Regulation of Clinical Decision Support Systems Using Genomics in China

1. Introduction

Clinical Decision Support Systems (CDSS) using genomics are digital healthcare tools that analyse genetic information to assist doctors in diagnosing diseases, predicting hereditary risks, selecting medicines and developing personalized treatment plans. Examples include systems that recommend cancer treatments based on tumour mutations and pharmacogenomic tools that predict a patient's response to particular medicines.

China regulates these systems through a combination of medical-device regulation, personal-information protection, genetic-resource governance and healthcare rules. The principal authorities include the National Medical Products Administration (NMPA) and the National Health Commission (NHC).

The major laws include the Personal Information Protection Law (PIPL), 2021; the Biosecurity Law, 2021; the Regulation on the Administration of Human Genetic Resources, as amended in 2024; and the Regulations on the Supervision and Administration of Medical Devices. The applicable requirements depend on whether a system merely stores information or actually provides diagnostic or therapeutic recommendations.

2. Medical Device Regulation

China regulates software intended for medical diagnosis or treatment under its medical-device framework. The Regulations on the Supervision and Administration of Medical Devices, revised in 2021, establish requirements for registration, production, distribution and use.

A genomic CDSS may qualify as Software as a Medical Device (SaMD) when its intended purpose is to support clinical diagnosis or treatment. For example, software that interprets tumour sequencing results and recommends a targeted cancer medicine may be subject to medical-device registration requirements.

The NMPA determines the applicable classification based on factors such as the intended use, clinical significance and risks associated with incorrect recommendations.

Class I: Lower-risk devices, generally subject to filing.

Class II: Moderate-risk devices, generally requiring registration.

Class III: Higher-risk devices, requiring registration and more stringent review.

The classification of a specific genomic CDSS cannot be determined from the fact that it uses AI or genetic data alone. Its intended purpose and risk profile are decisive.

Manufacturers may need to provide evidence concerning software performance, clinical evaluation, cybersecurity, risk management and the reliability of algorithms. Systems that influence major treatment decisions require particular attention to clinical validity and patient safety.

3. Protection of Genetic Data under PIPL

The PIPL is central to genomic CDSS because these systems may process DNA sequences, hereditary disease information, genomic test reports and other sensitive health information.

Important provisions include:

Article 6: Requires a clear and reasonable purpose and limits processing to the minimum necessary.

Article 13: Establishes lawful bases for processing personal information.

Article 28: Defines sensitive personal information, a category that can include genetic and medical information.

Articles 29–30: Generally require separate consent for processing sensitive personal information and specific notice about the necessity and impact of processing.

Article 55: Requires personal information protection impact assessments for specified activities, including processing sensitive personal information and transferring personal information abroad.

Hospitals and software providers must determine their respective responsibilities as personal-information processors or entrusted service providers. Appropriate safeguards include access controls, secure storage, audit logs and restrictions on secondary use.

Consent does not automatically authorize every use of genomic information. Processing must also comply with other applicable legal requirements.

4. Human Genetic Resources and Biosecurity Regulation

The Human Genetic Resources framework is particularly important where genomic CDSS platforms are developed using Chinese human genetic resources.

China's regulations distinguish between human genetic materials and human genetic resource information. The latter may include data generated from human genetic materials, subject to the definitions and requirements of the governing rules.

Research involving genomic databases, international collaborations or the provision of genetic information to overseas entities may trigger specific approval, filing, reporting or security-review obligations.

The Biosecurity Law also establishes broader safeguards relating to biotechnology and human genetic resources.

Consequently, a hospital or technology company developing genomic decision-support software should assess not only whether its product is a regulated medical device but also whether the collection, research, storage or international sharing of genetic information triggers additional requirements.

5. Clinical Validation and Professional Responsibility

A genomic CDSS should be scientifically validated before being relied upon for consequential clinical decisions. Important considerations include:

Analytical validity: Whether the system correctly processes the underlying genomic data.

Clinical validity: Whether identified genetic variants are meaningfully associated with the relevant disease or treatment response.

Clinical utility: Whether using the system improves clinical decision-making or patient outcomes.

Algorithmic reliability: Whether performance is sufficiently robust across relevant patient populations.

Human oversight: Whether clinicians can evaluate recommendations rather than relying blindly on automated outputs.

Hospitals must also comply with applicable medical-quality, clinical-testing and professional-practice requirements. A software recommendation does not automatically replace the treating physician's clinical judgment.

Where a system produces an erroneous recommendation, responsibility may depend on whether the problem arose from defective software, inaccurate laboratory results, inadequate validation, improper implementation or negligent clinical use.

6. Relevant Cases and Legal Precedents

Directly reported Chinese court judgments specifically concerning genomic clinical decision-support software are limited. The following matters provide relevant regulatory context, but they should not be mistaken for direct precedents interpreting genomic CDSS regulation.

A. He Jiankui gene-editing criminal case (2019)

In December 2019, the Shenzhen Nanshan District People's Court convicted He Jiankui and two collaborators of illegal medical practice connected with gene-edited human embryos. He received a three-year prison sentence and a fine.

Legal significance: The case demonstrates the consequences of conducting unauthorized genetic interventions outside applicable medical and ethical requirements. It supports the broader principle that technological innovation in genetics does not displace clinical and regulatory oversight.

Limitation: The case concerned reproductive gene editing and illegal medical practice, not genomic decision-support software or medical-device registration.

B. Civil Code of China: Personal Information Protection

Articles 1034–1039 of the Civil Code establish protections for personal information and regulate its processing, disclosure and security.

Legal significance: These provisions may be relevant when a genomic CDSS improperly discloses identifiable genetic data or causes harm through unlawful information processing. They provide part of the civil-law foundation for protecting patients whose genetic information is used by healthcare institutions and technology providers.

These are statutory provisions, not a specific reported genomic-CDSS judgment.

C. PIPL enforcement framework

Articles 66 and 69 of the PIPL provide important enforcement and liability mechanisms. Article 66 authorizes administrative sanctions for violations, while Article 69 addresses civil liability for infringement of personal-information rights and interests, subject to its applicable rules.

Legal significance: Hospitals and technology providers may face liability if their genomic systems unlawfully process personal information, fail to meet applicable obligations or cause legally recognized harm. The exact consequences depend on the facts and the applicable legal provisions.

No directly on-point published judgment is identified here that establishes a specific judicial test for genomic CDSS under the PIPL.

7. Regulatory Challenges

China faces several challenges in regulating genomic CDSS:

Rapid technological development: AI models and genomic databases evolve faster than traditional review processes.

Clinical reliability: A system trained on limited populations may produce less reliable recommendations for other groups.

Data security: Genomic data can reveal information about biological relatives as well as the tested patient.

Accountability: Responsibility may be divided among software developers, laboratories, hospitals and clinicians.

Cross-border collaboration: International research and cloud-based services may trigger additional genetic-resource and data-transfer restrictions.

Effective regulation requires coordinated oversight of software safety, clinical evidence, genetic-data protection and medical practice.

8. Conclusion

China regulates genomic clinical decision-support systems through a layered framework combining NMPA medical-device oversight, PIPL privacy safeguards, human genetic resource rules and clinical-governance requirements.

A system that merely displays a laboratory report may face different requirements from one that recommends a diagnosis or selects a cancer treatment. The latter is more likely to require careful medical-device classification, clinical evidence and risk controls.

The central principle is that genomic decision-support technology must be scientifically reliable, legally compliant and subject to appropriate clinical oversight. Although general Chinese laws provide a substantial regulatory foundation, directly applicable published case law specifically addressing genomic CDSS remains limited.