Software as a Medical Device (SaMD) is software that functions independently of any hardware device and is intended for medical purposes. SaMD is not the same as SiMD, which is firmware embedded into a physical device.
Image Credit: elenabsl/Shutterstock.com
Navigating the SaMD regulatory pathways is one of the most complex yet important aspects of product development for medical technology startups.
Startups in this field are required to meet local regulatory expectations, for example, the European Union’s Medical Device Regulation (EU MDR), or the U.S. Food and Drug Administration (FDA) requirements, as well as aligning with international frameworks such as the International Medical Device Regulators Forum (IMDRF).
Innovation must go hand in hand with regulatory discipline. In the rapidly expanding digital health sector, ensuring compliance across these jurisdictions is key to ensuring patient safety, investor confidence, and market access.
Understanding SaMD and global frameworks
The IMDRF’s SaMD framework
The IMDRF defines SaMD as “software intended to be used for one or more medical purposes that perform these purposes without being part of a hardware medical device.”
This definition has been established to provide a strong foundation for global harmonization, enabling regulators across regions to interpret and categorize software consistently.
The IMDRF’s SaMD framework incorporates three key principles:
- Risk-based categorization, whereby SaMD is classified according to its intended purpose and the provision of relevant information to inform healthcare decisions
- Clinical evaluation, where developers are required to demonstrate clinical validity, analytical validity, and clinical performance
- Life cycle management, whereby SaMD requires continuous evaluation and control throughout its entire life cycle, ranging from design to post-market monitoring
The principles outlined by the IMDRF have been adopted by many regulators, including the FDA, the EU, and Japan’s PMDA. Early alignment with IMDRF guidance can help to streamline multi-region approvals and reduce rework in the later stages of development.
The FDA’s SaMD regulatory pathway (United States)
SaMD products are regulated as medical devices in the United States in line with the FDA’s risk-based framework. SaMD classifications span Class I to III, depending on the related level of patient risk.
The primary pathways for U.S. market entry include:
- 510(k) clearance for moderate-risk devices that show significant equivalence to a predicate
- De Novo classification for novel devices with low to moderate risk where there is currently no predicate in existence
- Premarket Approval (PMA) for high-risk, novel applications that necessitate the collation of substantial clinical evidence
FDA’s guidance, such as “SaMD: Clinical Evaluation” and its risk categorization framework, has been created directly on IMDRF principles.
The Digital Health Center of Excellence is currently working on a range of ongoing initiatives, including guidance on cybersecurity expectations and AI/ML-based software.
Submissions generally require robust evidence of effectiveness, safety, and effective cybersecurity management.
The FDA also applies enforcement discretion to some low-risk health and wellness applications, easing regulatory requirements for developers of software that has minimal impact on patients.
This trend includes aspects such as Predetermined Change Control Plans (PCCPs) and the developing area of Notified Body (NB) scrutiny.
Clinical expectations vary between different regulatory bodies. For instance, the FDA only requires clinical data when it is required by risk of claims, while the EU’s Medical Device Regulations (MDR) require a CER, and typically ask for Post-Market Clinical Follow-up (PMCF) for each individual SaMD.
EU MDR Compliance for SaMD (Europe)
The EU’s Medical Device Regulation (MDR 2017/745) has significantly increased software compliance requirements in Europe.
Rule 11 now categorizes the majority of standalone diagnostic or therapeutic software into Class IIa, IIb, or III, depending on its potential risk and intended use. While it was once common under the old MDD, this reclassification means that self-certification is now rare.
There are several key steps to achieving MDR compliance. These include:
- Determination of qualification and classification, including a successful verification of the software’s medical purpose and the application of Rule 11 to establish its risk class
- Preparation of technical documentation, including clinical evaluation, risk management (ISO 14971), usability evidence (IEC 62366), and cybersecurity measures
- Assessment of conformity, including working with a Notified Body to perform review and certification (this step is mandatory for Class IIa software and above)
- Post-market surveillance (PMS), including the implementation of appropriate systems for continuous monitoring, vigilance reporting (such as PMCF studies), and software updates
It is essential to note that new EU developments, such as extended transition timelines for legacy devices, do not apply to new SaMD, as these are required to meet MDR requirements immediately.
The IMDRF and other international pathways
Many countries and regions outside of the U.S. and EU also align their SaMD frameworks with IMDRF principles. For instance:
- Australia and Canada follow risk-based approaches much like those outlined by the IMDRF
- Japan’s PMDA has a tiered approval and post-market control structure
- China’s NMPA maintains a distinct approval process, but it has adopted IMDRF-aligned definitions
Companies can develop a unified regulatory strategy by maintaining global consistency through IMDRF-aligned categorization.
Keeping informed is essential for long-term compliance planning as the IMDRF continues to refine its guidance, particularly in terms of rapidly evolving areas like AI and adaptive algorithms.
Practical advice for navigating multiple pathways
Strategic foresight and cross-functional collaboration are required to successfully navigate multiple regulatory systems. MedTech startups can implement a number of practical steps to reduce friction in this area, including:
- Designing for dual compliance by generating documentation and evidence that simultaneously satisfies both FDA and MDR requirements.
- Engaging with regulators or consultants at the earliest opportunity can help prevent misclassification, which continues to be one of the most common and expensive mistakes.
- Implementing a robust QMS ensures adherence to IEC 62304 for software lifecycle management and ISO 13485 for quality systems.
- Maintaining traceability by ensuring that every requirement is linked, from design through to testing and risk management.
- Partnering with experts, by working with reputable organizations like RQM+ that specialize in supporting SaMD developers to navigate the nuances of both the FDA and EU MDR processes, as well as ensuring alignment with effective regulatory and business strategies for efficient market entry.
- Early engagement with regulations, such as early FDA Q-Submissions and early interactions with Notified Bodies, can help prevent misclassification and the need for rework.
Conclusion and future outlook
An early, integrated approach is required to successfully navigate SaMD regulatory pathways, particularly one that embeds compliance into product development.
Companies that use IMDRF’s risk framework should perform thorough evaluations of their clinical and cybersecurity capabilities, proactively planning for post-market obligations to position themselves for success throughout global markets.
AI/ML regulations and real-world evidence requirements are reshaping expectations around digital health as part of a dynamic and evolving regulatory landscape.
Regulatory literacy and agility are as important as technical excellence for innovators, and successfully aligning innovation with compliance is key to both accelerating approvals and fostering trust with patients, clinicians, and investors.
MedTech startups can transform regulatory complexity into a competitive advantage by combining informed strategy with the right partnerships.
Acknowledgments
Produced from materials originally authored by Christine Scheve from RQM+ Corp.
About RQM+
Two industry leaders - R&Q and Maetrics - merged in 2020 to become RQM+, the largest medical device and diagnostics-focused full-service regulatory and quality consulting firm in the world. The integration of our leadership teams and the extensive skills and experience of our collective resources have created a highly agile and scalable global organization.
With offices in the United States, United Kingdom, and Switzerland, our large global footprint allows us to meet the regulatory and quality support needs of international clients of all sizes.
Order an Audit
Sponsored Content Policy: News-Medical.net publishes articles and related content that may be derived from sources where we have existing commercial relationships, provided such content adds value to the core editorial ethos of News-Medical.net, which is to educate and inform site visitors interested in medical research, science, medical devices, and treatments.