AI Healthcare Regulations in China: Medical AI Compliance

Introduction: 

Quick Answer: How Is Medical AI Regulated in China?

AI healthcare regulations in China treat AI software that diagnoses, triages or guides treatment as a medical device. It must be registered with the National Medical Products Administration (NMPA) before it can be sold or used in hospitals. Medical AI compliance also covers the patient data used to train or run the AI, which must follow China’s Personal Information Protection Law (PIPL), Data Security Law (DSL) and Cybersecurity Law (CSL).

So, there are two gates: product approval and data compliance. Miss either one and your launch stalls.

Why This Matters Right Now

This area has moved fast in recent weeks. In mid-September 2026, the NMPA released a Draft Guideline on Artificial Intelligence Medical Devices and a Draft Guideline on Clinical Evaluation of Artificial Intelligence Multi-Disease Auxiliary Decision-Making Medical Device. Analysts read these as a move toward a layered system: a horizontal lifecycle and algorithm framework, plus vertical clinical evaluation rules for complex AI products.

The revised medical device GMP also takes effect on November 1, 2026. That is this month. If you sell or plan to sell AI-enabled devices in China, these changes affect your documents and quality systems.

What Counts as an “AI Medical Device” in China?

The NMPA definition is simple. Since March 2022, an AI medical device has been one built on medical device data and using AI technology to fulfill its intended purpose. In practice, that covers:

• AI imaging software (CT, X-ray, pathology, endoscopy)
• AI-assisted diagnosis and triage tools
• AI-enabled treatment planning and surgical navigation
• Devices that contain AI components, including some in vitro diagnostics

A general wellness chatbot is not automatically a medical device. But once software claims to diagnose, detect, triage or recommend treatment, expect NMPA scrutiny.

How Are AI Medical Devices Classified?

Classification sets your registration route, your reviewer and your timeline. China uses three risk classes:

*Timelines are statutory review periods and exclude your preparation and testing time.

For AI, classification depends on algorithm maturity and the role the software plays in clinical decisions. In reality, most diagnostic AI lands in Class III. A 2026 analysis of AI approvals through June 2025 found 154 approvals since 2020, rising from 9 in 2020 to 45 in 2024, with 79.9% in Class III.

NMPA Approval Requirements for AI Medical Devices

Here is the China medical AI software registration process, step by step.

1. Confirm classification. Check the classification catalogue and, if unclear, request a formal classification opinion. AI-assisted diagnosis software, for example, falls under code 21-04-02.

2. Appoint a China agent (foreign companies). Foreign manufacturers cannot register devices directly with the NMPA, so you need a legal agent in China.

3. Prepare the technical dossier. Expect to document:

• Intended use and clinical scenario
• Algorithm design, version and performance metrics
• Training, validation and test data (sources, size, labeling, population)
• Software lifecycle and cybersecurity documentation
• Algorithm change control

CMDE’s technical guidance puts weight on algorithm transparency, training data requirements, algorithm change protocols and cybersecurity.

4. Type testing. Your product technical requirements are tested by an accredited lab.

5. Clinical evaluation. More on this below. It is usually the longest step.

6. Submit, respond to deficiency requests, receive the certificate. Certificates are valid for five years, and renewal must be filed six months before expiry.

Pro tip: Treat reviewer questions as a normal part of the process, not a rejection. Build two to three months of buffer into your launch plan.

Clinical Evaluation of AI Medical Devices in China

This is where many teams get stuck. For Class II and III devices, clinical evidence is required, but the form it takes varies: a prospective clinical trial, a retrospective study, or equivalence to an approved device.

The 2026 draft on AI-assisted diagnostics is useful here. It targets Class III software that helps characterize lesions in medical images, such as benign versus malignant status (think pulmonary, thyroid and breast nodules, or gastrointestinal polyps). Alongside it, the multi-disease draft signals that the NMPA is building dedicated rules for broader AI products rather than forcing them into single-disease templates.

What reviewers generally want to see:

• A test set independent of training data
• Performance across hospitals, scanners and patient groups
• Evidence that Chinese-population data supports your claims (important for imported products)
• Clear human-in-the-loop positioning: AI assists, the clinician decides

Good News: Faster Paths for Updates

Regulators are also trying to reduce friction. The NMPA’s 2025 life-cycle measures say it will simplify change registration for AI devices when the core algorithm stays the same but performance is optimized, and explore using evaluation databases for performance assessment.

For companies that retrain models regularly, this matters. A well-documented algorithm change control plan may save you a full re-registration.

Healthcare Data Compliance for AI Companies in China

Even a fully approved AI product can fail on data. Here are the laws to know:

• PIPL: requires strict consent for sensitive personal information, which includes health data.
• DSL: classifies data into ordinary, important and core categories, each with escalating protection requirements.
• CSL: adds network security and localization duties.

Key practical points:

1.    Cross-border transfers are restricted. Sending patient data overseas can require a security assessment, standard contract clauses or certification. Many companies simply keep training and inference in China.
2.    De-identification helps but doesn’t solve everything. Practitioners note that masked medical data has exceptions to the consent and re-consent requirement, so proper de-identification or anonymization is worth the investment.
3.    Roles matter. Whether you act as a controller or an entrusted processor for a hospital changes your obligations.
4.    Genetic and clinical trial data may trigger additional human genetic resources rules.

If your training data came from hospital partners, make sure your data-sharing agreements, consent records and ethics approvals are airtight. Reviewers and auditors can ask for them.

Medical AI Compliance Checklist (Save This)

• Classify your product and document the rationale
• Appoint a China agent (if foreign)
• Map training and test data sources, consent and locations
• Build an algorithm lifecycle and change control file
• Complete cybersecurity documentation
• Plan clinical evaluation early (design it before you build your dossier)
• Align your quality system with the revised GMP, effective November 1, 2026
• Set up post-market surveillance and adverse event reporting
• Track NMPA draft guidelines and comment deadlines

The Market Signal

Regulation is demanding, but the market is real. One review found medical imaging accounts for 67% of the 59 Class III AI devices approved by 2023, and newer approvals are expanding into pathology, endoscopy and surgical navigation. A Class III certificate is effectively your license to sell into hospitals.

Frequently Asked Questions

Do all AI healthcare products need NMPA approval?

No. Only software that meets the medical device definition (diagnosis, treatment support, monitoring) needs it. Administrative or pure wellness tools often don’t, but claims and intended use decide this.

How long does AI medical device registration take in China?

The statutory technical review is 60 working days for Class II and 90 for Class III, but total time, including testing, clinical evidence and queries, is typically much longer.

Can foreign AI companies register directly?

No. You need a China-based legal agent.

Is clinical data from other countries accepted?

Sometimes, but reviewers often want evidence relevant to the Chinese population. Discuss this with your regulatory consultant early.

Are the September 2026 AI guidelines final?

No. They are drafts open for comment, so check for final versions before you lock your strategy.

Bottom Line

AI healthcare regulations in China are strict but increasingly clear. Classify early, design clinical evaluation first, keep your data house in order and plan for algorithm updates from day one. The rules are moving toward a structured, lifecycle-based system, and companies that prepare now will have a head start.

This article is general information, not legal or regulatory advice. Always confirm requirements with the NMPA’s current publications and a qualified regulatory advisor.