MDR traceability requirements come from Article 25 of Regulation (EU) 2017/745, which obliges manufacturers, authorised representatives, importers, and distributors to be able to identify any economic operator to whom they have directly supplied a device and any economic operator who has directly supplied them with a device, for the periods laid down in Article 10(8). The harmonised standard EN ISO 13485:2016+A11:2021 supports this obligation through clause 7.5.8 (identification) and clause 7.5.9 (traceability), which together require documented procedures for identifying product throughout realisation and for tracing components, materials, and distribution. MDR Articles 27 and 29 add the UDI layer on top, making each device model and production unit uniquely identifiable. Together, Article 25, the UDI system, and the ISO 13485 clauses form the traceability spine of an MDR-compliant quality system.

By Tibor Zechmeister and Felix Lenhard. Last updated 10 April 2026.

TL;DR

  • MDR Article 25 is the legal obligation: every economic operator must be able to identify who they received a device from and who they supplied it to, for the retention periods in Article 10(8) — at least ten years after the last device has been placed on the market, and fifteen years for implantable devices.
  • EN ISO 13485:2016+A11:2021 clauses 7.5.8 and 7.5.9 give the QMS framework: clause 7.5.8 requires product identification throughout realisation; clause 7.5.9 requires a documented traceability procedure and, for implantable devices, traceability records that cover components and work environment conditions that could cause the device not to meet its specified requirements.
  • The UDI system under MDR Articles 27 and 29 is the mechanism by which each device model and each production unit becomes uniquely identifiable, making Article 25 traceability operable across the supply chain.
  • Annex VI Part A specifies the information to be submitted by manufacturers, authorised representatives, and importers when registering themselves and their devices in EUDAMED — the actor-level data that Article 25 traceability depends on.
  • A startup's traceability system is not a separate project. It is the combination of the UDI decisions, the supplier records, the production records, the distribution records, and the complaint handling records that the QMS already produces — stitched together so that any unit can be traced backwards to its components and forwards to its end user.

Why traceability is the process the auditor always tests

A Notified Body auditor who wants to know whether a quality system is real has one reliable move. Pick a device unit — any one, from any production run — and ask the manufacturer to trace it. Backwards: what were the components, who supplied them, what were the production records, which operators touched it, what tests passed. Forwards: which packaging unit, which distributor, which customer, which incident reports if any. Then ask the same question about a component: which finished devices contain it, which lots, which customers received those lots.

When traceability is real, the answers come out of the system in minutes. When traceability is theatre, the answers take days and come with hedges. The difference is visible immediately, and it is the single most diagnostic test of whether a QMS is being run or is being maintained as a set of documents.

This is why Article 25 and the ISO 13485 traceability clauses deserve attention disproportionate to their word count. They are short. They are also the clauses that decide whether a recall would actually work, whether a vigilance case can be closed, and whether a Notified Body audit will end with a certificate or with a major non-conformity.

What traceability means under MDR

MDR traceability has a specific, bounded meaning that differs from the colloquial use of the word. It is not "we know everything about every unit." It is the ability to answer two specific questions, at any time during the retention period, for any device on the market.

The first question, looking upstream: who supplied us with this device, or with the components of this device? The second question, looking downstream: to whom did we directly supply this device?

The emphasis on "directly" matters. Article 25 does not require a manufacturer to know the identity of the final patient, unless the device is an implantable device where the implant card obligations under MDR Article 18 apply. For most devices, traceability stops at the immediate economic operator — the distributor, the hospital, the wholesaler — who received the unit directly from the manufacturer. That operator, in turn, has its own Article 25 obligation to trace one step further down.

The system is a chain of one-up, one-down traces. No single actor needs to know the entire chain end-to-end. But every actor must know their own step up and their own step down, and must keep that information for the retention period set by Article 10(8) — at least ten years after the last device covered by the record has been placed on the market, and at least fifteen years for implantable devices.

MDR Article 25 — the exact obligation

Article 25 of Regulation (EU) 2017/745, headed "Identification within the supply chain," sets out two concrete obligations for traceability of devices other than custom-made and investigational devices.

First, distributors and importers must cooperate with manufacturers or authorised representatives to achieve an appropriate level of traceability of devices.

