The Medical Device Validation Handbook
169
requirement for 21 CFR Part 830.360 and the
requisites of 21 CFR Part 11. Should the labeler
desire to develop its own solution, it also will
need to follow 21 CFR Part 11, which details
the process companies should use for software
validation. This document also points to 21 CFR
820.70(i) (see above). Because GUDID SPL
submissions do not require a signature, Part 11
requirements specific to electronic signatures
do not apply. Instead of an electronic signature,
the FDA requires the use of a digital certificate
that serves to authenticate the submitter. Digital
certificates are requisites for all data uploaded to
the FDA’s ESG, including the GUDID.
DI records successfully uploaded to the
GUDID using SPL will allow labelers to view
and edit data attributes via the web interface.
Labelers need to be aware that editing uploaded
SPL data via the web interface can lead to
discrepancies between their source data and
GUDID data. It is incumbent on labelers to
create and follow SOPs for data management to
control the quality of their device data.
UDI Post-Implementation Follow-
Through (Change Management)
Managing the UDI process does not end once
labelers have made sure their devices comply
with FDA expectations. They must maintain not
only their systems, making changes as needed
they also must address changes to the device or
its data attributes, and continue to update and
keep current the data in GUDID. This includes
verifying and validating new product listings and
changes to existing devices in the GUDID.
Introducing a new device subject to UDI into
commercial distribution requires the labeling to
comply with the FDA’s UDI rule. It also requires
submission of the DI record for the new device to
be entered into the GUDID before distribution.
Relabeling or changing an existing device
required to have a UDI necessitates assigning a
new DI. In addition, 21 CFR Part 830.60 stipu-
lates keeping a record of the relationship of the
prior device identifier to the new DI.
There are 12 GUDID attributes (see the
FDA’s Design control guidance for medical
device manufacturers—new DI triggers) that, if
changed, require a new DI to be assigned to the
device (model or version) and a new GUDID
submission. Changes to GUDID data attributes
not requiring a new DI must be made within 10
business days. Companies will need to have tight
controls and processes in place to monitor these
attributes for changes. Changes not resulting in
the requisite new DI and GUDID submission
will result in the device being out of compliance,
and it may be misbranded.
Maintaining the System
The FDA under 21 CFR Part 830.3601 expects
the labeler to maintain, retain and make available
to the agency upon request “records showing all
[UDIs] used to identify devices that must bear a
UDI on their label.” The UDI rule stipulates that
device labelers keep these records for three years
from the date they have stopped marketing the
model or version.
Making System Changes
Changes to any of the systems maintaining the
GUDID data, modifications to the labeling soft-
ware or equipment, or changes to software used
for complaint handling or electronic DHRs will
need to go through verification and revalidation.
Updating GUDID
21 CFR Part 830.3301 requires submitting any
changes to the information required by the UDI
rule to the FDA’s GUDID database whenever
necessary. The changed information must be
entered into GUDID no later than the date the
changed information is printed on the device’s
label for the first time. Should the modified
information not be printed on the label, the
changes must be entered into GUDID no later
than 10 business days after the changes go into
effect. Companies should have SOPs in place to
manage this change process. The SOP should
delineate the process for verifying and validat-
ing changed data, including the titles of those
responsible for signing off on the changes.
The FDA also has the right to notify labelers
if it determines information in the GUDID
appears to be incorrect or misleading. If this
occurs, the labeler is responsible for either
169
requirement for 21 CFR Part 830.360 and the
requisites of 21 CFR Part 11. Should the labeler
desire to develop its own solution, it also will
need to follow 21 CFR Part 11, which details
the process companies should use for software
validation. This document also points to 21 CFR
820.70(i) (see above). Because GUDID SPL
submissions do not require a signature, Part 11
requirements specific to electronic signatures
do not apply. Instead of an electronic signature,
the FDA requires the use of a digital certificate
that serves to authenticate the submitter. Digital
certificates are requisites for all data uploaded to
the FDA’s ESG, including the GUDID.
DI records successfully uploaded to the
GUDID using SPL will allow labelers to view
and edit data attributes via the web interface.
Labelers need to be aware that editing uploaded
SPL data via the web interface can lead to
discrepancies between their source data and
GUDID data. It is incumbent on labelers to
create and follow SOPs for data management to
control the quality of their device data.
UDI Post-Implementation Follow-
Through (Change Management)
Managing the UDI process does not end once
labelers have made sure their devices comply
with FDA expectations. They must maintain not
only their systems, making changes as needed
they also must address changes to the device or
its data attributes, and continue to update and
keep current the data in GUDID. This includes
verifying and validating new product listings and
changes to existing devices in the GUDID.
Introducing a new device subject to UDI into
commercial distribution requires the labeling to
comply with the FDA’s UDI rule. It also requires
submission of the DI record for the new device to
be entered into the GUDID before distribution.
Relabeling or changing an existing device
required to have a UDI necessitates assigning a
new DI. In addition, 21 CFR Part 830.60 stipu-
lates keeping a record of the relationship of the
prior device identifier to the new DI.
There are 12 GUDID attributes (see the
FDA’s Design control guidance for medical
device manufacturers—new DI triggers) that, if
changed, require a new DI to be assigned to the
device (model or version) and a new GUDID
submission. Changes to GUDID data attributes
not requiring a new DI must be made within 10
business days. Companies will need to have tight
controls and processes in place to monitor these
attributes for changes. Changes not resulting in
the requisite new DI and GUDID submission
will result in the device being out of compliance,
and it may be misbranded.
Maintaining the System
The FDA under 21 CFR Part 830.3601 expects
the labeler to maintain, retain and make available
to the agency upon request “records showing all
[UDIs] used to identify devices that must bear a
UDI on their label.” The UDI rule stipulates that
device labelers keep these records for three years
from the date they have stopped marketing the
model or version.
Making System Changes
Changes to any of the systems maintaining the
GUDID data, modifications to the labeling soft-
ware or equipment, or changes to software used
for complaint handling or electronic DHRs will
need to go through verification and revalidation.
Updating GUDID
21 CFR Part 830.3301 requires submitting any
changes to the information required by the UDI
rule to the FDA’s GUDID database whenever
necessary. The changed information must be
entered into GUDID no later than the date the
changed information is printed on the device’s
label for the first time. Should the modified
information not be printed on the label, the
changes must be entered into GUDID no later
than 10 business days after the changes go into
effect. Companies should have SOPs in place to
manage this change process. The SOP should
delineate the process for verifying and validat-
ing changed data, including the titles of those
responsible for signing off on the changes.
The FDA also has the right to notify labelers
if it determines information in the GUDID
appears to be incorrect or misleading. If this
occurs, the labeler is responsible for either