What is a UFI code? The Unique Formula Identifier, explained

The UFI (Unique Formula Identifier), also called the UFI number, is a 16-character code on the label of hazardous chemical mixtures sold in the EU and EEA. It exists for one reason. When someone calls a poison centre about a product, the person answering reads the UFI back and pulls up the exact composition of that mixture from the notification the company filed before it went on sale. There’s no guessing from a trade name and no waiting for a safety data sheet. The code is the link between the label in someone’s hand and the formulation on file.

The requirement comes from Annex VIII to the CLP Regulation (Regulation (EC) No 1272/2008), the same annex that created the poison centre notification (PCN) duty. If your mixture is classified for health or physical hazards, the UFI and the notification go together. The code on the label means something only because a matching dossier sits in the poison centres’ database.

What the code looks like

A UFI is 16 characters long and printed in four blocks of four, separated by hyphens: for example GMTT-2SQN-6FDD-6TV1, one of the worked examples in ECHA’s own UFI Developers Manual. Counting the hyphens, the printed string is 19 characters. On a label it always carries the prefix “UFI:” in capital letters.

The alphabet is restricted on purpose: the digits 0 to 9 and 21 letters. Five letters (O, I, L, B and Z) are left out because they’re too easy to confuse with 0, 1 and 2 when someone reads a label aloud over the phone in an emergency. The code also carries a checksum, so a mistyped or misread UFI fails the check rather than pulling up the wrong formulation. You can test this with the free UFI checker, which runs ECHA’s published validation algorithm in your browser.

What a UFI is for

Poison centres across the EU take calls about exposures to cleaning products, coatings, adhesives and biocides. Before Annex VIII, each member state ran its own notification system with its own format, and the person answering often had to work from whatever the caller could read off a label.

The UFI closes that gap. Every UFI maps to exactly one notified composition, so the person who receives the code can call up the full ingredient list, the concentration ranges and the toxicological information: the contents of your poison centre notification. The code does nothing by itself. It’s a lookup key into the database your notification filled.

Who needs a UFI

The duty sits with the company that places a hazardous mixture on the EU/EEA market: importers bringing mixtures in from outside the EU, and downstream users (formulators who blend mixtures, and anyone who rebrands or repackages a mixture under their own name). If you buy a mixture from an EU supplier and sell it unchanged under the supplier’s label, the supplier’s UFI and notification cover you. The moment you put your own brand on it, relabel it or change the composition, you’re responsible for your own notification, and usually your own UFI.

What decides it is the classification, not the product type. Mixtures classified for health hazards (skin corrosion or acute toxicity, say) or physical hazards (flammable liquids, say) are in scope. Mixtures classified only for environmental hazards aren’t, though you can notify them voluntarily. From 1 January 2027, Regulation (EU) 2024/2865 also brings distributors into Article 45 in certain cases. The scope tests and exemptions are worked through in whether you need to submit a PCN.

How a UFI is generated

A UFI is computed from two inputs your company controls:

• A company identifier. Normally your VAT number. If you have no VAT number, or prefer not to derive codes from it, ECHA’s UFI Generator issues a “company key” that plays the same role.
• A formulation number. Any whole number between 0 and 268,435,455 that you assign to a specific composition. How you number formulations is your choice. The only rule is consistency: one number per composition.

The algorithm that combines them is published in ECHA’s UFI Developers Manual, so the same inputs always produce the same UFI, whether you use ECHA’s free UFI Generator, compliance software or your own implementation of the spec. That matters in practice: you can regenerate a lost UFI at any time from your VAT number and formulation number, and two departments generating a UFI for the same formulation get the same code. The step-by-step walkthrough is in how to generate a UFI.

The one-UFI-one-composition rule

The whole system rests on one rule: a UFI always points to exactly one mixture composition. The reverse is looser on purpose. One composition may carry several UFIs, so a contract manufacturer making the same blend for three brands can issue three UFIs, one per brand, all pointing to the same notified composition. What can never happen is one UFI pointing to two different formulations.

So when your composition changes beyond the ranges Annex VIII permits within an existing notification, it’s a new composition. It needs a new UFI and an updated notification before the reformulated product ships. The triggers are specific, and when a UFI must change lists them.

How the UFI appears on the label

Annex VIII Part A requires the UFI to be printed on or affixed to the label of the mixture, prefixed with “UFI:” in capital letters, and to be clearly visible, legible and indelibly marked. For mixtures supplied without packaging, and for mixtures at industrial sites, the UFI may instead be stated in section 1.1 of the safety data sheet.

This is the check an inspector can do at a glance: either the code is on the label or it isn’t. In ECHA’s 2025 enforcement pilot, 15% of inspected mixtures had no UFI on the label (ECHA/NR/26/08, 11 February 2026). The full labelling rules, including placement options and the unpackaged-mixture cases, are in UFI label requirements.

The UFI is half the job: the PCN is the rest

It’s an understandable reading to treat the UFI as the deliverable, because the code is the part you can see. The UFI takes a minute. The notification takes the afternoon, and it’s the poison centre notification that carries the legal weight. The PCN is a structured dossier (full composition with concentrations, toxicological information, product category, packaging, label information) submitted to ECHA’s central portal, or in a few countries to national systems, before the product goes on the market.

A UFI has no legal effect until the mixture is notified. The duty came in on a schedule that has now run out:

Since 1 January 2025 there’s no deadline left to plan around. Every mixture in scope, in every use type, has to carry a UFI and have a harmonised notification on file. The duty is continuous: it starts the day you place the product on the market.

Common mistakes

• Printing a UFI without submitting the PCN. The code has no legal effect on its own, and the 2025 pilot inspectors checked labels against the notification database.
• Reusing one UFI across different formulations. Two products with different compositions need different UFIs, even if they’re variants of the same product line.
• Forgetting the UFI when reformulating. A composition change beyond the permitted ranges needs a new UFI and an updated notification before the new formulation ships.
• Assuming the supplier’s UFI covers your private label. Rebranding a mixture makes you the duty holder: you notify, with your own UFI, even if the composition is unchanged.
• Typing UFIs by hand between systems. The checksum catches transcription errors, but only if something checks it. Run codes through a checker before they reach the artwork.

If your backlog is the notifications rather than the codes, that’s the job UFI Number is built for: the UFI, the notification in ECHA’s current format, and sending it through ECHA’s system-to-system route, with ECHA’s submission number coming back to you. It’s in private beta.