Medical AI Rules: China Weighs Lessons From EU, US, Japan
Medical artificial intelligence is outpacing the laws meant to govern it. A new comparative policy analysis published in Frontiers in Public Health argues that the central flaw in China’s regulatory system for medical AI is a structural mismatch: regulators approve a fixed, static version of an algorithm before it reaches the market, while the technology itself is built to keep learning and changing after launch. The study, a review by Jiayun Zhao and Qing Chen of Nanjing University of Chinese Medicine, compares how China, the European Union, the United States and Japan handle this tension, and proposes a lifecycle-oriented regulatory pathway adapted to China’s institutional context.
The authors define medical artificial intelligence (MAI) as systems that automatically analyze multimodal medical data, including clinical text, medical images and audio recordings, to support diagnosis and treatment decisions. Applications span AI-assisted imaging diagnosis, risk prediction for public health surveillance, intelligent triage, personalized treatment recommendation and AI-assisted surgery. Notably, the study excludes traditional surgical robots such as the da Vinci system, which provide mechanical assistance without AI algorithm empowerment and are classified as precision medical devices. AI-integrated surgical robots with navigation, intraoperative decision support and autonomous execution of standardized steps, by contrast, fall within the treatment-oriented MAI category.
China currently has no dedicated, systematic set of rules for MAI. Instead, the authors find, relevant provisions are scattered across different laws and regulations, producing a framework the paper describes as dependent, fragmented and principle-oriented. The backbone is medical device supervision: AI medical devices, including software as a medical device (SaMD) and AI embedded in traditional equipment, are classified into three risk tiers based on intended use, decision-making weight and the consequences of error, corresponding to Class III devices requiring clinical trial validation, Class II devices requiring non-clinical evidence, and Class I devices subject to filing. Data governance rests on the Personal Information Protection Law, which lists medical and health information as sensitive personal information under Article 28, alongside the Data Security Law and Cybersecurity Law. A 2026 measure on ethical review of artificial intelligence classified MAI as a high-risk AI type, making ethical review a mandatory access condition before launch.
The core regulatory tension is spelled out in the registration requirements. For AI-containing medical device software, companies must submit complete algorithm research reports disclosing fully fixed model frameworks, fixed training and validation datasets, and fixed performance indicators such as sensitivity, specificity and accuracy. After launch, technical parameters may not be changed at will; substantive changes require renewed registration or change approval, and direct online iteration is not allowed. Yet the core value of MAI lies in continuous optimization through learning from real-world clinical data. The paper notes that current norms lack clear definitions of the frequency, magnitude and legal nature of algorithm iterations, particularly criteria for determining what counts as a substantive change, creating uncertainty for both regulators and enterprises.
The three comparison jurisdictions have taken different routes through this problem. The European Union treats algorithm updates under the Medical Device Regulation and the Artificial Intelligence Act as software changes: once a change may affect intended use, performance or safety, it is identified as a significant change and triggers renewed conformity assessment, effectively equivalent to re-undergoing market approval. The authors judge this safety-first model comprehensive but rigid, arguing that generally classifying algorithm updates as significant changes raises compliance costs and may inhibit continuous iteration and market entry of MAI products.
The United States has adopted what the authors describe as a more forward-looking dynamic approach. Under the 2022 Food and Drug Omnibus Reform Act, which added Section 515C to the Federal Food, Drug, and Cosmetic Act, and the FDA’s guidance on Predetermined Change Control Plans (PCCPs), companies can pre-define the scope, type and risk boundaries of future algorithm adjustments before product launch. Changes falling within the pre-defined plan do not require renewed market approval, only verification and filing. The mechanism reduces repeated approval costs, but the paper cautions that the 510(k) pathway, which relies on substantial equivalence to existing devices, may not fully address performance changes caused by continuous learning. The US also lacks special federal AI legislation, relying on the existing medical device framework, which the authors say leaves algorithmic black boxes and data bias without dedicated regulation.
