UDI and GUDID for Medical Consumables: What Receiving Teams Should Capture from Labels

When a hospital, surgical center, or medical supply distributor receives an inbound shipment of medical consumables, receiving clerks and materials managers face an operational question: Which Unique Device Identifier (UDI) elements must be captured from the labeled device package, and what can the FDA Global Unique Device Identification Database (GUDID) actually verify versus what only the physical label's production identifiers can prove?

The central rule of dock-level consumable traceability is straightforward: Receiving teams should capture the UDI from the labeled device package in front of them—such as a shelf dispenser box, case carton, or multi-unit carton—not from an outer variable-contents shipping container. Under 21 CFR 801.20, the label of every medical device and every device package must bear a UDI that satisfies 21 CFR part 801 subpart B and 21 CFR part 830, unless an exception or alternative applies under 21 CFR 801.30, 801.45, or 801.128(f)(2). 21 CFR 801.55 is the request path for an exception or alternative those provisions do not already grant. A UDI consists of a mandatory Device Identifier (DI) identifying the specific model and legal labeler, and conditional Production Identifiers (PI) identifying the lot or batch number, expiration date, serial number, or manufacturing date whenever those attributes appear on the product labeling.

At the same time, receiving teams must understand the architectural boundaries of FDA's public AccessGUDID database. AccessGUDID is the public catalog of labeler-submitted Device Identifier records: it can confirm that a scanned Device Identifier matches a published medical device record, identify the commercial labeler, confirm commercial-distribution status, and display the production-identifier flags that the labeler declared to FDA. AccessGUDID does not store, verify, or track unit-level lot numbers, serial numbers, or expiration dates. Dynamic production data exist solely on the physical product package and within its machine-readable barcode carrier.

The federal Unique Device Identification system is anchored in the definitions set forth in 21 CFR 801.3. That section establishes a rigid legal distinction between a device package and a shipping container:

A device package is defined as a package that contains a fixed quantity of a particular version or model of a device. Examples include a dispenser box of 50 sterile IV cannulas, a carton of 100 latex-free Foley catheters, or a master case containing exactly 10 dispenser boxes of hypodermic syringes. Every device package is subject to 21 CFR 801.20 and must bear a compliant UDI.

Conversely, a shipping container is defined as a container used during shipment or transportation whose contents may vary from one shipment to another. Examples include a corrugated logistics overwrap, a mixed pallet wrapped in shrink film, or a wooden crate carrying multiple split orders. Under 21 CFR 801.30(c), a UDI is not required on any shipping container.

Establishing rigorous identifier capture at goods receipt is the foundational prerequisite for downstream supply chain control. When a manufacturer or regulatory authority issues an urgent recall or safety correction, hospital traceability teams must immediately isolate affected stock. As detailed in MedDeviceGuide: Tracing Mixed-Lot Consumables During a Recall, materials managers who capture both the Device Identifier and the specific Production Identifier (lot or batch number) at the dock can segregate compromised units in minutes without mistakenly quarantining unaffected lots that share the same catalog model number.

flowchart TD
    SC["Shipping container / logistics pallet\n(Variable contents; carrier SSCC)\n21 CFR 801.30(c): UDI not required"] --> DP["Device package / fixed-count carton\n(Fixed quantity of one version or model)\n21 CFR 801.20: UDI required on this package"]
    DP --> SB["Intermediate shelf box / dispenser\n(Fixed quantity of inner units)\n21 CFR 801.20: UDI required on this package"]
    SB --> ISU["Inner single-use unit / peel pouch\n(Individual sterile consumable)\n801.30(a)(3) may apply; outer package still needs UDI"]

Under 21 CFR 801.40, every UDI must be presented in two forms: easily readable plain-text and automatic identification and data capture (AIDC) technology. AIDC means any technology that conveys the UDI or the device identifier in a form that can be entered into an electronic patient record or other computer system via an automated process. Linear barcodes, two-dimensional symbols, and radio-frequency identification can all serve as AIDC. If AIDC is not evident upon visual examination of the label or device package, the label or device package must disclose the presence of AIDC technology. 21 CFR 801.40(c) requires disclosure of presence; it does not require the label to name the AIDC technology type.

For Class I medical consumables, federal law provides a critical administrative flexibility. Under 21 CFR 801.40(d), a Class I device that bears a Universal Product Code (UPC) on its label and device packages is legally deemed to meet all requirements of 21 CFR part 801 subpart B, and that UPC serves as the official UDI required by 21 CFR 801.20. Furthermore, under 21 CFR 801.35(b), a device package may bear both a UPC and an issuing-agency UDI.

