EVERBIZ | Original compilation. Please credit the source when republishing.
Every time a medical software product is updated, can the manufacturer clearly answer: what changed, what does it affect, who verified it, and who approved the release?
For medical device software companies, these questions link R&D, quality and post-market product management. They are also the first questions worth asking in an internal self-inspection.
According to published reports, China’s National Medical Products Administration (NMPA) issued the Notice on Issuing the Inspection Guideline for Standalone Software under the Good Manufacturing Practice for Medical Devices on 30 October 2026. The guideline applies from 1 November 2026.
What matters here is that standalone software manufacturers must now build the revised GMP requirements into day-to-day development, testing, release and maintenance.
Whether compliance stands up to inspection is ultimately answered by the processes and records that actually run.
1. Background: the revised GMP is already in force
An earlier NMPA notice made clear that from 1 November 2026, regulators carry out manufacturing licence inspections and post-market supervisory inspections against the revised Good Manufacturing Practice for Medical Devices. Manufacturers of standalone software and other covered device categories must comply with both the revised GMP and the applicable current appendices. (NMPA implementation notice, in Chinese)
For manufacturers, this means the quality system transition has moved into actual execution.
Revising the quality manual and updating procedures is only the starting point. The next questions are whether the development team follows the updated processes, whether quality staff can obtain complete records, and whether management can spot and handle risks in time.
The release of a dedicated inspection guideline is also a signal to check the official documents promptly and re-examine the gap between internal self-inspection checklists and current workflows.
2. Start the self-inspection from one real release
Faced with inspection requirements, companies tend to begin by tidying up their procedures. A more useful approach is to pick a recently released software version and trace it along the actual delivery path.
For example, a feature change starts with user feedback, goes through requirements review, development and testing, and is finally delivered to customers. Can the company reconstruct that entire chain?
We suggest building the internal check around these questions:
- Who raised the requirement, and was it reviewed and approved?
- Was the change assessed for its impact on safety, effectiveness and related functions?
- How was the test scope determined, and how were defects handled?
- Can the released software package be matched to test records and version information?
- Who reviewed the delivery conditions, and who approved the release?
- Can user-reported issues be traced to a specific version and the related handling records?
These are self-inspection suggestions, not a clause-by-clause restatement of the official annex.
The value of this exercise lies in finding the breaks between processes: a change logged in the development tool without a matching assessment in the quality records, or a completed test report that cannot be matched precisely to the package actually delivered.
For the same release, R&D, testing, quality and service teams should all give the same answer.
3. Treat the release as the key point of cross-functional work
Software delivery involves frequent iterations and varied update methods. A seemingly minor change can still affect functional performance, the operating environment or how users work with the product.
Companies can therefore check first whether responsibilities around the release step are clear.
R&D needs to explain the change and its technical impact; testers need to provide verification evidence that matches the version actually delivered; quality staff need to confirm the required steps were completed; service staff need to know who received the release, how it was deployed and what feedback followed.
If this information is scattered across different systems, personal computers or chat histories, the company needs to assess whether its current approach supports accurate traceability and whether the records are kept under control.
Tools may differ, but the links between responsibilities, approvals and evidence must be clear.
4. Three things to do now
First, confirm the applicable documents and versions.
Regulatory and quality functions should jointly check the revised GMP, the standalone software appendix and the new inspection guideline, confirming document status, scope and implementation requirements. Internal training materials, self-inspection checklists and external consulting materials should be checked against the current versions as well.
Second, test the system with real projects.
Pick one released version and one project in development and check whether procedural requirements are actually followed. Focus on whether records connect, whether responsibilities are fulfilled and whether identified issues have been closed.
Third, make corrective actions verifiable.
For each gap, define an owner, a deadline and a verification method. Issues spanning several departments should be driven jointly by the relevant managers, so that corrective action does not stop at adding documents or back-signing records.
Companies should also set priorities based on product risk, business model and actual processes.
How EVERBIZ Can Help
EVERBIZ has long supported medical device companies with regulatory registration and quality management system services in China and international markets. For China’s revised medical device GMP and standalone software inspections, we offer:
- Gap assessment between the old and new inspection guidelines, with a corrective action plan;
- Quality management system documentation upgrades (including standalone software appendix requirements);
- Mock inspections and inspection-readiness coaching.
This article is a compilation of regulatory information and does not constitute legal advice. The original texts published by the NMPA prevail.
EVERBIZ | Original compilation. Please credit the source when republishing.