Medical Device Sourcing from China: Regulatory Basics

Medical device sourcing from China is legal, but the device must be authorized for your market before it ships: FDA clearance or approval in the US; a valid CE mark under the Medical Device Regulation in the EU; an NMPA registration for sale inside China. The factory's paperwork decides what you can import, not the price list.

Classification is the single biggest decision. Each market sorts devices into risk classes, and the class determines the pathway: required testing, notified body or FDA involvement, your duties as importer. Get it wrong and everything downstream sits on a false foundation.

This guide covers classification under the FDA, EU MDR, and China's NMPA; the pathways (510(k), PMA, CE marking, NMPA registration); ISO 13485; factory audit checks; and importer duties. A sourcing agent like CN Ally earns its place finding suppliers whose certifications cover your device. This article is informational, not regulatory advice.

How are medical devices classified in the US, the EU, and China?

All three systems classify devices by risk, but the classes and their consequences differ. The US FDA uses three classes, the EU MDR four, China's NMPA three. The table shows how they line up.

Risk level · US FDA · EU MDR 2017/745 · China NMPA

• Low: Class I — most devices exempt from premarket review; general controls apply · Class I — manufacturer self-certification, except sterile, measuring, and reusable surgical instruments, which need a notified body · Class I — filing (备案) at the provincial level; streamlined
• Moderate: Class II — 510(k) premarket notification showing substantial equivalence to a marketed "predicate" device · Class IIa — notified body required (quality management system certification plus technical documentation assessment) · Class II — registration certificate from the provincial NMPA
• Medium-high: (covered by FDA Class II) · Class IIb — notified body required; stricter conformity assessment for implantable IIb devices · (covered by NMPA Class II)
• High: Class III — Premarket Approval (PMA), FDA's most rigorous review · Class III — notified body scrutiny of design and manufacturing · Class III — registration certificate from the national NMPA in Beijing

Bandages and examination gloves sit at the low end; infusion pumps, diagnostic ultrasound devices, and blood pressure monitors in the middle; pacemakers, heart valves, and implantable defibrillators at the top.

Two cautions: classes don't map one-to-one across markets — a US Class II device may be Class IIb or III under the MDR, and NMPA classification follows China's own catalogue. And certificates expire: NMPA registrations for Class II and III devices run five years.

Which regulatory pathway applies: 510(k), PMA, CE marking, or NMPA registration?

It depends on the device's class in the target market. A 510(k) shows substantial equivalence to an already marketed predicate device; a PMA is the FDA's full safety-and-effectiveness review; CE marking under the MDR needs a conformity assessment, usually with a notified body; NMPA registration needs in-country testing and technical review.

Pathway · Applies to · What it proves · Who issues it

• **510(k) premarket notification**: Most FDA Class II devices (and some Class I) · Substantial equivalence to a predicate device · FDA clears the device
• **De Novo classification**: Novel low-to-moderate-risk devices with no predicate · A new device can be safely classified without a predicate · FDA grants the request
• **PMA (Premarket Approval)**: FDA Class III devices · Safety and effectiveness through full clinical and scientific review · FDA approves the device
• **CE marking under MDR**: All devices placed on the EU market, with notified body involvement for Class IIa and above · Conformity with EU safety and performance requirements · Notified body certifies; manufacturer affixes the mark
• **NMPA registration**: Class II and III devices sold in China (Class I uses filing) · Compliance with Chinese standards after local testing and technical review · Provincial NMPA (Class II) or national NMPA (Class III)

In practice: a device needing a 510(k) or PMA cannot legally enter the US until clearance is in place, and the entry filing must reference the submission number or the shipment can be detained. Under the MDR, new devices must comply since May 2021; legacy devices get transition deadlines into 2027–2028, but only if the manufacturer has already applied to a notified body and signed a contract — see TÜV SÜD's MDR FAQ. For China, an imported device generally needs home-country approval before NMPA registration. Each market's authorization stands alone.

Why is ISO 13485 the baseline for any Chinese supplier?

ISO 13485:2016 is the international quality management standard written specifically for medical devices — design controls, production controls, traceability, corrective and preventive action, post-market surveillance. Every major regulator expects it, and it is now effectively US law: FDA's Quality Management System Regulation took effect in February 2026, incorporating ISO 13485:2016 into 21 CFR Part 820 and replacing the older Quality System Regulation.

