This blog was originally posted on 3rd November, 2026. Further regulatory developments may have occurred after publication. To keep up-to-date with the latest compliance news, sign up to our newsletter.

AUTHORED BY NGUYEN NGUYEN, Regulatory Compliance Specialist, ADHERENT

---

Key Insight

What a regulator asks when an approved AI medical device is retrained or updated depends on where in Asia it is sold. In the six markets covered here, regulators differ on when a retrain needs a filing and on what evidence about local patients they expect. Several of these differences come from rules, guidance and drafts issued in mid- to late 2026. For manufacturers selling across several markets, they affect when and where retrains can be deployed.

Contents

• Planned Changes to a Screening Tool 
• When an Update Needs a Filing
• Where Local Patients Come In
• If Version 2 Adds an LLM
• What to Plan For
• Frequently Asked Questions

Planned Changes to a Screening Tool

Consider an imported AI screening tool that reads retinal photos and flags diabetic eye disease for referral. Its manufacturer trained the model on images from outside Asia and intends to retrain it every few months after approval. A later version would rely on a general-purpose large language model (LLM) to draft referral letters.

China’s 2022 guiding principles for AI medical devices expect self-learning, in which a deployed model keeps learning from user data, to stay out of clinical use. Their draft revision of 14 September 2026 would keep that position. Retraining that the manufacturer controls and releases as a new version counts instead as a software update. For this tool, the costs come from the filings each update needs and the evidence each market wants on its own patients. Version 2 would introduce the risks of a model the manufacturer does not control, such as vendor upgrades and false output.

When an Update Needs a Filing

The same retrain of the screening tool might require no filing in Taiwan but a new marketing authorisation in Indonesia. In certain markets, a plan agreed at approval can cover it in advance. Elsewhere, the regulator classes each retrain by its effect on performance.

Updates Agreed in Advance

Taiwan’s Artificial Intelligence Basic Act of 14 January 2026 leaves AI rules to each sector’s regulator. In the device sector, a change plan approved with the application allows the manufacturer to retrain without a new filing. AI devices have had this option since September 2024 when the Food and Drug Administration issued its guidance on predetermined change control plans. As long as the intended use and claimed effectiveness stay the same, a retrain inside the plan needs no change registration, even one that improves sensitivity. The manufacturer must still maintain records consistent with the plan and provide them on request, and under the guidance missing or mismatched records count as false documents, which the Medical Devices Act penalises.

The Ministry of Food and Drug Safety (MFDS) in South Korea accepts a plan mainly for retraining in real use that corrects a decline in performance or tailors the device to its users. Unless a plan covers it, a change to the analysis method has to be filed under the Enforcement Rules of the Digital Medical Products Act, as amended in January 2026. MFDS’s June 2026 guideline on change management plans gives retraining on added real-use data as an example of such a change that a plan can cover. In practice, the screening tool’s retrains would fit a plan most easily if the images come from clinics that use the device. Korean applications must state how often the training data is expected to be updated.

Minor and Major Thresholds

A change protocol in India does not relieve the manufacturer of a filing. The Guidance Document on Medical Device Software allows one in the risk management file, but each change made under it still needs approval or notification. The guidance counts re-tuning within validated ranges as a minor change, which the manufacturer only needs to report within 30 days under the Medical Devices Rules, 2017. But a design change that impacts performance needs approval before it goes out. Every retrain released in India therefore normally reaches the regulator as a notice or a request for approval.

China’s 2022 guiding principles and the September draft contain no change plan or protocol. A retrain that only adds data counts as major when its performance differs statistically from the last registered version, not from the previous retrain. This means three small retrains could cross that line together even if none of them would alone. The manufacturer would then need change registration, a new filing to update the licence. The draft would require it to report every change since the last registration in that filing.

A retrain that changes the tool’s accuracy or sensitivity could need a new izin edar, Indonesia’s marketing authorisation. Since 7 September 2026, Ministry of Health Decree HK.01.07/MENKES/951/2026 on software-based medical devices has required a new one whenever a change affects the indication, main function or clinical performance.

Where Local Patients Come In

Local Validation in Indonesia

Indonesia’s decree could oblige the manufacturer to test the screening tool on Indonesian patients once it is retrained on Indonesian images. The decree requires local clinical validation for imported AI of medium to high risk, especially in diagnosis or screening. It does not define that risk level for AI. Imported software retrained on data representing the Indonesian population needs local validation too, whatever its risk level. Before approval, the decree’s evidence table recommends a trial only for software that diagnoses or treats. The intended use, what the software actually does and what the manufacturer claims therefore decide together whether the decree recommends a trial. After approval, the manufacturer must deliver results within a year of the izin edar. The decree entered into force on signature with no transition period and says nothing about products already approved or applications still under review on 7 September 2026.

When Foreign Data Can Count

For the screening tool, China requests clinical trial evidence. That said, the 2022 guiding principles for AI medical devices let that evidence come from a comparable device’s trial or from a retrospective study. Software that recommends referral for diabetic retinopathy is Class III, as the 2022 registration review principles for diabetic retinopathy fundus image software state. China’s draft guideline on clinical trials for this software, dated 10 June 2026, would allow a single-arm trial (one group measured against a set accuracy target). Its sample-size example needs close to 700 patients. A foreign trial can count under China’s 2018 guideline on clinical trial data from outside China if its results apply to Chinese patients. The June draft makes the same point about ethnicity for imported software.

