Product identification throughout receipt, production, and distribution stages — 820.60 identification and 820.65 traceability requirements persist.
UDI must be integrated into traceability systems; ISO 13485 7.5.9 expands traceability expectations beyond implantables to all device types where risk warrants.
UDI integration in batch and complaint records, and in-process status identification at each production stage — traceability gaps in non-implantable devices are common.
Maps to
QMSR / ISO 13485: §820.60 Identification., §820.65 Traceability.
ISO 13485: §7.5.8 Identification, §7.5.9 Traceability
Requirement text
Product must be identified by suitable means (lot number, batch, serial number, UDI) throughout all stages of product realization. A documented traceability procedure must exist. Traceability records must be maintained to allow investigation of safety-related events.
Why this clause exists
Product identification and traceability are the infrastructure that makes post-market action possible: when a safety-related event occurs — a complaint, a field failure, an MDR-reportable adverse event — the ability to identify which specific devices or lots are involved, trace those devices to their manufacturing history, and determine the scope of devices affected by a similar cause is what distinguishes a targeted, effective response from a broad, uncertain one. Without identification maintained throughout all stages of manufacturing, a finished device cannot be reliably linked to the in-process batches, components, materials, and production conditions from which it was produced. Without a documented traceability procedure, the records needed to support that linkage may not be generated systematically. For implantable devices, the traceability obligation is expanded to cover components, materials, and environmental conditions — because for a device that will remain in a patient for years or decades, the ability to trace a post-market failure back to a specific material lot or process condition is the foundation of effective recall and corrective action. UDI assignment and maintenance in traceability records connects device-level identification with the FDA's Global Unique Device Identification Database (GUDID) and supports population-level signal detection in FDA's post-market surveillance systems: a device identifier that appears in multiple MDR reports creates a detectable pattern; an unidentified device does not.
What changed
§820.60 / §820.65 — Part 820 (legacy)
"Each manufacturer shall establish and maintain procedures for identifying product during all stages of receipt, production, distribution, and installation to prevent mixups. Each manufacturer of a device that is intended for surgical implant into the body or to support or sustain life and whose failure to perform when properly used in accordance with instructions for use provided in the labeling can be reasonably expected to result in a significant injury to the user shall establish and maintain procedures for identifying with a control number each unit, lot, or batch of finished devices and where appropriate components. The procedures shall facilitate corrective action. Such identification shall be documented in the DHR."
§7.5.8 — ISO 13485:2016 (current)
"The organization shall document procedures for product identification and identify product by suitable means throughout product realization. The organization shall identify product status with respect to monitoring and measurement requirements throughout product realization. Identification of product status shall be maintained throughout production, storage, installation and servicing of product to ensure that only product that has passed the required inspections and tests or released under an authorized concession is dispatched, used or installed. If required by applicable regulatory requirements, the organization shall document a system to assign unique device identification to the medical device. The organization shall document procedures to ensure that medical devices returned to the organization are identified and distinguished from conforming product."
Δ Identification now explicitly covers product status (pass/fail/concession) throughout the full lifecycle including servicing; returned-device identification and UDI system documentation are new requirements.
Common gaps (what we see in audits)
- UDI Not Integrated into Traceability System — Traceability systems use internal lot/serial numbers but do not incorporate UDI as a primary identifier. The QMSR expects UDI to be the standard device identifier in traceability records, linking production records, distribution records, and complaint/adverse event reports.
- Traceability too narrow (Implant only) — Traceability procedures only cover implantable devices, missing 'life-sustaining' devices as required by the supplemental QMSR provisions.
- Gaps in In-Process Status Identification — Product status (inspected, pending inspection, rejected, quarantined) is not clearly identified at all stages of production. ISO 13485 clause 7.5.8 explicitly requires identification of product status with respect to monitoring and measurement requirements throughout production.
- Incomplete Traceability for Non-Implantable Devices — Companies that manufacture non-implantable devices may have limited traceability because Part 820.65 traceability was only required for specific device categories. ISO 13485 clause 7.5.9 requires traceability procedures and unique identification for all medical devices, not just implantables.
- Missing Environmental Condition Records for Implantable Devices — For implantable devices, ISO 13485 clause 7.5.9.2 requires records of work environment conditions during manufacturing. Many batch records capture lot numbers and operator IDs but not environmental conditions (temperature, humidity, cleanroom classification) at the time of manufacture.