Understanding GUDID-A Guide for Medical Device Labelers

Understanding GUDID: A Guide to the Global Unique Device Identification Database for Medical Device Labelers

The Global Unique Device Identification Database (GUDID) is the central database of the FDA's Unique Device Identification (UDI) system. It gives regulators, healthcare providers, researchers, and patients one authoritative source of device identification information. For a medical device labeler, understanding GUDID matters for compliance and also for keeping your devices traceable and trusted throughout their lifecycle.

This guide explains what GUDID is, how UDIs are assigned, who must submit data, and the steps to follow. It also covers how to keep records accurate over time.

What is GUDID?

GUDID is a database managed by the FDA that stores identifying information about medical devices distributed in the U.S. It holds only standardized descriptive attributes. It does not contain confidential design or performance data.

Each record in GUDID is tied to a device identifier (DI), which identifies a specific version or model of a device from a specific labeler.

Why Is the GUDID Database Important?

GUDID supports the goals of the UDI system in four main ways:

• Transparency: Anyone can look up standardized details about a device.
• Traceability: Devices can be identified quickly, which helps recalls, adverse event reporting, and post-market surveillance.
• Standardization: Consistent attributes and terminology make device identification uniform across manufacturers.
• Global alignment: UDI systems worldwide follow similar principles, so a common approach to device identification supports international device tracking.

For labelers, accurate GUDID records also reduce the risk of compliance findings and misbranding, and they make your devices easier to identify in hospital and supply chain systems.

Understanding the GUDID Database

GUDID is a repository of device identification data, not a full device file. Labelers submit records, and the FDA validates and publishes them. Once released, the data is available to the public through AccessGUDID, run by the National Library of Medicine, and through openFDA.

A GUDID record has one DI record for each device version or model, and it includes:

• The device identifier (DI) and the issuing agency that assigned it
• Device attributes such as device name, brand, version or model, and catalog number
• The FDA product code and the GMDN term (standardized nomenclature)
• Package information, including package configurations
• Production identifier (PI) flags showing whether the label carries a lot or batch number, serial number, manufacturing date, or expiration date
• Direct marking details, if the device carries a permanent UDI marking

Important: GUDID does not store the actual PI values, such as individual serial numbers or batch codes. It only records whether those elements appear on the label.

How GUDID and UDI Work Together

The UDI system has two connected parts: the UDI on the device label and packages, and the device information in GUDID.

1. The labeler creates a UDI, made of a DI and, where applicable, a PI.
2. The UDI is printed on the label in plain text and in a machine-readable barcode. Some devices are also directly marked.
3. The labeler submits the DI and its attributes to GUDID.
4. Anyone who scans or reads the DI can look it up in AccessGUDID and find the device details.

The DI is the link. The PI is variable and stays on the label, so the database can tell you what a device is, while the label tells you which specific unit or batch it is.

How is a UDI Assigned?

A UDI has two parts, and it must be issued through an FDA-accredited issuing agency. These are GS1, the Health Industry Business Communications Council (HIBCC), the International Council for Commonality in Blood Banking Automation (ICCBBA), and IFA. The labeler picks an agency and follows its coding standard.

Device Identifier (DI)

The DI is the fixed, mandatory part of the UDI. It identifies the labeler and the specific version or model of the device. It is the part submitted to GUDID.

Production Identifier (PI)

The PI is the variable, conditional part. It can include a lot or batch number, serial number, manufacturing date, or expiration date, and it appears only if it is on the label. It is not submitted to GUDID beyond the yes/no flags.

In a GS1 barcode, each element is marked with an application identifier in parentheses:

Who Must Submit Data to the GUDID Database?

The labeler is responsible for submitting data. In the UDI rule, a labeler is the person who causes a label to be applied to a device, or causes the label to be modified, with the intent that the device be commercially distributed without another replacement or modification of the label. In practice this is usually the manufacturer, but it can also be a specification developer, a relabeler, or another party.

Key points:

• The UDI requirements were phased in by device class, starting in 2014 with the highest-risk devices, and now apply broadly.
• Some devices are excepted, for example certain low-risk Class I devices, and devices made only for export or investigational use. Check 21 CFR 801.30 to confirm whether your device is excepted.
• A third party can submit data for you, but the labeler stays legally responsible for the accuracy and completeness of what is submitted.

What Information Must Be Submitted to GUDID?

