UFI vs PCN: the five-minute code and the dossier behind it

UFI and PCN travel together in every piece of poison-centre guidance, which is exactly why they get conflated. They are not two names for one thing, and they are not interchangeable steps. The UFI is a 16-character code you can generate in five minutes. The PCN is the structured dossier — full composition, toxicology, product category, markets — that takes the real work. Compliance requires both, wired to each other. Having one without the other is not half-compliance; it is a finding.

What the UFI is

The Unique Formula Identifieris a code printed on the label (or, for industrial and unpackaged mixtures, stated in section 1.1 of the safety data sheet). It is computed from your VAT number — or an ECHA company key — plus a formulation number you assign, using the algorithm in ECHA’s UFI Developers Manual. Generating one is free, anonymous and creates no obligation by itself; the walkthrough is in how to generate a UFI.

Functionally, the UFI is a lookup key. When someone calls a poison centre, the responder types the code from the label and retrieves the exact composition on file. The code carries no chemical information itself — a built-in checksum aside, it is deliberately meaningless until it is matched against a database record.

What the PCN is

The poison centre notification is the database record. It is a structured IUCLID dossier containing the full composition with concentrations, the CLP classification and label elements, toxicological information, the EuPCS product category, packaging types and sizes, the member states where the product is sold, and — critically — the UFI or UFIs it covers. It is submitted through ECHA’s portal before the product is placed on the market, and validated against more than a hundred business rules before it is accepted.

This is where the effort lives: assembling composition data from suppliers, choosing the right category, getting concentration ranges within the permitted precision, and clearing validation. The UFI is one field inside this dossier.

The dossier also has a geography the code lacks. A UFI reads identically on a shelf in Lisbon and in Helsinki, but the notification behind it names the member states it covers and must satisfy each one’s language requirements. Entering a new market therefore means updating the dossier — the code on the label does not change. The two artefacts age differently, too: a UFI persists across notification updates and only changes when the composition itself moves beyond the permitted limits, while the PCN accumulates new versions with every relevant product change.

Side by side

The most common failure pattern

Because the UFI is the visible, five-minute artefact, it becomes the proxy for being done. A manager asks whether the products are poison-centre compliant; someone confirms the labels carry UFIs; the topic is closed. Nobody asks the second question — is there a notification behind each code? — because the distinction between the code and the dossier was never made.

ECHA’s 2025 enforcement pilot measured both halves of the failure separately, and both were common: 19% of mixtures requiring a notification had none, and 15% had no UFI on the label where one was required. The two lists overlap imperfectly — which is the point. Labels with orphan UFIs and notifications with no code on the shelf are distinct defects, and inspectors cross-check in both directions: label to database, database to label.

The orphan-UFI case is the more dangerous one, because it looks compliant from the outside. It fails at the worst possible moment: a responder types the code from the label and the database returns nothing.

Reformulation is where the pair most often drifts apart even in well-run companies. The lab changes the blend, a new UFI is generated and sent to artwork — and the notification update never follows, or follows months later. From that window onward the label advertises a code the database has never heard of. Whatever process triggers a label change should trigger the dossier update in the same ticket.

The both-or-nothing rule

The two artefacts only have legal meaning as a pair, in a fixed order:

1. Generate the UFI — it must exist first, because it goes inside the dossier and onto the label artwork.
2. Submit the PCN containing that UFI, and see it accepted — the mechanics are in how to submit a PCN.
3. Place the product on the market with the UFI on the label. Not before.

If the code side is done and the dossier side is the backlog, that split is common — and it is the half Ufi Number exists for: the notification built in the current required format, submitted, with the acknowledgement number to file, at €20 per mixture.