Hong Kong GDP Requirements 2026: Who Must Comply, When It Starts, and Do You Need a Certificate?

What is GDP, and how is it different from GMP?

Good Distribution Practice (GDP) is a quality management standard for the distribution of pharmaceutical products. Its purpose is to make sure medicines are consistently stored, transported and handled under suitable conditions across the entire supply chain — so that their quality and integrity survive the journey from the factory to the patient.

The core difference from GMP is which part of the journey it governs:

A common and expensive misconception: "we already have GMP, so GDP is covered."It isn't. GMP has nothing to say about whether your third-party logistics provider switched the reefer on in August.

Why is Hong Kong introducing GDP now?

The Pharmacy and Poisons Board recently reviewed how GDP is implemented in the Chinese Mainland and a range of overseas jurisdictions — including Australia, Canada, the European Union, Japan, Singapore, South Korea, the United Kingdom and the United States.

On the strength of that review, the Board endorsed a decision to require licensed manufacturers (ML) and licensed wholesale dealers (WDL) to implement GDP in Hong Kong by adopting the PIC/S Guide to Good Distribution Practice through the imposition of an additional licensing condition.

The stated policy objectives:

1. Strengthen regulatory control over the pharmaceutical supply chain
2. Align Hong Kong's regulatory regime with international standards and practices
3. Ensure pharmaceutical products are consistently stored, transported and handled under suitable conditions throughout the distribution chain, safeguarding their quality, integrity and public health

The real story here is international alignment. PIC/S is the mutual-recognition framework that regulators worldwide speak. Adopting PIC/S GDP means Hong Kong's distribution oversight will be seen as equivalent by international peers — which matters enormously for Hong Kong's standing as a regional pharmaceutical trading hub.

Which standard and which version is Hong Kong adopting?

The requirements in the Hong Kong GDP Guide are **based on two PIC/S documents**:

1. PIC/S Guide to Good Distribution Practice for Medicinal Products (PE 011-1) → corresponds to Part I: requirements for pharmaceutical products
2. PIC/S Guidelines on the Principles of Good Distribution Practice of Active Substances for Medicinal Products for Human Use (PI 047-1) → corresponds to Part II: requirements specific to active substances

In other words, the HK GDP Guide is split into two parts: Part I covers pharmaceutical products; Part II covers active substances (APIs).

if your business touches both finished products and APIs, you need both parts. Plenty of companies read Part I and assume they're done.

What are the three key documents, and where do I download them?

The Board prepared three documents for the implementation of GDP, all published during the consultation:

• Guide to Good Distribution Practice for Pharmaceutical Products ("GDP Guide")

This is the mandatory regulatory document — it tells you what must be done. Compliance becomes part of your licensing conditions.

• Guidance for Industry: Guide to GDP for Pharmaceutical Products ("Guidance for Industry")

Not legally binding, but provides practical guidance on how to understand and implement the requirements — it tells you how to do it.

• Official page

Drug Office — Implementation of GDP for Pharmaceutical Products

Note: these are consultation drafts. The consultation closed on 31 May 2026, and the Board will finalise the documents after considering stakeholder feedback. Final wording may differ. Always work from the promulgated version.

The full timeline: when does this bite, and how long do I have?

What this actually means for you:

1. Applying for a new licence? You effectively have no grace period. From Q3 2026 you must present a GDP-compliant system on day one.
2. Already licensed? You have roughly two years — and that is far less runway than it sounds.
3. Implementation is tentative and phased. Confirm dates against the Board's announcements.

Who must comply — and who is exempt?

• Must comply

1. Licensed manufacturers (ML holders)
2. Licensed wholesale dealers (WDL holders)

Note that ML holders are already required to comply with the GMP Guide issued by the Board, which already stipulates related considerations — but the introduction of GDP means distribution-stage requirements are now spelled out separately and explicitly.

• Does not apply

The COP and the GDP Guide do not apply to trade:

1. solely dealing in non-medicinal poisons — such as chemical reagents, hair dyes and industrial chemicals
2. solely dealing in medical devices containing poisons

The load-bearing word is "solely." If any part of your trade involves pharmaceutical products, this carve-out is unavailable to you. This is the single most misjudged provision in the whole package.

