Medical device traceability regulation, country by country

Why every framework looks alike

Behind almost every regulation in force sits the same model: UDI, Unique Device Identification, the framework that standardises how a medical device is identified and which the international forum of medical device regulators promotes.

The practical consequence is that the differences between countries are not about data format. A GTIN is a GTIN in Santiago, in São Paulo and in Riyadh. The differences sit in three places: which risk class comes first, on what date, and above all who is required to act.

How the UDI code is built and what GS1 contributes

Comparison by jurisdiction

Calendars are updated frequently and the governing reference is always each authority's official publication.

The difference that matters most: who is required to act

Read together, the frameworks split into two families, and that split explains why the same project moves fast in one country and stalls in another.

In the first family the obligation begins and ends with industry. The United States and Saudi Arabia require the manufacturer to assign the identifier and submit the data to a public database. The hospital receives a well identified product, but no rule asks it to record anything. There, internal traceability is a management decision rather than a compliance one.

In the second family the obligation reaches the facility. The European Union requires health institutions to keep the UDI of the class III implantables they receive and supply. Chile goes further and requires the record through use or implantation in the patient. There, internal traceability stops being optional.

• Obligation on the manufacturer: United States, Saudi Arabia, Brazil and Colombia at their current stage
• Obligation reaching the health facility: European Union and Chile
• Labelling framework without UDI adoption: Mexico
• Chain traceability over a contained group of products: Argentina

United States and European Union: the two reference frameworks

The UDI rule from the United States Food and Drug Administration was the first large scale implementation and set the vocabulary the rest later adopted. It binds whoever is responsible for the label, in most cases the manufacturer, though it can also be a repackager, a reprocessor or a convenience kit assembler. All that information is submitted to the public identifier database.

The European Union Medical Device Regulation introduced the change that affects a hospital most. Its Article 27 requires health institutions to record and store, preferably by electronic means, the UDI of the class III implantable devices they receive and supply. It has applied since 26 May 2021 and relies on the European medical device database.

That European clause is the direct precedent for what later appeared in Chile: the recognition that traceability breaks precisely where the distribution chain ends and the hospital begins.

Latin America: four different speeds

Brazil has the most defined calendar in the region. The resolution that established UDI was amended in 2024 to extend the deadlines, and the requirement now enters by risk class, from class IV down to class I, with the national identification database as the repository.

Chile is the only country in the region that reached the point of use. Technical Standard 226 covered traceability up to reception and Technical Standard 247 extended it inside the facility, through use or implantation, with inspection by the Superintendency of Health.

Colombia is advancing through the health registration route: incorporating the UDI-DI is a condition for maintaining commercialisation, with deadlines differentiated by risk class.

Argentina solved it earlier than the rest, but with a different scope. Its national traceability system, built on the GS1 standard, covers a contained group of medical products across the chain.

Mexico is the outlier. Its labelling standard expressly admits QR codes, RFID and other electronic media to complement package information, but does not adopt the UDI framework.

Technical Standard 247: the Chilean case in detail

What it means for anyone supplying several countries

For a manufacturer or distributor with regional operations, following each calendar separately is the most expensive way to comply. The alternative is to treat the most demanding requirement as the internal standard and apply it everywhere.

The cost of capturing the complete data set is practically the same as capturing quantity alone. Recording lot, serial and expiry from the source avoids redoing the process every time an authority moves a date or adds a risk class.

• Adopt an accredited issuing agency and use the same identifier across every market
• Tag at source, because tagging at destination multiplies the work by each country
• Capture lot, serial and expiry from the first movement, even where the local market does not yet require it
• Deliver traceability data on the shipping document, which is what several standards require providers to demand
• Prepare the hospital's internal traceability where regulation already reaches it, because that is the stage coming next across the region