Key Takeaways
- From 1 July 2026, all Class IIb and Class III medical devices supplied in Australia must carry a Unique Device Identifier (UDI). The obligation to label devices and submit UDI data to the Australian UDI Database (AusUDID) rests with the Australian sponsor (the distributor or manufacturer responsible for supply). Devices placed into supply after this date without a UDI are non-compliant.
- Class IIb devices commonly found in GP and allied health settings include external defibrillators, diagnostic X-ray equipment, and surgical lasers. Class III devices include implantable medical devices such as cardiac implants, joint prostheses, and contraceptive implants including Implanon/Nexplanon. If your practice uses any of these, check that your supplier is UDI-compliant before 1 July 2026.
- For implantable devices, healthcare providers have their own recording obligations: the UDI must be documented in the patient's clinical record, on a Patient Implant Card issued to the patient, in the discharge summary, and in the patient's My Health Record. From 1 March 2025, UDIs must also be included in any adverse event report submitted to the TGA.
- From 21 March 2026, mandatory adverse event reporting for medical device-related incidents applies to all public hospitals, private hospitals, and registered day hospital facilities. GP practices and standalone allied health clinics are explicitly excluded from the mandatory regime.
- Stage 1 of mandatory reporting covers adverse events associated with Class III medical devices and Class 4 in vitro diagnostic medical devices. The CEO (or equivalent) of each covered facility is the responsible person. Reports are submitted through the TGA's new Adverse Signal Detection and Event Reporting (ASDER) system.
- The maximum civil penalty for a covered facility that fails to report a mandatory adverse event is 30 penalty units per breach, which at the current Commonwealth rate of $330 per unit equals $9,900 per unreported event.
- Class IIa devices, including most diagnostic ultrasound machines, standard ECG monitors, blood pressure monitors, and pulse oximeters, are not in scope for mandatory UDI until 1 July 2028. Practices planning equipment procurement should factor the upcoming requirement into purchasing decisions now.
Two changes to Australian medical device regulation took effect within months of each other in 2026. From 21 March 2026, mandatory adverse event reporting for hospitals and day hospital facilities came into force. From 1 July 2026, the first wave of Unique Device Identifier requirements applies to high-risk medical devices supplied in Australia. Together, these changes represent the most significant reform to the country's medical device governance framework in more than a decade.
Most of the UDI labelling burden falls on device sponsors: the Australian entities responsible for placing devices into supply. But healthcare providers are not uninvolved. Practices that use implantable devices have specific record-keeping obligations tied directly to the UDI framework. Day procedure centres registered as day hospital facilities became mandatory adverse event reporters in March. And every practice using Class IIb or Class III devices needs to understand what these changes mean for procurement, patient documentation, and clinical governance.
The UDI Framework: What It Is
A Unique Device Identifier is a structured code that links a specific medical device to a standardised record in a national database. The TGA's national database is the Australian UDI Database (AusUDID), established under amendments to the Therapeutic Goods Act 1989 (Cth) and the Therapeutic Goods (Medical Devices) Regulations 2002.
Every UDI has two components. The UDI-Device Identifier (UDI-DI) identifies the specific version or model of the device. This is the part submitted to the AusUDID by the sponsor. The UDI-Production Identifier (UDI-PI) identifies the specific production run: the lot number, serial number, manufacturing date, and expiry date where applicable. Together, these components enable a device involved in an adverse event or a product recall to be traced with precision to the exact batch or unit, rather than through manual searches across invoices and handwritten registers.
On a device label, the UDI appears as a barcode (linear or Data Matrix format) alongside a human-readable version of the same code. Issuing agencies recognised by the TGA are GS1, HIBCC, and ICCBBA.
The 1 July 2026 Deadline: Which Devices Are Affected
From 1 July 2026, mandatory UDI requirements apply to Class IIb and Class III medical devices. The phased rollout by risk class continues after that date:
- 1 July 2026: Class IIb and Class III devices must carry a UDI. Sponsors must submit the UDI-DI and required data to the AusUDID within 30 days of the device's first supply in Australia after this date.
- 1 July 2028: Class IIa devices enter the mandatory regime.
- 1 July 2030: Class I devices become subject to the requirement.
- 1 January 2030: Any Class IIb or Class III device manufactured and labelled before 1 July 2026 that remains within a sponsor's control must be relabelled with a compliant UDI.
Class IIb examples in GP and allied health settings include external defibrillators (AEDs), diagnostic X-ray and fluoroscopy equipment, surgical lasers used in dermatology and minor procedures, and devices used for high-frequency surgery. Class III examples include all active implantable medical devices: cardiac pacemakers, implantable cardiac monitors, joint prostheses, contraceptive implants such as Implanon/Nexplanon, and cochlear implants.
Class IIa devices, including most diagnostic ultrasound machines, standard ECG monitors, blood pressure monitors, spirometers, and pulse oximeters, are not in scope until 1 July 2028. If the majority of your diagnostic equipment is Class IIa, the immediate 1 July 2026 deadline does not apply to those specific devices. Verify the classification of each device against its Australian Register of Therapeutic Goods (ARTG) entry at tga.gov.au using the product name or ARTG number printed on the device label.
