China’s digital health regulatory framework for SaMD

Feature ArticlesFeature Articles | 30 November 2022 | Citation

There is no specific definition in the People’s Republic of China regulatory framework clarifying the term “digital health,” but there is general acceptance that the term refers to digital technologies applied across the healthcare sector.1,2 This article describes recent updates to the regulatory framework for digital health applications that qualify as medical devices under China’s regulations.
Keywords – China, digital health, regulatory
China’s medical device software products are governed by the same regulations for other medical devices. However, increasing numbers of standards, guidance, and practice points are being issued to address the regulatory complexity presented by medical software, including standalone software. Of particular complexity is the regulatory acceptance of safety and efficacy in the context of products with fast (and accelerating) update cycles or novel, and therefore unforeseen, outputs generated based on deep learning from vast data sets.
The traditional hierarchical structure of medical device regulatory framework in China, with relevant standards and guidance for medical software, is shown in Figure 1.

Qualification as a medical device
China’s National Medical Products Administration (NMPA), the regulator responsible for medical device supervision, does not address qualification systematically. Instead, guidance can be found across multiple sources.3 For example, a March 2022 technical review guideline for the registration of medical software,4 distinguishes between medical device and nonmedical device software functions. A more specific July 2021 technical review guideline for software as a medical device (SaMD) using artificial intelligence (AI)5 clarifies how AI software is classified into 4 categories according to intended use:
  • Decision support software (category 1)
  • Image/data processing software (category 2)
  • Analysis and data-mining products (category 3)
  • Medical assistance products (category 4)
Categories 1 and 2 are regulated as medical devices, whereas categories 3 and 4 are not. The guideline implemented in July 2021 states that in principle, medical software using AI technology is by default Class III (the highest-risk class), because the application is still in its infancy and clinical practical risks have not yet been fully evaluated. However, the guideline also notes that, as the regulator becomes more familiar with the technology, the risk class could be adjusted.
In regard to mobile apps, the guideline for technical review6 states that mobile software products intended for exercise, fitness, weight control, and healthy lifestyle management are not medical devices, whereas those intended for patient rehabilitation, medical treatment, disease management, and other similar purposes are medical devices. As always, the intended use of the software is key to determining whether it qualifies as a medical device.
China’s classification catalog, which determines the risk class of the medical device software, is updated every year or two. There have been several updates so far this year, but no notable changes relating to standalone software.7,8
Classification begins with checking the extensive catalog, or otherwise checking against the Rules for Medical Device Classification. If neither of those resources is helpful, applicants should seek clarification directly from the regulator. The classification process is shown in Figure 2.

There is a helpful annex to the rules for classification in which a table for determining classification has a section devoted to SaMD (Table).

