Software and Artificial Intelligence Medical Devices Under TR-007 and TR-008

1. Key takeaways

Software and artificial intelligence medical devices have 2 dedicated technical reference documents in Hong Kong, China: TR-007, Medical Device Software and Cybersecurity, updated on 1 September 2025 with a Chinese version published for the first time; and TR-008, Artificial Intelligence Medical Devices, updated on 2 October 2025 with a Chinese version published on the same date. TR-009, Personalised Medical Devices, was also updated on that date. Three documents revised within the same year point to one clear signal: the Medical Device Division (MDD) is standardising the technical requirements for software, artificial intelligence and personalised devices.

• TR-007 and TR-008 are cumulative rather than alternative: an AI device is a software device first, and has to satisfy both documents.
• The publication of Chinese versions narrows the gap for teams working in Chinese, mainly by aligning terminology rather than by changing substance.
• The Department of Health has publicly identified AI device listing as an area where technical reference material is being developed, which indicates further revision.
• Personalised devices that embed algorithmic design fall within both TR-008 and TR-009, and each set of requirements has to be addressed separately.
• Version tracking is part of compliance, because the applicable version is the one in force at the time of assessment.

2. Legal basis

The three technical reference documents sit under the Medical Device Administrative Control System (MDACS) framework and are announced through the MDD developments page, while the policy direction is reflected in a Department of Health press release on its regulatory symposium. The table below lists the instruments and provisions used in this article.

Because the technical reference documents are updated independently of the listing guidances, a dossier can be complete against GN-02 or GN-06 and still fall short against the applicable TR. The two layers answer different questions: the guidance says what a listing application contains, and the technical reference says what the evidence for a particular technology has to demonstrate.

3. Expert insights

First, the Chinese versions lower the barrier for manufacturers on the Chinese mainland. TR-007 and TR-008 had previously existed in English only, and Chinese versions were published in 2025. For teams on the Chinese mainland the benefit is not simply convenience of reading: aligned terminology reduces the risk of misreading, particularly for concepts such as the software lifecycle, change control and algorithm locking, where a translated term that differs from the term used in the quality system can create a genuine gap between the dossier and the technical file.

Second, software and artificial intelligence are cumulative, not a choice between two options. An artificial intelligence medical device is first of all a software medical device, and must satisfy both the software lifecycle and cybersecurity requirements of TR-007 and the algorithm and data requirements of TR-008. A dossier that submits only one of the two sets will be met with a request for supplementary information. Structuring the file so that each requirement maps to a specific section is the simplest way to avoid that outcome.

Third, the Department of Health has made artificial intelligence an explicit technical priority. In remarks at the symposium on 3 February 2026, the Director of Health stated that the Department has developed technical reference documents for the listing of artificial intelligence medical devices to help the industry understand the requirements. That statement indicates that the document will continue to evolve, so companies need a version tracking mechanism rather than a one-off review at the start of a project.

Fourth, personalised devices and artificial intelligence overlap. A patient-matched device that also contains algorithmic decision-making may fall within the scope of both TR-008 and TR-009, and each set of requirements has to be explained separately in the dossier. Where both apply, the file should make clear which requirement each section answers, so that the reviewer is not left to infer the mapping. Where the design output is generated automatically from patient data, the overlap is not theoretical but structural, and the documentation burden should be planned on that basis from the outset.

4. Practical recommendations

• Keep a TR version register. Record the update and publication date of each technical reference document and the version that applies, and check against the latest version before filing.
• Split software dossiers into two volumes. One volume addresses TR-007 (lifecycle, risk management, cybersecurity) and the other addresses TR-008 (data, algorithm, performance verification).
• Bring algorithm changes into change management. Model updates, expansion of training data sets and similar changes should be assessed for whether they constitute a substantial change under GN-10.
• Engage MDD early. For novel artificial intelligence products, use the MDD enquiry channel before submission to confirm how the documents apply to the specific product.

5. Verification checklist

• □ The latest versions and publication dates of TR-007 and TR-008 have been confirmed
• □ Software lifecycle and cybersecurity documentation is prepared against TR-007
• □ Algorithm and data documentation is prepared against TR-008
• □ Whether the product also falls within TR-009 for personalised devices has been assessed
• □ Algorithm changes have been brought into the change management process
• □ A mechanism for tracking technical reference document versions is in place

Regulatory information verified to 29 October 2026. The legislation, guidance and effective dates described in this article are limited to what the official sources listed under Legal basis had published on that date; where an official document has since been updated, the most recent published version prevails.

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support for Hong Kong, China. Our team manages MDACS listing applications across all risk classes, prepares reference-approval dossiers, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com