The absence of production identifiers in Class I barcodes is further reinforced by 21 CFR 801.30(d), which establishes that the UDI of a Class I device is not required to include a production identifier. FDA's guidance Unique Device Identification System: Form and Content of the Unique Device Identifier (UDI) (July 2021), which does not apply to UPCs, and the agency's Contact an FDA-Accredited Issuing Agency page (content current as of 30 April 2026) confirm that while a labeler may choose a full issuing-agency UDI (DI + PI) on a Class I device to carry expiration date, lot, or serial number and to meet customer requirements, that choice is optional. A Class I barcode that carries only a Device Identifier, or a UPC serving as the UDI, can still satisfy labeling form rules.

Under 21 CFR 830.20, all UDIs must be issued under an identification system operated by FDA or an FDA-accredited issuing agency, conforming to international standards ISO/IEC 15459-2, 15459-4, and 15459-6, using ISO/IEC 646 invariant characters. FDA currently accredits three issuing agencies: GS1, the Health Industry Business Communications Council (HIBCC), and ICCBBA. According to FDA's official reference document, UDI Formats by FDA-Accredited Issuing Agency (Version 1.4, September 1, 2025), each agency employs distinct syntactic delimiters:

GS1 barcodes utilize Application Identifiers (AIs) encased in parentheses in plain text, such as (01) for the Device Identifier (GS1 GTIN), (10) for the batch or lot number, (17) for the expiration date in YYMMDD format, (11) for the manufacturing date in YYMMDD format, and (21) for the serial number. HIBCC uses a different delimiter family, opening with a primary Device Identifier flag +. Secondary HIBCC segments use a $$ delimiter family for lot, expiration, and serial data, with supplemental /S, /14D, and /16D fields listed in FDA's issuing-agency format table. ICCBBA/ISBT 128 uses a different delimiter family, including donation identification and MPHO lot for HCT/P-regulated devices. Record the issuing-agency family from the labeled syntax. Do not assume every consumable barcode is a GS1 GTIN, and do not treat a GTIN-only scan as a full UDI when production-identifier application identifiers are present on the same carrier.

A frequent friction point at healthcare receiving facilities is whether every single pouch, syringe wrapper, or catheter sleeve inside a multi-unit box must display a UDI. Federal regulations explicitly answer this question in 21 CFR 801.30(a), which lists device types that are not required to bear a UDI:

1. Inner Single-Use Devices (21 CFR 801.30(a)(3)): Individual single-use devices of a single version or model that are distributed together in a single device package, intended to be stored in that package until removed for use, and not intended for individual commercial distribution are exempt from bearing a UDI on the individual device or its immediate sterile pouch. (This exception is expressly unavailable for implantable devices). For example, inside a dispenser carton of 100 sterile hypodermic needles or a shelf box of 50 disposable Foley catheters, the individual peel pouches are not required to bear a UDI barcode, provided the outer containing carton bears a fully compliant UDI. Receiving personnel must not reject shipments because inner single-use pouches lack barcodes.

2. Class I CGMP-Exempt Devices (21 CFR 801.30(a)(2)): A Class I device that FDA has by regulation exempted from the Good Manufacturing Practice (GMP) requirements of 21 CFR part 820 is exempt from UDI labeling, exclusive of continuing recordkeeping obligations under 21 CFR 820.35. This cross-reference was formally conformed from former citations by FDA's QMSR technical amendments at 90 FR 55979 on December 4, 2025.

A finished device manufactured and labeled before the FDA compliance date established for that device is excepted from 21 CFR 801.20. That exception expires three years after that compliance date (21 CFR 801.30(a)(1)). A leftover carton labeled before the applicable Class I labeling date can therefore lack a UDI without being a current labeling defect, but the exception is time-limited. It is not a receiving waiver to skip identity checks the quality agreement requires.

3. Combination Products and Convenience Kits (21 CFR 801.30(a)(11)): Devices packaged within the immediate container of a convenience kit (such as a sterile laceration tray, central venous catheter dressing kit, or suture removal pack) or a combination product are exempt from bearing individual UDIs, provided the outer kit or combination product container displays a compliant UDI.

Direct marking (21 CFR 801.45) is a manufacturer marking duty, not an 801.30 packaging-level exception. A device must bear a permanent UDI on the device itself only when it must bear a UDI on its label and is intended to be used more than once and reprocessed before each use. FDA's July 2022 guidance treats reprocessing for that purpose as high-level disinfection and/or sterilization between uses. Direct marking is therefore generally inapplicable to single-use consumables and is not a receiving-dock inspection of inner pouches.

Keep UDI labeling identity separate from physical packaging integrity. If a box of consumable peel pouches arrives intact but individual sterile barrier pouches show punctures, abrasion, or seal channeling, record the damage for supplier review as outlined in MedDeviceGuide: Recording Sterile-Pouch Damage at Goods Receipt, rather than flagged as an administrative UDI labeling failure.

