A manufacturer does not obtain a UDI from the European Commission. Under MDR Article 27(2), UDIs are assigned by the manufacturer itself, under the rules of an issuing entity designated by the Commission. The Commission has designated four issuing entities for the EU UDI system: GS1, HIBCC, ICCBBA, and IFA. To obtain a UDI a manufacturer becomes a member of one of the four entities, receives a manufacturer prefix, allocates UDI-DIs at each packaging level under that entity's rules, composes UDI-PI elements in line with Annex VI Part C, and uses that identifier on the label and — when the EUDAMED UDI module is mandatory under (EU) 2021/2078 and Article 34 — in the UDI database. For most pan-European startups the right entity is GS1, because GS1 is already the de-facto standard in hospital logistics and because the GS1 data carriers are the ones the rest of the supply chain is already reading.

By Tibor Zechmeister and Felix Lenhard. Last updated 10 April 2026.

TL;DR

  • MDR Article 27(2) requires UDIs to be assigned under the rules of an issuing entity designated by the Commission. The four currently designated entities are GS1, HIBCC, ICCBBA, and IFA.
  • The manufacturer joins one entity, obtains a manufacturer prefix, and allocates UDI-DIs itself under that entity's allocation rules. The Commission does not issue UDIs directly.
  • GS1 is the default for most pan-European medical device startups. HIBCC is used primarily by manufacturers with a strong US installed base. ICCBBA is the entity for products of human origin and the devices intimately connected with them. IFA serves the German pharmacy and medical device supply chain.
  • Cost structures differ. GS1 charges an annual membership fee that scales with company revenue in most national member organisations. HIBCC charges a flat annual licensing fee. ICCBBA charges a licensing and registration fee. IFA charges per registered product.
  • The same Basic UDI-DI and UDI-DI structure flows into EUDAMED regardless of which entity is used. The entity choice governs how the identifier is encoded on the carrier, not what is stored in the UDI database.

A founder reads Article 27(2) and finds a sentence, not a process

Article 27(2) is four lines of regulation that hand the whole question of UDI assignment off to external organisations. The founder reading it for the first time sees the words "issuing entity designated by the Commission" and assumes there is a Commission portal somewhere that hands out UDI numbers. There is not. The Commission designates the entities. The entities run their own membership, their own fee schedules, and their own technical allocation rules. The manufacturer joins one of them, learns its system, and assigns its own UDIs inside that system.

This post is the practical walkthrough of that process. It explains who the four entities are, what each is designed for, how to choose between them without wasting a month on a false comparison, what each costs in rough terms, how the choice interacts with EUDAMED, and what happens if the choice later turns out to be wrong. For the conceptual orientation to UDI itself, read What is UDI?. For the article-by-article reading of Articles 27 to 29, read MDR Articles 27-29 UDI requirements decoded. For the difference between the two UDI components, read UDI-DI vs UDI-PI.

The four issuing entities

MDR Article 27(2) requires that UDIs be assigned according to the rules of an issuing entity designated by the Commission. The Commission adopts the designation through an implementing act, and the four entities currently designated for the EU UDI system are GS1, HIBCC, ICCBBA, and IFA. Each was already operating its own identifier system for medical products before MDR; the Commission designation formalises their role inside the EU regulatory architecture.

GS1. GS1 is the global standards organisation best known for the barcodes on consumer goods. Its healthcare standards — the GTIN (Global Trade Item Number), GS1 Application Identifiers, GS1-128 linear barcodes, and GS1 DataMatrix 2D codes — are the ones already scanned by the majority of hospital logistics systems in Europe. GS1 operates through national member organisations (GS1 Germany, GS1 Austria, GS1 France, and so on), and a manufacturer joins the member organisation of the country where the legal entity is based.

HIBCC. The Health Industry Business Communications Council is a US-origin not-for-profit that maintains the HIBC (Health Industry Bar Code) standard. HIBCC identifiers are widely used by manufacturers with a strong US installed base, particularly in orthopaedics, surgical instruments, and hospital implantables that pre-date the GS1 dominance in Europe. HIBCC runs as a single global organisation rather than through national chapters.

ICCBBA. The International Council for Commonality in Blood Banking Automation maintains the ISBT 128 standard, the established international identifier for products of human origin — blood, cells, tissues, and related cellular therapy products. The Commission designated ICCBBA for medical devices that are intimately connected with products of human origin, because ISBT 128 is already how those products are traced. A device that packages, delivers, or is used in direct processing of human tissue is often the case where ICCBBA is the right entity.

