China: NMPA Drug Traceability Guidance

Most RxTrace readers will recall that China was an early adopter of drug traceability.  Back in 2007, companies were required to begin printing unique identifiers in linear barcodes on certain drug packages.  The unique identifiers had to be purchased from a government contractor.  The list of drugs grew each year to the point where all drugs were effectively covered by early 2016.  But shortly after that, the whole requirement was suspended (see “China’s Retreat From Pharma Serialization: Will This Become A Global Trend?” and “China Adds Traceability Requirement To CFDA Drug Quality Management Specification”).  Then last summer, a new government agency, the National Medical Products Administration (NMPA), posted three draft guidance documents for review and comments (see “China Posts New Draft Pharma Serialization Guidelines”).  Finally, last month, the NMPA published two of those documents in final form, “Implemented on April 19, 2019”. 

Fortunately for us, they also published an official English version of both.  That’s significant, because we don’t have to wonder how accurate our translations are.  Official English versions should be just as reliable as the versions in Chinese are to native Chinese readers.  Unfortunately, I can’t find either of the two English versions of these final guidance documents on the internet, which means I cannot provide them to you.  My copies came through my membership in GS1 Healthcare, so I have been able to study them, but I cannot provide them to you.

Compared to the original China drug serialization and tracing regulation from more than a decade ago, this new approach is much better.  It appears that the NMPA took advantage of the existing regulations around the world to figure out what works and what doesn’t work.  The new approach appears to me to be a mish-mash with elements of the EU Falsified Medicines Directive and the EU Medical Device Regulation (MDR) Unique Device Identification (UDI) regulation, with maybe a little salt from the US Drug Supply Chain Security Act (DSCSA)…maybe.  Let’s take a look.


First, rather than the government contractor-run central repository from the old approach, the new one forces the industry to create most of the infrastructure.

“              The participants of drug traceability information system shall actively participate in the construction and maintenance of the drug traceability information system in accordance with relevant laws and standards.”

“              Drug marketing authorization holders and manufacturers bear the major responsibility for the construction of the drug traceability system. They may construct their own drug traceability systems or use drug traceability systems provided by third-party technical agencies. Drug distributors and drug using institutions shall cooperate with drug marketing authorization holders and manufacturers in the construction of a traceability system and upload the corresponding traceability information to the traceability system.”

Sound familiar?  That’s very close to the way it is described in the EU FMD.  I read the phrase “…bear the major responsibility for…” as “…shall fund…”.

Next, the standards used to produce the “Drug Traceability Code” (DTC) must conform to one of two “standards”:  a China-specific 20-character code, or any code that “…complies with the coding rules of relevant international standards prescribed by the International Organization for Standardization (ISO) (e.g.  Standards for ISO/IEC 15459 Series).”  The latter includes GS1 Global Trade Item Numbers (GTINs) plus serial numbers, and GS1 Serial Shipping Container Codes (SSCC) (see “GS1 IDENTIFICATION KEYS AT YOUR FINGER TIPS”).  And it includes other identifiers from organizations that compete with GS1.  So rather than specifying GS1 or one of their competitors, NMPA will apparently allow drug manufacturers to select any “number issuing agency” that meets the ISO 15459 series requirement.  This will sound familiar to anyone who needs to follow one or more of the medical device UDI regulations around the world.  

“Code issuing agencies shall have clear coding rules, and shall cooperate with drug MAHs and manufacturers to file the basic information of the code issuing agency, coding rules and relevant data of the drug identification code on the harmonization platform, so as to ensure the uniqueness of every drug traceability code.”

Also note that I have proposed this same approach to the US FDA to solve the approaching cliff in the National Drug Code, which is now estimated to be about 9 to 14 years away (see “NDC Nearing Its End, Afflicted by ‘Identifier Failure’” and “An Open Letter To The FDA: New NDC Format Public Meeting”).  This makes China 9 to 14 years ahead of the US.

Next, China will require the capture and sharing of aggregation data, avoiding the pitfall that the EU is in right now (see “Aggregation Under the FMD”, “Aggregation: The Achilles’ Heel of Pharma Supply Chain Operation Under A Serialization Regulation” and “EU FMD: Aggregation Is Not Mandated, But It Will Be Necessary”).              Drug marketing authorization holders and manufacturers shall allocate a drug traceability code to the sales packaging unit at each level of the product manufactured thereby in accordance with the General Rules for Drug Traceability Code and the relationship among the drug traceability codes of the sales packaging units at all levels shall be well established. …”

But the NMPA also goes beyond almost every other regulatory agency in the world by allowing each marketing authorization holder and manufacturer to choose which data carrier they encode their DTCs into on their packaging.  And, like most regulations around the world, the DTC must be machine-readable and human readable.

“One-dimensional barcode, two-dimensional barcode or RFID tag, etc. can be selected as the carrier of the drug traceability code according to the actual needs. Drug traceability codes shall be recognized by equipment and the human naked eyes.”

In my view, everyone is going to regret this allowance.  It means that all downstream trading partners throughout China will require the ability to read all three data carriers.  It’s not hard to deal with either 1D or 2D barcodes, but now throw in the possibility that some drugs will be encoded with RFID tags and your cost go up and efficiency will go down.  Big mistake.  I guess no one from the NMPA reads RxTrace (see “The Case Against RFID In Pharma”).  Too bad.


There are several things I can’t tell from reading these documents.  Is the system being mandated a centralized system like Turkey, a semi-centralized system like the EU or a fully distributed system like the US?  Each owner of drugs in the supply chain must receive traceability information from the previous owner and they must check the drugs they receive to make sure it matches, and they must pass traceability information to their customers.  That sounds like a distributed system.

But “drug regulatory authorities” are obligated to:

“              National drug regulatory authority shall construct a harmonization platform to provide accurate basic information on drug categories and manufacturers, provide such services as filing and management of coding rules for drug traceability code and various drug traceability system addresses, so as to provide support for the interconnection of drug traceability systems.”

“              The national and provincial drug regulatory authorities shall establish a drug traceability supervision system to collect drug traceability relevant data within its administrative region according to their supervision needs, and give full play to the role of traceability data in regular supervision, risk prevention and control, product recalls, emergency disposal and other supervision works.”

And then there is the description of the Drug Traceability Supervision System:

 “Drug traceability supervision system includes the national and all provincial drug traceability supervision systems, which can collect data according to their respective regulatory needs and monitor the flow of drugs. It shall include the following functions: acquisition of traceability data, data statistics, data analysis, intelligent early warning, recall management, information release, etc.”

That all sounds at least a little like the EU “system of repositories”. 

There are no dates contained in these documents.  You might recall that in the translated draft version of one of these documents the statement “At the end of 2022, the complete coverage of the drug information and traceability system [will be] basically complete”.  Nothing like that appears in these documents.

I think there is a reason I can’t tell these things.  Remember last summer the NMPA published three draft documents, but last month they only published two of them as final.  What happened to that third document?  It was called “Guidance on the Construction of Drug Information and Traceability System”, and it was the document that contained that claim that the system would basically be complete at the end of 2022.  Why didn’t they publish a final version of this document?  It appears that a fair amount of its content is duplicated in the other documents, but it appears to be written as the overarching document that connects the three into a cohesive unit.  The two documents that were published in final form were simply attachments to the third one in the draft versions.  That may make the missing final document the most important one.  If you would like to review a translation of the draft version of that document, you can find it here.

I suspect we will see a final version of this third document soon, and it will likely include a mandated timeline.  We should all watch for that.