---
title: Inventory Management for Medical Devices: Traceability Under MDR
description: Inventory management for medical devices under MDR: lot-level traceability, UDI, expiry control, quarantine, and recall readiness on a startup budget.
authors: Tibor Zechmeister, Felix Lenhard
category: Team Building, Operations & Scaling
primary_keyword: inventory management medical devices traceability
canonical_url: https://zechmeister-solutions.com/en/blog/inventory-management-medical-devices
source: zechmeister-solutions.com
license: All rights reserved. Content may be cited with attribution and a link to the canonical URL.
---

# Inventory Management for Medical Devices: Traceability Under MDR

*By Tibor Zechmeister (EU MDR Expert, Notified Body Lead Auditor) and Felix Lenhard.*

> **Inventory for medical devices is not stock on a shelf — it is a chain of evidence. Every unit must be traceable from supplier lot to patient, every expiry must be controlled, every quarantine must be enforceable within minutes of a signal. Get this right early or inherit a recall nightmare later.**

**By Tibor Zechmeister and Felix Lenhard.**

## TL;DR
- MDR Article 25 requires manufacturers to identify, throughout the supply chain, any economic operator to whom they have directly supplied a device, and any economic operator that has directly supplied them.
- MDR Articles 27-29 require UDI assignment and application, enabling unique identification of each device down to the production unit.
- EN ISO 13485:2016+A11:2021 clause 7.5.9 requires documented traceability procedures and, for implantable devices, traceability of components and conditions of work environment.
- FIFO and expiry control are not good-housekeeping habits — they are required production controls under clause 7.5.1.
- Recall readiness is tested by one question: can you list every unit of lot X, by location, within two hours?

## Why inventory traceability matters before you think it does

Most MedTech startups treat inventory as a bookkeeping problem. You buy components, you build devices, you ship them. A spreadsheet is fine until the day something goes wrong.

The day something goes wrong, three things happen simultaneously. You receive a complaint mentioning a specific device. You discover that a component supplier has issued a recall notice for a lot you used between two specific dates. And your notified body asks for evidence of how you segregated the affected stock within 24 hours of the signal.

At that moment, a spreadsheet is not an inventory system. It is a liability. Because the spreadsheet cannot tell you which finished devices contain component lot AX-2387, which of those devices are still in your warehouse, which are with the distributor, which are at the hospital, and which are implanted in patients.

Tibor has audited startups on both sides of this problem — some who had prepared for it and handled a supplier recall in 48 hours with zero finished devices reaching patients, and some who spent three weeks reconstructing records and received a major non-conformity for inadequate traceability. The delta between the two was not budget. It was whether traceability was designed into the inventory workflow on day one.

## What MDR and ISO 13485 actually require

### MDR Article 25 — Identification within the supply chain
Manufacturers must be able to identify, for the period referred to in Article 10(8) — typically 10 years after the last device has been placed on the market, and 15 years for implantable devices — any economic operator to whom they have directly supplied a device and any economic operator that has directly supplied them. This is a bidirectional obligation covering the full shelf life plus the retention window.

### MDR Articles 27-29 — UDI system
Article 27 establishes the UDI system. Each device (other than custom-made) must carry a UDI comprising a UDI-DI (device identifier) and a UDI-PI (production identifier). The UDI-PI includes the lot or serial number, software identification where relevant, and manufacturing or expiry date. Article 29 governs UDI registration in Eudamed.

Operationally, this means every finished device leaving your facility carries a machine-readable identifier that maps, through your inventory records, back to the production lot, to the component lots that built it, and to the date of manufacture and expiry.

### EN ISO 13485:2016+A11:2021 clause 7.5.9 — Identification and traceability
Clause 7.5.9.1 requires identification of product throughout product realisation, with documented procedures for traceability defining the extent of traceability to be maintained and the records required. Clause 7.5.9.2 applies to implantable devices and requires traceability of components, materials, and conditions for the work environment — at a level that allows identification of any device that may have caused or potentially could cause an adverse situation.

### EN ISO 13485 clause 7.5.1 — Controlled conditions of production
Production must occur under controlled conditions, including monitoring, cleanliness, and — critically for inventory — the control of shelf-life-limited materials and components. FIFO enforcement is not a warehouse preference; it is a production control that auditors will verify.

## A worked example: a Class IIa sterile device on 12,000 units per year

Consider a Class IIa sterile single-use device with a 24-month shelf life, a critical sterilant-packaging component, and a polymer substrate with lot-level biocompatibility data. Annual volume: 12,000 units. The traceability workflow must cover:

**Incoming inventory.**
Every incoming lot of polymer, sterilant packaging, electronic subassembly, and label stock is recorded with supplier lot number, receipt date, quantity, and certificate of conformity reference. Incoming inspection results are linked to the lot record. Nothing is released to production stores until the record is complete and inspection is signed off.

**Work-in-process.**
Each production batch is assigned a batch number. The batch record captures which incoming lots were consumed. A single finished device carries a UDI-PI that encodes the batch. Given any finished device UDI-PI, you can retrieve in one query: the batch, every component lot consumed, the operator, the equipment state, the environmental record, the sterilisation cycle, and the release approval.

**Finished goods.**
Finished devices are stored by batch, segregated from released and non-released stock. Released stock is picked FIFO by expiry date. Pick records tie each shipped unit to a specific customer or distributor consignment.

**Distributor stock.**
Under Article 25, the manufacturer must know which economic operator received which lots. The distributor agreement requires the distributor to report stock movements of lot-identified devices back to the manufacturer on demand. The manufacturer maintains a running lot-location view across the supply chain.

