Read the grades alongside the inspection framework
A reproduced notice reports that NMPA is revising its 2020 independent-software on-site inspection guidance, with comments due by October 13, 2026. The draft addresses independent-software registrants and contract manufacturers and connects general medical-device GMP provisions with the software appendix.
The reproduced checklist contains 203 items: 41 critical, 95 major and 67 general, identified by three, two and one asterisk respectively. Inspection types and outcome determinations refer to the general GMP inspection guidance. A grade alone therefore does not establish the outcome of a particular inspection.
Software traceability analysis is critical. The requirement that developers and testers of the same software item do not serve in both roles for black-box testing is also critical. Configuration management, release, cloud-service agreements and cybersecurity incident response are major items. Treating all of them as critical findings loses the draft’s distinctions.
Manufacturers of imaging or IVD equipment need to distinguish independent software from software components in a device before assessing this checklist’s scope. The presence of software is not sufficient to establish applicability of every item. This is a revision of an existing inspection document, not the first establishment of software production controls.
What traceability needs to connect
Item 7.4.1 calls for documented traceability procedures covering third-party software and cybersecurity, an analysis report for review, and tools supporting development, updates and the software lifecycle.
The associated clauses explain the relationships. At the requirements stage, traceability addresses software requirements in relation to risk management and product requirements. Design-stage analysis links design to requirements; coding-stage analysis links source code to design and to test cases. Retaining each type of document is distinct from demonstrating those connections.
A requirements-to-test matrix alone may therefore leave relationships unaddressed. The update provisions also require relevant documents to be maintained, reviewed or approved as appropriate. Traceability cannot be assumed to remain adequate merely because it was established for the initial development. Its format matters less than whether the evidence captures the specified relationships.
Release controls address a different question: whether the delivered software is identifiable and its release repeatable. Item 10.11.1 covers product-file creation, archiving and backup, version identification and marking, assessment and verification of delivery, and virus protection. Configuration management covers versions, source code, documents, tools and third-party software.
Together these controls link the released package to controlled inputs: what was released and how that version was produced. Retaining more documents does not by itself demonstrate that link. Network delivery has additional provisions for product marking, licensing and cybersecurity assurance.
Cloud agreements and security response have distinct purposes
Item 8.5.1 distinguishes outsourced software from cloud computing. Outsourced-software quality agreements address matters including requirements, delivery, acceptance, design files, intellectual property and maintenance. Cloud-service agreements must define responsibilities for cybersecurity assurance and protection of patient data and privacy.
Within that responsibility framework, service availability alone does not explain who is responsible for cybersecurity or patient data. Implementation depends on the cloud arrangement. The clause does not support a claim that the draft expressly specifies uniform SLA metrics, a particular data-isolation architecture or an SBOM format.
Item 14.7.2 addresses documented cybersecurity response, including event risk management, verification of response measures, user notification and recalls, with records. Its coverage extends beyond implementing a technical fix to the verification and communication that accompany a quality-system response.
The grades, traceability relationships and responsibility categories provide concrete material for understanding the draft. Claims about which provisions are newly introduced require comparison with the prior document and eventual final text. The November 1, 2026 implementation arrangements for the general GMP framework do not establish an effective date for this consultation draft.
Source limitation
The current consultation material used here is a public reproduction, not an authenticated copy obtained directly from NMPA. Counts, grades, clauses and the deadline are attributed to that material. Official background information supports the general framework but does not authenticate the current copy.
Sources
- Primary official source医疗器械生产质量管理规范独立软件检查指导原则（征求意见稿）—公开转载全文 (opens in a new tab)夜雨聆风学习网（转载国家药监局文本）
- Supporting source国家局：独立软件检查指导原则（征求意见稿）—通知转载 (opens in a new tab)夜雨聆风学习网
- Supporting source国家药监局关于印发医疗器械生产质量管理规范检查指导原则的通知 (opens in a new tab)Shanghai Medical Products Administration