Do logistics, warehousing and transport companies count?

This is the most-asked question in the trade, and the answer is: indirectly yes — and there is no way around it.

Logistics, warehousing and transport providers are usually not WDL holders themselves. But they are the licensee's contract acceptors. The GDP Guide requires WDL holders to maintain control of outsourced activities, which means:

• A WDL holder (the contract giver) can gather and consider the relevant background information of the contract acceptor — assessing whether they are actually capable of meeting GDP requirements. In plain terms: your customers are going to audit you.

Even if you never hold a WDL licence, from 2026–2028 your pharma and wholesaler clients will be under regulatory pressure to qualify you. A logistics provider without demonstrable GDP capability will be progressively designed out of the pharmaceutical supply chain. For 3PLs, this isn't a compliance issue — it's a survival issue.

Do medical gases count?

Yes — and the clock already started.

Medical gases are regulated as pharmaceutical products starting from 14 June 2026. WDL holders should also refer to the Board's "Guidance Notes on Manufacture, Wholesale, Storage and Transport of Medical Gases."

This is a separate change from the GDP timeline, and it is already in force. If you're in medical gases, you are absorbing two regulatory shifts at once — being brought into scope as a pharmaceutical product, and the GDP implementation on top.

Does a one-person company really need a quality system?

Yes.

The GDP Guide is explicit: the quality system should cover all GDP operations. Its size and complexity should be proportionate to the distribution activities undertaken and appropriate for the nature of the company. A WDL holder which is a one-person company should also develop a quality system.

Proportionality is a scaling principle, not an exemption. It means a small company's system can be simple — not that it can be absent. A one-person operation still needs a documented quality policy, SOPs, self-inspection records and CAPA follow-up.

Is the GDP Guide itself a law? Where does its legal force come from?

This is the single most misunderstood point in the Hong Kong pharmaceutical trade.

The answer: the GDP Guide is not a piece of legislation.

But it has teeth, and here is the mechanism:

Pharmacy and Poisons Ordinance (Cap. 138)

Pharmacy and Poisons Regulations (Cap. 138A)

