and Electronic Signatures

Systems supporting GUDID submissions often form part of regulated quality systems and should support appropriate controls for electronic records and approvals.

Manufacturers should consider implementing controls consistent with recognized industry practices, including:

• 21 CFR Part 11 and EU Annex 11 for audit trails, electronic records and electronic signatures.
• Risk-based system validation approaches aligned with GAMP 5.

Relevant controls include:

• Unique user identification
• Role-based access control
• Secure authentication
• Audit trails
• Electronic signatures where used
• Record retention
• Protection against unauthorized modification
• Controlled review and approval workflows

Applying these controls helps strengthen data integrity and supports consistent compliance across global regulatory environments.

Security Controls

Systems supporting GUDID compliance should implement appropriate technical and organizational security measures to protect regulated device information.

Recommended controls include:

• Role-based access control
• Secure credential management
• Network security monitoring
• Vulnerability and patch management
• Backup and disaster recovery
• Security incident response procedures
• Periodic user access reviews
• Third-party security assessments

Organizations should also establish procedures to monitor privileged accounts and protect FDA account credentials used to access GUDID.

Integration and Interface Controls

Organizations using HL7 SPL should establish controls to ensure reliable and secure data exchange with GUDID.

These controls should include:

• HL7 SPL message validation
• XML schema validation
• Interface testing
• Automated error handling
• Transmission logging
• Retry mechanisms for failed submissions
• Monitoring of interface performance
• Reconciliation of submitted and published Device Identifier records
• Controlled interface changes

Strong interface controls improve submission reliability while reducing manual intervention and operational risk.

Managing Third-Party Service Providers

Many manufacturers rely on external software vendors, regulatory consultants, system integrators, or bureau service providers to support GUDID submission activities.

When third parties are involved, organizations should establish documented agreements covering:

• Regulatory responsibilities
• Data ownership
• Information security
• System validation responsibilities
• Business continuity
• Incident management
• Change management
• Service level expectations

Although operational activities may be delegated, the FDA Labeler remains responsible for the accuracy and compliance of Device Identifier records submitted to GUDID.

Change Management

Changes affecting systems used for GUDID submissions should be managed through formal change control procedures.

Typical changes include:

• Software upgrades
• HL7 SPL implementation updates
• Data model revisions
• FDA technical specification updates
• Security configuration changes
• Infrastructure modifications
• Integration enhancements
• Changes to approved labeling that affect Device Identifier records

Each change should be assessed for its potential regulatory impact, validated where appropriate, and approved before implementation.

Periodic Review

Validated systems should be reviewed regularly to ensure they remain fit for their intended purpose.

Organizations should periodically assess:

• System performance
• User access permissions
• HL7 SPL integration performance
• Security controls
• Outstanding software defects
• Backup and recovery procedures
• Compliance with current FDA technical documentation and GUDID requirements

Periodic reviews support continuous improvement while ensuring systems continue to meet UDI requirements.

Best Practices

Organizations should:

• Apply a risk-based validation approach to systems supporting GUDID
• Implement controls consistent with 21 CFR Part 11, GAMP 5, and EU Annex 11, where applicable
• Maintain complete audit trails for regulatory activities
• Protect FDA accounts through strong access controls
• Validate HL7 SPL integrations before production use
• Establish formal change management procedures
• Periodically review system performance, security, and validation status
• Monitor integration performance and investigate recurring issues
• Maintain documented procedures supporting secure and reliable GUDID operations

Best Practices for Successful GUDID Compliance

Overview

Manufacturers should establish standardized processes that support accurate device information throughout the product lifecycle while ensuring that GUDID records remain aligned with approved labeling and current regulatory requirements.

Successful organizations treat GUDID as an ongoing regulatory capability rather than a one-time submission project. By combining trusted master data, strong governance, validated systems, and continuous monitoring, manufacturers can improve data quality, reduce compliance risk, and efficiently manage regulatory changes throughout the commercial life of their devices.

