China's revised device GMP takes effect as Mexico tightens AI software rules

China's new quality rules take effect

China's revised medical device GMP took effect on 1 November 2026. It landed about six weeks after the NMPA published two draft guidelines in mid-September 2026.

One covers AI medical devices. The other covers clinical evaluation of AI multi-disease auxiliary decision-making devices. Asian Hospital & Healthcare Management reads the pair as a layered system: a horizontal lifecycle and algorithm framework, plus vertical clinical evaluation rules for complex products.

The gate is registration. AI software that diagnoses, triages or guides treatment counts as a medical device. It must be registered with the NMPA before it can be sold or used in hospitals.

There is a second gate, and it is separate. Medical AI must also comply with the Personal Information Protection Law, the Data Security Law and the Cybersecurity Law. Miss either gate and the launch stalls, according to Asian Hospital & Healthcare Management. For developers, clearance is now a documentation exercise as much as a technical one. Algorithm records, clinical evaluation and data compliance all have to be in place before a hospital can buy.

Mexico sorts AI by risk

Mexico's legal basis is older and narrower. The Ministry of Health published edition 5.0 of the Medical Devices Supplement of the Mexican Pharmacopoeia, known as the FEUM, in May 2023. That edition expanded the definition of a medical device to include software.

Under Rule 16 for active devices, software that provides information for diagnostic or therapeutic decisions is Class II. So is software that monitors physiological processes. It becomes Class III when an incorrect decision could cause death, serious or irreversible harm, or the need for surgery. All other software is Class I.

"We need to regulate more, and the Ministry of Health is working on broader regulation for medical devices," said Víctor Hugo Borja, Federal Commissioner at COFEPRIS, in October 2026. Borja named AI and self-learning systems as the regulatory challenge. He said their use has grown since 2024.

Until that regulation appears, one document does the work. The working reference is the SaMD appendix the FEUM Permanent Commission put to public consultation in 2022. It asks for a definition statement setting out each product's intended use, plus two categorization factors.

Three layers of evidence

Mexico's evidence requirements come in three layers, according to Mexico Business News. The first is a valid clinical association: the software's output must be scientifically grounded.

Then analytical validation. It shows the software reliably produces the intended output from its inputs. Then clinical validation, confirming the output is clinically meaningful for its intended use, both before and after market release.

Clinical validation can use existing data, extrapolated data or new studies. Design and development must follow a systematic process based on standards such as IEC 62304. Any software change needs risk assessment, traceability and verification and validation before release. For AI products, that change-control provision also covers model updates.

China's technical file asks for similar material in different words. It lists intended use, algorithm design, version and performance metrics, and training, validation and test data with sources, size, labeling and population.

Most Chinese diagnostic AI lands in Class III

A 2026 analysis of AI approvals through June 2025 counted 154 approvals since 2020. Annual approvals rose from 9 in 2020 to 45 in 2024. Of those, 79.9% were Class III, the strictest route.

Classification decides the reviewer, the route and the timeline. AI-assisted diagnosis software falls under classification code 21-04-02. Foreign manufacturers cannot register directly with the NMPA. They must appoint a legal agent in China.

Since March 2022 the NMPA has defined an AI medical device as one built on medical device data and using AI technology to fulfil its intended purpose. A general wellness chatbot is not automatically a device. But once software claims to diagnose, detect, triage or recommend treatment, expect NMPA scrutiny.

Registration is not the same as approval

The US Food and Drug Administration states that a registration entry "does not denote approval, clearance, or authorization of that facility or its medical devices". It also states that it "does not issue any type of device registration certificates to medical device facilities".

What is still missing is the final text. Mexico's broader regulation is still in preparation, and China's two documents remain drafts.