Foreign data can also support an application in India and South Korea if it applies to local patients. For a model trained or validated abroad, section 12.4.2 of India’s guidance says “justification shall be provided for applicability to Indian clinical environments” and asks for evidence on bias and robustness “across sub-populations relevant to India”. Approval in the EU, the US and other listed markets can exempt a device from a local clinical investigation under Rule 36. G.S.R. 744(E), which amended the Rules on 14 August 2026, extended a similar waiver to EU-approved devices new to India under the conditions of Rule 63. In Korea, the MFDS approval regulation permits the ministry to request data on Korean patients where ethnic factors make foreign data difficult to apply.

Subgroups and Models Trained Abroad

Subgroup analysis is required under one of ten principles of good machine learning practice, which Indonesia’s decree says manufacturers must apply. Taiwan’s principles on good machine learning practice for AI medical devices of 4 June 2026 list the same ten but let the manufacturer judge how far each applies to its product. Specifically, one of Taiwan’s ten covers how a model trained on foreign data performs for Taiwanese patients.

If Version 2 Adds an LLM

A general-purpose model that the device calls but does not need for its intended use would usually be a non-device function under China’s September draft. The instructions for use would name it and its version. A model the intended use depends on would be an off-the-shelf software component, which the technical requirements would describe. Either way, the manufacturer would need controls and user warnings for bias and for hallucination, where a model generates false output.

When the vendor upgrades the model, South Korea’s guideline of 30 June 2026 on devices built on LLMs treats the upgrade as a possible significant change. In the guideline’s own example, upgrading GPT-4 to GPT-5 is significant if core clinical performance falls outside the approved range or the intended use expands, but not if the settings are fixed and performance stays within range. Hallucination is also cited in Indonesia’s requirements for software-based devices and the MFDS approval regulation as a risk that the device file or its precautions for use must address.

Beyond device rules, Vietnam’s Law on Artificial Intelligence has applied since 1 March 2026. AI systems in health already in use by then have until 1 September 2027 to comply. Device registration still operates separately under Decree 98/2021/NĐ-CP. Decision 33/2026/QĐ-TTg on the list of high-risk AI systems names only systems that support surgery or run surgical robots as high-risk in health. Under Article 9 of Decree 142/2026/NĐ-CP, a system that does not interact with, or provide services or content directly to, the public is not medium risk. On that basis, version 1 would fall within that exclusion if only clinicians use it. Letters from version 2 that reach patients directly could make it medium risk if patients cannot tell the content is AI-generated and may be misled.

What to Plan For

If the model is retrained often, change registration in China and local validation in Indonesia are likely to take the most time. The rules point to the following steps in roughly the order a manufacturer would take them:

• Before freezing the design, decide if the LLM feature is essential to the intended use, since that can set how it is regulated.
• Settle the retraining cycle early and state it wherever a file requires one.
• In markets that accept a change plan, file it with the application and make sure the planned retrains fit what the plan can cover.
• Be ready to show that a model trained abroad works for local patients and their subgroups.
• Measure each retrain against the last registered version as well as against the previous retrain.
• Keep records that match the approved plan and cover every change since the last registration.
• Plan local validation before retraining on local data, which can bring the duty with it.
• Agree notice of model upgrades with the LLM vendor because the vendor’s upgrade can be a significant change to the device.

The obligations to file changes come from binding regulations, including India’s Medical Devices Rules, 2017 and the Enforcement Rules of South Korea’s Digital Medical Products Act. Several of these steps rely on guidance or draft documents, for example Taiwan’s change-plan guidance or China’s draft guideline on clinical trials. Indonesia’s Ministry of Health uses its decree as the reference when it reviews applications for marketing authorisation. At least one depends on a term that remains undefined, namely the level of AI risk that triggers local validation in Indonesia. Asking the regulator how it reads “medium to high risk” before submission may save you from having to defend your own reading during review.

Frequently Asked Questions

What Does Indonesia’s Decree on Software-Based Medical Devices Require?

The Ministry of Health Decree HK.01.07/MENKES/951/2026 requires documented controls for learning after approval and for generative AI as well as local clinical validation for certain imported software. Where clinical evidence for the Indonesian population is lacking, it points manufacturers to a clinical trial or a regulatory sandbox. It also expects authorisation holders to report after launch on complaints as well as on technical monitoring and clinical performance.

Does China Require a Clinical Trial for AI Diabetic Retinopathy Software?

Usually, for software that advises referral. China’s 2022 guiding principles for AI medical devices expect clinical trial evidence for decision-support functions, with retrospective studies counted as trials. A draft guideline of 10 June 2026, not yet final, places referral advice among those functions and allows a trial with one group measured against a set accuracy target.

Can Manufacturers Retrain AI Medical Devices in Taiwan Without a New Filing?

Yes, if the retraining falls within a predetermined change control plan approved by the Taiwan Food and Drug Administration. Under its September 2024 guidance, manufacturers can make changes covered by the plan without a separate change registration if the intended use and claimed effectiveness stay the same. They must retain records demonstrating compliance with the plan and provide them to the regulator on request. Changes outside the approved plan may require a new filing.

Is India’s Software Guidance Binding?

No. The guidance says in section 2.0 that it reflects current practices under the Medical Devices Rules, 2017 and “should not be misconstrued as a new regulatory control”. The binding duties remain in the Rules.

Does Complying with South Korea’s Digital Medical Products Act Cover the Framework Act?

Not entirely. The Enforcement Decree of the Framework Act on the Development of Artificial Intelligence and the Creation of a Foundation for Trust deems compliance with the Digital Medical Products Act to meet the specified duties for high-impact AI. The duties to tell users in advance and to mark generated output stay separate. Missing the notice can bring a fine of up to KRW 30 million once the Ministry of Science and ICT’s grace period of at least one year ends.

See Adherent in Action

Discover how agentic AI is reshaping product compliance for global enterprises.

BOOK A DEMO