Medical Device Good Manufacturing Practice (2025 Edition) - Corporate Response Strategies

Clause No.

New editionGMPNew/Enhanced requirements (2025）

PreviousGMPCorresponding original requirements (2014）

Recommended enterprise response strategies

Article 4

Lifecycle quality risk management runs throughout system operation and review (“quality risk management review”“continuous improvement”requirements are more systematic)

Risk management principles were already set out, but systematic review and data-driven closed-loop management were described only at a high level.

▪ Establishriskmanagement procedures and a quality system update plan;

▪ incorporate adverse events,changes,CAPA audits, and release data into unified risk management, forming a closed loop and reviewing them during internal management review.

Article 6

Explicitly encourages“digital and intelligent transformation”, emphasizing electronic records, data integrity, access permissions, and audit trails

With respect to informatization/electronic data were addressed only minimally, and the requirements were not sufficiently detailed

▪  Conductdata integrity assessment; unified document management system/Manufacturing Execution System/Laboratory Information Management System/QMSUnified access traceability management, audit trails, and backup policies;

▪   Electronicsignature legality and compliance validation。

Article 77

Information systems and computer software that affect the product must be validated/Revalidation (before first use, after changes)

Software validation requirements are incomplete and too coarse-grained

▪   EstablishCSV/CSA(Computerized System Validation/assurance) master plan and validate by risk tier;

▪   Validate/version control and revalidation for algorithms, scripts, inspection software, and process control software.

Articles 15-17

Management responsibilities are further clarified: the quality department independently performsQA/QCand has“quality veto authority”; qualification and full-time requirements for key positions

Responsibilities are stipulated, but not this explicit“veto authority”“full-time”boundary

▪  Reassess organizational structure and position qualification requirements

▪  to fill all full-time key positions (legal representative,/ principal person in charge,/ management representative,/ head of production,/ head of quality,/ release approver);

▪    Improve authorization letters and recusal mechanisms.

Articles 19-20

Refined thresholds for the education of the management representative and head of quality/ qualifications/ and years of experience (by device category)

Qualification requirements are broad;

▪   conduct a gap assessment and strengthen personnel qualifications (education,、 professional titles, years of experience);

▪  Establish backup arrangements and training plans, and retain qualification records and training assessment records.

Article 10

Classified change control, pre-implementation approval, and validation where necessary/confirmation; requires alignment with registration/filing/for changes to manufacturing matters

Change control is in place, but alignment with registration/filing is not sufficiently systematic

▪Establish integrated“registration-quality-manufacturing”change coordination workflows and dashboards

▪   define changeclassification（quality/regulatory/process/facilities, etc.), prior to implementationQAapproval, and where necessary process,/cleaning,/and method revalidation.

Articles 47-58

Design and development comprehensively strengthened: inputs/outputs/verification/validation/review/transfer (DFX→PFx) clearly defined and documented

Development control provisions are in place, but the level of detail is relatively coarse

▪ Incorporate risk control measures into design inputs;

▪  Establish verification/ and validation protocols and a report repository;

▪   Include pilot production and process validation in “design→ transfer”。

Articles 59-68

Upgrade supplier and critical outsourced process management: tiered management, on-site audits, quality agreements, and periodic comprehensive evaluations

Supplier management is in place, but requirements for “critical suppliers/' outsourcing ”agreements and documentation inventories are relatively weak

▪   Establish “critical supplier” list;

▪   execute quality agreements；

▪ Based on risk and usage volume, set the frequency of on-site audits accordingly;

▪ establish a performance scoring (quality, delivery, /tech/nology) and an exit mechanism;

▪  standardize the required-document checklist.

Article 68

Advance notification and assessment of procurement changes and changes to critical raw materials

Related requirements are not addressed early enough or systematically

▪ Include in procurement contracts and /quality agreements “advance change notification; ”；

▪  incoming material changes should trigger assessment, /veri/fication, and linkage to necessary registration activities.

Article 32

Production environment controls further specified: clean areas/Pressure differential thresholds for non-clean areas and between different grades; dust-/and hazardous-operation areas: negative pressure and exhaust gas purification

Environmental controls are required, but specific thresholds are not uniformly detailed

▪ Update facilityHVAC and BMSsetpoints;

▪ pressure differential monitoring, alarms, and deviation handling;

▪ For dust-/VOC/and hazardous-gas-generating processes, validate negative pressure and end-of-pipe treatment.