Integrate GUDID Compliance into Regulatory Operations

GUDID activities should be incorporated into routine regulatory and quality processes rather than managed as standalone projects.

Organizations should establish documented procedures covering:

• Device Identifier assignment
• GUDID submissions
• Product and labeling changes
• Package configuration management
• Device lifecycle updates
• Record maintenance
• Regulatory approvals
• Change management

Embedding GUDID into everyday regulatory operations helps ensure that Device Identifier records remain current and consistent throughout the product lifecycle.

Maintain a Single Source of Trusted UDI Data

Accurate Device Identifier records depend on trusted master data.

Organizations should establish authoritative sources for device information and maintain consistency across:

• PLM
• ERP
• RIM
• QMS
• PIM or MDM
• Labeling systems
• GUDID
• Other UDI databases (if applicable)

Maintaining a single source of trusted UDI data reduces inconsistencies while improving the accuracy and efficiency of GUDID submissions.

Establish Clear Ownership and Governance

Successful GUDID compliance requires collaboration across multiple business functions.

Responsibilities should be clearly defined for:

• Device Identifier management
• Labeling
• Regulatory approvals
• Data ownership
• Submission activities
• Lifecycle maintenance
• Change management
• System administration

Clearly defined governance improves accountability while ensuring Device Identifier records remain accurate in GUDID as products evolve.

Validate Data Before Submission

Organizations should validate Device Identifier records before submission rather than relying solely on FDA validation during registration.

Validation should confirm:

• Mandatory data elements
• Device Identifier formats
• Package relationships
• Unit of Use information
• Direct Mark information
• FDA business rules
• Consistency with approved labeling
• HL7 SPL message structure, where applicable

Strong pre-submission data validation significantly reduces rejected records and corrective effort.

Leverage Automation Where Appropriate

As product portfolios expand, manual submission processes become increasingly difficult to maintain.

Organizations should evaluate opportunities to automate:

• Device data aggregation
• Data transformation
• Data validation
• HL7 SPL XML generation
• Submission processing
• Reporting and monitoring

Automation improves consistency and reliability while allowing Regulatory Affairs teams to focus on higher-value compliance activities.

Maintain Secure and Validated Systems

Systems supporting GUDID compliance should remain secure, reliable, and appropriately validated throughout their operational lifecycle.

Organizations should:

• Apply risk-based computer system validation
• Protect electronic records
• Maintain comprehensive audit trails
• Enforce role-based access controls
• Implement formal change management
• Periodically review system performance and security controls

Many manufacturers adopt 21 CFR Part 11, EU Annex 11, and GAMP 5 practices to establish consistent quality and compliance controls across global regulatory systems.

Monitor Data Quality and Regulatory Performance

Organizations should establish performance metrics that support continuous improvement.

Examples include:

• Device Identifier record completeness
• Submission success rates
• Validation error trends
• Time to register new Device Identifier records
• Labeling and GUDID consistency
• Data quality metrics

Regular review of operational metrics enables organizations to identify improvement opportunities while strengthening long-term UDI compliance.

Stay Current with FDA Requirements

FDA regulations, GUDID guidance, technical specifications, and HL7 SPL implementation requirements continue to evolve.

Organizations should regularly monitor updates to:

• FDA UDI guidance
• GUDID technical documentation
• HL7 SPL implementation guides
• Issuing agency standards
• Regulatory guidance documents

Proactively assessing regulatory changes helps organizations update systems and business processes before new requirements become effective.

Foster Cross-Functional Collaboration

Successful GUDID compliance requires close collaboration between multiple business functions.

Organizations should encourage coordination between:

• Regulatory Affairs
• Quality Assurance
• Product Management
• Packaging and Labeling
• Manufacturing
• Supply Chain
• IT
• Master Data/Data Governance

Cross-functional collaboration improves product data quality, strengthens governance, and helps ensure Device Identifier records in GUDID remain synchronized with enterprise systems and approved labeling.