New "Medical Device Production Quality Management Standards" to Take Effect on November 1, 2026: From "Managing Factories" to "Managing the Entire Chain" — 200 Quantitative Inspection Items + One-Vote Veto Red Lines, Both Contract Manufacturers and Brand Owners Need to Re-understand GMP

On June 9, 2026, the Comprehensive Department of the National Medical Products Administration issued the "Guidelines for Inspection of Medical Device Production Quality Management Standards (Draft for Comments)", soliciting opinions from the entire industry, with a deadline of June 24. This document is the supporting inspection benchmark for the 2025 version of the "Medical Device Production Quality Management Standards" (commonly known as the new GMP, officially implemented on November 1, 2026) — in simple terms, the new regulations take effect in November, and how inspections are scored and classified is all defined in this document.

The most critical numbers: - 200 items of quantifiable inspection items (39 critical items + 86 major items + 75 general items) - November 1 — the new GMP officially takes effect - The 2015 version guidelines that have been in use for 11 years (Food and Drug Administration Medical Device Supervision [2015] No. 218) are repealed

For brand owners using contract manufacturing for Class II medical device registration and channel distributors doing private labeling, this document is more worth reading carefully than the new GMP itself — because it directly determines, when regulators conduct on-site inspections, which issues are one-vote vetoes, which require rectification within a deadline, and which are self-inspection and self-correction.

This article will clearly explain three things regarding the new GMP inspection guidelines: the real impact on contract manufacturers, how brand owners should select contract manufacturers, and how UDI compliance should be implemented.

I. What Exactly Has Changed in the New GMP — 3 Core Changes

Change 1: From "Only Managing Factories" to "Managing the Entire Chain"

The 2015 version only targeted production enterprises holding Medical Device Production Licenses, with registration verification, license inspections, and routine unannounced inspections only constraining the production facility. How was contract manufacturing managed? It wasn't written.

The 2026 new version directly expands coverage: it covers four types of entities — registrants, filers, commissioning parties, and contract manufacturing enterprises, achieving "whoever holds the certificate is responsible" throughout the entire chain.

Practical impact: - Brand owners (registrants/filers) are explicitly included in GMP regulatory scope for the first time - Both commissioning and contract manufacturing parties must undergo on-site inspections - Outsourced processing, commissioned testing, and cross-facility contract production now have complete inspection clauses for the first time

Change 2: From "Rough Framework" to "Full Lifecycle Systematization"

The 2015 version framework was 12 chapters: "Organization and Personnel – Facilities and Premises – Equipment – Documentation – Design – Procurement – Production – Quality Control – Sales – Nonconforming Products – Adverse Events – Analysis and Improvement." There was no independent quality assurance chapter, no independent validation and qualification chapter, and no independent contract manufacturing chapter — risk management and change control were scattered across piecemeal clauses.

The 2026 new version directly restructures into 14 chapters:

1. General Provisions
2. Quality Assurance (newly independent chapter)
3. Organization and Personnel
4. Premises and Facilities
5. Equipment
6. Documentation and Data Management
7. Design and Development
8. Procurement and Raw Material Management
9. Validation and Qualification (newly independent chapter)
10. Production Management
11. Quality Control and Product Release
12. Contract Manufacturing and Outsourced Processing (newly independent chapter)
13. Sales and After-Sales Service
14. Analysis and Improvement

Practical impact: - Quality Assurance (QA) becomes a standalone chapter for the first time, requiring QA to perform duties independently and hold quality veto power - Validation and Qualification becomes a standalone chapter for the first time, mandating closed-loop validation of full-process processes, cleaning, and computerized systems - Contract manufacturing becomes a standalone chapter for the first time, clarifying commissioning party control obligations, contract manufacturer production responsibilities, and system interface inspection points for both parties

Change 3: From "Vague Classification" to "200 Quantitative Red Lines"

The 2015 version only had two levels — "key clauses + ordinary clauses" — with no clear three-tier classification and no quantitative deduction standards. Inspectors had broad discretion, and enterprises could not predict inspection results.

The 2026 new version has 200 fixed inspection items, all corresponding to the original regulatory text, with unified national standards:

Inspectors use the 200-item checklist to check item by item, and enterprises can also precisely benchmark for self-inspection. This was unimaginable under the 2015 version.

II. 4 New UDI Regulations — The Most Likely Area for Contract Manufacturers to "Fail Unannounced Inspections"

In the new GMP inspection guidelines, there are 4 clauses directly governing UDI implementation, concentrated in the production management module, with risk weight increasing progressively:

Clause 10.4.1 (Critical Item): Batch production records must satisfy full-chain traceability

High-weight critical defect item. The regulations require complete batch production records for every batch and every unit of medical device, with UDI serving as the core carrier linking raw materials, production, finished products, and distribution across the entire traceability chain.