**Recall test.**
Once per year, the team runs a mock recall. The signal: sterilant packaging lot SP-2104 is suspected of a pinhole defect. The test: from that signal, identify every finished batch that consumed lot SP-2104, every unit of those batches, their current location, and initiate quarantine within four hours. A failing mock recall is a non-conformity discovered internally — which is how you want to discover it.

## The Subtract to Ship playbook for inventory traceability

You do not need a six-figure ERP to comply with Article 25 and clause 7.5.9. You need discipline and a system that forces the discipline.

### 1. Assign every unit a UDI-PI that is genuinely unique

Lot-level UDI-PI is the minimum for non-implantable devices. For implantables, serial-level identification is effectively required by clause 7.5.9.2 and the implant card obligations under MDR Article 18. Design the UDI-PI scheme before your first production run. Retrofitting UDI onto an existing production line is expensive and audit-risky.

### 2. Enforce single-source data entry

Every time a lot is recorded twice — once on paper in the warehouse and once in a spreadsheet by accounting — you have created a traceability risk. Either invest in a lightweight eQMS or ERP with a traceability module, or build a single-source workflow in whatever tool you have and enforce that nobody records stock movements anywhere else. Double records diverge; divergence becomes an audit finding when one record is missing and the other is wrong.

### 3. Design quarantine as a physical and logical state

Quarantine means the stock cannot be picked for any shipment until formally released. This requires both a physical location (marked, separated, with controlled access) and a logical status flag that blocks picking. Clause 8.3 on nonconforming product control assumes you can enforce this. An auditor will ask to see a quarantined lot. If you cannot point at a physical location and a system record simultaneously, that is a finding. See our post on [nonconforming product control](/blog/nonconforming-product-control) for the procedural detail.

### 4. Run FIFO from expiry date, not receipt date

For shelf-life-limited devices, FIFO by receipt date is wrong. A lot received later but expiring earlier must pick first. Build the pick logic on expiry, not receipt, and automate the daily expiry-approaching report. Clause 7.5.1 expects you to prevent shipment of near-expiry stock when fresher stock is available without justification.

### 5. Make distributor lot visibility a contract requirement

Article 25 traceability does not stop at your dock. Your distribution agreements must obligate distributors to report, on request, the lots and quantities they hold and where they have onward-supplied. This is not optional. Build it into the contract template before you sign your first distributor. For more on distributor and importer obligations, see our [managing distributors and importers under MDR](/blog/managing-distributors-importers-mdr) post.

### 6. Test your recall capability annually with a real clock

A mock recall is only useful if you time it. Set a target — two hours to identify affected stock, four hours to initiate quarantine, 24 hours to draft customer notifications — and measure against it. The gap between what you thought your system could do and what it actually does is where non-conformities live.

## Reality Check

1. Can you, right now, list every finished device that contains a specific supplier lot number within two hours?
2. Does every finished device in your warehouse carry a UDI-PI that encodes its batch and expiry?
3. Is your quarantine stock physically separated and logically flagged so it cannot be picked by mistake?
4. Does your pick logic run FIFO by expiry date rather than receipt date?
5. Do your distributor agreements require on-demand lot-location reporting?
6. When did you last run a timed mock recall, and what did it reveal?
7. Do your incoming inspection records link to the batch records of finished devices that consumed the inspected lots?
8. If your primary person responsible for traceability records left tomorrow, could the next hire execute the system from the SOPs alone?

## Frequently Asked Questions

**Do I need serial-level traceability or is lot-level enough?**
Lot-level is the minimum under the UDI framework for most devices. Implantables effectively require unit-level traceability under clause 7.5.9.2 and Article 18 implant card obligations. High-risk devices often benefit from unit-level even when not strictly required.

**Does Article 25 apply to my direct customers or only to distributors?**
It applies to any economic operator you directly supply. If you sell direct to hospitals, the hospital is not an economic operator under MDR — but the distributor or importer between you and the hospital is, and you must trace that link.

**How long must I retain inventory and traceability records?**
At least 10 years after the last device has been placed on the market, and 15 years for implantable devices, under MDR Article 10(8). This retention applies to production records, batch records, and traceability data.

**Is a spreadsheet ever adequate?**
At very small volumes — say, under 500 units per year of a low-risk Class I device — a rigorously controlled spreadsheet can be adequate if it is version-controlled, backed up, and has a single owner. Above that volume, or for any device with multiple component lots per finished unit, a purpose-built tool pays back quickly.

**What is the most common inventory finding in MDR audits?**
In Tibor's audit experience: inability to demonstrate traceability from a finished device back to all component lots within a reasonable time. The records exist, but they are fragmented, and reconstruction takes days instead of hours.

## Related reading
- [MDR traceability requirements](/blog/mdr-traceability-requirements) — the full clause 7.5.9 breakdown.
- [Lot numbering and traceability under MDR](/blog/lot-numbering-traceability-mdr) — how to design a lot scheme that supports UDI-PI.
- [What is UDI?](/blog/what-is-udi) — the identification framework inventory is built on.
- [Recalls under MDR](/blog/recalls-mdr-withdrawing-device-from-market) — the downstream process inventory traceability must support.
- [Nonconforming product control](/blog/nonconforming-product-control) — the quarantine and segregation procedures.

## Sources
1. Regulation (EU) 2017/745 on medical devices, consolidated text. Articles 10(8), 18, 25, 27, 29.
2. EN ISO 13485:2016+A11:2021 — Medical devices — Quality management systems — Requirements for regulatory purposes. Clauses 7.5.1, 7.5.9, 8.3.

---

*This post is part of the [Team Building, Operations & Scaling](https://zechmeister-solutions.com/en/blog/category/team-operations) cluster in the [Subtract to Ship: MDR Blog](https://zechmeister-solutions.com/en/blog). For EU MDR certification consulting, see [zechmeister-solutions.com](https://zechmeister-solutions.com).*