Does the UFI protect your confidential business information?

Our page on what a UFI is covers the code's structure and where it comes from; this page answers the question that follows almost immediately once a company understands that a formulation number sits behind the code — does printing that code on a label leak anything about what the mixture actually contains?

The UFI cannot be decoded

Treat the 16 characters as a pointer rather than a container. Nothing about the string itself carries ingredient names, percentages, or hazard data — it identifies a record, the way a case number identifies a file without describing what is in it. Reading the code off a label, even alongside the notifying company's publicly listed VAT number, does not let anyone reconstruct the formulation number that produced it, and the formulation number alone would still mean nothing without the mapping your own company holds between that number and the actual recipe.

That mapping is the part worth protecting, and it never leaves your organisation except through the one channel Annex VIII provides for it: the PCN dossier, submitted to the member states where the mixture is sold. Nobody can work backwards from a printed code to a percentage breakdown, because the code was never built to be reversible in the first place.

Who sees the full composition

The short answer is: the poison centres your company notifies through the dossier, and nobody else by default. When a national poison centre takes an emergency call and is given the UFI, its system retrieves the composition your company submitted for that exact code — full ingredient list, concentrations, and the toxicological detail attached to it. That access exists for emergency response and market surveillance, not for general disclosure, and it does not extend automatically to distributors, retailers, or the customer standing in front of the packaging.

A downstream party in your own supply chain — a distributor rebranding your product, or a formulator buying it as a component of something bigger — only sees the composition if your commercial agreement with them says so. The UFI system itself never forces that disclosure; it exists precisely so a company can meet a legal notification duty without that duty becoming a route for a business partner, let alone a stranger, to obtain the recipe.

Why this matters in the supply chain

The same confidentiality logic runs the other direction when your own mixture contains someone else's proprietary formulation as one of its components — a specialty resin, a fragrance compound, a masterbatch bought in rather than mixed on site. You need to account for that ingredient in your own PCN dossier, but your supplier has exactly the same reasons for not wanting its formulation copied into your paperwork that you have for not wanting yours copied into a customer's. Annex VIII resolves this with a mechanism built for it: citing the supplier's own UFI in place of disclosing what is inside their component. How that works, and the condition it depends on, is covered in full on our page on using a supplier's UFI in a mixture in mixture.

What is visible to your competitors

Here is the honest version, without overselling what the system protects: the only thing that reaches a shelf, a product page, or a competitor's hands is the 16-character code with its UFI: prefix. Nothing else about the composition is printed anywhere a member of the public — or a rival formulator standing in a shop comparing labels — can read it. A competitor can note that your code exists, can see it change if you relabel after a reformulation, and can in principle buy the product and send it for independent lab analysis the way they always could regardless of what CLP requires. What the UFI system does not do is hand that analysis to them for free by printing the recipe in code form on the pack.

It is also worth being precise about what it does not protect. The UFI says nothing about your pricing, your supplier relationships, your manufacturing process, or anything else a competitor might want to know beyond the formulation itself — and even the formulation stays hidden only as long as the code itself is never accompanied, elsewhere on your own materials, by the composition it points to. Confidentiality here is a property of the notification system, not a guarantee that applies to whatever else your company chooses to publish.