What is a UFI code? The Unique Formula Identifier, explained

The UFI — Unique Formula Identifier— is a 16-character alphanumeric code that appears on the label of hazardous chemical mixtures sold in the EU and EEA. It exists for exactly one reason: when someone calls a poison centre about a product, the responder reads the UFI back and immediately retrieves the precise composition of that mixture from the notification the company filed before placing it on the market. No guessing from a trade name, no waiting for a safety data sheet — the code is the link between the label in someone’s hand and the formulation on file.

The requirement comes from Annex VIII to the CLP Regulation(Regulation (EC) No 1272/2008), the same annex that created the poison centre notification (PCN) duty. If your mixture is classified for health or physical hazards, the UFI and the notification travel together: the code on the label is only meaningful because a matching dossier sits in the poison centres’ database.

What the code looks like

A UFI is 16 characters long and printed in four blocks of four, separated by hyphens — for example GMTT-2SQN-6FDD-6TV1, one of the worked examples in ECHA’s own UFI Developers Manual. Counting the hyphens, the printed string is 19 characters. On a label it must always carry the prefix “UFI:” in capital letters.

The characters are drawn from a deliberately restricted alphabet: the digits 0–9 and 21 letters. Five letters — O, I, L, B and Z — are excluded because they are too easy to confuse with 0, 1 and 2 when someone reads a label aloud over the phone in an emergency. The last block also hides a checksum: the code is self-verifying, so a mistyped or misread UFI is detected immediately rather than pulling up the wrong formulation. You can test this yourself with our free UFI checker, which runs ECHA’s published validation algorithm in your browser.

What a UFI is for

Poison centres across the EU handle hundreds of thousands of exposure calls a year, and a large share involve mixtures — cleaning products, coatings, adhesives, biocides. Before Annex VIII, each member state ran its own notification system with its own format, and responders often had to work from whatever the caller could read off a label.

The UFI closes that gap. Because every UFI maps to exactly one notified composition, the responder who receives the code can call up the full ingredient list, concentration ranges, toxicological information and recommended medical response — the contents of your poison centre notification — in seconds. The code does nothing by itself; it is a lookup key into the database that your notification populated.

Who needs a UFI

The duty sits with the company that places a hazardous mixture on the EU/EEA market: importers bringing mixtures in from outside the EU, and downstream users— formulators who blend mixtures, and anyone who rebrands or repackages a mixture under their own name. If you buy a mixture from an EU supplier and sell it unchanged under the supplier’s label, the supplier’s UFI and notification cover you. The moment you put your own brand on it, re-label it, or change the composition, you become responsible for your own notification — and typically your own UFI.

The trigger is classification: mixtures classified for health hazards (like skin corrosion or acute toxicity) or physical hazards (like flammable liquids) are in scope. Mixtures classified only for environmental hazards are not — though notifying them voluntarily is allowed. The 2024 CLP revision (Regulation (EU) 2024/2865) also extends duties to distributors in certain cases, with those Article 45 amendments applying from 1 January 2027. Our guide on whether you need to submit a PCN walks through the scope tests and exemptions in detail.

How a UFI is generated

A UFI is computed — not assigned — from two inputs your company controls:

• A company identifier.Normally your VAT number. If you have no VAT number, or prefer not to derive codes from it, ECHA’s UFI Generator issues a “company key” that plays the same role.
• A formulation number. Any whole number between 0 and 268,435,455 that you assign to a specific composition. How you number formulations is entirely your choice — the only obligation is consistency: one number per composition.

The algorithm that combines them is published in ECHA’s UFI Developers Manual, so the same inputs always produce the same UFI, whether you use ECHA’s free UFI Generator, compliance software, or your own implementation of the spec. That determinism matters operationally: you can regenerate a lost UFI at any time from your VAT number and formulation number, and two departments generating a UFI for the same formulation will get the same code. The step-by-step walkthrough lives in how to generate a UFI.

The one-UFI-one-composition rule

The system’s integrity rests on a single invariant: a UFI always points to exactly one mixture composition. The reverse is deliberately looser — one composition may carry several UFIs. A contract manufacturer producing the same blend for three brands can issue three UFIs, one per brand, all resolving to the same notified composition. What can never happen is one UFI resolving to two different formulations.

The practical consequence: when your composition changes beyond the ranges Annex VIII permits within an existing notification, that is a new composition — it needs a new UFI and an updated notification before the reformulated product ships. The triggers are specific and worth knowing precisely; see when a UFI must change.

How the UFI appears on the label

Annex VIII Part A requires the UFI to be printed on or affixed to the labelof the mixture, prefixed with “UFI:” in capital letters, and to be clearly visible, legible and indelibly marked. For mixtures supplied without packaging, and for mixtures at industrial sites, the UFI may instead be stated in section 1.1 of the safety data sheet.

This is the compliance point inspectors check first, because it takes seconds: either the code is on the label or it is not. In ECHA’s enforcement pilot (reported February 2026), 15% of inspected mixtures had no UFI on the label — the single cheapest finding for an inspector to record. The full labelling rules, including placement options and the unpackaged-mixture cases, are covered in UFI label requirements.

The UFI is half the job — the PCN is the rest

A common and expensive misunderstanding is treating the UFI as the deliverable. Generating the code takes five minutes; it is the accompanying poison centre notificationthat carries the legal weight. The PCN is a structured dossier — full composition with concentrations, toxicological information, product category, packaging, label information — submitted to ECHA’s central portal (or, in a few countries, national systems) before the product goes on the market.

A UFI printed on a label with no matching notification behind it is not partial compliance — it is a finding. The obligations became fully applicable on a rolling schedule that has now completely run out:

Since 1 January 2025 there is no future deadline to plan around: every mixture in scope, in every use type, must carry a UFI and have a harmonised notification on file. The obligation is continuous — it attaches the day you place the product on the market.

Common mistakes

• Printing a UFI without submitting the PCN. The code has no legal effect on its own; inspectors cross-check labels against the notification database.
• Reusing one UFI across different formulations. Two products with different compositions need different UFIs, even if they are variants of the same product line.
• Forgetting the UFI when reformulating. A composition change beyond the permitted ranges requires a new UFI and an updated notification before the new formulation ships.
• Assuming the supplier’s UFI covers your private label. Rebranding a mixture makes you the duty holder — you notify, with your own UFI, even if the composition is unchanged.
• Typing UFIs by hand between systems. The checksum catches transcription errors, but only if something validates it — run codes through a checker before they reach artwork.

If your backlog is the notification side rather than the codes, that is exactly the job Ufi Number automates: the UFI, the dossier in ECHA’s current format, and the submission itself — with the acknowledgement number to prove it.