Second, economic operators must be able, for the period referred to in Article 10(8), to identify any economic operator to whom they have directly supplied a device and any economic operator who has directly supplied them with a device, as well as any health institution or healthcare professional to which they have directly supplied a device. They must provide this information to the competent authorities on request.

The retention period in Article 10(8) is a minimum of ten years after the last device covered by the EU declaration of conformity has been placed on the market, extended to fifteen years for implantable devices. The technical documentation, the EU declaration of conformity, and certificates are held by the manufacturer; the Article 25 traceability records are held by every economic operator in the chain.

Article 25 is short. Its consequences are not. Every decision about how to label, ship, record, and archive device movements traces back to this article and to the retention period it invokes.

UDI as the traceability backbone

Article 25 tells operators what they must be able to do. MDR Articles 27 to 29 — the UDI system — provide the technical means by which they can actually do it efficiently and across borders.

MDR Article 27 establishes the Unique Device Identification system. Every device (other than custom-made and investigational) must carry a UDI assigned under the rules of a designated issuing entity — currently GS1, HIBCC, ICCBBA, or IFA. The UDI consists of a UDI-DI (the device identifier, unique to the model and packaging level) and a UDI-PI (the production identifier — lot, serial number, software version, manufacturing date, or expiry date). Sitting above the UDI-DI is the Basic UDI-DI defined in MDR Article 2(15), which groups device variants within one family and serves as the primary access key in EUDAMED.

MDR Article 29 then requires the manufacturer, before placing a device on the market, to assign a Basic UDI-DI and to register the device together with the Annex VI Part B data elements in the UDI database within EUDAMED. Annex VI Part A, in parallel, specifies the information that manufacturers, authorised representatives, and importers must submit when registering themselves as actors — the actor-level data that makes the chain addressable in the first place.

The practical effect is that every unit shipped under the MDR carries a machine-readable and human-readable identifier that resolves, via the UDI database, to the manufacturer, the device family, and the regulatory history of the device. The UDI does not replace Article 25 traceability records. It makes them dramatically easier to produce, because every scan of a label becomes a traceable event.

For the full orientation on UDI components and the four issuing entities, read What is UDI? and the deep dive on MDR Articles 27 to 29 UDI requirements.

ISO 13485 clauses 7.5.8 and 7.5.9 — the QMS framework

EN ISO 13485:2016+A11:2021 is the harmonised standard that, under MDR Article 8, gives presumption of conformity with the corresponding MDR requirements when its clauses are correctly applied. Two clauses carry the identification and traceability load.

Clause 7.5.8 — Identification. The standard requires the organisation to document procedures for product identification and to identify product by suitable means throughout product realisation. It also requires identification of the status of product with respect to monitoring and measurement requirements throughout product realisation — which inspection steps have been performed, which have not, and which have produced non-conforming results. For devices where returned medical devices can be mixed with conforming product, the standard requires procedures to ensure the returned product is identified and distinguished.

Clause 7.5.9 — Traceability. The standard requires the organisation to document procedures for traceability in accordance with applicable regulatory requirements. The clause has a sub-clause dealing specifically with implantable medical devices, where records must include the components, materials, and conditions for the work environment used if these could cause the medical device not to satisfy its specified safety and performance requirements. The implant sub-clause also requires the organisation to require its suppliers to maintain traceability records of distributed components and materials to enable traceability.

Together, clauses 7.5.8 and 7.5.9 are the QMS-level implementation of MDR Article 25 and of the implantable device traceability obligations. Clause 7.5.8 makes sure every unit is identifiable at every step of production. Clause 7.5.9 makes sure the identification connects into a traceability chain that reaches upstream to components and downstream to distribution.

A startup building its QMS against the harmonised standard writes two procedures — one for identification, one for traceability — and those procedures must describe the real identification marks, the real record-keeping, and the real retention practices of the company.

Lot and serial number tracking in practice

The operational question for most startups is: lot numbers, serial numbers, or both?

Lot tracking applies when devices are produced in batches where every unit in the batch is considered equivalent for traceability purposes — typical for single-use sterile products, consumables, and many Class I and Class IIa devices. The UDI-PI for a lot-tracked device is the lot number, combined with the manufacturing date or expiry date as applicable.

Serial number tracking applies when each individual unit needs its own identity — typical for reusable devices, active implantables, capital equipment, and any device where failure analysis or recall needs to address individual units rather than whole batches. The UDI-PI for a serial-tracked device is the serial number.