For sourcing, the signal is direct: if a factory's documentation still references only the old QSR framework, confirm it has transitioned. Under the MDR, most conformity routes also require a certified QMS, and a factory without ISO 13485 can rarely support a serious export program for regulated markets.

When reviewing a certificate, check scope, validity dates, and the certification body — then verify the certificate number with that body. A PDF alone is not proof; certificates can be forged, mis-scoped, or expired. Verify before any money moves.

What should a factory audit check before you commit?

Verify that the paperwork matches the product: certification scope covers this device, market authorization covers this exact model, and the quality system actually operates on the floor. Desk-reviewed documents can look perfect while the factory tells a different story.

A focused audit for a medical device supplier should cover:

1. ISO 13485 certificate — scope, validity, accredited certification body; cross-check the certificate number with the body.
2. Market authorization for your device — the 510(k) K-number, the CE certificate with the notified body's four-digit number, or the NMPA registration for this exact model. A clearance for a similar product does not count.
3. Technical documentation and Declaration of Conformity — current, with the product description matching the labeling.
4. Labeling and UDI — correct languages and claims, UDI carrier where the target market requires it, traceability from finished device back to batch records.
5. Manufacturing reality — cleanroom class where relevant, calibration, incoming inspection, batch records that are actually filled in.
6. Post-market systems — complaint handling, adverse event reporting, recall procedures. Ask about the last complaint and see how fast they produce the record.
7. Subcontractors and OEM relationships — who makes critical components, and whether the factory is the legal manufacturer or a trading front. Certificate names and factory names must agree.

This is the stage importers most often skip — and the one where factory audits pay for themselves. A day on the ground answers questions months of email cannot.

What responsibilities do you carry as the importer?

In both the US and the EU, the importer is a legally responsible economic operator, not just a buyer. You must verify compliance before placing the device on the market — "the factory told me it was fine" is not a defense.

Duty · United States · European Union (MDR Article 13)

• **Who must be on file**: Foreign manufacturer registers its establishment with FDA and lists devices; designates a US Agent as FDA's point of contact. The initial importer — the US party that first receives the device — must also register annually. · Non-EU manufacturer must appoint an EU-based authorized representative. The importer is a defined economic operator alongside the manufacturer, authorized representative, and distributor.
• **What to verify before import**: Required premarket clearance or approval exists and the entry filing references the correct submission number; labeling and UDI requirements are met. · CE marking is present and valid; the EU Declaration of Conformity exists; the authorized representative is designated; labeling is correct; UDI is assigned where applicable.
• **Ongoing duties**: Medical Device Reporting, post-market surveillance, complaint files; establishment registration renewed every year. · Keep a register of complaints and non-conforming devices; cooperate with competent authorities; inform the manufacturer and authorized representative of risks.
• **What happens at the border**: FDA screens entries through the Automated Commercial Environment (ACE); shipments with missing registration, listing, or clearance can be detained and refused admission. · Market surveillance authorities can withdraw non-compliant devices; distributors and importers must verify compliance before making devices available.

One surprise: selling under your own brand can make you the legal manufacturer under the MDR. Private-label importers should confirm their regulatory status with a specialist before printing labels — and remember that FDA clearance does not place a device on the EU market.

How does China's NMPA fit into your sourcing plan?

Even for export-only sourcing, the NMPA matters: the factory must hold valid domestic manufacturing and business licenses. An unlicensed operation cannot legally manufacture, whatever it promises online — ask for both.

Selling into China is a separate project. Class I devices go through a filing (备案); Class II needs a registration certificate from the provincial NMPA; Class III from the national NMPA. Foreign manufacturers must appoint a China-based legal agent who carries real post-market responsibility: adverse event reporting, official communications, defending the dossier under reviewer questioning. A pure trading company is a poor fit.

Expect in-country testing even with a full FDA and CE portfolio: NMPA typically requires an accredited Chinese laboratory to test electrical safety, EMC, biocompatibility (implants), and sterilization validation. This NMPA registration overview notes certificates run five years and clinical evaluation is part of the process, though a full trial is not always mandatory. Build the timeline into your product plan rather than discovering it after launch.