Article 93

For continuous production, “maximum number of batches, /maximum production duration, ”and cleaning/maintenance validation

there is no dedicated provision on "continuous production"

▪ Include continuous production in the process validation plan;

▪   set batch /time limits and interim cleaning points, and validate the impact on the environment and equipment.

Article 82

Requirements for material balance, reconciliation of key raw material quantities, and deviation investigation are more explicit

Documentation is required, but “material balance ”and limits are not sufficiently emphasized

▪  Expandbatchrecordstructured fields;

▪   Deployelectronicbatchrecords（eBR) automatically verify material balance and usage limits; deviations triggerCAPA。

Articles 13 + 129

deviations,CAPAand the annual review process (Annual Product Quality Review and data analysis procedures) is more complete

ExistingCAPAand internal audits, but“annual review+data analysis”workflow is incomplete

▪Establishannualproductqualityreview（APR/PQR), summarizing release, complaints/recalls, adverse events, and trend analysis;

▪Management review incorporates improvement decisions and follow-up.

Article 91

UDIrequirements for unique identifier assignment, upload, and maintenance (traceability)

2014not yet systematically incorporated in the current versionUDI

▪  Establish in fullUDImaster data and system interfaces (ERP/MES/barcodes), and improve coding, upload, and change maintenanceSOP, enabling post-market traceability.

Article 104 + Article 113

Layered release controls: under contract manufacturing arrangements“manufacturing release (contract manufacturer)/market release (registrant//filer)”clear dual-track structure

The boundary between release responsibilities in contract manufacturing is not sufficiently clear

▪ For the contract manufacturer and /the commissioning party, separately establish release procedures and document package lists;

▪ the registrant performs the market release review;

▪  establish a joint sign-off and issue escalation mechanism.

Article 101

Retention samples, test methods, and equipment management (calibration, /handling, /maintenance, /and traceability for nonconforming equipment) should be further detailed

Requirements exist, but they are not yet integrated into a comprehensive closed-loop system

▪ Establish method validationand transferSOP；

▪  Equipment register including calibration/verification and handling/storage;

▪  Equipment failure triggers a retrospective review and evaluation of historical results, with reinspection where necessary.

Article 86

Line clearance management requires pre-use confirmation, with records included in batch documentation; labeling/Instructions for Use versions are controlled

Line clearance and labeling controls are in place, but detail and interlocks are insufficient

▪   Introduce a pre-batch-start“line clearance checklist”；

▪  label/IFUversion and release,UDIlinkage;

▪ implement barcode-based error-proofing and multiple checks.

Articles 115-116

Outsourced processing shall be managed under supplier controls, with outsourced quality agreements executed and validation/release/change communication

Outsourcing clauses are not specific enough

▪  Establish outsourcedclassificationand qualificationassessment;

▪ outsourced qualityAgreementClearly specify the manufacturing processscopecoverage、validation, incominginspectionand releaseresponsibilities;

▪   changesmust be communicated bilaterally andjointreviewandassessment.

Articles 118-120

After-sales and installation requirements: transport validation and installation qualification (IQ),/acceptance criteria, and third-party installation/documentation and guidance for maintenance

There are requirements for after-sales service, but“installation qualification/documentation/passwords”are insufficiently detailed

▪   Establish a transportvalidationplan;

▪   develop installationqualificationand acceptance criteria；

▪  third-party installationmaintenancedocuments/spare parts/password management and closed-loop training record management.

Articles 45-46

Record control: the retention period shall align with the product lifetime and be no less than2years; electronic records shall be traceable, backed up, and signature-compliant

Record retention requirements exist, but details on product lifetime alignment and electronic records are incomplete

▪ unifiedpaper-electronicintegratedrecordretention strategy;

▪ electronicRecord backup

▪Electronic signature compliance assessment (legal validity, identity authentication、, audit trail).

Articles 123-127

Formalized, time-bound procedures for adverse event monitoring, recalls, and product information notification

Complaints,/ adverse events,/ and recalls exist, but the end-to-end process requirements are not sufficiently systematic

▪ Establish timely adverse eventsMonitoringSO and signal assessment;

▪ recall classification and proceduralization; standardized customer notification templates, audit trail documentation, and closed-loop verification.

Article 132

Effective date and transition: the new code shall take effect on 2026-11-01, 2014 edition is simultaneously repealed

/

▪ Immediately launch “an internal compliance gap assessment and analysis between the new and previous requirements→initiate the remediation plan→validation and training→trial operation→internal audit and management review”，

▪by 2026year Q3complete key remediation, and Q4complete the QMS transition and validation filing.