FDA UDI labelling + DSCSA traceability, what must merchants store per SKU, per lot?

Two separate FDA requirements that often get confused:

UDI (Unique Device Identifier), per-SKU identifier for medical devices, in effect since 2014 for Class III and rolled down to Class I by 2022. Two parts:

• DI (Device Identifier), static per SKU. Composed of issuing agency code (GS1, HIBCC, or ICCBBA) + device-specific identifier. Submitted to FDA’s GUDID database.
• PI (Production Identifier), per-lot. Includes lot number, serial number (for high-risk devices), expiration date, manufacturing date.

What Magento must store: DI as a product attribute (immutable per SKU); PI as a per-receipt-line attribute (per inventory batch). Render UDI on PDP for visibility, on packing slip for traceability, on returns intake form for recall handling.

DSCSA (Drug Supply Chain Security Act), pharmaceutical traceability, fully effective November 2024. Applies to prescription drugs, not generic medical devices. Most dental supply distributors carry some Rx-class items (anesthetic carpules, antibiotics for surgical kits, sedatives) that fall under DSCSA.

• T3 (Transaction History, Transaction Information, Transaction Statement), every Rx item must have an electronic record of every owner from manufacturer down to dispenser.
• GS1 EPCIS or AS2 exchange, the data format for T3 transfer between trading partners.
• Serialisation at unit level, each unit gets a GS1 DataMatrix barcode with GTIN + serial + lot + expiry.
• Recall workflow, if a manufacturer recalls a lot, every downstream serial is auto-flagged and forward-traceable to the clinic / patient.

If you carry any Rx items, DSCSA is in scope. Middleware: TraceLink, rfxcel, SAP ATTP, Tag-It Smart. Magento bridges to middleware via AS2 webhook + REST. Build time for DSCSA layer: 8-14 weeks. For pure non-Rx dental supplies (gloves, masks, instruments), UDI applies but DSCSA does not.