UFI Codes (Unique Formula Identifier) for European Poison Centres

Author: R&D Team, CUIGUAI Flavoring
Published by: Guangdong Unique Flavor Co., Ltd.
Last Updated: Sep 17, 2026
WhatsApp & Telegram: +86 189 2926 7983
Email: info@cuiguai.com

A UFI — Unique Formula Identifier — is a 16-character alphanumeric code that links a hazardous chemical mixture on the market to the composition dossier its supplier has filed with European poison centres. The system is administered by the European Chemicals Agency (ECHA) under Annex VIII of the CLP Regulation (EC) No 1272/2008, and it is now a hard legal requirement for every hazardous mixture placed on the European Union market. If you import e-liquids, sell flavor concentrates, or formulate vape products for the EU, the UFI is the code your labels and safety data sheets (SDS) have to carry.

The idea is simple. When someone is exposed to a product and a poison centre picks up the phone, the caller reads the UFI from the label, the operator types it into the national database, and the full composition appears on screen in seconds. Before Annex VIII, that retrieval often failed: the poison centre had the name of the product but no direct line to the ingredients behind it. The UFI closes the gap by making the chemical identity of a product machine-searchable across all Member States.

UFI Codes Explained for EU Poison Centre Notification

Why the UFI Exists — the Poison Centre Problem

European poison centres take calls about everyday exposures: a child swallows a cleaning product, a worker breathes in solvent fumes, a vaper reports symptoms after using a new e-liquid. To treat these cases, the toxicologist needs to know what is actually in the product. Historically, that information was submitted under Article 45 of the CLP Regulation, but the format, depth, and completeness of submissions varied widely from one Member State to the next, and the link between the bottle on the shelf and the file in the database was weak.

Annex VIII replaced that patchwork with a single harmonised information requirement. Every in-scope mixture now has one stable identifier — the UFI — that appears on the label and in the SDS, and one structured dossier in the EU submission system. The toxicologist no longer has to guess which “vanilla cream e-liquid” the caller means; the UFI resolves the ambiguity instantly.

In short, the UFI is a stable, language-independent key that connects a product, its label, its safety data sheet, and the poison centre dossier for that exact formulation.

The Legal Framework: CLP Annex VIII

Annex VIII was added to the CLP Regulation by Commission Regulation (EU) 2017/542, adopted in March 2017. It sets out the harmonised information requirements for poison centre notification (PCN): which data must be submitted, how compositions are expressed in concentration bands, and how the UFI is assigned, formatted, and displayed. The obligations arrived in phases — mixtures for consumer use from 1 January 2021, professional use from 1 January 2024, and industrial use from 1 January 2025 — after which every hazardous mixture on the EU market must carry a UFI.

Two legal actors carry the burden. The importer — the EU-based company that brings the mixture into the Union — and the downstream user who places a hazardous mixture on the market are responsible for the notification. A non-EU manufacturer cannot submit; it must hand the dossier data to its EU importer. That is why every brand owner working with a Chinese or US flavor factory needs an EU entity, or an importer of record, that owns the PCN.

Notifications go to the appointed bodies of the Member States where the product is placed on the market. In Ireland, for example, the appointed body is the National Poisons Information Centre at Beaumont Hospital, with guidance published by the Health and Safety Authority. ECHA provides an IUCLID-based submission tool so that one dossier can be sent to the appointed bodies of several Member States at once.

Building a Poison Centre Notification (PCN) Dossier

Anatomy of a UFI — Format and Generation

A UFI is exactly 16 characters: uppercase letters and digits, split into four blocks of four, for example J200-U0CW-500U-XXXX or VV53-41GU-X00E-G0K8. On a label it is always written with the prefix “UFI:” so it cannot be confused with batch numbers or barcodes. The character set is deliberately restricted to avoid ambiguity between similar glyphs, and because the code carries no words, it needs no translation.

UFIs are not random. They are produced by the ECHA UFI generator from two inputs: a company identifier derived from the VAT or EORI number (or an equivalent company key), and an internal formulation number between 0 and 268,435,255 that you assign to each of your mixtures. The same two inputs always produce the same UFI, which means you can generate codes in advance, keep them in a registry, and print them without waiting for any approval process.

The practical consequence: you should never hand-assign or guess a UFI. Use the generator, either on the ECHA website or inside your IUCLID submission, and keep one formulation number per product version. Losing the link between formulation numbers and UFIs is a fast route to mismatched labels.