Some devices use both: a lot number for the sterile packaging run plus a serial number for the individual instrument inside. The choice is determined by the device type, the risk class, the failure modes, and the issuing entity's rules.

Clause 7.5.9 does not prescribe lot versus serial. It requires whatever identification is sufficient to satisfy the applicable regulatory requirement — which, under MDR, means whatever is sufficient to support Article 25 traceability and (for implantable devices) the implant card obligations. The decision is made at design time and documented in the traceability procedure. Changing it later is painful because labels, production records, and ERP data all carry the identifier.

Distribution records and the Article 25 chain

Distribution records are where most traceability systems break, not because the records do not exist but because they are not kept in a form that can be queried under pressure.

Under Article 25, a manufacturer must be able to produce, on request from a competent authority, the list of economic operators (and, where applicable, health institutions and healthcare professionals) to whom each device was directly supplied. The list must be complete, accurate, and cover the full retention period — ten years or fifteen years for implantable devices.

The practical implementation for a startup has three moving parts. First, the shipping record: every device unit that leaves the manufacturer's premises is recorded with its UDI-DI, its UDI-PI (lot or serial), the recipient, the date, and the shipment reference. Second, the customer master record: every recipient is a registered legal entity with an address, a contact, and (where relevant) a registration identifier. Third, the archive: the records are stored in a system that survives the retention period, is backed up, and can be queried by UDI-DI, by UDI-PI, by recipient, or by date range.

A system that holds these three elements cleanly can answer Article 25 queries in minutes. A system that holds them in scattered spreadsheets, emails, and shipping receipts cannot.

Implant traceability and the implant card

For implantable devices, traceability is not only a back-office obligation. It reaches the patient directly, through the implant card required under MDR Article 18.

Article 18 obliges the manufacturer of an implantable device to provide, together with the device, an implant card and information to be provided to the patient identified by a UDI. The information includes the identity of the device (including its UDI), the name, address, and website of the manufacturer, any warnings, precautions, or measures to be taken by the patient or a healthcare professional, the expected lifetime of the device, and any necessary follow-up. Health institutions store this information with the patient's health records.

Clause 7.5.9 of EN ISO 13485:2016+A11:2021 reinforces this from the QMS side: the traceability records for an implantable device must include the components, materials, and work environment conditions that could cause the device not to meet its specified requirements. In practice, this means a Class III implant manufacturer maintains a traceability chain that reaches from the individual implant, through the production batch, through the raw material lots, through the supplier qualifications, all the way back to the supplier's own traceability records.

A startup building an implantable device cannot treat traceability as a back-end concern to be solved later. The traceability architecture has to be designed at the same time as the device itself.

Common gaps in startup traceability systems

A handful of patterns appear again and again in early-stage Notified Body reviews.

The shipping log is in the founder's email. Orders and shipments are tracked in inbox threads, not in the QMS. When the auditor asks for the shipping record of a specific lot, the founder searches their email. This fails Article 25.

Supplier traceability stops at the purchase order. The QMS records what was bought, not which lots of components ended up in which finished devices. When a supplier reports a defect in a specific component batch, the manufacturer cannot identify the affected finished devices.

The UDI-PI is not recorded at shipment. The label carries a lot or serial number, but the shipping system records only the UDI-DI and the quantity. The traceability chain breaks at the most important link.

Returned devices are re-mixed with conforming stock. Clause 7.5.8 explicitly addresses this, and clause 8.3 on control of non-conforming product reinforces it. When returns are handled without identification, a single complaint can contaminate the status of an entire batch.

The retention period is interpreted as "a few years." Article 10(8) is specific: ten years minimum, fifteen years for implantable devices, counted from the last unit placed on the market. A startup that ships its final unit in year three of operation still has to maintain the records for at least another ten years after that.

No one has tested the system. The single most diagnostic move a founder can make is to simulate an Article 25 query: pick a random UDI-PI from six months ago and try to produce the full upstream and downstream trace in under an hour. Teams that have never done this are invariably surprised by how long it takes the first time.

