China’s National Medical Products Administration (NMPA) put its revised Good Manufacturing Practice (GMP) for Medical Devices into effect on 1 November 2026. Issued under NMPA Announcement No. 107, the revised regulation replaces the 2014 edition and introduces more comprehensive requirements for quality assurance, lifecycle risk management, validation and verification, and contract manufacturing.

The updated framework applies to medical device registrants, filing holders and contract manufacturers. It covers design and development, manufacturing, quality control, product release, sales and after-sales service.

According to the NMPA, the revised GMP comprises 15 chapters and 132 articles, compared with the previous edition issued in 2014. Three new chapters address quality assurance, validation and verification, and contract manufacturing and outsourcing.

Strengthened quality assurance and lifecycle risk management

The revised GMP requires companies to integrate risk management throughout the entire quality management system, from design and development to manufacturing and after-sales service.

Chapter 2, dedicated to quality assurance, establishes more explicit requirements for quality objectives, management responsibilities, resources and the effective operation of the quality management system.

Companies must collect quality and risk information throughout the product lifecycle, conduct periodic risk management reviews and ensure that control measures remain effective. The regulation also reinforces change control, internal audits, management reviews and continuous improvement.

The quality management department must carry out quality assurance and quality control functions independently and has authority to reject products that do not meet quality requirements.

Management responsibilities and key personnel

The revised GMP clarifies organisational responsibilities and requirements for personnel holding key positions.

These include the legal representative, principal person in charge, management representative, heads of production and quality management departments, and product release reviewer.

The heads of production management and quality management departments are prohibited from holding each other’s positions. The principal person in charge, management representative, production manager, quality manager and product release reviewer must be full-time employees.

The regulation also requires companies to provide sufficient personnel with appropriate qualifications, training and practical experience. Responsibilities and authorities must be clearly defined within the organisational structure.

Contract manufacturing and outsourcing

Chapter 12 introduces a more comprehensive framework for contract manufacturing and outsourced processing.

The quality management system of the registrant or filing holder must cover the entire product lifecycle, while the contract manufacturer’s system must cover the activities performed under the manufacturing arrangement.

Before contract manufacturing begins, the contracting party must conduct an on-site assessment of the contractor’s manufacturing capabilities, quality assurance system and risk management capabilities. Regular on-site audits and assessments are required throughout the contract manufacturing relationship.

The parties must establish a quality agreement defining their respective rights, obligations and responsibilities. The contracting party cannot transfer statutory responsibilities to the contract manufacturer through contractual arrangements.

The revised GMP further clarifies the two-stage product release process:

• Production release: performed by the contract manufacturer after reviewing manufacturing and quality control records
• Marketing release: performed by the registrant or filing holder after reviewing the relevant production and quality documentation

Marketing release must be performed by the registrant or filing holder itself and cannot be delegated to another company.

These requirements are particularly relevant to international medical device manufacturers using contract manufacturing facilities in China.

Validation and verification requirements

Chapter 9 strengthens requirements for validation and verification across manufacturing operations.

Companies must determine the scope and extent of these activities based on risk assessment. Facilities, equipment and manufacturing processes must undergo appropriate qualification, validation or verification to demonstrate their suitability and consistent performance.

Special processes require validation, while critical manufacturing operations must undergo verification. Changes to critical raw materials, manufacturing environments, processes, equipment and inspection methods must be assessed to determine whether additional validation or qualification is necessary.

The regulation also addresses computer software used in design and development, manufacturing, inspection and warehousing. Where software can affect product quality, companies must confirm its suitability before initial use and reconfirm after changes, where necessary. The scope of these activities must be proportionate to the risks associated with the software.

Documentation, electronic records and data integrity

The revised GMP strengthens requirements for documentation and data management.

Companies must maintain quality management system documentation covering quality policies and objectives, quality manuals, procedures, technical documentation and records.

Records must be authentic, accurate, complete, timely and traceable. The regulation requires companies using electronic records and data to implement user access controls and ensure that changes and deletions are made only by authorised personnel, with corresponding records retained.

Electronic records and data must be backed up and remain accessible throughout the applicable retention period.

Records must generally be retained for at least the service life specified for the medical device or in accordance with applicable regulatory requirements, and for no less than two years from product release.

Digital transformation and UDI traceability

The revised GMP encourages manufacturers to advance digital transformation to improve production and quality management efficiency. The NMPA specifically identifies artificial intelligence, information technology and the Unique Device Identification (UDI) system as relevant elements of the industry’s digital and intelligent transformation.

The regulation also requires companies to comply with national UDI requirements for coding, data uploading and information maintenance and updates.

Manufacturers must ensure that product identification and traceability information remains authentic, accurate, complete and traceable throughout the relevant processes.

Implications for medical device manufacturers

The revised GMP establishes a more comprehensive quality management framework for medical device manufacturing in China.

The changes are particularly relevant to companies reviewing their quality management systems, personnel responsibilities, validation programmes, electronic documentation and arrangements with contract manufacturers.

For international manufacturers relying on Chinese production partners, the strengthened requirements for contractor assessment, ongoing audits, quality agreements and the separation of production release from marketing release are especially important.

The regulation also reinforces the need to maintain effective controls over outsourced activities and ensure that quality management responsibilities remain clearly allocated throughout the product lifecycle.