From Approving Products to Governing Systems: How the U.S. and China Are Rethinking Medical AI Regulation

Imagine a hospital using AI software to flag possible lung nodules on scans. On day one, the question seems simple: does it work, and is it safe enough to use? But six months later, the developer wants to update the model with new data, improve performance on different scanners, and reduce false alarms in certain patient groups. Now the real questions begin: can the model be changed without starting the approval process from scratch? Who checks whether the update still works for everyone? And if performance shifted over time, who would be responsible?

That is why medical AI regulation is changing. In both the United States and China, the conversation is moving beyond a one-time “Can this product enter the market?” mindset toward a broader “How do we govern this system over time?” approach. Recent FDA and National Medical Products Administration (NMPA) / Center for Medical Device Evaluation (CMDE) documents show that regulators are increasingly focused on lifecycle management, software updates, evidence quality, transparency, and the institutions needed to oversee AI after launch. U.S. Food and Drug Administration

At a Glance

One important caveat: these are not all the same kind of legal instrument. FDA guidances are nonbinding recommendations, while the Chinese package includes review guidances, official notices, and policy opinions. But together they still tell us something important: the center of gravity is shifting from approving a static product to governing a changing sociotechnical system. U.S. Food and Drug Administration

Why the Old Approval Model Is No Longer Enough

Traditional medical device regulation was built for products that are relatively stable. A device might be improved, but it usually does not keep changing its behavior through new data, retraining, or software updates in the same way AI systems can. FDA now openly says that its traditional paradigm was not designed for adaptive AI and machine learning technologies, and it also notes that the complex and dynamic processes behind AI benefit from careful, continuous management across the medical product lifecycle. U.S. Food and Drug Administration

In plain English, that means regulators are no longer asking only, “Did this model perform well at launch?” They are also asking, “How was it trained? What data shaped it? What are its limits? How will changes be validated? How will problems be found after release?” That is a much bigger governance question than a simple yes-or-no approval decision.

The FDA Route: From One-Time Approval to Total Product Lifecycle Oversight

The FDA’s recent approach is best understood as building a governance structure around the total product lifecycle. Its January 2025 draft guidance on AI-enabled device software functions says marketing submissions should include the documentation needed for FDA to evaluate safety and effectiveness, and that the recommendations reflect a comprehensive approach to managing risk throughout the device’s total product lifecycle. In other words, FDA is telling companies that AI regulation starts before launch and continues after launch. U.S. Food and Drug Administration

The clearest example is the FDA’s August 2025 final guidance on Predetermined Change Control Plans, or PCCPs. A PCCP lets a company describe in advance what kinds of AI-related modifications it expects to make, how those changes will be developed and validated, and how their impact will be assessed. FDA reviews that plan as part of the original marketing submission so that some future modifications can be implemented without a brand-new marketing submission every single time. That is not deregulation. It is regulation designed for a product that may need bounded, predictable evolution. U.S. Food and Drug Administration

FDA’s January 2026 final guidance on Clinical Decision Support adds another important layer. It clarifies that some decision-support software functions are excluded from the legal definition of a device, while software that still meets the definition of a device remains under FDA regulation. This matters because public discussion about medical AI often assumes every health-related AI tool falls into the same box. It does not. Part of governance is drawing the boundary between a regulated medical device and a tool that sits outside that category. U.S. Food and Drug Administration

Put together, the FDA model is becoming more structured and more explicit. It asks: what is the product, what evidence supports it, what changes are foreseeable, and which software functions are regulated in the first place? That is a more sophisticated system than a one-time review of a frozen product.

The China Route: From Review Guidance to System-Wide Regulatory Capacity

China’s path reaches the same destination through a somewhat different style. The foundation was laid earlier through technical review guidance. Official Chinese regulatory materials list the 2022 AI medical device registration review guidance and the 2023 clinical evaluation guidance for AI-assisted detection medical device software, showing that China has already built product-specific review expectations for medical AI. Beijing Drug Administration

What is especially telling is how Chinese review practice talks about evidence. Official CMDE technical review reports for AI products show applicants being asked to submit materials on data diversity, data labeling quality control, training-data-volume versus performance curves, algorithm performance evaluation, and analyses of factors that affect performance. That means the review is not just about a headline accuracy number. It is also about whether the model was built and tested in a way that reveals where it may fail. CMDE

Then came a broader shift. In July 2025, NMPA issued measures to support high-end medical devices across the full lifecycle, explicitly covering areas such as medical large models and AI medical devices. Official summaries of those measures say regulators will study management attributes and product categories for new AI-related functions and technologies. The same official notice also says NMPA will study guidance for multi-disease and large-model AI, simplify certain change-registration requirements when the core algorithm stays the same but performance is optimized, and explore the use of evaluation databases for AI medical device performance assessment. National Medical Products Administration

And China’s policy picture does not stop at device review. A seven-department 2025 digital transformation plan for the pharmaceutical industry calls for high-quality datasets and stronger data governance. Then, in April 2026, NMPA released its “AI + drug regulation” implementation opinion, which says that by 2030 China aims to form a basic “AI + drug regulation” operating mechanism with high-quality data resources to support smarter regulation. The official policy interpretation also says regulators will accelerate exploration of AI applications in review and approval and co-build review-and-approval large models and intelligent agents. This is a sign that China is thinking not only about regulating AI products, but also about building AI-enabled regulatory capacity inside the regulatory system itself. National Medical Products Administration

What Is the Real Difference?

My reading is that the U.S. approach is more modular and pathway-oriented, while the China approach is more layered and system-oriented. The FDA has focused on defining regulated software functions, refining what goes into a marketing submission, and creating mechanisms like PCCP so future modifications can be governed in advance. China is also developing technical review expectations, but it is pairing them with broader efforts in standards, data infrastructure, industrial digital transformation, and regulatory AI capability. U.S. Food and Drug Administration

That does not mean one system cares about innovation while the other cares about control, or that one is “ahead” and the other is “behind.” A better way to see it is this: both are trying to solve the same hard problem, but through different institutional styles. The U.S. is building a clearer device-governance toolkit around submissions, boundaries, and updates. China is building a broader governance architecture that links review, standards, data, industrial policy, and regulator modernization.

Why This Matters to Ordinary Readers

For patients, this shift matters because medical AI should not be judged only by how good version 1.0 looked on launch day. What matters is whether someone is watching the updates, the blind spots, and the long-term performance.

For clinicians, it matters because “AI in healthcare” is not one thing. Some tools are regulated medical devices. Some are not. Some can be updated within a pre-approved framework. Others may require a fuller review. Understanding those differences helps cut through hype and fear.

For companies, the message is even clearer: compliance is no longer just a filing exercise. It is a lifecycle strategy. Data quality, model limits, update plans, documentation, and post-market monitoring all increasingly belong in the same conversation.

Kaiyuan’s Thoughts

The most important regulatory shift in medical AI is not that governments are suddenly becoming more permissive. It is that they are becoming more realistic. They are starting to regulate medical AI as what it actually is: not just a product, but a changing system shaped by data, updates, clinical workflows, and institutional oversight.

That is why the real public question is no longer, “Should AI be allowed in healthcare?” The better question is, “Under what evidence, boundaries, transparency, and ongoing oversight should it be used?” On that question, both the FDA and China’s NMPA are moving in the same direction, even if they are taking somewhat different roads to get there.