KGMP Certificate in South Korea: Validity, Audit Types and Renewal

1. Key takeaways

The Korean Standards for Manufacture and Quality Management of Medical Devices (KGMP) apply mandatorily to Class 2 to Class 4 devices; Class 1 devices are not within the mandatory scope. A KGMP certificate is valid for 3 years, and the licence holder must apply for a periodic audit 90 days before expiry.

Audits fall into 4 types: initial audit, periodic audit, additional audit, and change audit. The initial audit corresponds to first issuance of the certificate; the periodic audit corresponds to the review before the 3-year validity expires; the additional audit corresponds to an extension of the product scope or manufacturing site; and the change audit corresponds to a major change affecting the quality system. The four types have different triggers, but all converge on keeping the certificate continuously valid.

GRZAN regards KGMP as the most underestimated line in a Korean registration project: it runs in parallel with technical document review, and once a certificate lapses, item approvals and certifications already granted within its validity are affected as well.

2. Legal basis

The KGMP regime rests on the following instruments.

The four KGMP audit types (per MFDS Public Notice No. 2023-79)

3. Expert insights

The boundary of KGMP applicability is the class, independent of the submission pathway. KGMP is mandatory for Classes 2-4 and exempt for Class 1. The judgment looks only at the class, not at whether the product is imported or locally made, and not at whether the submission is initial or a change. GRZAN repeatedly encounters companies whose product lines contain both Class 1 and Class 2 devices, where Class 1 has already reached the market smoothly while Class 2 stalls at the KGMP stage. The class dividing line should be drawn when the project is initiated.

The 90-day mark is an application timing requirement, not an audit completion deadline. The periodic audit must be applied for 90 days before certificate expiry; this timing requirement exists to leave a window for the audit to be executed. If the process starts less than 90 days before the expiry date, the certificate may lapse before the audit is finished. GRZAN recommends setting the application node at 90 days before expiry with an added buffer (practical estimate), and monitoring the certificate status throughout the audit execution period.

Of the four audit types, the additional and change audits are the ones most often missed. Initial and periodic audits have fixed time points and carry low miss risk; additional and change audits are triggered by the company’s own events and have no external reminder. Adding a manufacturing site, extending the product scope, or making a major change affecting the quality system all trigger the corresponding audit. GRZAN’s practice is to write these trigger events into the change management process, so the quality function triggers a KGMP review when an event occurs without waiting for a separate judgment by the regulatory team.

Since on-site audits resumed in January 2023, the timeline assumptions behind certificate acquisition need rewriting. Korea resumed KGMP on-site audits in January 2023. Timeline assumptions built on desk-based review no longer hold, and foreign manufacturers must reserve travel, interpretation, and remediation time for the site verification. GRZAN schedules the on-site audit as an independent stage, not as an appendage of technical document review.

4. Practical recommendations

• Confirm KGMP applicability by class. Mandatory for Classes 2-4 and exempt for Class 1; confirm item by item, not at the product-line level.
• Build a certificate expiry register. On the 3-year validity cycle, write the application node 90 days before expiry into the compliance calendar.
• Write the triggers for additional and change audits into internal procedures. Manufacturing site, product scope, and major quality system changes automatically trigger a review when they occur.
• Run KGMP in parallel with technical document review. Running the two lines in series significantly lengthens the project.
• Reserve an independent time block for the on-site audit. Since on-site audits resumed in January 2023, travel, interpretation, and remediation time should be estimated separately (practical estimate).

5. Verification checklist

• □ Applicability — judged by class; standard: Classes 2-4 must obtain the certificate, Class 1 is not within the mandatory scope.
• □ Certificate validity — check the validity period recorded on the certificate; standard: within the 3-year validity.
• □ Periodic audit node — counted back from the expiry date; standard: the application has been scheduled 90 days before expiry.
• □ Audit type determination — checked against the initial, periodic, additional, and change types; standard: the audit type matches the triggering situation.
• □ Additional audit triggers — check changes in product scope and manufacturing site; standard: a scope or site extension has triggered the additional audit.
• □ Change audit triggers — check records of major quality system changes; standard: a major change has triggered the change audit.
• □ On-site audit arrangement — check the audit format; standard: prepared on the basis that on-site audits resumed in January 2023.

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, Korean licence holder and local testing support for the Republic of Korea. Our team manages MFDS approvals, certifications and notifications, prepares equivalence dossiers, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com