              ↓

 Law requires wholesalers / manufacturers to hold a licence

              ↓

The Board imposes an ADDITIONAL LICENSING CONDITION

              ↓

That condition = you must comply with the GDP Guide

              ↓

Non-compliance = breach of licensing condition = your licence is at risk

```

• The Pharmacy and Poisons Ordinance (Cap. 138) is the principal legislation governing pharmaceutical products in Hong Kong
• The Drug Office of the Department of Health provides professional and administrative support to the Board
• The GDP Guide is a regulatory guideline issued by the Board, and it acquires binding force through the licensing condition

The GDP Guide isn't law" is technically true and operationally irrelevant. If you act on that sentence, you lose your licence. Treat it as mandatory.

Will the government issue a "GDP certificate"?

No. This is the second great misconception — and it trips up anyone reasoning by analogy from Europe.

Hong Kong's mechanism is structurally different from the EU/UK model:

So if anyone tells you the Hong Kong government will issue you a GDP certificate — they are wrong. Your proof of compliance is the continued validity of your licence.

Then what is the role of a certification body (CB)?

If the government doesn't issue certificates and doesn't require you to engage a CB, why would any company pursue third-party GDP certification?

Let's draw the line honestly first: Third-party GDP certification is not a legal requirement, does not replace a regulatory inspection, and is not a get-out-of-jail card.

So where is the value? Three real scenarios:

• Scenario 1 — Verifying your system will actually survive an inspection

The GDP Guide itself says it: WDL holders may consider an external audit, by an auditor experienced in conducting audits to PIC/S or other international standards (e.g. the World Health Organization), to be conducted once the QMS has been implemented — which can ensure that core requirements are covered.

That isn't a certification body's sales pitch. That is the regulatory guidance putting "engage a PIC/S-experienced external auditor" on the record as a recognised practice.

• Scenario 2 — A commercial passport for international supply chains

Your European customers and multinational pharma partners will not read your Hong Kong licence. What they recognise is an audit report or certificate against the PIC/S standard from an internationally accredited body.

• Scenario 3 — Evidence for management and the board

An independent third-party report is the most efficient way to demonstrate upward that the organisation is genuinely ready — rather than assumed to be.

Can an external audit replace self-inspection?

No. And this is the most important — and most misread — sentence in the entire Guide.

The Guide's position is unambiguous:

A self-inspection should always be undertaken by the company. Self-inspections can be conducted by competent staff from another department within the company.

It is not acceptable to replace self-inspections by external audits or regulatory inspections.

However — a company may take into consideration the external audits by external experts when assessing the scope of their self-inspections.

That single passage establishes two things at once:

Use this as your test of whether a certification body is professional. If anyone promises you that their certificate means you can skip self-inspection or that you'll definitely pass inspection — walk away.

What is a Responsible Person (RP), and how does it differ from a QP?

A concrete example of the RP's duties: where quality problems arise and a decision must be made on the disposition of affected stock, the RP must be involved in that decision — and the decision to retain or dispose must be based on scientific justification, not on commercial convenience or a hunch.

What exactly does the Quality Management System (QMS) need to contain?

Breaking the GDP Guide's QMS requirements into components:

• Structure

The quality system should encompass the organisational structure, procedures, processes and resources, plus the actions necessary to demonstrate that the distributor meets quality requirements.

• Mandatory elements

1. A documented quality policy — the GDP quality system needs to be in written format
2. Authorised procurement and release procedures
3. Quality risk management — distributors must assess potential risks to product quality and apply quality risk management principles
4. A change control system must be in place
5. Control of outsourced activities
6. Monitoring of QMS effectiveness — and the Guide notes this monitoring can be measured in various ways; you must be able to show the system is actually working, not merely documented

• Documentation

Documents should have unambiguous content; the title, nature and purpose of each document should be clearly stated. Valid and approved procedures should be used.

Records should also stand up to ALCOA+ expectations (attributable, legible, contemporaneous, original, accurate and so on), with audit trails and access control in place so that evidence of compliance is reliable and traceable.

• Proportionality

Scale to your operations — but never to zero.

How do I do temperature mapping?

Cold chain is where GDP enforcement concentrates, and where real (not paper) findings surface.

• Primary reference:

WHO Technical Report Series, No. 961, Annex 9, Supplement 8: Temperature mapping of storage areas

• What must be covered

1. Warehouse thermal mapping — identify cold spots and hot spots
2. Route qualification — temperature profiles, packaging, routes and acceptance criteria
3. Packaging validation — how long does that passive shipper actually hold?
4. Continuous temperature monitoring and recording
5. Deviation recording, investigation and review

• The failures inspectors find every time

1. Mapping done once, in winter, never repeated for summer worst case
2. The warehouse was qualified; the transport leg never was
3. Loggers are installed, but nobody reviews the data
4. No defined procedure for handling a temperature excursion

How often must self-inspections be done, and what if I find problems?

• What is mandatory

1. The observations and outcomes of self-inspections must be documented for each self-inspection
2. The report can be in the form of a checklist, but must contain sufficient details
3. It must be made available for management review and other relevant personnel

• When you find non-compliance