What the UDI Obligation Means for Your Practice
The legal duty to label devices and submit data to the AusUDID rests with the sponsor, not the healthcare provider. If your practice purchases a Class IIb defibrillator after 1 July 2026, the supplier's responsibility is to ensure that device carries a compliant UDI.
However, healthcare providers have their own obligations that connect directly to the UDI framework.
Implant record-keeping. For any implantable device your practice uses, the UDI must be recorded in four places: the patient's clinical record, a Patient Implant Card issued to the patient at the time of implantation, the patient's discharge summary, and the patient's My Health Record where one exists and sharing settings permit. These obligations apply to all health practitioners involved in implant procedures, not only to hospital settings. A GP inserting a contraceptive implant has the same record-keeping obligations for the device's UDI as a surgeon placing a cardiac device in a hospital.
Adverse event reports. Since 1 March 2025, the UDI must be included in any adverse event report submitted to the TGA where the device has been assigned one. If your practice submits a voluntary adverse event report, include the UDI from the device label.
Procurement checks. Before purchasing Class IIb or Class III devices after 1 July 2026, ask your supplier whether their devices carry a compliant UDI and whether the UDI-DI data has been submitted to the AusUDID. The TGA has established a Consent to Supply process that permits sponsors with unresolved UDI compliance to continue supplying devices during a defined transition period, so not every device without a UDI represents a regulatory breach, but procurement teams should ask the question and document the response.
For practices managing broader privacy and data obligations around clinical records, including how patient health information is handled in digital systems, the AI privacy compliance guide for healthcare covers the intersection of technology use and your obligations under the Privacy Act 1988 (Cth). The data breach obligations guide covers what to do if patient records, including implant records, are compromised.
Mandatory Adverse Event Reporting: The March 2026 Change
From 21 March 2026, all public hospitals, private hospitals, and registered day hospital facilities in Australia must report medical device-related adverse events to the TGA. This obligation was established by 2023 amendments to the Therapeutic Goods Act 1989 (Cth) and came into force after a 12-month voluntary reporting period that ran from 21 March 2025 to 20 March 2026.
GP practices and standalone allied health clinics are explicitly excluded from the mandatory reporting obligation. Residential aged care facilities operating as standalone entities are also excluded. The exclusion does not remove all device-related clinical governance obligations from these settings, but it means the mandatory reporting framework carrying civil penalties does not currently apply to them.
Who is a "day hospital facility"? The definition covers facilities registered as day hospitals or day surgery centres under applicable state and territory health legislation. Many large day procedure centres hold this registration. If your practice operates within, or as part of, a facility registered as a day hospital facility, confirm with your legal or compliance adviser whether the mandatory reporting obligation applies to your specific registration.
Stage 1 scope. Mandatory reporting in Stage 1 covers adverse events associated with Class III medical devices and Class 4 in vitro diagnostic medical devices. An adverse event is an incident in which a device used in connection with a patient may have caused or contributed to a serious deterioration in their health, including injury, illness, or death. Reports are submitted through the TGA's ASDER (Adverse Signal Detection and Event Reporting) system. The CEO (however described) of the facility is the legally responsible person.
Penalties. The maximum civil penalty for a failure to report a mandatory adverse event is 30 penalty units per breach. At the current Commonwealth penalty unit rate of $330, that is $9,900 per unreported event. Because the penalty applies per individual unreported incident, multiple failures compound the exposure.
GP practices and allied health clinics that are not covered by mandatory reporting should still use the TGA's voluntary reporting channels for any device-related incident that may have contributed to patient harm or a near miss. Voluntary reporting supports national device safety surveillance and is consistent with clinical governance obligations under the RACGP Standards for General Practices, 6th Edition. Our RACGP 6th Edition standards guide covers the clinical governance and safety criteria relevant to general practices, including those related to equipment management and incident review.
How ClinicComply Helps
Medical device compliance in a GP practice or day procedure centre involves multiple intersecting obligations: UDI recording for implants, device procurement checklists, adverse event reporting processes, and patient documentation requirements. Most practices currently manage these across separate spreadsheets, paper registers, and isolated policy documents, which creates audit risk and recall response gaps.
ClinicComply's document library lets you store device-related policies and procedures against specific regulatory requirements, with review dates tracked and automated reminders set against upcoming deadlines. You can assign the pre-July UDI supplier audit as a tracked task, set a completion target, and link the evidence of supplier confirmation directly to the compliance record.
For practices approaching RACGP accreditation, ClinicComply maps clinical governance obligations, including equipment safety documentation and incident management processes, to specific 6th Edition Standards criteria. Use the RACGP Accreditation Quiz for a rapid assessment of where your practice currently stands, and the compliance calendar tool to track the 1 July 2026 UDI deadline alongside your other regulatory obligations. RACGP-aligned policy templates, including clinical governance and incident management frameworks, are available in the ClinicComply template library.
