SaMD Classification and Conformity Assessment: A Comprehensive Analysis of UK and EU Regulatory Frameworks

I. Introduction

Software as a Medical Device (SaMD) is defined as “software intended to be used for one or more medical purposes without being part of a hardware medical device” (IMDRF, 2013). The regulation of SaMD presents unique challenges due to its intangible nature, rapid development cycles, and evolving technological capabilities, particularly with the integration of artificial intelligence (AI) and machine learning (ML) algorithms (Gerke et al., 2020). This document examines the classification systems and conformity assessment procedures for SaMD within both the European Union (EU) and United Kingdom (UK) regulatory frameworks, with particular attention to the divergence occurring post-Brexit.

II. Regulatory Framework Overview

A. European Union

The primary regulatory framework governing medical devices in the EU is the Medical Device Regulation (MDR) (EU) 2017/745, which became fully applicable on May 26, 2021 (European Parliament and Council, 2017). This regulation replaced the previous Medical Device Directive (MDD) 93/42/EEC and introduced more stringent requirements for clinical evaluation, post-market surveillance, and technical documentation. For SaMD specifically, the MDR clarified that software with a medical purpose falls within its scope regardless of its deployment method (cloud-based, installed locally, or mobile application).

Additionally, the forthcoming EU AI Act will introduce specific requirements for AI systems, including those incorporated in SaMD. This regulation will classify AI systems based on risk, with high-risk systems facing more stringent requirements (European Commission, 2021).

B. United Kingdom

Following Brexit, the UK established its regulatory framework through the Medicines and Medical Devices Act 2021, which provides the legal basis for the UK’s independent regulatory regime (UK Government, 2021). Currently, the UK Medical Devices Regulations 2002 (as amended) govern medical devices, including SaMD. These regulations initially mirrored the EU approach but are increasingly diverging.

The Medicines and Healthcare products Regulatory Agency (MHRA) serves as the UK’s regulatory body responsible for medical devices and has published specific guidance on software applications that qualify as medical devices (MHRA, 2023). The UK has also introduced the UK Conformity Assessed (UKCA) marking, which is replacing the CE marking for medical devices placed on the Great Britain market (MHRA, 2022a).

III. Classification of SaMD

A. EU MDR Classification System

The EU MDR classifies medical devices, including SaMD, into four risk classes: Class I (lowest risk), Class IIa, Class IIb, and Class III (highest risk). The classification is determined based on rules outlined in Annex VIII of the MDR. For SaMD, the key rules include:

1. Rule 11

Software intended to provide information used in diagnostic or therapeutic decisions is classified as:

• Class III if these decisions may cause death or irreversible deterioration in health
• Class IIb if these decisions may cause serious deterioration in health or surgical intervention
• Class IIa in all other cases

2. Rule 12

Software intended to monitor physiological processes is classified as:

• Class IIb if monitoring vital physiological parameters, where variations could result in immediate danger
• Class IIa if monitoring other physiological processes

3. Additional Rules

Other rules may apply depending on the specific functionality of the SaMD, such as Rule 15 for contraception and Rule 22 for active therapeutic devices with integrated diagnostic functions (European Parliament and Council, 2017).

B. UK Classification System

The UK system currently maintains a classification approach similar to the EU MDR, with devices categorized into Classes I, IIa, IIb, and III. However, the MHRA has signaled its intention to develop a more tailored approach to software and AI as medical devices, which may lead to further divergence in classification methodologies (MHRA, 2022b).

The MHRA has published specific guidance on software and AI as medical devices, which provides additional context for classification decisions in the UK context (MHRA, 2024). This guidance emphasizes factors such as the intended purpose, the significance of the information provided for clinical decision-making, and the healthcare context in which the software operates.

C. Classification Determination Factors

When determining the classification of SaMD, manufacturers must consider several factors:

1. Intended purpose: The stated medical purpose of the software
2. Significance of information: How the information provided by the software impacts clinical decisions
3. Healthcare situation or patient condition: The clinical context in which the software operates
4. Technological characteristics: The technical features and functionalities of the software
5. User profile: Whether the software is intended for use by healthcare professionals or patients

IV. Conformity Assessment Procedures

The classification of a SaMD determines the conformity assessment procedure that must be followed to demonstrate compliance with regulatory requirements.