IFA. Informationsstelle für Arzneispezialitäten, based in Frankfurt, is the German pharmaceutical and medical device data centre historically used by the German pharmacy supply chain. IFA issues PZN (Pharmazentralnummer) identifiers that the German pharmacy and reimbursement system is built around. For a manufacturer whose principal channel is German pharmacies or whose products interoperate with the German reimbursement infrastructure, IFA has a specific role. For a pan-European startup without that channel, IFA is not the default.

None of these four is "better" than the others in the abstract. They are designed for different supply chains, and the right one for a given startup is the one whose supply chain already matches where the devices will go.

Scope and industry orientation of each entity

The clearest way to think about the four entities is by the supply chain they were built for.

GS1 — general-purpose hospital and distribution logistics. GS1 is the right default when the devices will move through general hospital purchasing, through European distributors, through group purchasing organisations, or through any channel where the downstream systems already read GS1 barcodes. This covers the overwhelming majority of new medical device startups entering the EU market. If a founder has no specific reason to choose otherwise, GS1 is the correct answer.

HIBCC — US-origin and specialist surgical portfolios. HIBCC is the right entity when the company already has a HIBCC prefix because it sells into the US market under FDA UDI with HIBCC, and wants a single identifier system across both jurisdictions. It is also common in specialist device categories — orthopaedic implants, surgical instruments — where HIBCC was historically entrenched. Dual-coding between HIBCC and GS1 is technically possible but operationally painful, and is a choice almost no startup should make.

ICCBBA — products of human origin and directly coupled devices. ICCBBA is the right entity when the device is intimately coupled with a product of human origin — a blood bag, a tissue scaffold packaging system, a cell therapy cassette, a device that is used in the direct handling or administration of human cells or tissues. For most MDR devices, ICCBBA is not in play. For devices in scope, it is usually the only sensible choice because the surrounding biological product is already identified under ISBT 128.

IFA — German pharmacy supply chain. IFA is the right entity when the device moves through German pharmacies as the dominant channel and must interoperate with PZN-based reimbursement and dispensing systems. Outside that specific context, IFA is an unusual choice and likely to create friction with non-German distributors.

The four descriptions above are enough for a startup to pick the right entity in almost every case without a week of comparison shopping. The founders who spend too long on the decision are almost always founders who have not yet asked the right upstream question — which is "where will the devices actually be sold."

How to choose between them

The decision framework has four questions, applied in order.

Question 1 — is the device intimately coupled with products of human origin? If yes, ICCBBA is almost certainly the right entity. Stop here.

Question 2 — is the principal channel the German pharmacy and reimbursement supply chain? If yes, evaluate IFA carefully and talk to the distributor channel before deciding. If no, IFA is not the default.

Question 3 — does the company already have a HIBCC prefix from an existing US product and a strong reason to keep one identifier system globally? If yes, HIBCC is defensible. If no, go to Question 4.

Question 4 — for everything else. GS1. The reasons are cumulative: GS1 is the de-facto standard in European hospital logistics, GS1 DataMatrix is the carrier the downstream systems expect to see, GS1 national member organisations provide local support in the manufacturer's own country, and the GS1 Application Identifier syntax is the one most integrators and label printing vendors already implement out of the box.

A founder who runs this four-question filter and arrives at GS1 has made the right decision in well under an hour. A founder who stalls on it for weeks has turned a tactical decision into an avoidance activity. Make the call, document the reason, and move on to Basic UDI-DI allocation, which is where the real work lives.

Cost structures of the four entities

The fee structures differ and change periodically, so any specific numbers a founder reads in a blog post should be confirmed against each entity's current schedule before a budget is signed off. The structural shape of the fees, which changes less, is what a planning conversation actually needs.

GS1. GS1 is organised through national member organisations, and fees are set by each national organisation. Most of them charge an annual membership fee that scales with the registering company's annual revenue, plus a one-time joining fee. The smallest startups typically fall into the lowest revenue tier and pay a modest annual fee. Companies growing past the smallest tier move up the revenue bands over time. Confirm the current schedule with the GS1 national member organisation in the country where the legal entity is based (GS1 Germany, GS1 Austria, GS1 France, GS1 Italy, GS1 Spain, GS1 UK, and so on).

