This document has been endorsed by the Medical Device Coordination Group (MDCG) established by Article 103 of Regulation (EU) 2017/745. The MDCG is composed of representatives of all Member States and it is chaired by a representative of the European Commission.
The document is not a European Commission document and it cannot be regarded as reflecting the official position of the European Commission. Any views expressed in this document are not legally binding and only the Court of Justice of the European Union can give binding interpretations of Union law.
In accordance with Annex VI, Part C of the Medical Device Regulation (EU) 2017/745 (MDR) and the In-Vitro Diagnostic Medical Device Regulation (EU) 2017/746 (IVDR), only software which is commercially available on its own as well as software which constitutes a device in itself shall be subject to UDI requirements.
In line with the general Guidance on Basic UDI-DI and changes to UDI-DI1, the Basic UDI-DI connects software with same intended purpose, risk class and essential design and manufacturing characteristics.
in accordance with Annex VI Part C, Section 6.5 of the MDR and Section 6.2 of the IVDR, a new UDI-DI is required whenever there is a modification that changes the original performance, the safety of the software or the interpretation of data. Such modifications include new or modified algorithms, database structures, operating platforms, architecture, user interfaces and new channels for interoperability. Such changes would be considered “significant.”
The Guidance on Basic UDI-DI and changes to UDI-DI2, defines standard rules on triggers that entail the creation of a new UDI-DI. It lays down that a new UDI—DI shall be required whenever there is a change that could lead to misidentification of a device and/or ambiguity in its traceability. In particular, a new UDI-DI shall be required in the case of any change of the following device related elements: name or trade name, device version or model, labelled as single use, packaged sterile, need for sterilization before use, quantity of devices provided in a package, critical
warnings or contra-indications (e.g. containing latex or DEHP3), CMR4/Endocrine
disruptors, colour, language. Not all those data elements are however applicable to software.
1 The Guidance is available at https://ec.europa.eu/docsroom/documents/28667 2 The Guidance is available at https://ec.europa.eu/docsroom/documents/28667 3 DEHP stands for Bis(2-ethylhexyl) phthalate
4 CMR stands for carcinogenic, mutagenic, or toxic for reproduction
It can therefore be concluded that, in the specific case of software,
Any change of the Basic UDI-DI5
Any changes which impact the original performance, safety, or the interpretation of data6
A change to the name or trade name, version or model number, critical warnings or contra-indications, user interface language
would require a new UDI-DI.
This is to guarantee the traceability and correct identification of the medical device software.
In accordance with Annex VI, Part C, point 6.5.4 of the MDR and Annex VI, Part C, point 6.2.4 of the IVDR, minor software revisions require a new UDI-PI and not a new UDI-DI. Minor software revisions are generally associated with bug fixes, usability enhancements that are not for safety purposes, security patches or operating efficiency. Minor software revisions shall be identified by a defined manufacturer- specific form of identification.
As part of their maintenance and post-market surveillance activities, manufacturers should evaluate the possible impact of any changes to the function of software on the software’s qualification as medical device software, its classification, its intended purpose and essential design and manufacturing characteristics, as that could trigger a new Basic UDI-DI.
Likewise, any changes shall be assessed in defining the need of a new UDI-DI.
UDI placement criteria for software are laid down in Annex VI, Part C, point 6.5.4 of the MDR and Annex VI, Part C, point 6.2.4 of the IVDR. Additional considerations on this aspect will be provided in future guidance.
5 This is a general rule. As indicated in the Guidance on Basic UDI-DI and changes to UDI-DI (available at https://ec.europa.eu/docsroom/documents/28667), "a UDI-DI shall be associated with one and only one Basic UDI-DI”.
6 Annex VI, Part C, point 6.5.2 of the MDR and Annex VI, Part C, point 6.2.2 of the IVDR