Regulation of Machine Learning Diagnostic Systems in Healthcare in China

1. Introduction and Legal Framework

Machine learning diagnostic systems use artificial intelligence (AI) algorithms to detect diseases, interpret medical images, predict clinical risks, and support doctors in making treatment decisions. Examples include AI systems for identifying cancer from radiological images, detecting diabetic retinopathy, and analysing electrocardiograms.

China regulates these technologies through medical-device law, AI-specific guidance, healthcare regulations, data protection legislation, and clinical research requirements. The principal regulatory objective is to ensure that diagnostic systems are safe, effective, clinically validated, and capable of protecting patients' personal and medical information.

The principal legal instruments include:

Regulations on the Supervision and Administration of Medical Devices (2021): Establish the registration, classification, production, and marketing framework for medical devices.

Medical Device Registration and Filing Measures (2021): Govern the registration and filing of medical devices.

Cybersecurity Law (2017, as amended): Establishes network security and personal information protection obligations.

Personal Information Protection Law (2021): Regulates the processing of personal information, including sensitive medical information.

Data Security Law (2021): Addresses data security and the protection of important data.

Biosecurity Law (2021): Provides additional safeguards where AI research involves biological resources or related regulated activities.

The National Medical Products Administration (NMPA) is the principal authority responsible for medical-device registration and oversight. The National Health Commission (NHC) supervises healthcare institutions and clinical practice within its statutory responsibilities.

2. Classification and Approval of AI Diagnostic Software

Under the medical-device framework, machine learning software may be classified as a medical device when its intended purpose is medical diagnosis, monitoring, prevention, or treatment.

The risk classification determines the regulatory pathway:

Class I: Lower-risk devices, generally subject to filing.

Class II: Moderate-risk devices, generally requiring registration with the relevant provincial authority.

Class III: Higher-risk devices, requiring registration with the NMPA.

AI diagnostic software is classified according to its intended use, risk, and potential consequences of an incorrect result. Software used to assist in diagnosing serious diseases may fall into Class II or Class III, depending on its function and risk profile. Not every AI diagnostic application automatically belongs to Class III.

The NMPA's Guiding Principles for the Registration Review of Artificial Intelligence Medical Devices (2022) provide important technical guidance for evaluating AI-based medical devices. Relevant considerations include algorithm design, training datasets, performance evaluation, clinical validation, cybersecurity, and lifecycle management.

Manufacturers must demonstrate that the software performs reliably for its intended clinical purpose. Evidence may include sensitivity, specificity, accuracy, robustness, and performance across relevant patient populations. Significant changes to an algorithm, its intended use, or its performance may require regulatory assessment.

3. Clinical Validation and Healthcare Data Protection

AI diagnostic systems depend on medical images, laboratory results, patient records, and other clinical datasets. These data must be collected and processed lawfully.

The Personal Information Protection Law treats medical and health information as sensitive personal information. Its provisions require appropriate legal grounds, enhanced protection, and compliance with applicable consent requirements. Where applicable, separate consent and a personal information protection impact assessment may be required.

The Data Security Law and Cybersecurity Law impose additional obligations concerning data security and network protection. Institutions using cloud-based diagnostic systems must consider access controls, security incidents, data storage, and cross-border transfers.

Clinical validation is equally important. A model trained using one hospital's population may perform differently in another hospital because of differences in equipment, disease prevalence, demographics, and image quality. Developers should therefore evaluate generalisability and document known limitations before deployment.

Healthcare institutions must also ensure that AI tools are used consistently with applicable clinical standards and professional responsibilities. An AI-generated result should not automatically replace clinical judgment where professional assessment is required.

4. Case Laws and Regulatory Examples

Direct judicial precedents: As of October 2026, I cannot reliably identify a leading, publicly reported Chinese court judgment specifically establishing liability for a machine learning diagnostic system's incorrect medical diagnosis. It would be misleading to invent a case or claim that a general AI ruling directly governs medical diagnostic software.

NMPA regulatory practice: China's registration and review of AI-assisted medical imaging products provides practical evidence of the regulatory approach. These reviews focus on intended clinical use, algorithm performance, clinical evidence, and safety. Such approvals are regulatory precedents, not court judgments.

General medical malpractice principles: Under China's Civil Code, particularly Articles 1218–1222, medical institutions may incur civil liability for harm caused by medical personnel's fault, subject to the applicable statutory requirements. If an AI system contributes to a misdiagnosis, responsibility may depend on the clinician's conduct, the hospital's deployment and supervision, the manufacturer's product defects, and the causal connection between the conduct and the injury.

5. Conclusion

China's regulatory approach combines NMPA medical-device approval, clinical performance assessment, healthcare supervision, and personal-data protection. Manufacturers must establish safety and effectiveness, while hospitals must use diagnostic systems responsibly and protect patient information. The principal legal challenge is allocating responsibility when an algorithm produces an incorrect diagnosis. Existing medical-device and civil-liability rules provide the foundation, although AI-specific judicial precedents remain limited.