What are the common pitfalls when sourcing medical devices from China?

Almost every failed sourcing project traces back to paperwork that looked right and wasn't:

• Misclassification by the supplier. Factories sometimes self-declare a lower class to avoid notified body or FDA review. Classification follows your market's rules, not the supplier's opinion — trusting the factory is not a legal defense.
• A "CE certificate" that isn't certification. A test report, or a certificate from a body that is not a designated notified body, does not place a device on the EU market. Check the four-digit notified body number against the official NANDO database.
• An ISO 13485 certificate that doesn't cover your device. Scopes are specific — a certificate for general molding does not certify medical device manufacturing. Verify scope, dates, and the issuing body.
• No EU authorized representative. A non-EU manufacturer must have one; without it, the device cannot legally be placed on the EU market, however valid the CE certificate.
• Private labeling without realizing you became the manufacturer. Your brand on the box can shift the full regulatory burden onto you under the MDR.
• UDI and labeling gaps found at customs. FDA screens US entries electronically; wrong data detains compliant devices as readily as non-compliant ones. Check labeling and entry data before goods leave the factory.

Frequently asked questions

Can I import medical devices from China into the US without FDA clearance?

No — not if the class requires it. A device needing a 510(k) or PMA cannot be imported until clearance or approval is in place, and the entry filing must reference the submission number. Even exempt Class I devices need establishment registration, device listing, a US Agent for the foreign manufacturer, and UDI on labels. Missing any of these can detain a shipment.

Is a Chinese manufacturer's CE certificate enough to sell in the EU?

Only with a valid CE mark under the MDR, notified body involvement where the class requires it, an EU authorized representative, a Declaration of Conformity, correct labeling, and UDI. Ask for the certificate number and the notified body's four-digit identifier, and verify both — a certificate proves nothing until checked.

What is the difference between ISO 13485 and a 510(k)?

ISO 13485 certifies the manufacturer's quality management system — how consistently it designs and produces devices. A 510(k) is the FDA's premarket clearance for a specific device. A factory can hold ISO 13485 with no FDA-cleared products; a cleared device should still come from a factory with a working quality system.

Do I have to register with the FDA as an importer?

The initial importer — the US party that first receives the device from abroad — must register its establishment with FDA and renew annually. The foreign manufacturer must separately register, list its devices, and designate a US Agent. Gaps in these records are a common reason shipments stall at the port.

How can I verify a supplier's NMPA registration?

Ask for the registration or filing certificate number and check it in the NMPA's public database. Confirm it covers your exact model — not a similar line — and that it is within its validity period (five years for Class II and III). Also confirm the factory holds NMPA manufacturing and business licenses.

Who is liable if a device I import fails or harms a patient?

As the importer, you carry independent legal responsibility in both the US and the EU — regulatory duties plus commercial and civil exposure if a device causes harm. How liability splits between you and the factory is for contracts and specialists to decide. Get professional advice before you ship.

Your sourcing decision rule

Work through these in order, and do not skip ahead to price negotiation until step five is done:

1. Classify the device in each target market. Use each regulator's rules separately; never assume one market's class predicts another's.
2. Confirm the pathway and who owns it — 510(k), PMA, CE marking, NMPA registration — and whether you or the manufacturer obtains and maintains it.
3. Shortlist only factories whose authorizations cover the device. ISO 13485 scope, 510(k) K-numbers, CE certificates, NMPA licenses — all for your exact product.
4. Audit before you commit. Certificates, production floor, subcontractors, complaint records. Factory audits and ongoing quality control are where compliant sourcing gets verified.
5. Appoint your regulatory pieces before signing. US Agent, EU authorized representative, China legal agent — these take weeks and cannot be backfilled after shipment.
6. Verify labeling and UDI before the goods leave. Customs screening in the US is electronic and unforgiving of data gaps.

Medical device regulation is unforgiving of shortcuts, but navigable with the right sequence: classify, verify, audit, then buy. Rules change and edge cases abound, so get professional advice for your specific device before ordering. If you need help finding and vetting compliant factories in China — qualification, audits, production monitoring — email hi@cnally.com or use our contact page.