ISO 13485 is the global baseline for a medical device quality system. Most manufacturers of medical devices use it.

But does ISO 13485 cover everything China expects? Not fully.

China has its own adoption version of ISO 13485:2016, which is YY/T 0287-2017.

If you recall the “four horsemen” of China’s standard types, this is a recommended standard, not a compulsory one.

So what sets the ground rules for a QMS in China? China’s Good Manufacturing Practice (GMP).

The old GMP focused on manufacturers.

It covered the activities from design, development, production, sales, to after-sales service for medical devices.

The new GMP regulation came out last week.

The new GMP goes deeper into how registrants, contract manufacturers, and outsourced activities are managed within the quality system.

In this series, I’ll break down what will change in the new GMP and how it differs from ISO 13485.

What’s new?

The New GMP replaces the 2014 rules. The major changes include, but are not limited to the following:

🍜 Expansion of scope

The 2014 rules specifically focused on manufacturers.

New GMP expands to both registrants and contract manufacturers.

The scope reaches into R&D, production, quality control, product release, sales, and after-sales service.

The term “registrant” is the key.

It points directly to the registration holder of the device registration, whether your company is based in China or overseas.

You must meet China’s relevant GMP requirements, even if you do not operate the factory yourself.

This is no longer a rulebook only for factory operators.

If you plan to enter China, build your quality system to align with China’s GMP in addition to ISO 13485.

That means aligning roles, agreements, and records so the registrant’s accountability is visible and the contract manufacturer’s controls are validated and auditable.

🍜 Personnel competence

China’s new GMP sets clear education and experience requirements by device class risk.

The management representative should come from your senior leadership team.

For Class II and Class III devices, the management representative should hold a bachelor’s degree or higher in a medical device-related field, or have an intermediate or higher professional technical title.

A college degree or higher in a medical device-related field is required for Class I devices.

As a rule of thumb, the management representative needs at least three years of experience in quality management (QM) or in production or technical management.

This person should understand the products and how they are made, know how the quality system runs, and show solid professional competence in the medical devices.

The head of quality and production must meet the same requirements as the management representative.

They should have at least three years of relevant experience in manufacturing or QM of medical devices.

Additionally, you need a formal release reviewer. This should be someone from the QM who has been trained and has experience approving product releases.

🍜 Production and facilities

The new GMP raises the bar for environmental controls in production sites.

Manufacturers need to keep a static pressure differential of ≥10 Pa between clean and non-clean zones, if the process involves a cleanroom setting.

Keep ≥5 Pa between clean zones of different grades.

Where it makes sense, maintain a pressure gradient between functional rooms within the same cleanliness grade to control flow and prevent cross-contamination.

Where necessary, maintain appropriate pressure differential gradients between different functional areas with the same cleanliness grade.

This is to control flow and prevent cross-contamination.

Use relative negative pressure in areas that may generate dust, fumes, or toxic substances. Purify exhaust before discharge, so it meets environmental requirements.

ISO 13485 requires controlled environments appropriate to the product category and risk class.

But it does not set specific numerical limits.

If your site follows ISO 14644 but does not track pressure exactly, add explicit setpoints, alarms, continuous monitoring, and trending.

Document these controls in your HVAC and environmental monitoring procedures.

🍜 Production control

Both ISO and GMP require a complete design history file for every product and meet traceability requirements across the full life cycle.

GMP further outlines specific requirements for production records.

It should capture the product name, model, product reference, unique device identifier, production date, quantity, critical raw materials, batch or serial numbers, intermediate batch numbers, major equipment list, key process parameters, and the operators involved.

These records shall also show the material balance.

You must track how you use key raw materials and define acceptable yield limits. Investigate any yield that falls outside the limit and document the outcome.

This involves material tracking and management from raw materials and intermediates to finished products and waste.

It ensures that material inputs and outputs reconcile.

Also, manufacturers should define a maximum batch size or a maximum run time before cleaning and maintenance are required.

If you run continuous production, validate how it affects the environment and the equipment, and define when you will stop for cleaning and checks.

Another new requirement on what to do if you restart production after a shutdown.

Verify and requalify the relevant processes on environment, equipment, suppliers, incoming materials, intermediates, water, HVAC, process gases, and air cleaning systems before you resume normal production.

You can link these steps to change control and deviation procedures. Use risk assessment to justify your decision.

🍜 Contract manufacturing & product release

I personally think this is the headline for those who use a CMO.

China now separates production release from market release. ISO 13485 doesn’t have the GMP dual-release concept.

The contract manufacturer can handle production release.

However, only the legal manufacturer or the registrant can release products to the market.

You cannot push the market release action to your CMO. This split makes liability and responsibility clear on both sides.

Like ISO 13485, the CMO’s quality system must cover the full device lifecycle. The registrant and the CMO need a signed quality agreement.

It outlines how production will run, who approves what, and how both parties manage changes and notifications.

Make sure that design changes, process changes, and release decisions are documented by both parties and informed on time in writing.

For critical raw materials, your suppliers must notify you of changes in advance. You then assess the impact and audit the supplier when needed.

Treat outsourced activities through your supplier management process. Evaluate competence, quality assurance, and risk. Put the requirements in a signed agreement.

For multinational networks (design at A, manufacturing at B, sterilization at C), NMPA expects to see clear interfaces and responsibilities, with change control and release process mapped to GMP terms.

Each finished product needs a proof of conformity for release.

You can show this with a product test report, a release slip, a compliance label, or a certificate of conformity.

This document is mandatory for the Chinese customs.

🍜 Verification and validation

This is a brand-new chapter in the GMP.

You must validate your production processes, your facility, and your main equipment.

The GMP also expects you to verify and validate your operating and testing methods.

You have to prove that when you run the process as specified, the products meet mandatory standards, product technical requirements, and the defined intended use.

China draws a clear line between verification and validation.

Use verification to confirm special processes that you cannot fully check by routine inspection of the finished product.

Use validation for critical processes that have a direct impact on safety and performance.

Keep the validation master plans, protocols, reports, and a matrix that shows when you will re-validate.

This should not come as a surprise if you follow ISO 13485.

Data integrity of the electronic records is also highlighted. Record and control user access, audit trails, change logs, and data backup.

If you use e-signatures, define how you verify identity and preserve signatures. Inspectors will ask for objective evidence, not just a policy.

These are the key updates I think matter most for QA teams already aligned with ISO 13485. That’s it for now!

New requirements will take effect on November 1st, 2026.

Need help assessing market entry strategy and regulatory compliance in China? Let’s talk!

Subscribe to the newsletter if you found this issue helpful. Stay informed about China’s ever-changing medtech regulations alongside other RA/QA specialists.

Forwarded this email? Sign up here
Follow me on LinkedIn

Disclaimer: This content is created solely in my personal interest and does not reflect the views, opinions, or policies of my employer or any other organizations I am affiliated with. Neither I nor my employer is liable for any use of this content. This newsletter does not compete with my employer’s interests. Any references to regulatory updates or guidance are based on publicly available information and are not intended to infringe upon proprietary or confidential content.