The Subtract to Ship angle on traceability

The Subtract to Ship framework applied to traceability produces a specific discipline: every identification field, every recorded attribute, every retention rule must trace to Article 25, to Articles 27 to 29, to clause 7.5.8, to clause 7.5.9, or to a specific higher-class obligation. Fields that do not trace come out. The traceability system is not a place to collect data "because it might be useful later." It is the exact set of identifiers, records, and links required to answer the one-up and one-down question on any unit, for the full retention period.

A startup applying this discipline ends up with a traceability system that is small enough to run with two or three people and complete enough to survive an unannounced audit. Most startups default to the opposite combination: elaborate fields that no one maintains, and missing the two or three fields that Article 25 actually requires.

Reality Check — Where do you stand?

  1. Pick a UDI-PI at random from your last six months of shipments. Can you produce, within one hour, the full list of components that went into that unit and the full list of customers who received it?
  2. Is every shipment out of your facility recorded with UDI-DI, UDI-PI, recipient, and date in a single queryable system, or is the information scattered across email, spreadsheets, and shipping labels?
  3. Do your supplier records connect specific component lots to specific finished device lots, or only to purchase orders?
  4. Do your procedures cover clause 7.5.8 (identification) and clause 7.5.9 (traceability) of EN ISO 13485:2016+A11:2021 with content that matches what your company actually does?
  5. For any implantable device in your portfolio, does your traceability record include components, materials, and work environment conditions as required by clause 7.5.9 for implantable devices?
  6. Is your retention schedule set to at least ten years (fifteen for implantable) after the last unit placed on the market, and does your archive actually cover that horizon?
  7. Have you ever simulated an Article 25 query end-to-end, or is this the first time you are thinking about it?

Frequently Asked Questions

Does MDR Article 25 require the manufacturer to know the final patient? No, except for implantable devices where the implant card obligations under Article 18 apply. For most devices, Article 25 requires one-up and one-down traceability — the manufacturer must know the direct recipient of each unit, and that recipient has its own Article 25 obligation for the next step.

How long must traceability records be kept? Under MDR Article 10(8), at least ten years after the last device covered by the EU declaration of conformity has been placed on the market, extended to fifteen years for implantable devices. Economic operators in the chain must maintain their Article 25 records for at least the same periods.

Is UDI the same as traceability? No. UDI is the identifier system under MDR Articles 27 to 29. Traceability is the obligation under Article 25 and the QMS clauses 7.5.8 and 7.5.9 of EN ISO 13485:2016+A11:2021. UDI is the backbone that makes traceability efficient, but the traceability obligation exists independently of the identifier system and must be implemented by every economic operator in the chain.

Is lot tracking enough, or do I need serial numbers? It depends on the device type, the risk class, and the failure modes. Single-use sterile consumables typically use lot tracking. Reusable instruments, active devices, and implants typically require serial-level tracking. The decision is made at design time and documented in the traceability procedure under clause 7.5.9.

Do software-only devices have traceability obligations? Yes. Software that is itself a medical device falls under Article 25 and under clauses 7.5.8 and 7.5.9. The UDI-PI for software is typically the software version. The traceability chain covers which versions were distributed to which customers and which components (libraries, dependencies) were incorporated into each version.

What is the role of EUDAMED in traceability? EUDAMED hosts the UDI database (Articles 28 and 29) and the actor registration (Annex VI Part A). It is the Union-level layer that makes UDIs and economic operators addressable across borders. The day-to-day Article 25 traceability records, however, live in each economic operator's own QMS system, not in EUDAMED.

Sources

  1. Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices, Article 10(8) (retention periods for technical documentation, declaration of conformity, and certificates), Article 18 (implant card and information to be provided to the patient), Article 25 (identification within the supply chain), Article 27 (Unique Device Identification system), Article 29 (registration of devices), Annex VI Part A (information to be submitted upon registration of manufacturers, authorised representatives, and importers). Official Journal L 117, 5.5.2017.
  2. EN ISO 13485:2016+A11:2021 — Medical devices — Quality management systems — Requirements for regulatory purposes. Clause 7.5.8 (Identification) and clause 7.5.9 (Traceability), including the specific provisions for implantable medical devices.

This post is part of the Quality Management Under MDR category in the Subtract to Ship: MDR blog. Authored by Tibor Zechmeister and Felix Lenhard. The MDR is the North Star. EN ISO 13485:2016+A11:2021 clauses 7.5.8 and 7.5.9 are the tools that make Article 25 traceability workable in a real quality system.