Documentation Requirements for Software Medical Devices and AI Devices

1. Key takeaways

The Digital Medical Products Act (DMPA) was enacted and promulgated on January 23, 2024, effective January 24, 2025 for digital medical devices and digital combination drugs, and extending to digital healthcare support devices from January 24, 2026. The documentation requirements for software medical devices and AI devices have left the original Medical Device Act framework, forming 10 independent requirements (see table).

• The requirement with the greatest impact is the Predetermined Change Control Plan (PCCP): an AI device that submits a change management plan is exempt from approval change by change. This runs in the same direction as the pre-announcement described in Article 27: Change management – from item-by-item prior approval to a negative list system – PCCP is already in force under the Digital Medical Products Act, while the Enforcement Rule amendment bill had not been formally promulgated as of October 29, 2026; both trend toward an advance plan plus post-hoc records instead of approval by instance.
• Two further requirements bind commercial conduct directly: digital medical device software must provide information electronically, and professional-use digital medical device software must not be sold directly to individuals.

2. Legal basis

The instruments below establish the DMPA regime, its phased application and the residual role of the Medical Device Act. Regulatory information verified as of October 29, 2026.

The nature and target of the 10 independent requirements. The table lists each requirement and where it lands in the documentation and commercial process.

3. Expert insights

The applicability determination must come first; a wrong sequence voids the entire dossier. AI and software devices can no longer classify under the Medical Device Act first and append a software explanation afterwards. The correct order is to determine first whether the product falls into one of the three product categories of the Digital Medical Products Act, then determine class and pathway. A reversed order costs a full rewrite of the dossier, not one added explanation. The determination method is in Article 09: Digital Medical Products Act – AI and software devices now legislated separately from the Medical Device Act and Article 20: Pre-market pathway selection decision tree.

Of the 10 requirements, 4 are blank pages for most Chinese manufacturers. Usability evaluation, cybersecurity, PCCP and AI transparency disclosure have no counterpart in Chinese registration dossiers and no mature templates to copy. Usability evaluation and cybersecurity can be built on existing international standard frameworks (IEC 62366-1 for usability engineering, IEC 81001-5-1 for cybersecurity; applicable versions subject to recognition by the Korean authority, practical estimate); PCCP and transparency disclosure have no ready template and need structures designed around the product’s algorithmic characteristics.

PCCP and the negative list system point the same way: changes move from approval by instance to execution within a plan. Under PCCP the company states at application what it will change in future, how, and how changes will be verified; the authority approves the plan once, and changes inside the plan are exempt from approval by instance. This is the same direction as moving review before the fact in the negative list system described in the Article 27 pre-announcement (that bill had not been formally promulgated as of October 29, 2026). The two differ in scope: PCCP governs algorithm and software updates, the proposed negative list governs manufacturing and product changes – a software or AI device can fall under both at once.

Transparency disclosure and sales delivery mode are both captured by the legislation. Enhanced AI transparency disclosure is not a bonus item; its content enters both review materials and user-facing information. The more specific the disclosure, the heavier the explanatory burden later when performance diverges from the claim. GRZAN recommends disclosing only what can be verified: training data sources, the boundary of applicable populations, known limitations and performance limits must be data-supported, and unverifiable statements are not written (practical estimate).

Sales and delivery modes carry hard requirements too: professional-use digital medical device software must not be sold directly to individuals, and information under digital medical device software must be provided electronically. These two clauses change the business model and the leaflet format, not the technical requirements – channel design for professional-use software aimed at individuals must be rebuilt before launch, and the paper leaflet no longer applies. Advertising carries separate rules, see Article 47: Advertising pre-review and advertising compliance.

4. Practical recommendations

• Run the applicability determination before touching the dossier. Determine whether the product is a digital medical device, a digital combination drug, or a digital healthcare support device; effective dates are January 24, 2025 and January 24, 2026 respectively.
• Close the four blank documents in one pass. Compile usability evaluation, cybersecurity, PCCP and AI transparency disclosure in parallel, not one by one at the rhythm of deficiency requests.
• State three things clearly in the PCCP. The scope of changes inside the plan, the verification methods and the activation conditions are all indispensable; vague wording pushes later changes back into approval by instance.
• Organize the leaflet and delivery electronically. Information under digital medical device software must be provided electronically, and a paper leaflet does not apply to the category.
• Self-check channels and advertising together. Professional-use software must not be sold directly to individuals, and advertising and sales copy must match the disclosed content.
• Use the low-risk exemption fully. Low-risk digital medical devices are exempt from prior approval of the clinical trial plan; submit the exemption basis together with the application, see Article 23: Clinical data requirements – clinical trial plan approval and data composition.

5. Verification checklist

• □ Applicability determination: check against the three product categories of the Digital Medical Products Act; conclusion clear and completed before class determination.
• □ Applicable effective dates: check the effective date by product category; digital medical devices January 24, 2025; digital healthcare support devices January 24, 2026.
• □ Software usability evaluation: check the usability engineering process and results documents; process records and result data present, not conclusion-only wording.
• □ Cybersecurity document: check vulnerability management and update response arrangements; both included.
• □ PCCP completeness: check the change scope, verification methods and activation conditions; all 3 items present, no vague wording.
• □ AI transparency disclosure: check the data support behind the disclosed content; training data, applicable boundaries and known limitations all evidenced.
• □ Delivery and channels: check the delivery mode and target audience; provided electronically, professional-use software not sold directly to individuals.
• □ Documentation reduction: determine whether an excellent management system certification is held; eligible partial omissions stated at filing.
• □ Low-risk exemption: determine the risk class and exemption basis; the basis filed with the application dossier.

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, Korean licence holder and local testing support for the Republic of Korea. Our team prepares MFDS-compliant technical dossiers, coordinates KGMP documentation, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com