--- title: "FDA 524B vs NMPA: Cybersecurity Compared" description: "United States vs China medical-device cybersecurity: SBOM, threat modeling, post-market and penalties side by side. NMPA is the largest reformat on the crossw" lang: en json-ld: | [ { "@context": "https://schema.org", "@type": "WebSite", "name": "The Medical Device Cybersecurity Crosswalk", "alternateName": "MDC Crosswalk", "url": "https://mdccrosswalk.com/", "description": "Compare FDA, EU MDR, MHRA, PMDA, NMPA, TGA, MFDS and Health Canada medical device cybersecurity requirements across 29 jurisdictions." }, { "@context": "https://schema.org", "@type": "Organization", "name": "MDC Crosswalk", "url": "https://mdccrosswalk.com/", "logo": "https://mdccrosswalk.com/favicon.png", "sameAs": [ "https://bluegoatcyber.com" ], "description": "An editorial reference comparing global medical-device cybersecurity regulations. Maintained by Blue Goat Cyber." }, { "@context": "https://schema.org", "@type": "Article", "headline": "FDA 524B vs NMPA: Medical Device Cybersecurity Compared", "description": "United States vs China medical-device cybersecurity: SBOM, threat modeling, post-market and penalties side by side. NMPA is the largest reformat on the crosswalk. FDA evidence stays useful, but Ch…", "about": [ "U.S. Food and Drug Administration, Center for Devices and Radiological Health", "National Medical Products Administration" ], "author": { "@type": "Organization", "name": "MDC Crosswalk" }, "publisher": { "@type": "Organization", "name": "MDC Crosswalk" }, "mainEntityOfPage": "https://mdccrosswalk.lovable.app/compare/fda-vs-nmpa" }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Can I run my Chinese device on a US-hosted cloud?", "acceptedAnswer": { "@type": "Answer", "text": "Generally no - PIPL and DSL push personal and 'important' data into Chinese-hosted environments, with CAC security assessment for cross-border transfers above defined thresholds." } } ] }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://mdccrosswalk.lovable.app/" }, { "@type": "ListItem", "position": 2, "name": "Compare", "item": "https://mdccrosswalk.lovable.app/compare" }, { "@type": "ListItem", "position": 3, "name": "FDA 524B vs NMPA" } ] } ] --- [ The Crosswalk ](/) [Overview](/)[Playbook](/playbook)CompareReference [New Per-page social previews and this changelog ](/changelog "Per-page social previews and this changelog") Search⌘K 1. [Home ](/) 2. [Compare](/compare) 3. FDA 524B vs NMPA Head to head # ![Flag of United States](/flags/us.svg) FDA 524Bvs ![Flag of China](/flags/cn.svg) NMPA United States and China medical-device cybersecurity, compared. Last updated · July 25, 2026 Share Copy link X LinkedIn Email Bottom line NMPA is the largest reformat on the crosswalk. FDA evidence stays useful, but China overlays MLPS 2.0 (cybersecurity classification), PIPL (personal information), DSL (data security), and data-localisation expectations that have no FDA analogue. Plan on ~45% reuse and a 9-12 month timeline. Who this is for · US sponsors evaluating the China market and how much extra work it costs. ## Where they differ Cyber framework ![Flag of United States](/flags/us.svg) FDA 524B §524B + SPDF. ![Flag of China](/flags/cn.svg) NMPA NMPA Cybersecurity Guidance + MLPS 2.0 + PIPL + DSL. Takeaway China stacks four regimes on top of the device rules. SBOM ![Flag of United States](/flags/us.svg) FDA 524B Mandatory. ![Flag of China](/flags/cn.svg) NMPA Expected for connected devices; format not yet standardised. Takeaway CycloneDX still works, but expect Chinese translation of component descriptions. Data residency ![Flag of United States](/flags/us.svg) FDA 524B No federal localisation rule. ![Flag of China](/flags/cn.svg) NMPA Personal & important data must be stored on Chinese servers. Takeaway Architecture decisions made for the US may force a re-deploy in China. [ Full profile ### ![Flag of United States](/flags/us.svg)United States FDA Premarket Cybersecurity Guidance & FD&C §524B Open profile ](/standards/fda)[ Full profile ### ![Flag of China](/flags/cn.svg)China Technical Review Guideline on Medical Device Cybersecurity (2022 rev.) Open profile ](/standards/cn) ## Frequently asked ### Can I run my Chinese device on a US-hosted cloud? Generally no - PIPL and DSL push personal and 'important' data into Chinese-hosted environments, with CAC security assessment for cross-border transfers above defined thresholds. ## Other head-to-heads [FDA 524B vs EU MDR](/compare/fda-vs-eu-mdr)[FDA 524B vs PMDA](/compare/fda-vs-pmda)[FDA 524B vs MHRA](/compare/fda-vs-mhra)[FDA 524B vs Health Canada](/compare/fda-vs-health-canada)[EU MDR vs MHRA](/compare/eu-mdr-vs-uk-mhra)[EU MDR vs PMDA](/compare/eu-mdr-vs-pmda)[EU MDR vs Health Canada](/compare/eu-mdr-vs-health-canada)[FDA 524B vs TGA](/compare/fda-vs-tga)[FDA 524B vs MFDS](/compare/fda-vs-mfds) Sponsored note · Blue Goat Cyber Submitting in both United States and China? Blue Goat Cyber has prepared cybersecurity evidence for both markets dozens of times. We'll map your existing package against both, in one 30-minute review. [Talk through your dual submission](https://go.bluegoatcyber.com/meetings/blue-goat-cyber/discovery-session) The Crosswalk An independent reference for global medical device cybersecurity standards. A field guide for MedTech innovators and RA/QA teams charting an international path. Resource - [Comparison matrix](/compare) - [Global playbook](/playbook) - [Glossary](/glossary) - [FAQ](/faq) Sponsored by [Blue Goat Cyber ↗](https://bluegoatcyber.com) Editorially independent. Sponsorship keeps it free. © 2026 The Crosswalk. Not legal advice. Validate every requirement against current regulator publications.