Guest Column | June 13, 2025

Key Regulatory Landscapes For SaMD Around The World

By Dhandapani Nattarayan, Baxter Healthcare

Globe and Keyboard showing America-GettyImages-183795467

Over the past 25 years, the software development landscape has undergone significant transformations, driven by technological advancements and evolving business needs. From the rise of the internet and mobile technologies to the emergence of agile methodologies and cloud computing, the industry has been marked by rapid innovation. As the use of medical device software and software as a medical device (SaMD) grows, regulatory bodies around the world are evolving to keep pace with technological advancements and ensure patient safety. In this article, I’ll focus on the regulations around the world for SaMD.

FDA Regulations For Software As A Medical Device (SaMD)

FDA adopted the definition of SaMD from the International Medical Device Regulators Forum (IMDRF) as "software intended to be used for one or more medical purposes that perform these purposes without being part of a hardware medical device."¹

FDA also provided additional clarifications for SaMD:

Software as a Medical Device is capable of running on general purpose (nonmedical purpose) computing platforms.
Software as a Medical Device may be interfaced with other medical devices, including hardware medical devices, and other software as a medical device software, as well as general purpose software.
Mobile apps that meet the definition above are considered SaMD.

Examples that are not considered as SaMD:

Software that is used to "drive or control" the motors and the pumping of medication in an infusion pump.
Software required by a hardware medical device to perform the hardware's medical device intended use, even if sold separately from the hardware medical device.

Software that enables clinical communication and workflow, including patient registration, scheduling visits, voice calling, and video calling.
Software that provides parameters that become the input for Software as a Medical Device is not Software as a Medical Device if it does not have a medical purpose.²

FDA released the initial guidance documents for Premarket submissions for Software contained in Medical Devices in May 2005,³ and later the updated regulations, Content of Premarket Submissions for Device Software Functions,⁴ were released in June 2023 to keep pace with technological advancements of software.

FDA follows the traditional risk-based approach similar to medical device classifications (Class I, II, and III) for SaMD classification. Along with that, the FDA expects the medical device company or developer to follow 21 CFR 820, Quality system regulations and 21 CFR 11, Clinical evaluation and submission guidance based on the classification.

Additional standards/guidelines to follow for development of SaMD include:

IEC 62304: Medical device software — Software life cycle processes
SaMD – Clinical Evaluation⁵
SaMD – Cybersecurity⁶

EU Regulations For SaMD/MDSW

Under the previous EU Medical Device Directive (MDD), many SaMDs were classified as Class I. However, MDD was outdated, and it did not properly regulate the evolving medical devices and SaMDs. So, the European Union developed an entirely new set of regulations, the EU Medical Device Regulation (EU MDR), published in May 2017, which has significantly altered the classification of SaMD, moving many of them to higher risk classes.

This change means that many SaMD manufacturers, who previously relied on self-certification for Class I devices, now need to engage with a notified body for conformity assessment.

Per the new regulations (especially MDR rule 11 – Guidance on qualification and classification of software), medical device software is defined as follows:

“Medical device software (MDSW) is software that is intended to be used, alone or in combination, for a purpose as specified in the definition of a “medical device” in the MDR or IVDR, regardless of whether the software is independent or driving or influencing the use of a device”.⁷

Like the FDA, the EU follows the risk-based classification (Class I, IIa, IIb, and III) approach for SaMD and medical device software.

Software intended to provide information that is used to take decisions with diagnosis or therapeutic purposes is classified as Class IIa, except if such decisions have an impact that may cause: death or an irreversible deterioration of a person's state of health, in which case it is in Class III; or a serious deterioration of a person's state of health or a surgical intervention, in which case it is classified as Class IIb.
Software intended to monitor physiological processes is classified as Class IIa, except if it is intended for monitoring vital physiological parameters, where the nature of variations of those parameters is such that it could result in immediate danger to the patient, in which case it is classified as Class IIb.
All other software is classified as Class I.

Additional standards/guidelines to follow for the development of MDSW include:

MDCG 2020-1: Guidance on clinical evaluation (MDR)/Performance evaluation (IVDR) of medical device software
MDCG 2019-16 rev.1: Guidance on cybersecurity for medical devices
MDCG 2019-11: Qualification and classification of software - Regulation (EU) 2017/745 and Regulation (EU) 2017/746⁷
ISO 13485: Medical devices — Quality management systems
ISO 14971: Medical devices — Application of risk management to medical devices
IEC 62304: Medical device software — Software life cycle processes
IEC 62366: Application of usability engineering to medical devices.