HIBCC. HIBCC charges a flat annual licensing fee for a Labeler Identification Code (LIC), independent of company revenue. This can make HIBCC relatively attractive for companies at a revenue level where the GS1 tiered fee would be higher, but most startups are well below that crossover. Confirm current fees with HIBCC directly.

ICCBBA. ICCBBA charges a licensing and registration fee structure set by ICCBBA for the ISBT 128 system. For devices that qualify for ICCBBA, the fees are rarely the deciding factor — the regulatory fit is.

IFA. IFA historically charges per registered product through its pharmacy data catalogue. The structure rewards a small portfolio and penalises a wide one. Confirm current fees with IFA directly.

Two points matter more than the specific numbers. First, fees at all four entities are an operating cost, not a capital cost — they recur annually. Second, the fee difference between entities is, for almost every startup, much smaller than the operational difference between entities. A founder who chooses HIBCC over GS1 to save a modest fee and then discovers the European distributor channel cannot read the resulting labels without custom integration has made an expensive decision dressed up as a cheap one.

How entity choice integrates with EUDAMED

A useful thing to hold in mind throughout this decision: the entity choice governs how the UDI is encoded on the carrier, not what is stored in the UDI database.

EUDAMED, established by MDR Article 33 and operated under Commission Implementing Regulation (EU) 2021/2078, holds the Basic UDI-DI and the UDI-DI with the Annex VI Part B data elements. The mandatory use of the UDI and device registration module is conditioned under MDR Article 34 on the Commission declaring the module functional. Inside the database, the fields are the same regardless of which issuing entity produced the UDI-DI. A UDI-DI issued as a GS1 GTIN, a HIBCC LIC-based code, an ISBT 128 identifier, or an IFA PZN all flow into the same Annex VI Part B structure.

What differs is the carrier on the label and the data parsing at the downstream scanner. A GS1 DataMatrix is parsed with GS1 Application Identifiers. A HIBCC code is parsed with HIBCC data structures. ISBT 128 uses its own data identifiers. PZN uses its own syntax. The database is agnostic; the supply chain is not. Choose the entity whose carrier the downstream supply chain already reads, and the EUDAMED side will work with any of them.

The companion post on device registration in EUDAMED walks through the Article 29 submission itself once the entity has been chosen.

Changing entity later — and why to avoid it

A founder sometimes asks whether the entity choice is reversible. Technically yes. Operationally, switching issuing entities after devices have been placed on the market is expensive and leaves a long paper trail.

Every UDI-DI on the previous entity's numbering scheme is a separate identifier from any new UDI-DI on the new entity's scheme. The two cannot be "converted" — they are different codes in different systems. Switching means allocating new Basic UDI-DIs and UDI-DIs under the new entity, relabelling devices in stock, updating the technical documentation, updating the Notified Body certificate where the Basic UDI-DI appears, updating the EU declaration of conformity, and making a new Annex VI Part B submission to the UDI database. Old labels in the field remain valid until the devices are consumed, so there is a transitional period during which the product exists under two parallel UDI-DI identities.

The lesson is not that the decision is irreversible. It is that the decision is much cheaper at day zero than at day 500. Make it deliberately, document the reasoning, and treat it as a settled foundation rather than a reopenable question. If a genuine strategic reason later forces a switch — acquisition, channel change, regulatory restructure — the cost is real but it is payable.

The Subtract to Ship angle on choosing an issuing entity

The entity decision is a clean case for the Subtract to Ship framework for MDR because the work that survives is finite and the waste is easy to spot.

The real work is: answer the four-question decision filter, confirm the current fee schedule with the chosen entity, join the entity, obtain the manufacturer prefix, learn the entity's allocation rules for UDI-DIs and the composition of UDI-PI elements under Annex VI Part C, and integrate the allocated identifiers into the label design, the ERP, the technical documentation, and the EUDAMED submission plan. That is the complete list.

Everything else is a candidate for removal. The "comparison workshop" that evaluates all four entities from scratch for a company whose distribution channel makes the answer obvious. The parallel dual-entity strategy for a first product. The custom internal numbering scheme built on top of the issuing entity's codes "for flexibility." The procurement cycle optimisation around the fee schedule of an entity that does not fit the channel. None of these trace back to Article 27, Annex VI Part C, or (EU) 2021/2078. They come out.

