Good Manufacturing Practice (GMP) is the body of regulatory requirements governing how medical devices are designed, manufactured, packaged, labeled, stored, installed, and serviced, so that finished devices are consistently safe and effective. In the United States, device GMP is codified in 21 CFR Part 820, now titled the Quality Management System Regulation (QMSR).
What is Good Manufacturing Practice (GMP)?
GMP, often written CGMP (current Good Manufacturing Practice), describes the methods, facilities, and controls a manufacturer must have in place before it can lawfully distribute a device. The word “current” matters: the expectation tracks accepted industry practice at the time of inspection, not when the procedure was written.
Device GMP is broader than the term suggests. It does not begin at the production line. It spans design and development, purchasing, production, packaging, labeling, storage, installation, and servicing. Quality is built into a device and cannot be inspected into it afterward.
Why Good Manufacturing Practice (GMP) matters in medical device development
A device made outside GMP is deemed adulterated under the Federal Food, Drug, and Cosmetic Act, whether or not the product is defective. That is a legal status, not a quality opinion, and it carries consequences: Form 483 observations, warning letters, import refusal, consent decrees.
The commercial stakes are just as concrete. A 510(k) clearance or CE certificate does not survive a broken quality system. Notified bodies suspend certificates. Distributors stop shipments. A failed pre-approval inspection can push a launch out by quarters.
Then there is the reason all of this exists. Sterile barrier failures, mislabeled reagents, and unvalidated welds reach patients.
Key components of a device GMP system
Under the QMSR, effective February 2, 2026, FDA incorporates ISO 13485:2016 by reference, so manufacturers build to the ISO clause structure with a small set of FDA-specific additions retained in Part 820. The building blocks:
- QMS governance. A documented quality system, defined responsibilities, and management review with recorded decisions.
- Design controls. Planning, inputs, outputs, review, verification, validation, transfer, and change control, per ISO 13485 Clause 7.3. Class II and III devices are in scope; most Class I devices are exempt.
- Risk management. A lifecycle risk file under ISO 14971:2019, feeding design inputs, process controls, and post-market data back into the analysis.
- Facility control. Cleanroom classification and monitoring to ISO 14644-1:2015, ESD-controlled areas for electronics, bioburden control where sterility matters.
- Process validation. IQ, OQ, and PQ for any process whose output cannot be fully verified downstream: injection molding, laser welding, sterile barrier sealing under ISO 11607.
- Production controls and traceability. Approved work instructions, in-process checks, and a device history record that reconstructs how a unit or lot was built.
- Supplier controls. Supplier qualification, incoming inspection, and agreements requiring notification of process or material changes.
- CAPA and complaints. Complaint intake, investigation, root cause analysis, corrective and preventive action, and reportability assessment under 21 CFR Part 803.
- Software. IEC 62304 for the device software lifecycle, plus validation of production and quality system software tools.
Outside the US, the vocabulary shifts. EU MDR 2017/745 Article 10(9) requires a quality management system rather than naming GMP, and ISO 13485 is the practical route to conformity. India’s Medical Devices Rules, 2017, place quality requirements in the Fifth Schedule.
Common challenges and best practices
The most common failure is treating GMP as a document set. Procedures describing a process nobody follows generate more findings than no procedure at all, because the gap itself is evidence of an ineffective system.
Validation gaps surface at design transfer. Teams validate the pilot line, then move to a production tool, a second cavity, or a new supplier, and call it equivalence. Requalification scope should follow the risk file, not the schedule.
CAPA turns into a paperwork loop when investigations stop at the proximate cause. Closing a CAPA on operator retraining three times for one defect is a finding waiting to happen.
Two QMSR-specific points deserve attention. Internal audit, supplier audit, and management review records are now open to FDA inspection; the old 820.180© exemption was not carried forward. FDA also retired the Quality System Inspection Technique for Compliance Program 7382.850, so audit rehearsals built on the four-subsystem model need rework.
Good looks like one integrated system satisfying ISO 13485, the QMSR, and EU MDR at once, with records generated as work happens.
How SJML helps with Good Manufacturing Practice (GMP)
Syrma Johari MedTech is an end-to-end medical device CDMO with quality systems certified to ISO 13485 and aligned to FDA 21 CFR Part 820, EU MDR and IVDR, MDSAP, and CDSCO requirements. Manufacturing runs in ISO Class 7 and Class 8 cleanrooms and ESD-controlled areas, with process validation (IQ, OQ, PQ), PFMEA, supplier qualification, and SAP-integrated MES traceability. Our QARA teams support DHF remediation, ISO 14971 risk files, CAPA and complaint handling, and CDSCO manufacturing and test license applications. Design, engineering, and production sit under one quality system.
Talk to SJML’s manufacturing team →
Frequently asked questions
Not identical, though they overlap heavily. GMP is a legal requirement enforced by a regulator; ISO 13485 is a voluntary consensus standard. Since February 2, 2026, FDA’s QMSR incorporates ISO 13485:2016 by reference, so meeting the standard covers most of Part 820. FDA-specific requirements on records, labeling, and complaints still apply, and certification does not remove inspection authority.
It applies to design. Device GMP covers design and development, which separates it from the pharmaceutical use of the term. Design controls under ISO 13485 Clause 7.3 require documented inputs, outputs, verification, validation, and transfer. Class II and Class III devices are always in scope, as is a short list of Class I devices, including software-automated ones.
Findings are issued on a Form 483. If they are not addressed credibly, FDA can escalate to a warning letter, import alert, seizure, injunction, or consent decree. Devices produced under a non-compliant quality system are adulterated under the FD&C Act. Notified bodies can separately suspend or withdraw a CE certificate.
No separate device GMP regulation exists in the EU. EU MDR 2017/745 Article 10(9) requires manufacturers to establish and maintain a quality management system proportionate to device risk class. In practice, manufacturers implement ISO 13485 and are audited against it by a notified body. The substance closely matches US GMP expectations; the terminology differs.
Related terms
- Quality Management System (QMS)
- Process Validation (IQ/OQ/PQ)
- Design Controls
- Device History Record (DHR)
- CAPA (Corrective and Preventive Action)