Under 21 CFR 830.300 and 21 CFR 830.310, medical device labelers must submit foundational master data attributes to the Global Unique Device Identification Database for each version or model required to bear a UDI. FDA's comprehensive Global Unique Device Identification Database (GUDID) Guidance (December 17, 2024) and the public AccessGUDID Portal define the strict architecture of this repository:

GUDID stores ONLY the Device Identifier (DI) as its primary key. Production Identifiers are never submitted to, stored in, or queryable from GUDID. Instead, GUDID contains only boolean production identifier flags indicating which PI attributes the labeler has declared to appear on the device labeling. AccessGUDID is updated daily and allows public lookup without credentials.

To navigate AccessGUDID records accurately, receiving personnel must recognize four distinct identifier concepts defined in FDA's December 2024 guidance:

1. Primary DI: The identifier assigned to the lowest level of medical device package containing a full UDI, designated as the 'base package' (such as a shelf box of 50 dressing sponges).

2. Device Count: The exact quantity of individual medical devices contained within that base package.

3. Package DI: Unique identifiers assigned to higher-level packaging configurations that contain fixed multiples of the base package (such as a master case of 10 shelf boxes). Package DIs link back to the Primary DI in GUDID. Shipping containers of variable quantity are never assigned Package DIs.

4. Unit of Use DI: A virtual identifier assigned to an individual device when the device is not labeled with a UDI at the unit-of-use level (for instance, an individual glove inside a 100-count dispenser box). The Unit of Use DI exists solely in electronic database records to facilitate patient electronic health record (EHR) documentation. The Unit of Use DI does not appear on the physical label or packaging. Receiving clerks who inspect an unlabeled sterile pouch will never find a printed Unit of Use DI.

When a receiving team queries AccessGUDID using a scanned Device Identifier, the database can return catalog attributes that 21 CFR 830.310 requires labelers to submit for versions or models that must bear a UDI: brand name, version or model, labeler name and contact, issuing agency, sterile statement, natural-rubber-latex statement, MRI safety information, size if more than one size, the type of production identifiers that appear on the label, premarket submission number or 510(k)-exempt statement, listing number, GMDN term or code, and the number of individual devices in the device package. Commercial-distribution status and package-configuration fields come from the GUDID record, not from this unit's lot. However, AccessGUDID cannot verify whether the batch sitting on the receiving dock was manufactured on an authorized line, whether the lot has expired, or whether the units in hand were properly stored. Verification of physical lot, serial, and expiration data relies entirely on the physical packaging label and machine-readable AIDC carriers.

Date formatting requires careful reconciliation between human-readable text and barcode data. Under 21 CFR 801.18, whenever a printed expiration date, date of manufacture, or other user-facing date appears on a medical device label, it must be formatted as YYYY-MM-DD with hyphens (for example, 2026-11-30). In contrast, GS1 AIDC barcode standards encode dates as YYMMDD inside application identifiers (such as (17)261130). Receiving clerks must understand that 261130 in a barcode stream is standard machine syntax, whereas 2026-11-30 is the mandatory human-readable representation on the carton. Furthermore, for temperature-sensitive diagnostic reagents or active sterile barriers, expiration validity remains contingent upon verified transit conditions, as detailed in Labeled Storage and Transport for Medical Consumables: Temperature, Humidity, and Distribution Evidence.

A frequent cause of false quarantine alerts at hospital receiving docks occurs when receiving staff scan a Class I medical consumable (such as an elastic bandage, non-sterile gauze pad, or wooden tongue depressor) and find no matching record in AccessGUDID. Many receiving teams incorrectly assume that any missing database record indicates counterfeit or noncompliant product. In reality, Class I regulatory compliance is governed by explicit, dated FDA enforcement discretion.

On 22 July 2022, FDA posted its final guidance Unique Device Identification: Policy Regarding Compliance Dates for Class I and Unclassified Devices, Direct Marking, and Global Unique Device Identification Database Requirements for Certain Devices (Docket No. FDA-2017-D-6841; PDF issued date and Federal Register availability 25 July 2022), which remains current policy on FDA's UDI Compliance Policies Portal. In Section III.B.1, FDA defined consumer health products as 510(k)-exempt Class I devices sold directly to consumers over-the-counter (OTC) in brick-and-mortar and/or online stores, that do not fall within any of the categories listed in Section III.B.2. For these consumer health products, FDA announced that it does not intend to enforce 21 CFR 830.300 GUDID submission requirements at this time. This enforcement discretion carries no stated expiration date.