Each DI record contains standardized data elements. The exact list is in the FDA's GUDID Data Elements Reference Table. The main groups are:

Steps Labelers Must Follow

Preparation

Before you request a GUDID account:

• Get a DUNS number. GUDID uses DUNS numbers to identify labeler organizations, and the labeler's name and address are pulled from the DUNS database. Make sure the DUNS record matches how your company appears on the label. registrarcorp
• Choose an issuing agency and obtain your labeler prefix so you can create DIs.
• Identify key user roles:
  • Regulatory Contact: the official responsible for compliance.
  • Coordinator: manages the account and user setup.
  • Labeler Data Entry (LDE) user: enters device data.
• Decide whether a third-party submitter will help. The labeler remains responsible for accurate and complete submissions.

Request a GUDID Account

Submit an account request to the FDA. Each account is tied to your labeler's DUNS number.

• Provide details for the Regulatory Contact and the Coordinator.
• Choose your submission method:
  • Web interface: manual entry, best for lower volumes.
  • HL7 SPL via the FDA Electronic Submissions Gateway (ESG): XML file submissions, best for high volumes. This route requires that you first create an FDA ESG account and complete ESG testing, then request a GUDID test account and complete HL7 testing. registrarcorp
• Once approved, the FDA provides login credentials.

Create and Manage DI Records

Every device version or model needs its own DI record in GUDID. A record can be in one of three states:

• Draft: editable and not yet validated. Drafts are not visible to the FDA. 
• Unpublished: validated and scheduled for a future publish date.
• Published: live in GUDID and searchable by the public.

Maintain Accuracy Over Time

Publishing is not the end of the work. Keep records current for the whole product lifecycle, update them within 10 business days when information changes, and follow the editing rules after the grace period. The section on maintaining accurate data explains these in detail.

How to Search and Access the GUDID Database

Anyone can search device information without an account through AccessGUDID, the public interface run by the National Library of Medicine. Records are released to the public on AccessGUDID and openFDA after the grace period. 

You can typically:

• Search by DI, brand name, company name, version or model number, catalog number, GMDN term, or product code
• View a device's full record, including package details and PI flags
• Download the full GUDID dataset for analysis
• Use the available application programming interface (API) to look up or parse UDIs in software

Labelers can use it to check that published records match their labels. Hospitals and distributors can use it to identify devices, and researchers can use it to analyze device data.

Maintaining Accurate GUDID Data

Grace period. When a DI record is published, a grace period of seven calendar days starts the day after the publish date. During this period, all data element values can be edited except the publish date. Treat it as a final review window, because after it ends the record goes public. 

After the grace period. Edits are restricted once the record is released to the public. Some data elements can no longer be changed. A Coordinator user can unlock a published record that is past its grace period to correct locked fields. 

Updating changes. Changes to GUDID attributes that do not require a new DI must be made within 10 business days. Examples include a GMDN term becoming obsolete or a change in commercial distribution status. 

New DIs. Some data elements are "new DI triggers." Changing one means the device is no longer the same device, so a new DI and a new DI record are required. Check the FDA's guidance on when a new DI is needed before changing a device version, model, or packaging. 

Good practices:

• Assign an owner for GUDID data and link it to your change control process, so design, labeling, and packaging changes trigger a GUDID review.
• Compare each record against the actual label before publishing.
• Audit your records periodically.
• If a third party submits data for you, review their work.
• Keep UDI records as required by 21 CFR 830.360.

Common GUDID Submission Challenges

• DUNS problems: A DUNS record whose name or address does not match your label, or delays getting one verified.
• Deciding when a new DI is needed: Confusion about which changes are trigger changes.
• Package hierarchies: Errors when linking base devices and packages, or in device counts.
• Product code and GMDN selection: Choosing an incorrect code, or leaving obsolete GMDN terms in place.
• Mismatch between label and GUDID: Data in the database that differs from the printed label or your internal systems.
• HL7 SPL and ESG setup: Technical set-up, testing, and validation errors for high-volume submitters.
• Edit restrictions: Errors found after the grace period, when correction needs an unlock.
• Third-party submitters: Assuming that outsourcing also transfers responsibility.
• Late updates: Missing the 10-business-day window when information changes.

FAQ about GUDID database

FAQ about GUDID database

1. What is the purpose of the GUDID database?

The Global Unique Device Identification Database (GUDID) is the FDA's central repository of standardized identifying information about medical devices distributed in the U.S. It is the database behind the Unique Device Identification (UDI) system. Each record is tied to a device identifier (DI), which identifies a specific version or model from a specific labeler.