Start a free 30-day trial at cliniccomply.com.au/signup to bring your device compliance documentation into a single trackable framework.
Frequently Asked Questions
What is a Unique Device Identifier and why is the TGA introducing it?
A Unique Device Identifier is a structured code on a medical device label that links the device to a standardised record in the Australian UDI Database (AusUDID). It consists of two parts: the UDI-DI, which identifies the device type and version, and the UDI-PI, which identifies the specific production run including lot number, serial number, and expiry date. The TGA introduced UDI requirements through amendments to the Therapeutic Goods Act 1989 (Cth) and the Therapeutic Goods (Medical Devices) Regulations 2002, mirroring equivalent frameworks in the European Union and the United States. The primary purpose is to enable precise, rapid device traceability in the event of recalls or adverse event investigations.
Which device classes must carry a UDI from 1 July 2026?
Class IIb and Class III medical devices must carry a UDI from 1 July 2026. Class IIa devices enter the mandatory regime on 1 July 2028, and Class I devices on 1 July 2030. The 1 July 2026 requirement applies to devices placed into supply from that date. Class IIb and Class III devices manufactured and labelled before that date may continue to be supplied until their expiry, but must be relabelled if still within a sponsor's control after 1 January 2030.
Who is legally responsible for putting a UDI on a medical device?
The obligation to label a device with a UDI and submit the UDI-DI data to the AusUDID rests with the sponsor: the Australian entity legally responsible for supplying the device. Healthcare providers are not required to apply UDI labels. However, healthcare providers must record the UDI of any implantable device in the patient's clinical record, on a Patient Implant Card given to the patient, in the discharge summary, and in the patient's My Health Record. Adverse event reports submitted to the TGA must also include the UDI where one has been assigned to the device.
Do GP practices need to record UDIs for implantable devices they insert?
Yes. The requirement to record UDIs for implantable devices applies to all health practitioners involved in implant procedures. If a GP inserts a contraceptive implant such as Implanon/Nexplanon or another Class III implantable device, the UDI must be recorded in the patient's clinical record and on a Patient Implant Card issued to the patient. This obligation exists under the Therapeutic Goods Act 1989 (Cth) provisions governing medical device traceability and applies regardless of the clinical setting.
Which healthcare facilities must comply with mandatory adverse event reporting from 21 March 2026?
Public hospitals, private hospitals, and registered day hospital facilities must report medical device-related adverse events to the TGA from 21 March 2026. GP practices and standalone allied health clinics are explicitly excluded from the mandatory regime under the current framework. Residential aged care facilities operating independently are also excluded. If your practice operates as, or within, a facility registered as a day hospital facility under state or territory legislation, confirm with your legal or compliance adviser whether the mandatory reporting obligation applies to your specific registration.
What must be reported under Stage 1 of mandatory adverse event reporting?
Stage 1 covers adverse events associated with Class III medical devices and Class 4 in vitro diagnostic medical devices. An adverse event is an incident in which a device used in connection with a patient may have caused or contributed to a serious deterioration in their health, including injury, illness, or death. Reports are submitted through the TGA's ASDER (Adverse Signal Detection and Event Reporting) system. The CEO (however described) of the covered facility is the legally responsible person for submitting the report.
What is the penalty for a hospital or day hospital failing to report a mandatory adverse event?
The maximum civil penalty is 30 penalty units per breach. At the current Commonwealth penalty unit rate of $330, that is $9,900 per unreported event. The penalty applies per individual unreported incident, meaning multiple failures at the same facility compound the total exposure. The civil penalty framework allows the TGA to impose penalties without commencing court proceedings for each unreported event.
Should GP practices and allied health clinics still report device-related adverse events voluntarily?
Yes. GP practices and allied health clinics that are not covered by the mandatory reporting obligation should still use the TGA's voluntary reporting channels for any device-related incident that may have contributed to patient harm or a near miss. Voluntary reporting supports the TGA's national device safety surveillance program and is consistent with clinical governance obligations under the RACGP Standards for General Practices, 6th Edition, and with professional obligations under relevant AHPRA codes of conduct.
How do I check whether a device in my practice is Class IIb or Class III?
The device's ARTG (Australian Register of Therapeutic Goods) entry records its regulatory classification. You can search the ARTG at tga.gov.au using the product name, sponsor name, or the ARTG number printed on the device label or product insert. Your supplier or the Australian sponsor should also be able to confirm the device's classification and their UDI compliance status. If the ARTG entry records the device as Class IIb or Class III, the 1 July 2026 UDI requirement applies to its supply.
What is the Consent to Supply process and when does it apply?
The TGA's Consent to Supply process allows a sponsor to seek TGA approval to continue supplying a medical device that does not yet meet UDI requirements, during a defined transition period. It is intended to prevent supply disruptions where a sponsor is working toward compliance but has not yet labelled existing stock. The existence of a Consent to Supply does not mean healthcare providers can ignore whether their devices are UDI-compliant. If a supplier is relying on the process beyond the voluntary transition period, that indicates a compliance gap that procurement teams should follow up directly with the sponsor.