Where the UFI Must Appear

• On the label of every in-scope mixture, placed near the product identifier and printed in a legible, durable form.
• In SDS subsection 1.1 (product identifier) for mixtures that are supplied without a label — in practice, many industrial or bulk mixtures and some transport-exempt supplies.
• In the SDS as well whenever the label cannot carry the code, so the emergency chain always has a written fallback.

When both a label and an SDS exist, the UFI in the two places must be identical. A mismatch is an immediate audit finding and can delay customs clearance or product registration.

Placement also matters operationally: emergency services in every Member State expect to find the UFI in the same spot on the label, so follow the ECHA guidance on position relative to the product identifier rather than inventing your own layout.

UFI in Your Supply Chain — Who Asks Whom

The UFI ripples through the supply chain in both directions. Upstream, your concentrate supplier should hand you a UFI-relevant package: the CLP classification, the composition expressed in concentration bands, and — where the concentrate itself is hazardous — its own UFI and proof of notification. Downstream, your customers in the EU will start asking for your UFI before they list your e-liquid on a shop shelf or a marketplace, because they need the same code for their own records and for the safety data sheets they pass on to consumers and workers.

Keep the chain honest with a simple rule: no UFI, no EU shipment. Before a purchase order is released, request the UFI and the PCN reference for every hazardous item. The reference number in the submission system is the evidence that the dossier exists; the UFI is the key that unlocks it. Both belong in your supplier qualification file, next to the SDS and the certificate of analysis.

The UFI and Your SDS: What to Check

The SDS is where most importers first meet the UFI in practice. Section 1, subsection 1.1, identifies the product; when a UFI is required, it is stated here, for example “UFI: J200-U0CW-500U-XXXX” immediately after the product identifier. Section 1.4 must carry the emergency telephone number of the relevant poison centre or the supplier medical information service.

When you review an SDS from a supplier, check three things. First, that the UFI shown in 1.1 matches the UFI printed on the label. Second, that the poison centre number in 1.4 belongs to the Member State where the product is sold. Third, that the composition bands disclosed to your importers are consistent with the PCN dossier. The UFI is only useful if every document in the chain points to the same dossier.

A Step-by-Step UFI Readiness Workflow

Getting UFI-compliant is a project with eight predictable steps:

1. Confirm scope — classify your mixture under CLP; if it triggers any health or physical hazard class, it is in scope for PCN and the UFI.
2. Identify your EU entity — the importer or downstream user that will hold the notification.
3. Prepare the company identifier — the VAT/EORI number or equivalent company key used by the UFI generator.
4. Assign a formulation number to every product and version you intend to place on the market.
5. Generate the UFI for each formulation with the ECHA generator and store it in a registry.
6. Build the PCN dossier in IUCLID with composition, concentration bands, toxicological information, and product identifiers.
7. Submit to the appointed bodies of every Member State where the mixture will be sold.
8. Print the UFI on the label and insert it in SDS Section 1.1, then re-run steps 4 to 8 on every reformulation.

Most mistakes happen at steps 4 and 8 — formulation numbers that drift between batches, and labels printed before the dossier is final.

Reformulation — When the UFI Has to Change

A UFI identifies a formulation, so the critical question is when a reformulation demands a new code. Annex VIII distinguishes between changes inside the notified composition bands, which require an updated submission but can keep the same UFI, and changes that alter the mixture identity, which require a new UFI and a fresh notification. In practice, if the concentration of a classified ingredient moves outside the band you notified, or a new hazardous ingredient appears, treat it as a new formulation.

Discipline matters here. A brand that ships “the same” flavor with silent recipe tweaks can end up with a label that no longer matches the dossier in the poison centre database — precisely the failure the UFI was built to prevent. Keep a version log with dates, bands, and UFIs.

There is also a hygiene rule for the dossier itself. When you submit an updated submission, keep the older one accessible and mark the revision. Poison centres may still receive calls about older stock for months after a change, so a retired UFI should never be silently deleted from your registry — archive it together with its formulation record and the date it was withdrawn. That archive discipline is what lets you answer an auditor, or a poison centre, with a single lookup.

Managing UFI Codes Across a Flavor Portfolio

Common UFI and PCN Mistakes

• Printing the UFI only on the SDS and not on the label for consumer mixtures.
• Using one UFI for several different formulations.
• A label UFI that differs from the SDS 1.1 UFI.
• Submitting the dossier in one Member State but selling in several.
• Assuming finished e-liquids are in scope but flavor concentrates are not — a flammable or sensitising concentrate is in scope in its own right.
• Delegating the UFI to the overseas supplier while forgetting that the EU importer holds the legal obligation.

Every one of these has been seen in real import batches; all are fixable, but each fix costs time at the border or in the warehouse.

