MDR Articles 27 to 29 together define three distinct obligations. Article 27 establishes the Unique Device Identification (UDI) system itself — the structure of UDI-DI and UDI-PI, the role of Commission-designated issuing entities, the requirement that manufacturers assign a UDI before placing a device on the market, and the labelling and direct-marking obligations in conjunction with Annex VI Part C. Article 28 establishes the UDI database inside EUDAMED and specifies that it holds the data elements listed in Annex VI Part B for every Basic UDI-DI and UDI-DI. Article 29 places the registration obligation on the manufacturer: before placing a device other than custom-made on the market, the manufacturer must assign a Basic UDI-DI, submit the Annex VI Part B data elements to the UDI database, and — where a Notified Body is involved — provide the Basic UDI-DI to the Notified Body so it appears on the certificate. The practical sequence for a startup is: register the legal entity under Article 31 and obtain the Single Registration Number, choose an issuing entity under Article 27(2), assign the Basic UDI-DI and UDI-DIs, submit the Annex VI Part B data under Article 29, and only then place the device on the market.

By Tibor Zechmeister and Felix Lenhard. Last updated 10 April 2026.

TL;DR

  • Article 27 of Regulation (EU) 2017/745 establishes the UDI system, defines its components, requires manufacturers to assign UDIs under the rules of a Commission-designated issuing entity, and sets out the labelling and direct-marking obligations with Annex VI Part C.
  • Article 28 establishes the UDI database as part of EUDAMED and requires it to contain, for every Basic UDI-DI and UDI-DI, the data elements listed in Annex VI Part B.
  • Article 29 places the registration obligation on the manufacturer: assign a Basic UDI-DI, submit the Annex VI Part B data elements before placing the device on the market, keep them current, and provide the Basic UDI-DI to the Notified Body where applicable.
  • Manufacturer registration itself sits in MDR Article 31, not in Article 29. Article 29 is about registering the device; Article 31 is about registering the legal entity and obtaining the Single Registration Number that Article 29 submissions depend on.
  • Commission Implementing Regulation (EU) 2021/2078 of 26 November 2021 governs the detailed functioning of EUDAMED and the UDI database module. The mandatory use of the UDI and device registration module is conditioned on Article 34 functionality declarations.

The three articles do three different jobs

Startups read Articles 27 to 29 as if they were one long rule about UDI. They are not. They are three adjacent but distinct obligations that are easy to conflate and expensive to get wrong in the conflation.

Article 27 is the UDI system itself — what a UDI is, how it is structured, who assigns it, and where it has to appear on a physical or digital product. Article 28 is the database — what the UDI database is, where it sits inside EUDAMED, and what data elements it must contain. Article 29 is the registration act — the moment at which a manufacturer, before placing a device on the market, submits the Basic UDI-DI and the associated data to the database. Each article has its own scope, its own actor, and its own timing.

This post decodes each article in the order the Regulation presents them, then maps the practical sequence a startup actually has to execute, then flags the errors founders most often make. If you want the conceptual orientation to UDI as a system, start with What is UDI?. The pillar post for the whole EUDAMED cluster is What is EUDAMED?.

Article 27 — the UDI system and the obligations it creates

MDR Article 27 is titled "Unique Device Identification system" and is structured into paragraphs that each do a specific job.

Article 27(1) establishes the system. It states that a UDI system for devices other than custom-made and investigational devices is established to allow identification and to facilitate traceability. The legal form of the system is set out in Annex VI Part C, which contains the technical rules for UDI carriers and for when a new UDI-DI is required.

Article 27(2) requires that UDIs be assigned according to the rules of an issuing entity designated by the Commission. As of April 2026, the Commission-designated issuing entities are GS1, HIBCC, ICCBBA, and IFA. A manufacturer cannot invent its own numbering scheme; it must work under the rules of one of these four.

Article 27(3) sets out the manufacturer's obligations. Before placing a device on the market, the manufacturer must assign a UDI to the device and, where applicable, to all higher levels of packaging. The UDI must be placed on the label of the device and on all higher levels of packaging. The manufacturer must keep an up-to-date list of all UDIs it has assigned. The UDI must also be used for reporting serious incidents and field safety corrective actions under Articles 87 and 88.

Article 27(4) covers direct marking of reusable devices. For devices that are reusable, the UDI carrier must be placed on the device itself. The direct marking obligation is subject to specific exclusions set out in the paragraph — for example where direct marking is not possible because of characteristics of the device. Annex VI Part C contains the technical detail.

Article 27(5) defines what triggers a new UDI-DI. A new UDI-DI is required whenever there is a change that could lead to misidentification of the device or ambiguity in its traceability. Annex VI Part C enumerates the specific change categories — change in device name, change in version or model, change in labelling, change in intended purpose, and others.