Reality Check — Can you defend your issuing entity choice?

  1. Have you answered the four-question decision filter and written down the answer?
  2. Do you know which entity your principal European distribution channel expects to see on labels?
  3. Have you confirmed the current fee structure with the chosen entity directly (not from a blog post, including this one)?
  4. For GS1 specifically, have you identified the correct national member organisation based on the country of your legal entity?
  5. Have you checked whether the devices couple intimately with products of human origin, which would point to ICCBBA?
  6. If you are considering HIBCC, do you already have a HIBCC prefix or a specific reason tied to a US installed base?
  7. Does your label design vendor and your ERP integration plan already support the chosen entity's data carrier syntax?
  8. Have you documented the entity choice in the technical documentation with a one-paragraph rationale, so that a Notified Body auditor can see the decision was deliberate?

If you cannot answer six or more of these cleanly, the issuing entity choice is not yet settled.

Frequently Asked Questions

Does the European Commission issue UDIs directly? No. Under MDR Article 27(2), the Commission designates issuing entities and the manufacturer obtains UDIs under the rules of one of those entities. The four currently designated entities are GS1, HIBCC, ICCBBA, and IFA. The manufacturer joins one, receives a manufacturer prefix, and allocates UDI-DIs inside that entity's system.

Which issuing entity should most EU medical device startups choose? For most pan-European medical device startups, GS1 is the right default. GS1 is the de-facto standard in European hospital logistics, GS1 DataMatrix is the carrier most downstream systems already read, and GS1 operates through national member organisations that provide local support. HIBCC, ICCBBA, and IFA each serve specific contexts where they are the better choice.

Can I use more than one issuing entity at the same time? Technically yes, but for a first product it is operationally painful. Different entities use different data carrier syntaxes, and dual-coding labels complicates printing, scanning, and ERP integration. The framework recommendation is to choose one entity per device family.

Is the issuing entity choice reversible later? Yes, but expensive. Switching entities means allocating new Basic UDI-DIs and UDI-DIs, relabelling devices in stock, updating the technical documentation, the declaration of conformity, the Notified Body certificate, and the UDI database submission under Article 29. Make the choice deliberately at the start.

Does the entity choice affect what gets stored in EUDAMED? No. The EUDAMED UDI database holds the Basic UDI-DI and UDI-DI with the Annex VI Part B data elements regardless of which entity produced the identifier. The entity choice governs how the UDI is encoded on the physical carrier, not the fields stored in the database. Commission Implementing Regulation (EU) 2021/2078 governs the detailed functioning of EUDAMED.

How much does a GS1 membership cost for a startup? The GS1 fee structure varies by national member organisation and typically scales with the company's annual revenue. Confirm the current joining fee and annual membership fee with the GS1 national member organisation in the country where the legal entity is based before budgeting.

Does ICCBBA apply to most medical devices? No. ICCBBA is designated for the identification of products of human origin and for medical devices intimately connected with them — for example devices directly handling blood, cells, or tissues. For most medical devices, ICCBBA is not in scope and the right entity is GS1.

Sources

  1. Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices, Article 27 (Unique Device Identification system), Article 27(2) (assignment under the rules of an issuing entity designated by the Commission), and Annex VI Part C (the UDI system, including the rules for UDI-DI allocation, UDI-PI composition, and UDI carrier requirements). Official Journal L 117, 5.5.2017.
  2. Commission Implementing Regulation (EU) 2021/2078 of 26 November 2021 laying down rules for the application of Regulation (EU) 2017/745 of the European Parliament and of the Council as regards the European Database on Medical Devices (Eudamed). OJ L 426, 29.11.2021.
  3. European Commission implementing decisions designating issuing entities for the UDI system — currently GS1, HIBCC, ICCBBA, and IFA. Readers should consult the Commission's EUDAMED information page and each entity's own website for the current fee schedules and membership rules.

This post is part of the EUDAMED, UDI and Registration category in the Subtract to Ship: MDR blog. Authored by Felix Lenhard and Tibor Zechmeister. The pillar post for this cluster is What is EUDAMED?. For questions about which issuing entity fits a specific device architecture and distribution channel, read this post alongside What is UDI? and MDR Articles 27-29 UDI requirements decoded.