UFI for E-Liquids and Flavor Concentrates

Two product categories matter most for vape brands. The first is the finished e-liquid. Nicotine-containing e-liquids are classified as acutely toxic under CLP, which puts them firmly inside Annex VIII scope — their labels have carried UFIs since the consumer deadline of 1 January 2021. The second is the flavor concentrate itself: any concentrate that is flammable (ethanol-heavy), skin sensitising (cinnamaldehyde, limonene), or otherwise hazardous is in scope in its own right, independently of what the finished liquid does.

That second point surprises many buyers. When you import a vanilla cream flavor concentrate or a grape flavor concentrate for EU production, the concentrate may need its own UFI and dossier even before it becomes an e-liquid. The composition documentation you request at sampling stage — the same discipline covered in our GB 41700 compliance guide for the Chinese market — becomes the raw material for the EU poison centre file.

A practical shortcut: ask your concentrate supplier for the CLP classification and full hazardous composition up front, then generate the UFI and submit the dossier before you order production quantities. Waiting until the shipment is at customs is the expensive way to learn the system.

And for formulators thinking about product development rather than compliance, the choices made early — which allergens, which solvents, which candy-flavor formulation approaches — determine how many dossiers and UFIs the portfolio will need later.

Frequently Asked Questions

What is a UFI?

A UFI (Unique Formula Identifier) is a 16-character alphanumeric code, generated by ECHA, that uniquely identifies a hazardous mixture composition for poison centre notification purposes under CLP Annex VIII.

Is the UFI mandatory?

Yes. All hazardous mixtures placed on the EU market must carry a UFI — consumer-use mixtures since 1 January 2021, professional-use since 1 January 2024, and industrial-use since 1 January 2025.

Who generates the UFI?

The company responsible for the notification — typically the EU importer or downstream user — generates the UFI with the ECHA UFI generator, using the company VAT/EORI identifier and an internal formulation number.

Where does the UFI go on the label?

The UFI must be printed on the label near the product identifier, prefixed with “UFI:”, in a legible and durable form. For unlabelled or unpackaged mixtures it goes in SDS Section 1.1 instead.

Does a recipe change require a new UFI?

If a change moves the composition outside the notified concentration bands, or introduces a new hazardous ingredient, a new UFI and a fresh notification are required. Minor in-band changes can keep the UFI but need an updated dossier.

Is the UFI the same as a barcode or SKU?

No. A barcode identifies a sales product; a UFI identifies a formulation. Two SKUs with identical composition can share a UFI, and one SKU can carry several UFIs if its batches differ in composition.

Who is legally responsible for the notification?

The EU importer and the downstream user who places the hazardous mixture on the market. A non-EU manufacturer cannot submit and must pass the data to its importer of record.

Does a UFI replace the SDS or the label?

No. The UFI works alongside the SDS and the label. The SDS still has to meet the 16-section requirements, and the label still needs the signal word, pictograms, H-codes and P-codes. The UFI is an additional identifier that links those documents to the poison centre dossier.

Can two companies share a UFI?

Only if they share the exact same formulation and the notification is managed accordingly. The UFI is generated from a company identifier, so in practice each notifying company generates its own code for its own formulation; a private-label arrangement can use one UFI when the composition and the responsible importer are identical.

Verifying UFI on Labels and SDS Section 1.1

Get UFI-Ready — Technical Support and Free Samples

CUIGUAI Flavor helps e-liquid brands and importers prepare for EU poison centre notification with classification review, composition documentation, and free development samples for qualifying projects.

📞 Phone: +86 0769 8838 0789
🌐 Website: https://www.cuiguai.com
📧 Email: info@cuiguai.com
💬 WhatsApp & Telegram: +86 189 2926 7983

References

[1] UL Solutions, “Unique Formula Identifier (UFI): Poison Centre Notification”. https://www.ul.com/news/unique-formula-identifier-ufi-poison-centre-notification

[2] Health and Safety Authority (HSA) Ireland, “Poison Centre Notification Ireland”. https://www.hsa.ie/eng/your_industry/chemicals/legislation_enforcement/reach/safety_data_sheets/poisoncentrenotificationireland_v5_fin.pdf

[3] European Chemicals Agency (ECHA), “UFI generator” (Poison Centres portal). https://poisoncentres.echa.europa.eu/ufi-generator

[4] Health and Safety Executive for Northern Ireland (HSENI), “REACH Safety Data Sheets” (SDS requirements referenced in the context of Section 1.1). https://www.hseni.gov.uk/reach-safety-data-sheets