Article 27(6) requires the manufacturer to verify, before placing the device on the market, that the data elements referred to in Annex VI Part B (the UDI database elements) have been submitted in accordance with Article 29 to the UDI database. This is the linkage sentence that ties Article 27 to Article 29: the labelling and identification obligations of Article 27 are not complete until the database submission of Article 29 has happened.

The remaining paragraphs of Article 27 cover the harmonisation of the UDI system with international developments, the cooperation with issuing entities, and the conditions under which the Commission may adopt implementing acts.

The startup reading of Article 27 is: define the UDI-DI and UDI-PI structure for your device, choose an issuing entity, get the UDI carrier onto the label and — where the device is reusable — onto the device itself, and keep the internal list of assigned UDIs. Everything else about Article 27 is context around those four concrete obligations.

Article 28 — what the UDI database actually is

Article 28 is short and specific. It establishes the UDI database within EUDAMED and sets out what it must contain.

Article 28(1) directs the Commission, after consulting the Medical Device Coordination Group, to set up and manage a UDI database to validate, collate, process, and make available to the public the information referred to in Annex VI Part B.

Article 28(2) requires that, when designing the UDI database, the Commission take into account the general principles set out in Annex VI Part C Section 5, including compatibility with existing UDI databases, risk-based data element design, and safeguards against fraudulent or incorrect data.

Article 28(3) requires that the data elements referred to in Annex VI Part B be accessible to the public, free of charge.

The key points for a startup are structural. The UDI database is not a separate system from EUDAMED — it is a module within EUDAMED. It contains the Annex VI Part B data, not Annex VI Part A (which is actor registration) and not the production identifiers carried on individual units. The data is intended to be publicly accessible. And the responsibility for the correctness of the submitted data is placed — in Article 29 — squarely on the manufacturer.

Annex VI Part B is worth reading directly. It lists the data elements that must be submitted for every Basic UDI-DI and UDI-DI: identification of the device, quantity per package configuration, the applicable risk class, name and address of the manufacturer, Single Registration Number of the manufacturer, authorised representative where applicable, Notified Body identification number (where relevant), URLs for the instructions for use and other relevant information, presence of substances of concern, information on clinical investigations, and a number of other fields. The list is exhaustive for a reason — it is the regulatory identity of the device that any competent authority, any healthcare provider, or any member of the public can retrieve by looking up the Basic UDI-DI.

Article 29 — the device registration obligation

Article 29 is titled "Registration of devices" and is where the obligations of the previous two articles become a concrete action by the manufacturer.

Article 29(1) requires that, before placing a device other than a custom-made device on the market, the manufacturer shall, in accordance with the rules of the issuing entity referred to in Article 27(2), assign a Basic UDI-DI as defined in Part C of Annex VI to the device and shall provide it to the UDI database together with the other core data elements referred to in Part B of Annex VI related to that device.

Two things are worth pausing on in that sentence. First, the act required is assigning a Basic UDI-DI and submitting the Annex VI Part B data. Second, the timing is "before placing the device on the market" — not after the first unit is shipped, not at the time of the first vigilance report, but before placing on the market.

Article 29(2) requires that, for devices covered by a conformity assessment involving a Notified Body referred to in Article 52 (meaning Class IIa, IIb, III, and specific other categories), the manufacturer shall provide the Basic UDI-DI to that Notified Body before applying for the conformity assessment. After the Notified Body has verified the core data elements and confirmed their adequacy, the Notified Body makes the Basic UDI-DI accessible through the UDI database. The Basic UDI-DI is the identifier that appears on the certificate.

Article 29(3) then states that, following the placing of the device on the market, the manufacturer shall ensure that all of the information referred to in Annex VI Part A Section 2 and Part B is kept up to date. Part A Section 2 references the actor-level data — the manufacturer registration data that lives under Article 31 — and Part B references the device-level data. Article 29(3) is the ongoing-maintenance clause that turns UDI database submission from a one-time act into a living obligation.

Article 29(4) concerns the implementing acts the Commission may adopt to specify the procedure and detailed arrangements for registration.

The most consequential misreading of Article 29 is to treat it as the manufacturer registration step. It is not. Manufacturer registration — the registration of the legal entity as a manufacturer, authorised representative, or importer — sits in MDR Article 31 and is the step that produces the Single Registration Number. Article 29 is device registration, and it presupposes that manufacturer registration under Article 31 has already happened, because the SRN is one of the Annex VI Part B data elements.

How Articles 27, 28 and 29 sequence in practice

The three articles describe a linear workflow for a startup bringing a device to market. The order is not negotiable, because each step depends on the previous one.

