On April 8, 2026, China's National Center for Adverse Drug Reaction Monitoring — operating under the authority of the National Medical Products Administration (NMPA) — released the Guidelines for Medical Device Registrants to Conduct Product Adverse Event Risk Assessment (2026 Revised Edition) (hereinafter the "2026 Guidelines"). Approved by the NMPA, the document marks the first significant revision to the original guidelines issued in November 2020 and signals a meaningful upgrade to China's post-market medical device risk management framework.
The 2026 Guidelines span five sections covering general requirements, assessment workflow, and product risk assessment reporting. They apply to all medical device registrants conducting adverse event monitoring activities within the People's Republic of China and may also serve as a reference for monitoring institutions reviewing submitted risk assessment reports. At the heart of the revision is a conceptual shift: the phrase "unreasonable risk" has been replaced throughout the document with "unacceptable safety risk" — language that aligns directly with the international risk management standard ISO 14971:2019. The update also sharpens accountability for registrants operating under China's Marketing Authorization Holder (MAH) system, adds new requirements for foreign registrant agent information, and restructures the workflow for triggering and completing risk assessments. For any company — domestic or international — that holds or is pursuing a medical device registration in China, the 2026 Guidelines are not optional reading. Regulix, a compliance services firm specializing in China medical device registration, recommends that all affected registrants initiate a gap assessment against the revised requirements without delay.
From "Unreasonable Risk" to "Unacceptable Safety Risk": Why the Language Shift Matters
The most consequential change in the 2026 Guidelines is a terminology update that runs through the entire document: every instance of "unreasonable risk" has been replaced with "unacceptable safety risk". While this may look like a copyediting tweak, it carries real regulatory weight. The prior language was criticized by practitioners for being too vague to apply consistently — leading to both over-reporting and under-reporting in practice. The new standard reflects the globally accepted principle embedded in ISO 14971:2019: risk cannot be eliminated entirely, but it can be managed to an acceptable level. The test is not whether a risk is "unreasonable" in the abstract, but whether it falls within what is defensibly tolerable. This shift brings China's medical device surveillance language into tighter alignment with FDA and EU MDR risk management frameworks.
2 Situations That Trigger a Mandatory Risk Assessment
The 2026 Guidelines set out two specific circumstances under which a registrant must initiate a formal product risk assessment:
Trigger 1 — Registrant-initiated. When a registrant, in the course of evaluating individual adverse event reports or conducting aggregate adverse event analysis, identifies that a product it holds may pose an unacceptable safety risk, it must proactively launch a product risk assessment. Notably, the 2026 revision eliminates "warning signal handling" as a standalone trigger — it has been folded into the broader "aggregate adverse event analysis" category. The intent is clear: regulators want companies to move away from reactive, signal-by-signal responses and toward systematic, data-driven risk surveillance.
Trigger 2 — Regulator-directed. Provincial-level or above monitoring institutions may, based on their own analysis of surveillance data, determine that a product poses an unacceptable safety risk and require the registrant to conduct a product risk assessment. Registrants must complete the evaluation within the allotted timeframe and ensure that all data and materials in the report are accurate, complete, and reliable. If the deadline cannot be met, the registrant must communicate with the relevant parties in advance and attach a written explanation of the delay to the final report.
6 Core Evaluation Steps: What Registrants Are Required to Do
The 2026 Guidelines spell out six core components of a compliant product risk assessment, providing a structured workflow for companies to follow:
Step 1 — Adverse Event Investigation and Verification. Registrants must conduct a thorough investigation of the reported event, searching domestic and international databases including China's National Medical Device Adverse Event Monitoring Information System, the FDA's MAUDE database, the EU's EUDAMED database, and the MHRA's alerts and recalls database. Relevant literature must be reviewed and summarized, with particular attention to identifying potential risk drivers.
Step 2 — Analysis of Monitoring Data and Literature. Registrants are required to systematically review adverse event data from both domestic and international sources and compare them. For devices marketed in multiple jurisdictions, establishing a unified data coding and mapping mechanism between domestic and overseas reporting systems is increasingly important.
Step 3 — Product Testing. Registrants may — but are not required to — conduct batch-specific product testing to determine whether the product meets its registered or filed technical requirements. If testing is conducted, the resulting test report must be submitted as an attachment to the risk assessment report.
Step 4 — Risk Analysis and Assessment. Registrants must conduct a comprehensive root-cause analysis spanning the full product lifecycle — design and development, manufacturing, distribution and storage, clinical use, maintenance, and after-sales service. The analysis should assess the probable causes of the product malfunction or patient injury, evaluate the overall impact on product safety based on adverse event frequency and injury severity, and determine whether warnings in the instructions for use are adequate and whether existing risk controls are sufficient. Expert consultation, whether internal or external, is encouraged where additional technical input is needed.
Step 5 — Risk Control. Where the assessment confirms the existence of an unacceptable safety risk, the registrant must implement effective risk mitigation measures without delay. Common measures include revising labeling, instructions for use, or operating manuals; modifying the manufacturing process, product design, or technical requirements; and suspending production or sales. The 2026 revision notably removes "recall" as a separately listed risk control option — not because recall is no longer available, but because it is now subsumed within the general risk control framework. Registrants are expected to select the appropriate response based on risk level rather than defaulting to recall as a first resort.
Step 6 — Report Preparation and Submission. The product risk assessment report must be written in Chinese and include a cover page (bearing the company seal), table of contents, main body, and attachments. The submission pathway depends on how the assessment was triggered: assessments initiated through the national adverse event information system are submitted electronically via that system; assessments self-initiated by the registrant that confirm an unacceptable safety risk must be submitted to the provincial monitoring institution in the registrant's home jurisdiction, which then forwards it to the National Center for Adverse Drug Reaction Monitoring after review.
What This Means for Foreign Registrants: Agent Information Now Required
One of the 2026 revision's more operationally significant changes for overseas companies is the addition of agent information requirements in risk assessment reports. The document consistently replaces the prior term "enterprise" (企业) with "registrant" (注册人), reinforcing that the primary compliance obligation rests with the legal holder of the registration — regardless of whether the product is self-manufactured or produced under a contract manufacturing arrangement. For foreign registrants relying on a China-based agent, clearly identifying that agent in adverse event reporting now carries explicit regulatory weight, enabling authorities and the public to quickly identify the responsible party when an adverse event occurs.
Regulix advises all registrants — particularly those operating under the MAH system or using a commissioned manufacturing model — to review current adverse event monitoring procedures against the 2026 Guidelines, update internal SOPs accordingly, and verify that agent information is accurately reflected in the national monitoring system. Post-market compliance in China is no longer a back-office function; it is an active, ongoing obligation with real enforcement exposure.