Japan occupies a middle position. Under the PMD Act and PMDA review guidelines for machine learning-enabled medical devices, companies can seek pre-consultation during development, and a tiered change classification divides algorithm adjustments into major, moderate and minor levels. Low-risk optimization within a pre-confirmed plan requires only post-hoc filing, while modifications that may significantly affect diagnostic safety and effectiveness require full change approval. Long-term adverse event monitoring and re-evaluation obligations require regular reporting on algorithm performance drift. The authors find this improves procedural flexibility but remains within traditional medical device approval logic, with limited special rules for AI-specific risks and heavy reliance on industry self-regulation.
Beyond algorithm change, the analysis identifies three supporting challenges. First, traceability and accountability: algorithmic opacity makes it hard to determine whether a performance failure stems from model design, training data limitations, subsequent updates or clinical deployment conditions, and China’s Civil Code product liability rules do not assign obligations to independent algorithm developers or data providers. Second, risk classification is too static: the same imaging system may pose low risk in routine pneumonia screening at a primary care clinic but extremely high risk in early-stage lung cancer diagnosis at a tertiary hospital, a scenario difference current uniform categories do not capture. Third, data governance: strict privacy protections, while effective, have contributed to data silos that limit the representative, multi-center data needed for training, external validation and continuous post-market evaluation.
From this comparison, the authors propose a regulatory pathway for China centered on differentiated algorithm-change control and continuous lifecycle evaluation. Enterprises would state in advance the possible adjustment scope, verification path and risk boundaries of their algorithms; updates within the pre-set scope would be handled through filing, continuous monitoring and real-world data evaluation rather than full re-approval. Algorithm changes would be sorted into three risk levels, from minor parameter optimization handled by post-event reporting to major changes in core architecture or intended use requiring re-registration. Accountability would center on registrants, with medical institutions, developers and data providers bearing tiered obligations, and defect identification based on whether actual outputs exceed predefined functional boundaries rather than on full algorithm interpretability. On data, the paper suggests tiered management allowing controlled circulation of de-identified data through trusted third-party intermediaries, modeled partly on Japan’s approach.
The authors are explicit about the limits of their work. The study is based mainly on policy texts and normative analysis, with insufficient empirical data on enterprise compliance costs, actual clinical effects or the long-term risk prevention performance of different regulatory models. It focuses on MAI under the medical device pathway, leaving in-hospital auxiliary AI systems outside its scope, and its treatment of cross-border services, cross-border data flow and international regulatory mutual recognition is preliminary. As a review of regulatory frameworks rather than an evaluation of deployed systems, it offers institutional design options, not evidence of outcomes. Its practical contribution lies in mapping which elements of the EU’s rule-based control, America’s predetermined change plans and Japan’s tiered, consultation-based flexibility might be combined into a system that lets medical AI keep learning without letting go of safety oversight.
Subject of Research: A comparative policy analysis of medical artificial intelligence regulation in China, the EU, the US and Japan, focused on algorithm change control and lifecycle oversight.
Article Title: Regulation of medical artificial intelligence in public health: governance lessons and implications for China
Article References: Zhao, J., & Chen, Q. (2026). Regulation of medical artificial intelligence in public health: governance lessons and implications for China. Frontiers in Public Health, 14, Article 1962331. https://doi.org/10.3389/fpubh.2026.1962331
Image Credits: AI Generated
DOI: 10.3389/fpubh.2026.1962331
Keywords: medical artificial intelligence, regulation, China, European Union, United States, Japan, algorithm change control, lifecycle oversight, medical devices, data governance, software as a medical device, public health
News Source: Ophelia Keating. (October 29, 2026). Medical AI Rules: China Weighs Lessons From EU, US, Japan. Scienmag.
We bring you the latest biotechnology news from best research centers and universities around the world. Check our website.
Enter your email address to subscribe to this blog and receive notifications of new posts by email.
Bioengineer.org © Copyright 2023 All Rights Reserved.
Login to your account below
Please enter your username or email address to reset your password.
Bioengineer.org © Copyright 2023 All Rights Reserved.
About the Author
