NMPA Center for Drug Inspection issued the “Inspection Points for Artificial Intelligence Medical Devices (Draft)” for feedback. Feedbacks need to be submitted by October 28, 2026. Based on the new GMP, it is to standardize and support quality management system (QMS) inspections for AI medical devices. The draft emphasizes lifecycle management, risk-based control, data and algorithm traceability, cybersecurity, and continuous improvement. It treats AI medical devices as software-driven products whose core production factors are datasets and algorithms, and it requires companies to manage them with the same rigor as traditional device production while addressing AI-specific risks.
This guideline forms an integral part of China’s Digital Health regulatory framework and serves as a supplement to other software & AI related documents, such as those on medical device software, cybersecurity, AI-assisted software, AI-assisted diagnostics and human factors engineering.
For our comprehensive analysis on China’s regulatory approach to Software as a Medical Device (SaMD), click HERE
Click HERE for software company defects found in NMPA unannounced inspection
Click HERE for NMPA chief reviewers’ opinion on regulating AI medical devices
Definition, Use, and Realization
Intended use is divided into auxiliary decision-making and non-auxiliary decision-making. Auxiliary decision-making helps users make medical decisions, such as triage, detection, diagnosis, and treatment. Non-auxiliary use provides reference information only, including workflow optimization, imaging quality improvement, automatic measurement, segmentation, and 3D reconstruction.
The typical realization process includes data collection and algorithm design:
– Data collection covers acquisition, sorting, annotation, and dataset construction.
– Algorithm design covers selection, training, and performance evaluation. If performance fails due to data problems, the process returns to data collection; if due to algorithm problems, it returns to algorithm design.
AI devices usually consist of installation programs, authorization files, client and server sides, optional modules, and specified algorithms such as deep learning.
Production differs from traditional devices:
– The core is algorithm and software design and development.
– Dataset construction, algorithm training, and coding are equivalent to production; performance evaluation and software verification are quality control.
– Delivery may be physical, such as CD/DVD or USB, or network-based, such as cloud, FTP, or app stores.
Major Points from the Inspection Guideline
Standards and Performance Indicators
– Relevant standards include: GB/T 25000.51; GB/T 42062; GB/T 42984.1; GB/T 45225; YY/T 0664; YY/T 1406.1; YY/T 1437; the YY/T 1833 series on AI medical device quality and evaluation; YY/T 1843 on cybersecurity; and various algorithm performance testing standards for lung imaging, coronary CT, radiotherapy, cytopathology, and stroke CT.
– Main performance indicators for AI standalone software include general, specific, and safety requirements.
– General requirements cover function, use restrictions, input/output, required hardware and software, operating environment, performance efficiency, access control, reliability, and maintainability.
– Specific and safety requirements follow product standards, such as alarms and radiotherapy.
– The technical requirements appendix should include architecture diagrams, user interface diagrams, main interface images, physical topology, and notes. If deep learning is used, the module must be identified.
– For AI software components, indicators include function, use restrictions, interfaces, and access control; external and dedicated standalone software also need operating environment and performance efficiency.
Major Risk Points and Controls
– Requirements analysis must consider data collection, algorithm performance, use restrictions, and cybersecurity.
– Data collection must define equipment and standards, keep traceability records, create de-identification rules, and distinguish data modalities.
– Data sorting must define cleaning and preprocessing, plus basic database sample type, size, and distribution.
– Data annotation must have specifications, quality control, annotator management, annotation rules, dispute resolution, and backup and recovery.
– Dataset construction must define training, tuning, and test set division; ensure balanced training data; make test and tuning distributions realistic; and ensure no overlap among the three sets.
– Algorithm design needs management procedures for intended use, route selection, model selection, and performance evaluation.
– Algorithm training must use training and tuning sets, define metrics, strategies, optimization goals, and tuning methods, analyze learning curves, and address overfitting or underfitting.
– Algorithm performance evaluation must use an independent test set and examine false negatives and false positives, repeatability, reproducibility, robustness, and real-time performance.
– Software verification and validation need test plans, records, reports, and user testing, clinical evaluation, and review.
– Change control must identify and evaluate changes, validate and confirm as needed, and include algorithm update research reports.
– Network and data security must include vulnerability scanning as mandatory, plus options such as source code review, binary scanning, virus scanning, penetration testing, and fuzz testing.
– Data collection should occur in a closed or controlled network, with de-identification, encrypted transfer, and anti-contamination measures.
– Software delivery must control physical and network delivery, including media quality, integrity checks, platform security, identity authentication, and access control.
Inspection Requirements
– General principles state that AI device production is data, algorithm, and software R&D management; datasets and algorithm models are key production factors.
– The QMS should cover the full lifecycle, including delegated R&D, production, and testing.
– Risk management should address AI-specific risks such as data poisoning, model backdoor attacks, model theft, prompt injection, information leakage, and privilege loss.
– Quality assurance requires quality objectives, adequate resources, clear responsibilities, compliant and traceable data and software, controlled design activities, delivery-appropriate production and inspection, release approval, and controlled outsourcing.
– Organization and personnel must include R&D, production, quality, and sales and after-sales. The quality department must be independent.
– Key positions include legal representative, person in charge, management representative, R&D, production and quality heads, release reviewer, algorithm R&D, data processing, and software testing.
– The quality head cannot concurrently head R&D or production; black-box testers cannot be developers of the same software item; primary annotation, review, and arbitration cannot be the same person. External personnel need qualification verification and training.
– Premises and facilities cover annotation sites, machine rooms, third-party machine room assessment, and controlled network environments.
– Equipment must provide development and testing environments, data processing devices with virus protection and backup, and confirmed annotation and cleaning tools.
– Documents and data management require electronic records that are true, accurate, complete, timely, and traceable.
– Design and development require requirements analysis, data collection management, algorithm design management, software verification and validation, defect management, release and deployment, change control, network and data security, and traceability analysis.
– Procurement requires supplier evaluation for algorithm modules, cloud services, and annotation services, plus open-source compliance and software verification.
– Production management covers physical and network delivery processes, records, UDI, and rework.
– Quality control and release cover inspection, release conditions, and nonconforming handling.
– Sales and after-sales cover records, contracts, and deployment records.
– Analysis and improvement require collecting quality, adverse event, and feedback data, and using post-market clinical data to track sensitivity and specificity.
Key Takeaways from the Inspection Guideline
– Data compliance, ethics, privacy, and de-identification are critical. Data sources must be lawful, sufficient, and diverse, and records must be traceable.
– Dataset separation and independence are essential. Training, tuning, and test sets must not overlap. Test sets should not be augmented except for adversarial testing. Dataset use changes should follow strict change control.
– Algorithm updates require strict change control and clinical evaluation. Version naming must distinguish major and minor updates. Algorithm update research reports should cover all changes since the first release.
– Cybersecurity is mandatory. Vulnerability scanning must be performed. Companies should also consider source code review, penetration testing, and emergency response. Data transfer and storage must be protected.
– Human oversight and clinical evaluation remain important. AI outputs are often auxiliary and cannot replace clinical judgment. Instructions should clearly state contraindications, precautions, and use restrictions.
– Continuous monitoring is required. Companies should track post-market performance, algorithm stability, data drift, and cybersecurity risks, and dynamically update maintenance plans.