  1. Register the legal entity under Article 31 and obtain the Single Registration Number (SRN). This is the prerequisite. Without an SRN, the Annex VI Part B submission under Article 29 cannot be made, because the SRN is a required data element. See the companion post on the Single Registration Number for the detail.
  2. Choose a UDI issuing entity under Article 27(2). GS1, HIBCC, ICCBBA, or IFA. Most pan-European startups choose GS1 unless there is a specific reason to go elsewhere. The decision framework is in Choosing a UDI issuing entity.
  3. Define the Basic UDI-DI groupings. Article 2(15) defines the Basic UDI-DI as the primary identifier of a device model that groups devices sharing the same intended purpose, risk class, and essential design and manufacturing characteristics. This grouping decision shapes the technical file, the declaration of conformity, and the certificate. See How to assign a Basic UDI-DI.
  4. Allocate UDI-DIs and define the UDI-PI elements. Under the rules of the chosen issuing entity and in accordance with Annex VI Part C. A UDI-DI per variant and packaging level; UDI-PI elements (lot, serial, software version, manufacturing date, expiry) as applicable.
  5. Design the label and the direct marking. Annex VI Part C sets out the UDI carrier requirements — machine-readable plus human-readable, placement on label and higher packaging levels, direct marking on reusable devices where feasible.
  6. Provide the Basic UDI-DI to the Notified Body. Required by Article 29(2) before applying for conformity assessment, for device classes that involve a Notified Body.
  7. Submit the Annex VI Part B data to the UDI database under Article 29(1). Before placing the device on the market. Verify under Article 27(6) that the submission has been made.
  8. Maintain the data under Article 29(3). Ongoing, for as long as the device is on the market.

Steps 1 to 6 are preparation. Step 7 is the registration act. Step 8 is the perpetual obligation. A founder who treats Articles 27 to 29 as a checklist to be ticked at the end of the project has already lost time — the Basic UDI-DI strategy needs to be in place while the technical file is being written, not after.

Implementation timeline by risk class

MDR Article 123, the transitional provisions article, sets out the dates by which UDI carrier obligations apply to different risk classes. The general architecture was that implantable and Class III devices were required to carry the UDI on the label first, then Class IIa and IIb, then Class I, with direct marking of reusable devices staged later. Regulation (EU) 2023/607 subsequently amended several of the transitional dates in Article 123 (principally extending the validity of certain MDD/AIMDD certificates and adjusting the sell-off provisions), and the mandatory use of the EUDAMED UDI and device registration module is conditioned under Article 34 on the Commission declaring the module functional.

For a startup placing a new device on the EU market under MDR today, the practical reading is simple: plan for full UDI-DI, UDI-PI, Basic UDI-DI, labelling, direct marking where applicable, and Article 29 registration as part of the initial launch plan. The transitional windows primarily mattered to legacy devices migrating from MDD. Read the latest consolidated Article 123, check the current EUDAMED module status via EUDAMED status in 2026, and confirm any specific effective date before relying on it.

Common founder errors on Articles 27 to 29

Treating Article 29 as manufacturer registration. It is device registration. Manufacturer registration is Article 31. The SRN from Article 31 is a prerequisite for the Article 29 submission.

Submitting Annex VI Part B data late. Article 29(1) requires submission before placing the device on the market. There is no grace period. A device placed on the market without its UDI database entry is non-compliant from day one.

Forgetting Article 27(6). The manufacturer must verify, before placing the device on the market, that the Annex VI Part B data has been submitted. This verification is a concrete step, not a formality.

Missing the Notified Body provision in Article 29(2). For devices requiring Notified Body involvement, the Basic UDI-DI must be provided to the Notified Body before the conformity assessment application. Teams that apply for assessment without a Basic UDI-DI strategy in place create avoidable delay.

Ignoring Article 29(3) maintenance. Submission is not a one-time act. The data must be kept up to date for as long as the device is on the market. Every change to the Annex VI Part B data requires a database update.

Conflating Annex VI Part A, Part B and Part C. Part A is actor registration (Article 31). Part B is the device data elements (Article 28, submitted under Article 29). Part C is the UDI system rules (Article 27). These are three different annex sections governing three different articles.

The Subtract to Ship angle on Articles 27 to 29

Articles 27 to 29 are a good test case for the Subtract to Ship framework for MDR because the work is finite and the waste is easy to identify.

The real work is what Articles 27, 28, 29 and Annex VI explicitly require: choose an issuing entity; define Basic UDI-DI groupings consistent with Article 2(15); allocate UDI-DIs and UDI-PI elements under Annex VI Part C; put the carrier on the label and the direct marking on the device where applicable; provide the Basic UDI-DI to the Notified Body for Class IIa and above; submit the Annex VI Part B data to the UDI database before placing on the market; verify the submission under Article 27(6); maintain the data under Article 29(3). That is the complete list.

Everything outside that list is a candidate for removal. Parallel UDI strategies across multiple issuing entities for a first device, custom databases that mirror Annex VI Part B fields, "UDI governance frameworks" untethered from the three articles, and workshops that do not end with a concrete Basic UDI-DI decision are all waste. If a proposed activity does not trace to Article 27, 28, 29, Annex VI, or Commission Implementing Regulation (EU) 2021/2078, it does not belong in the plan.