However, Section III.B.2 of the July 2022 guidance explicitly carves out categories of Class I devices that are not consumer health products and therefore do not receive open-ended GUDID enforcement discretion:

1. Class I reserved devices that are not 510(k)-exempt under Section 510(l)(1) of the Federal Food, Drug, and Cosmetic Act;

2. Restricted devices, including in vitro diagnostic devices (IVDs) restricted under 21 CFR part 809 subpart C;

3. Implantable devices as defined in 21 CFR 801.3;

4. Life-supporting or life-sustaining (I/LS/LS) devices as defined in 21 CFR 860.3; and

5. Devices distributed to professional healthcare facilities, intended for use by healthcare professionals only, that are reusable or reprocessed, or intended for wound care.

Footnote 20 defines a professional healthcare facility as any environment where personnel with medical training are continually available to oversee or administer device use, including hospitals, long-term care, nursing homes, EMS, clinics, physician offices, outpatient treatment, or a clinical laboratory. Devices in Section III.B.2 are not consumer health products. For other Class I and unclassified devices that are not I/LS/LS, FDA's GUDID-submission delay ran only until December 8, 2022. That 75-day extension has passed. Consumer-health products keep the separate, open-ended 830.300 discretion. UDI labeling under 21 CFR 801.20 and date formatting under 21 CFR 801.18 for Class I and unclassified devices other than I/LS/LS ran only until September 24, 2022. I/LS/LS devices, including Class I I/LS/LS, were already expected to comply. A missing AccessGUDID record is therefore a classification-and-policy check against those dated categories, not an automatic receiving defect.

Receiving managers should also distinguish U.S. Customs bulletin CSMS #56355955 (issued May 22, 2023). In that bulletin, U.S. Customs and Border Protection reminded manufacturers and importers that most medical devices offered for import into the United States must meet 21 CFR 801 subpart B and 21 CFR 830.300, and that entries that appear to lack a UDI on the label and/or a matching GUDID record may be subject to refusal at the port of entry. CSMS #56355955 is an import-entry review for importers of record. It is not a hospital receiving standard, it does not mandate domestic dock quarantines, it does not repeal the July 2022 consumer-health GUDID discretion, and it does not convert a UPC-as-UDI Class I label into a GUDID-mandatory SKU.

On February 2, 2026, FDA's Quality Management System Regulation (QMSR) became effective and incorporates ISO 13485:2016 into 21 CFR part 820, with additional U.S. requirements. Those UDI-assignment and recordkeeping duties run to manufacturers subject to part 820:

Under 21 CFR 820.10(b)(1), manufacturers must document a system to assign unique device identification in accordance with 21 CFR part 830 to satisfy ISO 13485 Clause 7.5.8 (Identification). Under 21 CFR 820.35(c), manufacturers must record the UDI for each medical device or batch of medical devices in addition to ISO 13485 Clauses 7.5.1, 7.5.8, and 7.5.9. Under 21 CFR 820.35(a)(3) and (b)(2), complaint and servicing records must include any UDI or UPC. Furthermore, under 21 CFR 820.45, manufacturers must examine labeling and packaging prior to release to ensure the correct UDI or UPC, expiration date, storage instructions, and handling instructions are present. FDA's inspectional directive, Compliance Program 7382.850 (implemented February 2, 2026), instructs FDA investigators to audit these manufacturer UDI records and match AccessGUDID attributes directly against commercial labeling.

These QMSR requirements govern manufacturers and other persons subject to part 820, not hospital receiving as such. Receiving teams can reuse the same public AccessGUDID-to-label match as a goods-receipt identity check. They should not be given named warehouse-management configuration steps. Procurement teams can put identifier and change-control expectations into quality agreements, as detailed in Quality Agreements for Consumable Suppliers: Purchasing Information, Change Control, and Outsourced Processes. The following eight-step checklist uses public label and AccessGUDID objects. It is not a hospital software implementation and it is not a 21 CFR 806 recall-readiness procedure:

This page is a goods-receipt identity worksheet, not a hospital software build and not a manufacturer inspection script. Do not treat a Class I UPC as proof that production identifiers or a GUDID record are present. Do not treat a missing AccessGUDID hit as automatic rejection without checking class, 801.30 exceptions, and the dated July 2022 consumer-health policy. Do not scan a variable-contents shipper as the device UDI, and do not flag an inner single-use pouch as noncompliant when 801.30(a)(3) applies and the outer device package is labeled.

When a field action later names lots, isolate mixed stock using MedDeviceGuide: Tracing Mixed-Lot Consumables During a Recall rather than treating a Device Identifier match as recall scope. Visible sterile-pouch damage is a packaging-integrity job, recorded under MedDeviceGuide: Recording Sterile-Pouch Damage at Goods Receipt. Labeled storage and transit limits remain on Labeled Storage and Transport for Medical Consumables. Identifier-field change control belongs in the quality agreement. This article does not decode ISO 15223-1 symbols, does not recast 21 CFR 806 manufacturer corrections, and does not give clinical use instructions.