1. Guideline for Medical Device Cybersecurity
This guideline applies to the registration of medical devices related to cybersecurity, including Class II and Class III products that exist as software only and medical devices containing software (including in vitro diagnostic medical devices) with one or more of the following functions:
- Electronic data interchange
- Remote access and control
- User access
This applies for the registration of self-developed software and off-the-shelf software.
Main Concepts Involved
The main concepts include:
- Confidentiality
- Integrity
- Availability
- Authenticity
- Non-repudiation
- Accountability
- Reliability
Concerning Major Cyber-security Updates
Updates affecting the safety or effectiveness of medical devices are categorized as minor function updates and patch updates (controlled by the quality management system). There is no need to apply for the amendment of product registration. Corresponding documents will be submitted with any subsequent amendment applications.
Documentation for Product Registration Submission
The software cybersecurity research report must be separately provided in the original submission dossier related to software research materials. Additionally, descriptions and usage guidance related to cybersecurity must be included in the instructions for use.
2. Guideline for Medical Device Software Registration Review
Scope of Application
This guideline is applicable to the registration and application of medical device software, including Class II and III that exist as software-only products, as well as medical devices containing software (including in vitro diagnostic medical devices). It is applicable for the registration of self-developed software and off-the-shelf software.
Requirements for Software Research Materials for Product Registration
- Submit self-developed software research report.
- Provide an external software environmental assessment report (if applicable).
- Include a GB/T 25000.51 self-test report.
3. Guidelines for Registration and Review of AI Medical Devices
An AI medical device is defined as a medical device that uses artificial intelligence technology to achieve its intended medical use based on medical device data.
Product Registration Information Requirements
(A) Algorithm research data.
| Security Level | New Type | Mature Types |
|---|---|---|
| Medium, Severe | New type: Submit each artificial intelligence algorithm or combination research report | Basic algorithm information can be clearly defined without providing research materials |
| Mild | It is only necessary to specify the basic information of the algorithm |
(B) User training program:
In principle, a separate user training program should be provided for products of severity level intended for use by patients or in primary care institutions.
(C) Product technical requirements:
If the product contains performance indicators based on the test database, the basic information of the test database must be specified in the appendix.
Kindly refer to the three official NMPA Guidelines for more information on the topics outlined above:
- NMPA Guideline 1 - https://www.cmde.org.cn/index.html
- NMPA Guideline 2 - https://www.cmde.org.cn/CL0112/25221.html
- NMPA Guideline 3 - https://www.cmde.org.cn/CL0112/25219.html
Type Approval impacted: MEDICAL
Date of published: 04/27/22