Which UDI issuing entity should you use: GS1, HIBCC, IFA or ICCBBA?

You do not invent your own UDI. You get it from an issuing entity the European Commission has designated, and there are exactly four: GS1, HIBCC, IFA and ICCBBA. For most manufacturers the answer is GS1 — but "most" is not "all", and the decision is one you live with, because changing entity means re-assigning identifiers across your portfolio. Here is how to choose, and what the choice actually commits you to.

Who designated them, and until when

The MDR (Regulation (EU) 2017/745) does not name the issuing entities in its own text. Article 27 sets up the UDI system and requires the Commission to designate entities to operate the identifier-assignment systems; the designation itself came in Commission Implementing Decision (EU) 2019/939 of 6 June 2019, following a public call for applications. Four bodies were designated:

• GS1 AISBL
• HIBCC — the Health Industry Business Communications Council
• ICCBBA — which operates the ISBT 128 standard
• IFA GmbH — the Informationsstelle für Arzneispezialitäten

The original designation ran five years. It was renewed by Commission Implementing Decision (EU) 2024/2120 of 30 July 2024, extending all four to 27 June 2029 after the Commission re-assessed each against the designation criteria. So the roster is stable for the rest of the decade — and it is a closed list. No fifth entity, no national alternative, no self-assignment. (The FDA accredits only three of the four: IFA is the EU-only one.)

How to choose between them

The honest framing is that this is rarely a free choice — it is usually determined by what your organisation already runs.

• GS1 is the default, and by a wide margin. If your products already carry a GTIN, the GTIN becomes your UDI-DI directly, which means no parallel numbering scheme and no new barcode symbology on the label. Any manufacturer already selling through retail or hospital supply chains that speak GS1 will find this the path of least resistance. In MD Atlas's indexed subset of EUDAMED, 5,775 economic operators declare a GS1-issued identifier — an order of magnitude more than the other three combined.
• HIBCC suits manufacturers already using HIBC bar coding, historically strong in parts of the medical-supplies and orthopaedic sectors. 274 operators in the indexed subset.
• IFA is the German pharmaceutical information centre, whose numbering (PZN-based) is embedded in the German supply chain. 119 operators.
• ICCBBA is genuinely specialised: ISBT 128 is the international standard for blood, cells, tissues and organs. If you make devices in that space you probably already know it; if you do not, it is not for you. 10 operators.

Two practical criteria decide most real cases: what your existing labelling and ERP systems already emit, and what your customers' scanners expect. A technically perfect identifier that a hospital's scanner cannot read is not a good outcome.

You can see the split for yourself across the whole indexed device corpus — for example devices registered under a GS1-issued identifier versus the ISBT 128 corner — or across the registered economic operators behind them.

One entity per device, and you keep it

The rule that surprises people: the choice is made per device, and it is effectively permanent. Your UDI-DI is issued under one entity's system. Switching means new identifiers, new labels, updated EUDAMED records, and a re-registration of the affected device families. Nothing forbids it, but the cost is real and it is entirely self-inflicted.

Nothing stops a large group from using different entities for different product lines — an acquired business already on HIBCC does not have to be migrated to GS1. What you cannot do is issue two competing UDI-DIs for one device.

The Basic UDI-DI follows the same entity as the UDI-DIs beneath it: it is issued by the same system, and it is the family key that groups your device models together in EUDAMED and on your certificates. Choose the entity before you assign the family, not after.

The fifth path that is not an entity

There is a case where no issuing entity is involved at all, and it accounts for a meaningful slice of what is currently registered: legacy devices.

A legacy device — one lawfully on the market under the old directives and not yet re-certified under the MDR or IVDR — carries no UDI, because the UDI obligations do not apply to it. EUDAMED still has to hold a record for it, so the system assigns its own identifiers: a EUDAMED DI (prefixed B-) in place of the Basic UDI-DI, and a EUDAMED ID (prefixed D-) in place of the UDI-DI. The operational detail is set out in the Commission's guidance on registering legacy devices in EUDAMED (MDCG 2019-5).

This matters for two reasons. First, you do not choose it — the system assigns it, and there is no application to make. Second, when you read a EUDAMED record and see an identifier starting B- or D-, that is not an exotic issuing entity: it is the tell that you are looking at a legacy device, with everything that implies about which regulation it currently sits under.

Getting the registration right

Three checks worth running before you commit:

1. Confirm the entity is designated, not merely a standards body. Plenty of organisations publish identifier standards. Only the four named in Decision (EU) 2019/939, as renewed, can issue a UDI valid for the EU market.
2. Check the whole product family, not one model. The Basic UDI-DI groups devices with the same intended purpose, risk class and essential design — get the family boundary wrong and the identifier structure inherits the error.
3. Confirm what your notified body already has on file. Certificates reference the Basic UDI-DI; a late change to your issuing entity ripples into documents that are not yours to amend.

As always, the figures above come from MD Atlas's indexed subset of EUDAMED as of July 2026, not the complete database, and they count economic operators declaring an identifier from each system rather than devices. The ranking is robust; the absolute numbers move as ingestion continues.