AI Medical Device Registration and Change Management in China

1. Key takeaways

Registration review requirements for AI devices are a priority area in Part Four of NMPA Announcement No. 63 of 2025 (published 27 June 2025), alongside medical robots, high-end imaging and novel biomaterials.

• The watershed for change classification is whether the core algorithm changes: where it and the design concept are unchanged and only performance is optimised, a simplified filing route may be available; where it changes, full variation requirements apply.
• Article 79 of the Medical Device Registration and Filing Measures (SAMR Order No. 47, published 26 August 2021, effective 1 October 2021) sets the boundary: substantive changes require variation, others are filed within thirty days.
• Where a trial is needed, the Good Clinical Practice (No. 28 of 2022, published 24 March 2022, effective 1 May 2022) applies; Class III catalogue devices need NMPA approval and a tertiary Grade A hospital under Article 38.
• Frequent iteration is inherent, so update, classification and evidence preparation must be one internal process before launch.
• GRZAN’s assessment: the difficulty lies after registration; the simplified route depends on how clearly the algorithm boundary, performance measures and update rules were written at first filing.

2. Legal basis

Administrative regulation. The Regulation (State Council Order No. 739, published 9 February 2021, effective 1 June 2021) provides:

• Article 21: substantive changes require variation registration; other changes are filed or reported. Article 22: five-year term, renewal six months before expiry.
• Article 25: two routes for clinical evaluation.
• Article 27: high-risk Class III trials require NMPA approval, decided within sixty working days, silence being consent. Article 28: ethics review and informed consent, no trial fees charged to subjects.

Departmental rule. Order No. 47 specifies:

• Articles 22 and 23: the communication mechanism and expert consultation.
• Article 26: objectively determinable specifications and test methods. Article 28: the nine study types include software.
• Article 29: method validation required; where statistics apply, the statistical method, sample size basis and acceptance criteria must be specified.
• Article 30: testing against the requirements must pass before trials or application.
• Article 37: trial site and sponsor filing. Article 38: catalogue devices need NMPA approval and a tertiary Grade A hospital, with the catalogue set by NMPA. Article 39: trial application materials.
• Article 40: decision within sixty days, silence being consent. Article 45: trials start within three years of approval, and permission lapses without informed consent in that period.
• Article 41: deficiencies notified once in full, answered once within one year, otherwise review terminates with a refusal.
• Article 79: substantive changes require variation, others are filed within thirty days. Article 117: electronic licences equal to paper.

Normative documents. Announcement No. 63 of 2025, Part Four, clarifies review requirements across AI, robots, imaging and biomaterials. The Good Clinical Practice runs to nine chapters and 66 articles, Article 6 repeating the hospital condition. Announcement No. 121 sets the catalogue. The Priority Review Catalogue (2025 edition) and the Special Review Procedure for Innovative Devices (Announcement No. 83 of 2018, published 2 November 2018, effective 1 December 2018) form the accelerated channels.

Background: the 2025 Annual Medical Device Registration Report (NMPA, published 24 February 2026) records 76 innovative approvals in 2025, up 17 per cent, 25 priority approvals, up 212.5 per cent, and cumulative totals of 361 and 153.

Practical estimate: criteria for an unchanged core algorithm, documentation relief for performance optimisation, the relation between update frequency and filing batches, and real-world data for re-confirmation have no clause-level table; current guidance governs. Seek prior confirmation through Articles 22 and 23.

3. Expert insights

Core must first be defined. Whether an update qualifies for a simplified route depends on whether the core algorithm changed, yet most companies never defined it at first filing. A three-layer split helps.

The split belongs in the algorithm description at first filing, mapped to risk items. Define first, classify later; without a definition, every update starts from zero.

What Part Four signals. On the review side, requirements become public and specific, so route design rests on citable bases. On the applicant side, clarity shifts effort from preparing more to preparing precisely. With 76 innovative and 25 priority approvals in 2025, the channels are used more; AI devices may qualify for both, so route comparison belongs at inception.

Trials: approval and site. Not every AI device needs a trial; where exemption or equivalence applies, follow that route. Class III devices in the approval catalogue face two hard requirements: NMPA approval, and conduct at a qualifying tertiary Grade A hospital. On timing, the Regulation allows sixty working days and Article 40 allows sixty days, silence meaning consent in both; the unit differs, so schedules must reflect each provision. Article 45 adds that trials start within three years and permission lapses without informed consent, which bites harder when algorithms iterate fast.

Statistics at two ends. On the dataset side: the split and independence of training, tuning and test sets; the number and geography of source institutions; balance of population or disease distribution; sample size for rare classes and important subgroups; and annotation consistency, including inter-annotator agreement and arbitration. On the metric side: selection of primary and secondary measures; target values and acceptable limits; stratified consistency by population, disease, device model or acquisition conditions; and the comparison basis against existing methods or comparators. The dataset decides extrapolation, the metrics decidability; both must be fixed in the protocol.

Two internal processes. The change classification process takes each update through the three layers and outputs variation, thirty-day filing or internal record, keeping the record as evidence of a controlled system. The consistency process maintains the correspondence between filed, verified and marketed versions and updates performance measures, intended use, limitations and the algorithm description together. Its absence surfaces at QMS inspection, which tests consistency with practice, not the existence of documents.

Post-market obligations. Under Article 20(1) of the Regulation the holder keeps an effective quality system and carries out post-market study and risk control, so performance changes from updates enter post-market evaluation. Under Article 22 the certificate runs five years with renewal six months before expiry; several iterations may occur in that term, and the consistency statement and change history required at renewal are only as good as the ledger kept. One combined ledger makes renewal extraction rather than reconstruction.

4. Practical recommendations

• Define the three algorithm layers at first filing and map them to risk items.
• Bind each layer to an action: variation for core, assessment for configuration, filing for engineering.
• For catalogue devices, arrange approval and a tertiary Grade A site in parallel.
• Schedule against the correct unit and track the three-year validity clause.
• Fix dataset and metric design in the protocol (Article 29).
• Keep a change classification ledger with one record per update.
• Maintain a version consistency matrix across four versions and three documents.
• Renew six months before expiry from the combined ledger.

5. Verification checklist

• □ Three layers defined in the algorithm description?
• □ Layer definitions mapped to risk items?
• □ Change classification ledger kept, conclusion per update (Article 79)?
• □ Part Four of No. 63 reviewed against current guidance?
• □ Accelerated channel comparison done?
• □ For trials, approval and site confirmed (Article 38)?
• □ Schedule distinguishes working days from days?
• □ Three-year commencement and lapse tracked (Article 45)?
• □ Dataset split, independence, sources, subgroup sizes fixed (Article 29)?
• □ Target values, limits and stratified consistency fixed?
• □ Version consistency across four versions and three documents?
• □ Testing passed (Article 30)?
• □ Updates in post-market study and risk control (Article 20(1))?
• □ Five-year term and renewal milestone scheduled?

Regulatory information verified as at 29 October 2026. Legal texts follow the versions published by NMPA, SAMR and gov.cn and must be rechecked after amendment or repeal. Time limits, fees and catalogue scope reflect the official position on that date; content marked practical estimate has no legal effect.

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support for the Chinese market. Our team prepares NMPA-compliant dossiers, coordinates typetesting and clinical evaluation documents, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com