The NMPA published the “Quality Management Regulation on Online Sales of Medical Devices” on April 28, 2025, which takes effect on October 1, 2025. This regulation establishes a comprehensive framework to ensure the safety, traceability, and quality compliance of medical devices sold through online channels. Any devices, even Class III, can be sold online, as long as the ‘user facility’, such as use limited to hospitals, is not restricted in the registration certificate.
The regulation applies to both online medical device sellers (“network sales operators”) and e-commerce platforms providing transactional services (“platform operators”). Both types of operators must establish, maintain, and continuously improve quality management systems tailored to the scale, risk profile, and operational model of their online sales activities. Advanced technologies such as big data, cloud computing, and artificial intelligence are encouraged to enhance quality oversight, detect risks, and improve operational efficiency.
Special attention is given to devices with specific fitting or usage requirements, such as corneal contact lenses, which must be fitted by eye-care professionals, and hearing aids, which require professional audiological testing and calibration. By clearly defining roles, responsibilities, and enforcement measures, the regulation aims to foster a reliable and trustworthy online medical device market, supporting safe access to both domestic and foreign products.
China New GSP has been effective since July 1, 2024. Click HERE for more information.
Quality Management Requirements for Network Sales Operators
Network sales operators must establish a quality management body proportional to sales scale, product range, and operational model. If no dedicated body exists, a qualified staff member must assume these responsibilities. Key obligations include:
- Monitor compliance with relevant laws, regulations, and internal quality procedures.
- Develop and supervise online sales quality management systems.
- Review medical device registration, license, and approval information, ensuring accurate display.
- Monitor and resolve complaints, safety incidents, and adverse events.
- Oversee self-operated websites, apps, or client software systems.
- For Class II and III devices, verify buyer qualifications and maintain dynamic purchase records.
- Ensure staff meet regulatory qualifications and receive regular training on laws, product knowledge, and online sales compliance.
- Maintain secure IT infrastructure with data backup, fault recovery, cybersecurity measures, and servers located in China.
- Verify credentials of third-party e-commerce platforms and maintain updated records.
Documentation must cover:
- Enterprise qualifications and license display management.
- Product approval, display, and information accuracy.
- Online contracts, order records, and shipping documentation.
- Risk control measures and staff training programs.
- Platform verification (if applicable) and system functionality assurance.
- Explicit warnings for specialized devices (e.g., contact lenses and hearing aids).
- Transportation and storage procedures meeting product specifications.
- After-sales service contacts and complaint tracking.
Any safety risk or quality concern must trigger immediate measures, such as pausing product display or sales.
Quality Management Requirements for E-Commerce Platform Operators
Platform operators are responsible for ensuring quality management across the online sales ecosystem. Core responsibilities include:
- Register all network sales operators and verify licenses, registration, and approval status.
- Monitor accuracy and legality of displayed product and license information.
- Assign sufficient resources and authority to quality managers to ensure independent compliance oversight.
- Implement staff training, system functionality checks, and quality oversight protocols.
- Detect unlawful activity, handle complaints, and collaborate with authorities on adverse events or product recalls.
- Securely store transaction data and maintain audit trails.
- Immediately correct operators displaying false or incomplete information.
- Suspend services and report serious violations, including unregistered or banned device sales.
- Conduct periodic audits of quality management systems, covering compliance, staff training, record integrity, risk monitoring, and corrective measures.
Penalties and Enforcement
The regulation establishes clear consequences for violations:
- Platform operators must report non-compliant behavior to local regulatory authorities.
- For serious breaches, services must be suspended and products removed from sale.
- Both network sales operators and platforms are accountable for maintaining accurate records, responding to complaints, and preventing unsafe or unapproved devices from reaching users.
- Non-compliance may result in administrative penalties, including suspension, fines, or license revocation.