Healthcare AI 2025

CHINA Law and Practice Contributed by: Gil Zhang, Diana Li, Muran Sun and Yongqi Tao, Fangda Partners

requirements of the Guiding Principles for Cyber - security Registration Review of Medical Devices (the “Guiding Principles for Cybersecurity Registra - tion”); and • production standards, where for standalone soft - ware, the Appendix to Guidelines for Quality Man - agement of Medical Device Production – SaMD (“SaMD Quality Management”) imposes specific controls (eg, separation of development/testing roles, record requirements, quality control). Regarding AI algorithm requirements, according to the Deep Learning-Assisted Decision-Making SaMD Review, algorithm design shall consider the quality control requirements for the following activities: algo - rithm selection, algorithm training, cybersecurity pro - tections and algorithm performance evaluation. As for continuous learning, according to the Guiding Principles for AMD Registration Review, the registra - tion applicant shall verify and validate the safety and effectiveness of self-learning updates under its qual - ity management system, apply for change registration where required and deploy such updates only upon obtaining NMPA approval. 2.5 Data Protection and Privacy China has not issued specific privacy and data pro - tection rules on the development and deployment of healthcare AI. Healthcare AI is still subject to general data protection legal requirements, including the PIPL, CSL, DSL and Network Data Security Management Regulations, etc. Where patient data or wearable device users’ personal data is to be used for AI model training and opera - tion, the following data processing activities should be carefully considered. • Collection and use: Developers and operators of AI-based medical devices must strictly adhere to the principles of lawfulness, legitimacy, necessity and data minimisation. Medical institutions should inform patients of the nature, function, and poten - tial risks of AI assistance with a clear explanation of the intended purpose and obtain necessary consent prior to treatment.

• Storage: Patients’ medical record data constitutes sensitive information and thus must be securely stored using encryption, access controls, audit logs, and other technical and managerial measures to ensure data security. • Sharing and cross-border data transfer (CBDT): Please see 6.3 Data Sharing and Access for details. • Anonymisation: Please see 6.4 De-Identification and Anonymisation for details. • Cybersecurity multi-level protection scheme (MLPS): Enterprises or medical institutions deploy - ing and operating on-premises AI diagnostic sys - tems must conduct pre-deployment security risk assessments and meet relevant MLPS obligations. Under China’s updated MLPS 3.0 (2025), health - care system operators are required to re-assess the grading of their systems based on the new grading standards and fill in the data inventory for systems above level 2. As the development of AI in the healthcare industry relies heavily on a large volume of sensitive patient data for training purposes, datasets composed of massive patient data or inferences drawn from com - prehensive analysis based on such data may poten - tially be recognised as “important data” when a cat - alogue of important data in the healthcare sector is released. Accordingly, this could in turn trigger obliga - tions such as data processing agreement drafting, risk assessments and annual reporting of important data processing activities, and graded classification and protection of important data. 2.6 Interoperability and Standards There is currently no technical standard specific to healthcare AI systems. Instead, applicable standards are scattered across national, industry, and group standards. While national standards mainly cover general cybersecurity and data protection, technical guidance pertinent to healthcare AI is largely found in industry and group-level standards. For GenAI systems that interact directly with patients – such as intelligent triage, virtual consultations or pre-diagnosis assistants – specific standards apply, including the following.

CHAMBERS.COM