Judgment red lines: - Production without records → directly determined as traceability system failure - Retroactively supplementing or altering records → critical item defect - UDI codes cannot be linked to product batches → critical item defect - Cumulative critical item defects exceeding 2 → production license renewal and change verification will be directly rejected; unannounced inspections during marketing can order immediate production suspension for rectification

Clause 10.4.2 (General Item): UDI must be included as a mandatory field in production records

Batch production records must include the Unique Device Identifier. It may be filled in as either the production batch number or product serial number, or both may be recorded simultaneously.

Judgment red lines: - Document codes inconsistent with product outer packaging codes → general item defect - Alterations, abbreviations, or errors in UDI entries → general item defect - Violations of this clause alone are mostly subject to self-correction within a deadline - Cumulative general defects exceeding 20 → regulators automatically escalate enforcement measures

Clause 10.13.1 (General Item): Traceability procedures must be accompanied by UDI management systems

Enterprises must independently establish written product traceability procedures, with UDI management written into documentation as a standalone module, not merely remaining as verbal norms.

Judgment red lines: - The system must clearly specify coding operation procedures, barcode scanning and retention requirements, handling of duplicate or missing codes, and data retrieval and query processes - On-site verification simultaneously checks system documents against actual workshop operation records - System exists but is not executed, or processes are disconnected from actual operations → general item defect

Clause 10.14.1 (Major Item): Three mandatory obligations — coding, uploading, and data updates

Core assessment clause for UDI compliance, with risk level second only to critical items, and a frequent failure point in unannounced inspections in recent years.

Three mandatory obligations: 1. Standardize coding at all packaging levels — the smallest saleable unit and inner/outer packaging must all bear compliant UDI labels; the DI product identifier must be unique for life, and one code for multiple uses, blank codes, and duplicate codes are strictly prohibited 2. Strictly implement "upload first, market later" — before finished products leave the factory for distribution, complete UDI information must be uploaded to the National Medical Device Unique Device Identification Database 3. After product registration information, specifications, or packaging changes, promptly update platform data — ensuring complete consistency between the online database, physical products, and registration certificate information

Judgment red lines: - Products missing codes or with unreadable barcodes → major item defect - Failure to upload data within the deadline → major item defect - Database information inconsistent with physical products → major item defect - Unauthorized use of other products' codes → major item defect - Cumulative major item defects reaching 10 → directly triggers production suspension for rectification

III. 3 GMP Non-Compliance "Negative Examples from Unannounced Inspections" — NMPA Notice Dated May 20, 2026

On May 20, 2026, the National Medical Products Administration issued a notice stating that 3 medical device enterprises had serious defects in their quality management systems, failing to meet the requirements of the Standards and the Annex to the Medical Device Production Quality Management Standards — Sterile Medical Devices. The enterprises have confirmed the existing problems and ceased production.

Case 1: A certain medical device company - Organization and Personnel: Did not have quality management personnel commensurate with production needs; key position personnel lacked sufficient competence - Quality Control: Did not effectively inspect and control raw materials, semi-finished products, or finished products; some inspection records were missing or untraceable - Sales and After-Sales Service: Product sales over the past two years could not be effectively traced - Non-compliant with the Standards requirement that "enterprises shall establish product sales records that satisfy traceability requirements"

Case 2: Shandong Zhushi Pharmaceutical Group Co., Ltd. - Organization and Personnel: Management representative lacked sufficient competence and was unfamiliar with medical device regulations; finished product inspection and release controls were lax - Quality Control: Some finished product inspection records were untraceable; the operating system time of gas chromatographs was modified, causing some inspection record dates to be inconsistent with actual dates; for some batches of sterile syringes, the ethylene oxide residue analysis date was later than the data processing date, creating a time logic error

Practical warnings: - Modifying instrument system time is a "capital offense" in GMP unannounced inspections — directly determined as record falsification - Inspectors will use data time logic to infer falsification - Ethylene oxide residue levels in sterile products are a mandatory inspection item in unannounced inspections

Case 3: Jiangsu Huayue Health Industry Group Co., Ltd. (no specific details) - Production has been suspended; rectification and re-inspection must pass before production can resume

Commonalities among these 3 enterprises: 1. System documents and actual operations were "two separate skins" 2. Incomplete or untraceable records 3. Insufficient competence of key position personnel 4. Forced production suspension for rectification after unannounced inspections

IV. Practical Recommendations for Contract Manufacturers and Brand Owners — New GMP Compliance Checklist

Recommendation 1: Contract manufacturers self-check "4 Whethers"

Recommendation 2: Brand owners' "5 New Standards" for selecting contract manufacturers

After the new GMP takes effect in November, the "old standards" for selecting contract manufacturers (GMPC certificate + ISO13485 certificate + facility area) are no longer sufficient. The new standards are:

1. New GMP transition progress: Has the system documentation been revised in accordance with the 2025 GMP? Complete full-dimension benchmarking self-inspection by end of May, and complete all issue rectification by end of October — this is the clear timeline given to enterprises by the Yangjiang Municipal Regulatory Bureau
2. 200-item self-inspection report: Can they provide a 200-item self-inspection checklist based on the 2026 guidelines? Which items are compliant, which are risk items, and what is the rectification plan
3. UDI practical capability: Has a dedicated UDI management system been established? Has a full-chain trial run of "upload first, market later" been completed? What is the data upload rate to the National Medical Device Unique Device Identification Database
4. Contract manufacturing system: Does the quality agreement cover all new requirements of the 2026 version? Does the annual audit include unannounced inspections by the commissioning party of the contract manufacturer?
5. Unannounced inspection history: Have they undergone provincial-level or higher unannounced inspections in the past 2 years? What is the rectification completion rate? Have there been any production suspension rectifications?

Recommendation 3: Brand owners' own "3 Actions"

After the new GMP takes effect in November, brand owners as registrants/filers are included in regulatory scope for the first time. 3 actions must be taken:

1. Establish quality management system documentation — stop "affiliating" with contract manufacturers. The 2026 new regulations clearly state "whoever holds the certificate is responsible," so brand owners (registrants) must establish independent quality management system documentation covering the full process of design and development, procurement, production, and after-sales service
2. Contract manufacturing quality agreements must be updated — brand owners still using 2015 version agreements need to re-sign. The new agreements must cover: UDI management responsibility allocation, change notification mechanisms, annual audit frequency, nonconforming product handling, and post-market surveillance
3. Post-market surveillance and adverse event reporting — this is a core new responsibility added by the 2026 new regulations for registrants/filers. The National Center for Adverse Drug Reaction Monitoring just released the "Medical Device Periodic Risk Evaluation Report Submission Form" (2026 Revised Edition) on July 9, and all Class II and III medical device registrants within their first registration cycle must submit PRER/PSUR using the new form

V. Hunan Yian Biological's Approach — A "Practical Sample" of New GMP Compliance

After theory, let's look at practice. Hunan Yian Biological, as a Class 100,000 cleanroom contract manufacturer in Ningxiang Lanyuegu Intelligent Manufacturing Industrial Park, Hunan, has taken several key actions for 2026 GMP compliance:

1. Quality assurance as an independent chapter: The QA department is independent of the production department, reports directly to the General Manager, and holds quality veto power
2. Closed-loop validation and qualification: Process validation, cleaning validation, and computerized system validation for core products such as lyophilized powder, gel, and liquid dressings are all archived, with periodic re-validation every 2 years
3. Standardized contract manufacturing agreement templates: New quality agreements have been signed with commissioning parties such as Hunan Weipei Biomedical and Hunan Weipei Meihui Medical, covering UDI management responsibility allocation, annual audit mechanisms, and change synchronization processes
4. Practical UDI management: All Class II medical device registration products have completed DI code applications, national database uploads, and batch association testing. The newly approved Xiangxie Zhunzhu 20252140968 (Medical Gel Dressing) and Xiangxie Zhunzhu 20252141021 (Medical Paste Dressing) in December 2025 have been executed in accordance with UDI new regulations from the start
5. Standardized change management: Multiple production address changes have been completed since 2025 (Building 11, Unit 501 → Building 11), with complete and traceable change processes

This approach didn't start in 2026 — it was already being done during the 2015 GMP era. The 2026 new regulations simply turn "industry practice" into "explicit rules" — having little impact on contract manufacturers that were already compliant, but dealing a fatal blow to those that "don't renew old certificates and don't report new ones".

VI. Final Thoughts

The new GMP officially takes effect on November 1, 2026, marking the largest systemic restructuring in the medical device contract manufacturing industry in nearly 11 years. From "managing factories" to "managing the entire chain," from "vague classification" to "200 quantitative red lines," from "affiliating with contract manufacturers" to "whoever holds the certificate is responsible" — every change raises the industry threshold.

For contract manufacturers that are already compliant, this is a positive — fewer competitors, lower unannounced inspection failure rates, and brand owners are more willing to cooperate. For non-compliant contract manufacturers, this is a lifeline-or-death line — critical items >2 means direct production suspension for rectification, major items ≥10 means production suspension, total >20 means direct failure.

For brand owners, this is a "watershed" in selecting contract manufacturers — after November, if a contract manufacturer cannot provide a 200-item self-inspection checklist, it is recommended to replace them directly. The compliance costs of the new GMP will be passed on to brand owners through contract manufacturing pricing — contract manufacturers that plan early will have lower costs, more stable service, and lower unannounced inspection risks.

There are 3 and a half months until November 1. There isn't much preparation time left, but it's enough for a compliant contract manufacturer to complete all rectifications. The key is — don't wait until the unannounced inspection arrives to make changes.