How to generate a UFI: from VAT number to label-ready code

Generating a UFI takes about five minutes. Doing it in a way that still makes sense three reformulations and two brand extensions later takes a little planning. This guide covers both: the mechanics of ECHA’s free UFI Generator — single codes and bulk runs — and the two decisions you should make before you generate anything: which company identifier to use, and how to number your formulations.

If you are still working out what the code is and whether you need one, start with what is a UFI. This article assumes you know you need codes and want to issue them correctly.

Step 1: choose your company identifier

The UFI algorithm combines a company identifier with a formulation number. For most companies the identifier is simply the VAT number — enter it as printed, since the generator strips dots, hyphens and spaces and accepts upper or lower case. Use the VAT number of the legal entity that will submit the poison centre notification, not a parent or sister company: the UFI and the notification must come from the same identity.

The alternative is an ECHA company key, a numeric identifier issued from the “Get a company key” tab of the generator. It exists for two situations: companies that legitimately have no VAT number, and companies that do not want their VAT number derivable along the supply chain — a real concern for contract manufacturers whose customers could otherwise infer who actually makes the product. ECHA’s Developers Manual is explicit on the discipline: issue one company key, store it, and reuse it for every future UFI. Do not request a fresh key per code.

One caveat on the online no-VAT route: if you tick the no-VAT declaration in the generator instead of using a stored company key, the tool fills in the missing identity itself. You get a valid UFI, but you cannot reproduce it later from inputs you control — so record it immediately, or better, get a company key first.

Step 2: design a formulation-numbering scheme

The second input is a formulation number: any integer from 0 to 268,435,455 that you assign to exactly one composition. ECHA does not care how you number — the only rule is one number per composition, never reused for a different one. With over 268 million values available, the constraint is discipline, not capacity.

Two schemes work well in practice:

• Sequential.1, 2, 3… in order of creation. Simple, and it unlocks the generator’s fastest bulk mode. Best when one register controls issuance.
• Structured. Encode meaning — for example 2026001–2026999 for formulations created in 2026, or a product-line prefix. Helpful when several sites issue numbers, as ranges prevent collisions.

Whichever you choose, keep an internal UFI register: one row per formulation number, recording the composition (with a version reference), the date, the resulting UFI, and every product and brand that carries it. When a recipe changes beyond the ranges Annex VIII permits, you issue a new number and a new UFI — the register is what tells you, two years later, which code belonged to which recipe. The triggers for that change are covered in when does a UFI change.

Step 3: generate the code

For a single code, ECHA’s UFI Generator is a four-step task: select your VAT country and enter the VAT number, enter the formulation number, click Create, and copy the 16-character result. No account, no registration, available in all official EU languages. Be aware that editing any input field clears the generated code from the screen — copy it before you touch anything. Our own free UFI generator produces the same codes from the same inputs, entirely in your browser — your VAT number never leaves your machine.

For product families, use the bulk tab. It works two ways: if your formulation numbers are sequential, enter the first number and how many UFIs you want; if they are not, upload a one-column CSV or text file of formulation numbers. Either way the generator returns a CSV named UFI_<VAT>_<date>_<time>.csv pairing each formulation number with its UFI — up to 10,000 codes per request. Import that file straight into your register rather than retyping anything.

The third option is software. Because the algorithm is published in full in ECHA’s UFI Developers Manual (v1.5), any correct implementation — a compliance platform, an ERP plug-in, or Ufi Number, which generates the UFI automatically when you register a mixture — produces byte-for-byte the same code as ECHA’s tool for the same inputs.

That determinism is worth internalising: the same identifier and formulation number always yield the same UFI. A lost code can be regenerated at any time; two departments generating independently will agree; and switching tools never changes your codes. The UFI is computed, not allocated — there is no central issuance record at ECHA, which is exactly why your own register matters.

Step 4: validate the code

UFIs are self-verifying: the code embeds a mod-31 checksum, and the alphabet deliberately excludes the confusable letters O, I, L, B and Z. Validation checks the length, the character set, and the checksum — catching essentially every transcription error before it reaches a label.

Validate at every handoff: when a code enters your ERP, when it lands in an artwork brief, and when a supplier sends you a UFI for a mixture-in-mixture component. The ECHA generator has a Validate tab, and our free UFI checker runs the same published algorithm in your browser. Note what validation cannot do: it proves the string is well-formed, not that it is your code or that a notification exists behind it.

Step 5: place it on the label and record it

On packaging, the code must appear prefixed with “UFI:” in capital letters, clearly visible, legible and indelibly marked — printed on or affixed to the label. Placement is otherwise flexible; the full rules, including the SDS alternative for unpackaged and industrial-site mixtures, are in UFI label requirements. Send artwork designers the exact string including hyphens, and have someone validate the code as it appears on the final proof — artwork is where transcription errors sneak in.

Then close the loop in your register: formulation number, composition version, UFI, products, artwork date. Compliance reviews and reformulation decisions both start from that table.

Common pitfalls

• Generating under the wrong entity. The UFI must be generated under the identity that notifies. Group companies with separate VAT numbers need separate codes.
• Reusing a formulation number after a recipe change. A changed composition is a new composition: new number, new UFI, updated notification.
• No register.ECHA keeps no record of what you generated. If you cannot say which composition a UFI maps to, an inspector’s question becomes an archaeology project.
• Retyping codes between systems.Always copy-paste or import the generator’s CSV, then validate at the destination.