1. Overview of 2025 GMP Framework
The National Medical Products Administration (NMPA) has announced amendments to the Good Manufacturing Practice (GMP) standards for medical devices.
The new medical device GMP is scheduled to take effect on November 1, 2026.
Key high-level updates include:
• Structural expansion: Reorganized into 15 chapters and 132 articles
• Scope extension: Full lifecycle coverage, including outsourced R&D, contract manufacturing, external processing, and entrusted testing
• Compliance focus: Stronger requirements for quality assurance, personnel qualifications, facilities, supplier management, and digital documentation
• Applicability: Impacts both domestic manufacturers and overseas companies using Chinese partners or supply-chain services
2. 새로운 조항 추가
One of the most significant structural changes in China’s 2025 GMP revision is the official introduction of three new independent chapters regarding quality assurance, validation, contract manufacturing, and outsourcing activities.
1) Quality Assurance (QA)
– The newly added Quality Assurance (QA) chapter establishes QA as a core governance function rather than a supporting operational role. The regulation requires manufacturers to build a structured, management-driven quality oversight system that spans the full product lifecycle
– Key regulatory expectations include:
• Establishment of a formal QA system covering design, production, distribution, and post-market activities
• Lifecycle risk management supported by continuous data collection, trend analysis, and periodic management review
• Structured change control mechanisms requiring documented risk assessment, approval workflows, and verification when applicable
• Clear assignment of management responsibilities for quality decision-making and regulatory compliance
2) Validation and Verification
– The newly introduced Validation and Verification chapter strengthens regulatory control over manufacturing reproducibility and technical consistency. Rather than focusing only on end-product inspection, the revised GMP emphasizes scientific validation of critical processes and systematic verification of design and production outputs.
– Manufacturers are now expected to:
• Validate critical production processes and special processes that cannot be fully verified through routine inspection
• Maintain documented evidence of equivalency when transferring technologies across sites or jurisdictions
• Perform revalidation following significant changes in equipment, materials, software, or production parameters
• Integrate validation activities into formal lifecycle change management systems
3) Contract Manufacturing and Outsourced Activities
– parallel, the addition of a dedicated Contract Manufacturing and Outsourced Activities chapter formally brings external production and service providers under direct GMP regulatory control. Activities such as outsourced R&D, sterilization services, packaging operations, external processing, and entrusted testing are now explicitly regulated within the GMP framework. The regulation clearly defines that registrants retain ultimate responsibility for compliance performance across the entire supply chain.
– Core requirements include:
• Mandatory quality agreements defining technical responsibilities, quality standards, deviation handling, and change notification procedures
• Two-way oversight mechanisms, including routine audits, performance monitoring, and corrective action tracking
• Formal communication channels for reporting deviations, complaints, and quality incidents
• Clear separation of production release responsibilities and market release authority, which cannot be subcontracted
3. Lifecycle Management
– One of the most significant conceptual changes in the 2025 GMP is the formal introduction of a full product lifecycle management mindset. Rather than treating manufacturing as an isolated compliance activity, the regulation requires manufacturers to demonstrate continuous quality and risk control from early-stage design through commercialization and post-market surveillance.
– Lifecycle coverage now explicitly includes:
• Design and development planning
• Risk analysis and mitigation
• Process validation and equipment qualification
• Supplier and material control
• Batch release and distribution management
• Post-market feedback integration
• Change management and continuous improvement
4. Design and Development Controls
– The 2025 GMP significantly strengthens requirements for design and development control, bringing China closer to mature regulatory systems in the US and EU.
– The regulation emphasizes:
• Structured design planning and documentation
• Clear definition of design inputs and outputs
• Formal verification and validation activities
• Robust design transfer procedures to ensure manufacturability
• Oversight of outsourced design partners
5. Qualification Requirements for Key Personnel
– The updated GMP introduces more prescriptive qualification standards for personnel in key management and quality roles.
– Key requirements include:
• A qualified management representative for Class II and III devices with a relevant bachelor’s degree or equivalent technical title and at least three years of experience
• Equivalent qualification requirements for heads of quality management
• Full-time staffing requirements for legal representatives, management representatives, and quality leads
• Separation of production leadership and quality management roles
6. Facility, Environmental, and Infrastructure Controls
– Facility management requirements under the 2025 GMP are significantly more detailed than before.
• Defined cleanroom pressure differentials (for example, >10 Pa between clean and non-clean areas)
• Layout requirements to prevent cross-contamination and material mix-ups
• Access restrictions for production, testing, and storage areas
• Suitability of IT infrastructure to support controlled production and quality operations
7. Equipment and Instrument Control
– The revised GMP formalizes full lifecycle management requirements for equipment and measuring instruments.
– Manufacturers must demonstrate:
• Documented procurement, installation, and qualification records
• Regular calibration and verification covering actual operating ranges
• Clear status identification to prevent misuse
• Requalification following major repairs or process modifications
8. Digital Documentation and Data Requirements
– The 2025 GMP formally recognizes electronic records and electronic signatures, while introducing clearer expectations for data integrity and system security.
– Key provisions include:
• User access control with full audit trails
• Logging of data changes and deletions
• Mandatory data backup and retention procedures
• Guaranteed data readability throughout the retention period
• Controlled document lifecycle management
9. Risk-Based Supplier and Procurement Management
– Supplier oversight is now governed by a more formalized risk-based classification framework.
– The new GMP requires manufacturers to:
• Categorize suppliers based on impact on product quality and safety
• Establish detailed quality agreements defining responsibilities and technical requirements
• Receive advance notification of supplier changes affecting critical materials or processes
• Conduct on-site audits based on risk assessment
8. Comparison Overview: 2014 GMP vs. 2025 GMP
| Regulatory Area | 2014 GMP | 2025 GMP (Effective Nov 2026) |
|---|---|---|
| Structure | Limited chapters with general requirements | Expanded to 15 chapters and 132 articles with prescriptive detail |
| Lifecycle Scope | Focused mainly on production | Full lifecycle coverage including outsourced R&D and post-market activities |
| Quality Assurance | General QMS framework | Dedicated QA chapter with structured change control and lifecycle risk management |
| Personnel Requirements | Basic competency expectations | Defined education and experience thresholds; full-time key roles; role separation |
| Facility Controls | Broad cleanroom guidance | Defined pressure differentials, layout restrictions, and IT infrastructure suitability |
| Equipment Management | Basic calibration requirements | Full equipment lifecycle documentation and mandatory requalification |
| Digital Documentation | Electronic records permitted but vague | Formal recognition with audit trails, access control, and data integrity rules |
| Design Controls | Limited requirements | Structured design control, strengthened design transfer, and outsourced R&D oversight |
| Supplier Management | Basic oversight | Risk-based classification, mandatory quality agreements, structured audits |
| Contract Manufacturing | Responsibilities unclear | Defined accountability, two-way oversight, separation of production vs. market release |
| Compliance Threshold | Less prescriptive | Higher regulatory expectations requiring system upgrades |