GUDID exists to make devices identifiable and traceable across their lifecycle. Regulators, hospitals, and researchers can look up a device's attributes, which helps with recalls, adverse event reporting, and post-market surveillance. The information is public through AccessGUDID and openFDA. GUDID does not hold confidential design or performance data, and it does not store production identifiers such as serial or lot numbers. It records only whether those appear on the label.

2. Who is required to submit data to GUDID?

The labeler, meaning the party that causes a label to be applied to a device or causes the label to be modified, with the intent that the device be commercially distributed without another change to the label. In practice this is usually the manufacturer, but it can also be a specification developer, relabeler, or another party.

Some devices are excepted from UDI requirements, for example certain low-risk devices, devices made only for export, and investigational devices. Check 21 CFR 801.30 to confirm whether your device is excepted. A third party can submit data for you, but the labeler stays legally responsible for its accuracy and completeness.

Under 21 CFR Part 820 (now the QMSR), your quality system must also record the UDI for each device or batch, and include it in complaint and service records. Your GUDID data and quality records should therefore agree.

3. How do I register for a GUDID account?

1. Get a DUNS number. Each GUDID account is tied to your labeler's DUNS number, and GUDID pulls the labeler's name and address from the DUNS database. 
2. Choose an issuing agency (GS1, HIBCC, ICCBBA, or IFA) and get your labeler prefix so you can create DIs.
3. Name your roles. These are the Regulatory Contact, the Coordinator (who manages the account and users), and Labeler Data Entry users.
4. Submit the account request to the FDA with the Regulatory Contact and Coordinator details.
5. Pick your submission method. The web interface suits small volumes. HL7 SPL through the FDA Electronic Submissions Gateway (ESG) suits large volumes, and it requires you to set up an ESG account and complete ESG testing, then request a GUDID test account and complete HL7 testing. 
6. Receive login credentials once the FDA approves the request.

Under ISO 13485, treat the GUDID account, user roles, and submission procedures as controlled parts of your quality system.

4. What information must be submitted to the GUDID database?

Each DI record contains standardized data elements. The exact list is in the FDA's GUDID Data Elements Reference Table. The main groups are:

• Identification: the DI, issuing agency, labeler DUNS number, and company name.
• Device description: brand name, version or model number, catalog number, and device description.
• Classification: the FDA product code (which comes from medical device classification), the GMDN term, and, where applicable, the premarket submission number for an FDA 510(k) or premarket approval (PMA).
• Regulatory and use information: prescription or over-the-counter status, MRI safety, latex information, and single-use status.
• Physical attributes: sterility, clinically relevant size, and storage and handling.
• Packaging: device count and package configurations.
• Production identifier flags: whether the label carries a lot or batch number, serial number, manufacturing date, or expiration date.
• Marking and status: direct marking details and commercial distribution status.

Accuracy matters because some attributes, such as MRI safety, latex, and sterility, are risk-related. Keep them consistent with your ISO 14971 risk file and labeling. For software devices, keep the version and identification aligned with IEC 62304 configuration management, and with the version you tested, including usability engineering results such as formative and summative evaluation. For the EU, device names and versions should also match your technical documentation and clinical evaluation report (CER), since the EU has its own separate UDI database requirements.

5. How can I update or correct GUDID records?

The rules depend on where the record is in its life.

• Draft and unpublished records can be edited. Drafts are not visible to the FDA.
• During the grace period, a published record has a seven-calendar-day period that starts the day after the publish date, in which all data elements can be edited except the publish date. Use it as a final review. 
• After the grace period, the record is released to the public on AccessGUDID and openFDA, and edits are restricted. A Coordinator user can unlock a published record that has passed its grace period to correct locked fields. 
• Changes that don't require a new DI must be made within 10 business days, for example when a GMDN term becomes obsolete or commercial distribution status changes. 
• "New DI trigger" changes are different. These are data elements that, when changed, mean the device is no longer the same device and require a new DI. Record a version or model change as a new DI record rather than an edit. Record discontinuation through commercial distribution status instead of trying to delete a published record. 

Good practice: link design, labeling, and packaging changes to a GUDID review in your change control process, so updates aren't missed. Keep your submission records under controlled procedures, and if they are electronic, apply 21 CFR Part 11 controls such as access limits and audit trails.