Is an AI medical consultation product necessarily non-compliant?
The words “AI consultation” do not decide compliance. Health-information retrieval, pre-visit questionnaires, structured history, and clinician draft assistance differ from diagnosing a patient, changing medication, or prescribing. China's internet-diagnosis rules state that AI software must not impersonate or replace the treating physician and must not generate prescriptions automatically. Patient-facing AI therefore needs firm limits on medical conclusions; licensed medical institutions and physicians provide and own actual diagnosis and treatment.
Calling a product a “wellness assistant” does not change what it does. If symptoms produce a disease probability, dose, or definitive instruction not to seek care, it may go beyond general education. Clinician-side summarization is not automatically safe either: the physician still verifies source, omissions, and errors. Software with a medical purpose may also require medical-device classification, which should be confirmed under the regulator's rules for the specific product.
When translating compliance duties into evidence and controls, also compare What governance duties apply to a platform where users can post and transact? and Why avoid fully automated scraping or replies on 1688, Taobao, JD.com, and Xiaohongshu?; the linked guidance adds context that should be considered in the same decision.
| Output | User | Main risk | Boundary |
|---|---|---|---|
| Reviewed health knowledge | Public | Stale material or education mistaken for diagnosis | Show source, scope, and care advice; no individualized diagnosis |
| Symptom and history intake | Patient and clinical staff | Missed emergency, leading questions, excessive sensitive data | Organize information and route emergencies; do not claim diagnosis |
| Record or communication draft | Physician | Fabrication, copied error, unclear responsibility | Physician checks source and approves the formal record |
| Clinical decision support | Clinical staff | Advice changes care and creates automation reliance | Define medical purpose, evidence, validation, intended population, classification |
| Patient diagnosis or treatment | Patient | Delayed care, medication harm, licensing | Only through a compliant clinical service with a responsible physician |
| Automatic prescription | Patient or pharmacy | Medication without physician review | Prohibited under the cited internet-diagnosis rules |
Define who uses the output, the input and intended purpose, where it enters the clinical workflow, and the harm of failure. Summarizing ten pages for confirmation differs from flagging an image or telling a patient to take a drug. Whether the output enters a record, changes a prescription, serves minors, or covers emergencies determines supervision, institutional requirements, validation, and possible device regulation; a disclaimer cannot resolve these facts.
The National Health Commission's Trial Rules for Internet Diagnosis and Treatment Supervision require regulated institutions and practitioners, prohibit AI from replacing the physician, prohibit automatically generated prescriptions, and require termination and offline referral where internet care is unsuitable. The system therefore needs explicit referral rather than letting a model answer every case. The NMPA's medical-device classification service is the formal route when classification is unclear.
Medical evaluation measures more than fluent language. Target-specialty clinicians create cases covering common and rare conditions, contradictions, missing facts, medication and allergy, pregnancy, children, older adults, self-harm, and emergencies. Track factual errors, dangerous omissions, unjustified certainty, unsafe medicine, missed referral, unsupported citation, and privacy leakage. Give severe errors a launch-blocking threshold rather than averaging them into overall accuracy. Record physician edits, rejection, and approval and rerun tests after model or knowledge changes.
Use deterministic safety rules and human routes for emergencies defined by the medical partner and jurisdiction. A model confidence is not a clinical probability. Collect only necessary sensitive data and define the roles of institution, Wavesteam, and model supplier, including training use, location, subprocessors, and deletion. Separate clinical and operational access and keep unnecessary full records out of logs.
Wavesteam first works with the medical institution, clinical owner, counsel, and device-regulatory specialist to classify the intended product. We can build intake, retrieval, physician approval, referral, audit, and evaluation tools. We will not disguise clinical output as “for reference only” or expose a general model to patients as a physician substitute.