Skip to content
Introduction
Software as a Medical Device (SaMD) has become a crucial component of modern healthcare, providing innovative solutions for diagnosing, monitoring, and treating diseases. However, Medical Device Regulations and Standards are often not well-tailored to software products and software development. In this blog, we will share some advice on how to understand Medical Device requirements in the context of Software as a Medical Device.
Compliance requirements in the UK and EU have deviated significantly over the past 4 years (since the UK left the EU) with the UK retaining the EU Medical Device Directive (with some changes and additions) and the EU moving on to the EU Medical Device Regulation; this article focuses on the UK perspective for SaMD, but 8fold can provide advice and guidance for the UK, EU, US and many other international markets.
What is Software as a Medical Device (SaMD)?
SaMD refers to software designed to perform medical functions without being integrated into a physical hardware device (which is known as Software in a Medical Device – SiMD).
According to the UK Medical Device Regulator (MHRA), SaMD includes software applications used for diagnosing, preventing, monitoring, or treating diseases. The key factor in determining whether software qualifies as a medical device is its intended purpose. The intended purpose directly impacts the software’s classification, as it defines the level of risk associated with its use and, consequently, the regulatory requirements it must meet.
Is my software SaMD?
The MHRA provides guidance on how to determine whether a piece of software qualifies as a medical device under UK regulations depending on what the software is intended to do (its Intended Purpose). If necessary, the MHRA will look at both what you’ve stated internally and in any submissions to them as well as marketing material associated with the product, so it’s important to make sure your marketing materials (such as your website, brochure, social media platforms or videos) don’t promise something your product isn’t intended to do.
The MHRA provides guidance on the requirements for software to comply with the UK Medical Device Regulations, including:
These guidance documents are informed and supported by international standards such as IEC 62304, ISO 13485 and ISO 14971.
- IEC 62304 defines the life cycle processes required for the safe design, development and maintenance of medical device software. By following this standard, manufacturers can manage software development, maintenance, and risk, ensuring the software functions as intended while reducing the chance of failures that could harm patients.
- ISO 13485 provides guidelines for building a QMS – a system designed to ensure that all processes in a company work together efficiently, with clear roles and responsibilities, making it easier to manage and continuously improve product quality while keeping patients safe.
- ISO 14971 outlines the risk management process for medical devices, including software. It ensures that all potential risks are identified, assessed, and mitigated throughout the product’s lifecycle.
Compliance with these standards is critical in ensuring the safety and effectiveness of the software and forms a key part of your Quality Management System (QMS). While this may sound daunting, you may find (especially with IEC 62304) that you are already meeting many of the requirements; after all, these requirements and standards are simply an accumulation of best practices for making a safe and effective medical device.
SaMD is viewed through the same lens as other Medical Devices, and stringent regulatory requirements are put in place to keep patients safe from dangerous or ineffective devices. These requirements provide a structured approach to the development, maintenance, and risk management of medical software, ensuring that potential hazards are identified and mitigated before, during and after release.
Need Help Building a QMS Compliant with these standards?
Medical Device Classifications.
In the UK (and EU), there are four classifications of Medical Devices, but only three classifications apply to SaMDs in the UK – Class I, IIa and IIb – the higher the number, the more risk. The UK and EU have different rules for classification, with the EU’s being significantly more stringent (especially for SaMDs).
Classification levels are based on the risks associated with the type of software and corresponding levels of oversight from regulators. Class I devices are low risk, allowing for self-certification, while Class IIa, IIb devices require third-party conformity assessments plus annual audits and surprise audits due to their higher risk profiles. The device’s intended purpose determines its classification and regulatory requirements.
The UK risk classifications are:
Class I
Class I SaMD is considered lower risk, supporting non-critical healthcare functions. Manufacturers can self-certify compliance but must still adhere to at least IEC 62304, ISO 13485 and ISO 14971. Postmarket surveillance and registration (either directly or through a UK Responsible Person) with the MHRA are also required to ensure ongoing product safety. Class I classification is determined by exclusion – If SaMD doesn’t fall into Class IIa or Class IIb, then it is Class I.
Class IIa
Class IIa SaMDs are moderate risk – controlling the delivery of low hazard energies for therapies or diagnosis or the delivery or removal of pharmaceuticals, imaging radiopharmaceutical distribution and diagnosing or monitoring physiological processes.
Class IIb
Class IIb are the highest risk SaMDs – controlling the delivery of hazardous energies (like neutron therapy) and controlling or monitoring active devices (like pacemakers).
Audits for Medical Devices Notified.
Audits are essential for verifying compliance with regulatory standards for Class IIa and IIb SaMD. Audits are conducted by Notified Bodies (for the EU and/or UK) or Approved Bodies (for UK only) and focus on the manufacturer’s quality management system, but also review the product’s technical file (including the Risk Management File), clinical evidence, and post-market surveillance. Regular post-market audits ensure continued compliance and address emerging safety concerns.
The Role of the Technical File in Conformity Assessment.
The technical file is a crucial part of the conformity assessment for SaMD, containing all documentation that demonstrates regulatory compliance for the SaMD. It includes records of the risk management process (following IEC 62304 and ISO 14971), software verification and validation, clinical evaluations, labelling, and post-market surveillance plans. The technical file must be reviewed and approved by a Notified/Approved Body before the release of a SaMD.
The Technical File must also be regularly updated (and for some product changes, re-approved) to maintain ongoing compliance.
How should AI-enabled Software as a Medical Device (AIaMD) ) be treated differently from other SaMDs?
All of the above information about SaMDs also applies to AI-enabled SaMDs, but there are specific considerations for AIaMDs.
Artificial Intelligence algorithms tend to be opaque – the method of their action is not just complicated but is by its nature (nearly) impossible to understand other than as a black box (by comparison of inputs and outputs). This means that explainability (to users and to regulators) is key in achieving compliance and ensuring patient safety.
When first working with an AIaMD, it is important to consider how the AIaMD might impact clinical practice, which means understanding how the developer has created and tested their algorithms. Risks related to AI algorithms include:
- Poor quality training and testing data – should be mitigated by a data plan or strategy.
- Bias the algorithm – should be identified and resolved by testing based on a thorough understanding of the biology and medicine behind the algorithm.
- Usability – should be examined by usability studies.
Developers of AIaMD developers should be able to provide information on how they addressed these risks as part of their Risk Management File and product technical file.
There are new guidelines and standards for managing AI in Medical Devices and healthcare in general as regulators and standards agencies get to grips with the state of the art in AI – we have an ongoing series of blogs identifying the latest in these documents.
AI algorithms in Medical Devices should be released in a fixed state – i.e. for one version of the SaMD, the outputs of the software should be the same each time you use it for the same inputs. The UK regulations do not allow for “Adaptive” algorithms in SaMDs, and changes to an AI algorithm in a Class IIa or IIb SaMD will likely require approval from your Notified/Approved Body before each release.
AIaMDs also fall under the EU AI Act in the EU and may fall under future UK AI regulations – which will add further requirements to the company’s QMS and product’s technical file to be reviewed by Notified/Approved Bodies.
Finding a route forward.
Understanding how Medical Devices Regulations apply to SaMDs and AIaMDs can be a minefield as most guidance is not tailored to Software; however, it is what we specialise in – get in touch if you’d like some advice about your SaMD or AIaMD product and what the fastest route to the UK, EU or US market is.
We’re the experts that have your back.
Let us help you find a route from from where you are, to where you need to go. We’re here to help.
