Regulation of AI Integration in Genomic Medicine in China

1. Legal Framework Governing AI and Genomic Medicine

China does not regulate AI-powered genomic medicine through one single statute. Instead, it applies a combination of laws governing artificial intelligence, medical devices, genetic resources, personal information, cybersecurity, and clinical research.

The principal legal instruments include:

Biosecurity Law of 2021: Establishes safeguards against biological risks and governs relevant activities involving human genetic resources.

Regulations on the Administration of Human Genetic Resources: Regulate the collection, preservation, utilization, and international provision of Chinese human genetic resources. The regulations were amended in 2024, with responsibilities and procedures adjusted under the revised framework.

Personal Information Protection Law (PIPL), 2021: Protects sensitive personal information, including medical and health information, and imposes requirements on lawful processing.

Data Security Law, 2021: Requires data-security measures proportionate to data classification and risk.

Cybersecurity Law, 2017, as amended: Establishes cybersecurity obligations for network operators and relevant infrastructure.

Regulations on the Supervision and Administration of Medical Devices: Govern the registration, clinical evaluation, and supervision of medical devices, including qualifying AI-based diagnostic software.

Measures for the Administration of Internet Information Services Using Deep Synthesis Technology (2023) and Interim Measures for the Management of Generative Artificial Intelligence Services (2023): May apply when AI genomic services fall within their respective scopes, particularly public-facing generative AI services.

These instruments operate together. For example, an AI system that predicts cancer risk from whole-genome sequencing may implicate medical-device regulation, personal information protection, and human genetic resources requirements simultaneously.

2. Regulation of AI-Based Genomic Diagnosis

A. Medical Device Approval

AI software used to diagnose genetic diseases, interpret sequencing results, or recommend clinical treatment may qualify as software as a medical device, depending on its intended purpose and functionality.

The National Medical Products Administration (NMPA) oversees medical-device registration. Depending on the product's risk classification, the developer may need to establish analytical and clinical performance, validate the algorithm, demonstrate reliability, and comply with quality-management requirements.

An AI system used only for basic research may be treated differently from one marketed to clinicians as a diagnostic tool. A research prototype should not automatically be treated as authorized for routine clinical diagnosis.

B. Clinical Validation and Human Oversight

AI systems must be evaluated for accuracy, reproducibility, and suitability for their intended patient population. Genomic algorithms may produce incorrect variant classifications, overlook rare mutations, or perform differently across populations underrepresented in training datasets.

Responsible institutions should therefore document training-data provenance, validation methods, known limitations, and procedures for reviewing clinically significant results. Human oversight is especially important when AI outputs influence cancer treatment, inherited-disease diagnosis, or reproductive decisions.

3. Genetic Data Protection and Cross-Border Transfers

Genomic data can reveal an individual's identity, disease susceptibility, and hereditary characteristics. When AI systems process identifiable genomic information, PIPL requirements become particularly important.

Organizations should establish a lawful basis for processing, provide required notices, obtain separate consent where applicable, and adopt strict security safeguards. Article 28 of PIPL classifies sensitive personal information as information whose misuse could easily harm personal dignity or personal safety and property security. Article 29 generally requires separate consent for processing sensitive personal information where consent is the legal basis.

If a foreign AI provider receives Chinese genomic datasets, additional restrictions may apply under the human genetic resources framework and cross-border data-transfer rules. De-identification does not automatically remove every legal obligation, particularly where datasets remain re-identifiable or qualify as regulated human genetic resources information.

4. Relevant Cases and Judicial Developments

A. He Jiankui Gene-Editing Case (2019)

In December 2019, the Shenzhen Nanshan District People's Court sentenced He Jiankui to three years' imprisonment and fined him RMB 3 million for illegally conducting human embryo gene-editing activities for reproductive purposes. Two collaborators also received criminal sentences.

Relevance: The case demonstrates the legal consequences of conducting human genetic research without appropriate safeguards and regulatory compliance. It is relevant to genomic medicine ethics, but it did not directly concern AI algorithms or AI medical-device approval.

B. Hangzhou Safari Park Facial-Recognition Litigation

Chinese courts considered the legality of compulsory biometric-information collection in litigation involving Hangzhou Safari Park. The dispute raised questions about informed consent, contractual fairness, and the collection of sensitive personal information.

Relevance: The case offers an analogy for AI genomic medicine because both biometric and genomic systems can process sensitive information. However, facial-recognition litigation is not a direct precedent on genomic algorithms.

C. AI-Generated Content Litigation

In 2023, the Beijing Internet Court decided a widely discussed dispute concerning an AI-generated image and copyright protection. The judgment addressed human creative contribution and the legal treatment of AI-generated content.

Relevance: This illustrates China's developing judicial approach to AI technologies, but it did not decide medical safety, genomic privacy, or clinical AI liability.

Important limitation: These are related judicial developments, not direct precedents establishing the legality of AI-based genomic diagnosis. No specific landmark Chinese judgment directly resolving AI-integrated genomic medicine compliance is identified here with sufficient confidence.

5. Institutional Responsibilities and Compliance

The principal authorities include the NMPA for medical-device regulation, the National Health Commission for relevant healthcare and clinical research oversight, the Cyberspace Administration of China for applicable data and internet regulations, and the competent human genetic resources authority under the current administrative framework.

Hospitals and biotechnology companies should validate algorithms, document clinical performance, protect genomic databases, conduct required ethical reviews, and assess international data transfers before implementation.

Conclusion

China's approach to AI integration in genomic medicine combines medical-device regulation, genetic-resource governance, personal information protection, and cybersecurity. AI diagnostic systems must be evaluated according to their intended clinical use, while genomic data processing must satisfy applicable privacy and genetic-resource requirements. Although related cases provide guidance on genetic research ethics, biometric privacy, and AI governance, they should not be misrepresented as direct judicial rulings on AI-powered genomic medicine.