Where events of non-compliance are identified, **their cause should be determined and the CAPA should be documented and followed up.

• How to set the frequency

If many quality issues are identified, self-inspections should be conducted more frequently — to help identify and address the root cause of these problems, and provide the opportunity for continuous improvement.

This is a risk-based rule. The more problems you have, the more often you look. An inspector will check whether your self-inspection frequency matches your deviation count. One self-inspection a year against twenty open deviations is itself a finding.

• Who performs it

Competent staff from another department within the company — i.e. independence is required. You cannot audit yourself.

How do I qualify suppliers and customers, and guard against falsified medicines?

One of GDP's founding purposes is keeping falsified medicines out of the legitimate supply chain.

What you must do

1. Supplier qualification — confirm your upstream sources are legitimate and licensed
2. Customer qualification — confirm your downstream recipients are entitled to receive the products
3. Verification of authorisations — check that counterparties' licences are real and current
4. Controls to prevent falsified products entering the legitimate chain

Why this carries the weight it does

GDP exists precisely to guard against contamination, falsification, and other risks to quality and integrity. Medicines pass through many hands between API and patient, and every touchpoint is an opportunity for failure. A lapse anywhere in distribution can cause shortages, delays, or falsified product reaching patients — with direct consequences for public health.

How do I control outsourced activities?

If you outsource warehousing or transport — you have not outsourced the responsibility.

• Core requirement

As contract giver, the WDL holder must:

1. Gather and consider the relevant background information of the contract acceptor
2. Assess whether they are capable of meeting GDP requirements
3. Establish a written contract with clearly divided responsibilities
4. Monitor the outsourced activity on an ongoing basis

• Practical checklist

- [ ] Does your 3PL have temperature control capability — with qualification evidence?

- [ ] Have you physically audited their warehouse?

- [ ] Does the contract specify temperature requirements and excursion notification duties?

- [ ] Do you know who their sub-contractors are?

How do I start a gap analysis?

If you haven't started, here is the sequence:

• Step 1 — Gap analysis against the Guide

Work through the GDP Guide (Part I and/or Part II) clause by clause against current practice and mark each:

1. Compliant
2. We do it, but there's no documented evidence
3. Not done at all

For most companies the pile dwarfs the pile. "We've always done it that way" with no records counts as not done in an inspection.

• Step 2 — Design or remediate the QMS

SOPs, quality risk management (QRM), record forms, change control, supplier qualification, mock recall, self-inspection programme.

• Step 3 — Qualify warehouses and routes

Thermal mapping, temperature profiles, packaging, routes and acceptance criteria.

• Step 4 — Train and qualify personnel

Including the RP. **Training content should cover the GDP Guide itself and the SOPs.

• Step 5 — Run your first self-inspection

And consider having a PIC/S-experienced external auditor verify that core requirements are covered.

I have until 2028 — why start now?

"Two years" is a dangerous illusion. Lay the work out on a calendar:

The binding constraint is temperature mapping. To demonstrate your warehouse holds temperature in the hottest and coldest conditions of the year, you need a full annual cycle. That cannot be compressed. You cannot pay to make it go faster.

Start in late 2027 and you will not have time to complete seasonal qualification before the deadline.

And one more thing: new applicants are caught from Q3 2026. If your plans include any new licence application, a new warehouse, or a new legal entity — your deadline is this year, not 2028.

What's the extra value for exporters and cross-border businesses?

Hong Kong's choice of PIC/S converts directly into commercial value across borders:

• International equivalence

The PIC/S GDP guide is the common language of pharmaceutical regulators. The EU GDP guidelines (2013/C 343/01) and WHO-promoted practice are already closely convergent — so most of the system you build for Hong Kong GDP is reusable for the EU, UK, Singapore and beyond.

• Market access

In the United States, GDP is not a direct legal requirement but is a critical industry standard, frequently mandated by trading partners and effectively a gate to certain markets. In the EU and UK, GDP compliance is a legal requirement — applying to manufacturers who distribute their own products, wholesale distributors, transport and logistics companies, and CDMOs offering integrated manufacturing-and-distribution services.

• Commercial credibility

An independent third-party audit report against PIC/S is a ready-made answer in a multinational customer's supplier qualification questionnaire.

What to do next

1. Download the three documents and determine whether Part I, Part II, or both apply to you
2. Establish your status: new applicant (deadline Q3 2026) or existing licensee (deadline ~Q3 2028)
3. Start the gap analysis — pay particular attention to the  "we do it but can't prove it" items
4. Begin temperature mapping planning immediately — it is the one workstream that cannot be accelerated
5. Consider an independent verification audit by a PIC/S-experienced auditor — find the problems before the inspector does

About DQS

DQS is an internationally accredited certification body providing GDP audit and certification services against PIC/S standards in Hong Kong, together with a 1.5-day Understanding Course on the Hong Kong Guide to Good Distribution Practice for Pharmaceutical Products, helping organisations to:

1. Perform a gap analysis against the GDP Guide (HK) Ver 2026
2. Have auditors experienced against PIC/S and international standards verify that QMS core requirements are covered
3. Obtain an internationally recognised certificate supporting cross-border business and supply chain access

We'll be straight with you: third-party certification is not a Hong Kong legal requirement, cannot replace your self-inspection, and cannot replace the Board's regulatory inspection. Its value is simpler than that — it helps you find the problems before the regulator does.

Contact: [email protected]