Health Canada Regulations For SaMD

Health Canada adopted the SaMD definition from the IMDRF and considers software as a medical device when:

it is intended to be used for one or more medical purposes as outlined in the definition of device in the [Canadian Food and Drugs] Act, and
it performs these purposes without being part of a hardware medical device (i.e., it is not necessary for a hardware medical device to achieve its intended medical purpose).

Health Canada broadly categorized SaMD in two major categories: clinical decision support software (CDS) and patient decision support software (PDS). CDS software (intended for healthcare providers [HCPs]) and PDS software (intended for patients and caregivers who are not HCPs) can encompass a wide spectrum of software functionalities. The criteria for categorizing SaMD are:

intended to acquire, process, or analyze a medical image, or a signal from an in vitro diagnostic device or a pattern/signal from a signal acquisition system or imaging device,

intended for the purpose of supporting or providing recommendations to healthcare professionals, patients, or non-healthcare professional caregivers about prevention, diagnosis, treatment, or mitigation of a disease or condition.

Health Canda created a detailed guidance document (Guidance Document - Software as a Medical Device (SaMD): Definition and Classification) for SaMD classification. Manufacturers or developers need to follow those guidelines to determine the appropriate classification via self-assessment.

When a classification is unique and complex, Health Canada can assess the manufacturer's classification to verify its accuracy. In the event of a discrepancy between the manufacturer and Health Canada regarding the product or risk classification of a medical device, Health Canada reserves the right to make the final decision. The manufacturer, however, may request a reconsideration of this classification.⁸

National Medical Products Administration (NMPA) Regulations for SaMD In China

The National Medical Products Administration is directly under the State Council of the People's Republic of China, which is in charge of comprehensive supervision of the safety management of food, health food, and cosmetics and is the competent authority of drug regulation in mainland China.

NMPA’s definition of software as a medical product (SaMD) is:

“Software as a Medical Device (SaMD) is defined as software intended to be used for one or more medical purposes that perform these purposes without being part of a hardware medical device and operate on general purpose computing platform.”⁹

Similar to the FDA, NMPA follows the risk-based approach for classification of SaMD, ranging from Class I to Class III.

Like other countries, NMPA specifies a set of submission requirements for SaMD. Manufacturers need to submit the stand-alone software description report, a cybersecurity description report, and a software external environment assessment report.

Clinical trials are generally not required for low-risk SaMD, but they may be necessary for higher-risk SaMD, depending on the NMPA's classification and the product’s intended use.

CDSCO Regulatory Guidelines For SaMD In India

The main regulatory body for medical devices in India is Central Drugs Standard Control Organization (CDSCO), which operates under the Ministry of Health and Family Welfare. CDSCO ensures compliance with the Medical Device Rules, 2017, to maintain the quality, safety, and efficacy of medical products.

In February 2020, CDSCO released updated regulations and extended the scope. As per the new regulations, software is also considered a medical device if it is used for:¹⁰

Diagnosis, prevention, monitoring, treatment, or alleviation of any disease or disorder
Assistance for any injury or disability
Investigation, replacement or modification, or support of the anatomy or a physiological process
Supporting or sustaining life
Disinfection of medical devices
Control of conception

The manufacturer/developer must comply with the below regulations when marketing a SaMD in India:

Medical device definition: As per S.O. 648(E) released on February 11, 2020.
Medical Device Rule, 2017
ISO 13485: Medical devices — Quality management systems
ISO 14971: Medical devices — Application of risk management to medical devices
Post-market surveillance (PMS)
Clinical evaluation report

Conclusion

The world is evolving rapidly and advancements in medical technology are crucial for addressing patients’ medical needs. Recent technical advancements like artificial intelligence (AI), machine learning (ML), and the Internet of Medical Things (IoMT) are boosting medical software into new levels, and SaMD provides powerful new tools for doctors to make more informed decisions, analyze data, and remotely monitor patients’ health conditions. Also, it can directly help people through improved health management, early disease detection, and personalized care. The regulatory landscape across the world is evolving to keep pace with technological advancements in SaMD to ensure the devices’ efficacy, along with patients’ safety.

References

About The Author:

Dhandapani Nattarayan is a senior project manager with over 22 years of experience in the medical technology and automotive industries and is currently contracting with Baxter Healthcare. He has played a pivotal role in successful development of many medical devices for major U.S. medical companies. Also, he played a major role in successful completion of multiple regulatory programs, including EU MDR compliance and FDA compliance programs (test method validation and DHF remediation). He holds a bachelor of mechanical engineering degree from Bharthiar University, Coimbatore, India. For further inquiries, he can be reached at dhans3481@gmail.com.

This website uses cookies to ensure you get the best experience on our website. Learn more