Innovative pathways
The revised regulatory framework for medical devices in China, introduced by Order 739 and implemented in June 2021, provided a more flexible and accommodating regulatory trajectory for innovative devices. The purpose was to attract device manufacturers and distributors to China so that Chinese patients would benefit from having easier access to cutting-edge treatment options. This trajectory includes having a special review procedure for innovative devices, with a dedicated NMPA reviewer, faster review times, and preregistration consultations.10
Most important in this regard is that products granted the innovative pathway designation do not require home country approval before application. All other imported medical device applications require such approval in support of their NMPA application.
However, innovative devices must be patented in China before the application for approval can be submitted. In addition, the device’s main working principle or mechanism must be a first case in China, and it must demonstrate better product performance or safety than similar products already on the Chinese market. Other conditions also apply.
Digital health alternative pathways
There is no specific alternative regulatory pathway for digital health, such as reliance on comparable regulator decisions. Change control plans are also a challenge for fast-changing software products. Unlike the US Food and Drug Administration and Japan’s Pharmaceuticals and Medical Devices Agency, there is no predetermined alignment possible between the applicant and regulator about the scope of future software changes.11 Instead, applicants must undergo burdensome product change applications in situations in which safety and efficacy is impacted by the software update. Minor software changes can be implemented through the quality management system, but major changes will continue to require premarket approval change submissions and review by the regulator, which can substantially detract from the iterative feedback loop improvements that SaMD and broader digital health technologies enjoy.
AI devices
There has been a flurry of regulations relating to AI-enabled medical devices and the subset of machine-learning medical devices, building on initiatives from the Artificial Intelligent Medical Device Innovation and Cooperation Platform launched in 2019. A recent policy paper has stated there are too many proposed AI-specific standards and guidances, which may burden or confuse applicants particularly where technology-agnostic standards already suffice.12
A March 2022 technical review guideline for the registration of AI medical device software13 specifies that applicants must carry out risk management activities that are reported in their submissions to ensure the risks, such as the differences between Chinese and non-Chinese in terms of ethnicity, epidemiological characteristics, clinical diagnosis, and treatment norms, have been reduced to an acceptable level throughout the product lifecycle. This analysis should be based on the intended use, use scenarios, and core functions of the product.
The final development of note for SaMD products issued this year relates to cybersecurity. Digital health technologies involve ever-increasing amounts of data – including personal health data of a sensitive nature – and cybersecurity regulations should be viewed within the latticework of China’s data laws, especially its Personal Information Protection Law (the equivalent of the EU’s General Data Protection Regulation) that came into force in November 2021.
A technical guideline of cybersecurity for medical device registration was issued in March 2022.14 The guideline applies to Class II and Class III SaMD or software in a medical device with electronic data interchange or remote or user access control and specifies that important data, personal information, and human genetic resource information collected and generated in China must be stored in China.
If there is a business need to share such data outside of China, a security assessment should be carried out in accordance with the requirements of the Cyberspace Administration of China. Network operators, which would include hospitals, have specific obligations to monitor data leakage and loss of information. In addition, a cybersecurity assessment document must be submitted as part of the NMPA dossier demonstrating analysis of data privacy, integrity, and availability points.
AI, artificial intelligence; NMPA, National Medical Products Association; SaMD, software as a medical device.
About the author
Hamish King, LLB, RAC, is COO at Cisema, a family-owned regulatory affairs consultancy and contract research organization for China. He lives in Hong Kong, is admitted as a lawyer in New South Wales, Australia, and Hong Kong, and was previously a solicitor with Magic Circle firm Linklaters. He has more than 10 years’ experience in the legal and regulatory fields and has a close interest in the regulatory implications of digital healthcare and AI applications. He can be contacted at
Acknowledgment This article is based on a presentation by the author at the RAPS 2022 Convergence on 11-13 September in Phoenix, Arizona. The presentation, which featured speakers from other global jurisdictions, focused on the latest updates on digital health, SaMD, mobile apps, and e-labeling wearables. For an overview of China’s digital health regulatory landscape, read:
King H. Regulatory update for SaMD and AI product approvals in China. RF Quarterly. 2021;1(2):33-41.
Citation King H. China’s digital health regulatory framework for SaMD. Regulatory Focus. Published 30 November 2022.
All references accessed and/or verified on 29 November 2022.
  1. He L, Zhang Z. Digital Healthcare 2022: China. Chambers and Partners website. Last updated 30 June 2022.
  2. Hu C, et al. Digital health laws and regulations China 2022 [section 1.1]. ICLG website. Published 24 February 2022.
  3. Asia Pacific Medical Technology Association. Digital health regulation in Asia-Pacific: China and Korea. Dated October 2021:7.
  4. Center for Medical Device Evaluation of NMPA. Technical review guideline for the registration of medical device software – Notice No. 9. Dated March 2022.
  5. Center for Medical Device Evaluation of NMPA. Guidelines for the classification and definition of AI-based SaMD – Notice No. 47. Dated July 2021.
  6. China Food and Drug Administration. Guidelines for technical review of mobile medical device registration. Dated January 2018.
  7. [Chinese] National Medical Products Administration. [Changes for 10 medical device product categories – No. 25-2022]. Dated 24 March 2022.
  8. [Chinese] National Medical Products Administration. [Changes for 27 medical device product categories – No. 30-2022]. Dated 30 March 2022.
  9. China Food and Drug Administration. Rules for classification of medical devices – Decree No. 15.  Updated 11 October  2019.
  10. [Chinese] National Medical Products Administration. [Order 739: Regulations on the supervision and administration of medical devices]. Dated 9 February 2021.
  11. Asia Pacific Medical Technology Association. Digital health regulation in Asia-Pacific: China and Korea. Dated October 2021:16.
  12. Asia Pacific Medical Technology Association. Digital health regulation in Asia-Pacific: China and Korea. Dated October 2021:22.
  13. Center for Medical Device Evaluation of NMPA. Technical review guideline for the registration of artificial intelligence medical device software – No. 8.
  14. Center for Medical Device Evaluation of NMPA. Technical review guideline for the registration of medical device software for cybersecurity – No. 7.


© 2023 Regulatory Affairs Professionals Society.

Discover more of what matters to you