Reality Check — Are you ready to execute Articles 27 to 29?

  1. Do you have an SRN under Article 31, or a concrete date by which you will have one?
  2. Have you chosen an issuing entity under Article 27(2) and can you state the reason?
  3. Have you defined the Basic UDI-DI groupings for your device family consistently with Article 2(15)?
  4. Have you allocated UDI-DIs at each packaging level and defined the applicable UDI-PI elements per Annex VI Part C?
  5. Does your label design carry the UDI in machine-readable and human-readable form per Annex VI Part C?
  6. For any reusable device, have you evaluated direct marking under Article 27(4)?
  7. Have you planned to provide the Basic UDI-DI to the Notified Body before applying for conformity assessment, as required by Article 29(2)?
  8. Do you have the full Annex VI Part B dataset prepared for submission before the device is placed on the market, per Article 29(1)?
  9. Do you have a process to verify the submission under Article 27(6) and to maintain the data under Article 29(3)?

If you cannot answer six or more of these cleanly, Articles 27 to 29 are not yet an executable workstream.

Frequently Asked Questions

What do MDR Articles 27, 28, and 29 cover? Article 27 establishes the UDI system, defines the labelling and direct-marking obligations, and requires manufacturers to assign UDIs under the rules of a Commission-designated issuing entity. Article 28 establishes the UDI database inside EUDAMED and specifies that it holds the Annex VI Part B data elements. Article 29 requires the manufacturer to assign a Basic UDI-DI and submit the Annex VI Part B data to the UDI database before placing the device on the market, and to keep that data up to date.

Is Article 29 the same as manufacturer registration? No. Article 29 is device registration. Manufacturer registration — the registration of the legal entity that produces a Single Registration Number — is governed by MDR Article 31. The SRN from Article 31 is a required data element in the Article 29 submission, so manufacturer registration must happen first.

When does Article 29 require the registration to be done? Article 29(1) requires the manufacturer to submit the Basic UDI-DI and the Annex VI Part B data before placing the device on the market. For devices involving a Notified Body, Article 29(2) additionally requires the Basic UDI-DI to be provided to the Notified Body before applying for conformity assessment.

Where in the MDR is the Basic UDI-DI defined? In Article 2(15), which defines it as the primary identifier of a device model and the main access key for information stored in the UDI database.

What data must be submitted to the UDI database? The data elements listed in Annex VI Part B of the MDR — including device identification, packaging configuration, risk class, manufacturer name and address, Single Registration Number, authorised representative where applicable, Notified Body identification number where relevant, URLs for instructions for use, presence of substances of concern, and clinical investigation information.

Which implementing act governs the UDI database in practice? Commission Implementing Regulation (EU) 2021/2078 of 26 November 2021 lays down the rules for the application of Regulation (EU) 2017/745 as regards the European Database on Medical Devices (EUDAMED), including the UDI database module.

Does Article 29 apply to custom-made devices? No. Article 29(1) explicitly excludes custom-made devices from the Basic UDI-DI submission obligation. Custom-made devices have a different regime under MDR Article 52(8) and Annex XIII.

Sources

  1. Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices, Article 2(15) (definition of Basic UDI-DI), Article 27 (Unique Device Identification system), Article 28 (UDI database), Article 29 (registration of devices), Article 31 (registration of manufacturers, authorised representatives and importers), Article 34 (functionality of Eudamed), Article 123 (transitional provisions), Annex VI Part A (information to be submitted upon registration of devices and economic operators in accordance with Articles 29 and 31), Annex VI Part B (core data elements to be provided to the UDI database together with the Basic UDI-DI) and Annex VI Part C (the UDI system). Official Journal L 117, 5.5.2017.
  2. Regulation (EU) 2023/607 of the European Parliament and of the Council of 15 March 2023 amending Regulations (EU) 2017/745 and (EU) 2017/746 as regards the transitional provisions for certain medical devices and in vitro diagnostic medical devices. OJ L 80, 20.3.2023.
  3. Commission Implementing Regulation (EU) 2021/2078 of 26 November 2021 laying down rules for the application of Regulation (EU) 2017/745 of the European Parliament and of the Council as regards the European Database on Medical Devices (Eudamed). OJ L 426, 29.11.2021.

This post is part of the EUDAMED, UDI and Registration category in the Subtract to Ship: MDR blog. Authored by Felix Lenhard and Tibor Zechmeister. The pillar post for this cluster is What is EUDAMED?. For questions about how Articles 27 to 29 apply to your specific device architecture — particularly around Basic UDI-DI groupings and the interaction with Notified Body certificates — read this post alongside What is UDI? and How to assign a Basic UDI-DI.