Regulatory approval for Software and AI medical devices

Software as a Medical Device (SaMD) includes any device that incorporates software, even AI systems. SaMD is regulated similarly to how physical medical devices and drugs are regulated - that is by independent third party audit of compliance against applicable standards and legislation. The aim of medical device regulation is to ensure that products are safe, effective and cyber secure, and that they demonstrate a clinical benefit.

Regulation of software intended for a medical purpose is mandatory. It is a serious commitment, and non-compliance can lead to heavy fines, penalties as well as having your device taken off market.

Enforcement of medical device regulations varies by country.

In the UK, it’s the MHRA who have oversight of medical devices under the UK Medical Device Regulation.

In the EU, each country has it’s own Competent Authority, which ensures the EU MDR is complied with.

In America, the FDA have authority over medical devices under the Federal Food Drug & Cosmetic Act (FD&C Act).

Many other countries either have their own authorities, or accept regulatory clearances from the three major jurisdictions described above.

The approval process for SaMD varies between countries. 


In the UK, Approved Bodies conduct compliance audits for UKCA marking, after which you can register your device with the MHRA and on the PARD database.



In the EU, Notified Bodies conduct compliance audits for CE marking, after which you can register your device with the relevant Competent Authority, and on the EUDAMED database.



In the US, the FDA conduct compliance review centrally, and issue regulatory clearance or approval directly via one of three different pathways, and then place you on the relevant FDA database.



Common to all regulatory processes, you will need to develop a technical file (also known as a medical device file) which includes both technical documentation and clinical data to support your claims, and to demonstrate compliance with the applicable standards and legislation.

The length of time to gain regulatory approval can vary greatly depending on the type of device, its risk class, the jurisdiction you are applying in and whether you need to develop a Quality Management System.

Regulatory approval can be as short as a three to four months for low risk devices, or up to 18 months for higher risk devices.

Most EU Notified Bodies have a 12 month queue before they can audit your product.

In the US, the length of time to get an FDA clearance or approval can range from 90 days up to a year.

The amount of technical documentation required for a regulatory submission depends on the safety classification of your software medical device, as well as its complexity.

We’ve written a guide with a free cheat sheet to get you started.

Additionally, you will have to document your clinical evidence, which can include a full systematic literature review, Clinical Investigation Report and Clinical Evaluation Report.