A. Class I Devices

For Class I SaMD:

1. Self-assessment: Manufacturers can generally self-declare conformity, except for Class I devices with a measuring function (Im) or that are provided sterile (Is)
2. Technical documentation: Comprehensive documentation must be prepared in accordance with Annexes II and III of the MDR (EU) or equivalent UK requirements
3. Declaration of Conformity: A declaration attesting compliance with applicable requirements
4. Registration: The device must be registered with relevant authorities (MHRA in the UK, competent authorities in EU member states)

B. Class IIa Devices

For Class IIa SaMD:

1. Notified Body involvement (EU) or Approved Body (UK): Assessment of technical documentation for at least one representative device per generic device group
2. Quality Management System (QMS): Implementation of a QMS, typically in accordance with ISO 13485:2016
3. Clinical evaluation: Demonstration of clinical performance and safety, typically through literature reviews and clinical data analysis
4. Post-market surveillance: Implementation of a systematic procedure to collect and review experience gained from devices on the market

C. Class IIb and III Devices

For Class IIb and III SaMD:

1. Extensive Notified Body/Approved Body assessment: Full assessment of technical documentation for each device
2. Thorough clinical evidence: More comprehensive clinical evaluation, potentially including clinical investigations
3. QMS certification: Full certification of the QMS
4. Summary of Safety and Clinical Performance (SSCP): For Class III devices, a publicly available summary must be prepared
5. Stricter post-market surveillance: More rigorous post-market clinical follow-up and periodic safety update reports

D. UK-EU Divergence in Conformity Assessment

The UK and EU conformity assessment procedures are currently similar in structure but differ in several key aspects:

1. Conformity marking: UKCA marking for the UK market versus CE marking for the EU market
2. Responsible Person: Requirement for a UK Responsible Person for non-UK manufacturers versus an EU Authorized Representative for non-EU manufacturers
3. Assessment bodies: UK Approved Bodies versus EU Notified Bodies
4. Registration databases: MHRA registration system versus EUDAMED for the EU
5. Transitional provisions: Different timelines and arrangements for compliance

V. Special Considerations for AI-Based SaMD

AI-based SaMD presents additional regulatory challenges due to its potentially adaptive nature and complex functionality.

A. EU Approach

The EU MDR does not contain specific provisions for AI/ML-based SaMD. However, the European Commission has published guidance on the qualification and classification of software under the MDR (MDCG, 2019), which provides some considerations for AI-based software. Additionally, the forthcoming EU AI Act will introduce specific requirements for high-risk AI systems, including those used in healthcare (European Commission, 2021).

B. UK Approach

The MHRA has developed more explicit guidance for AI as a medical device, including:

1. Software and AI as a Medical Device Change Programme: An initiative to develop a tailored regulatory framework for software and AI-based medical devices (MHRA, 2022b)
2. AI Guidance: Specific guidance on the regulation of AI in medical devices, addressing aspects such as adaptivity, transparency, and continuous learning (MHRA, 2024)
3. Classification considerations: Additional factors to consider when classifying AI-based SaMD, with emphasis on the level of autonomy and transparency of the AI system (Taylor Wessing, n.d.)

C. Common Considerations

Both regulatory frameworks emphasize several key aspects for AI-based SaMD:

1. Data quality and representativeness: Ensuring training and validation data are appropriate and free from bias
2. Algorithm validation: Demonstrating the performance, accuracy, and reliability of AI algorithms
3. Explainability and transparency: Providing sufficient information about how the AI system works
4. Change management: Establishing procedures for managing algorithm updates and continuous learning
5. Performance monitoring: Implementing systems to detect performance drift in real-world use

VI. Practical Implications for SaMD Developers

A. Strategic Approach to Dual Compliance

Given the evolving divergence between UK and EU regulations, SaMD developers should consider:

1. Modular technical documentation: Structuring documentation to accommodate both regulatory frameworks
2. Parallel conformity assessment: Engaging with both UK Approved Bodies and EU Notified Bodies when required
3. Horizon scanning: Monitoring regulatory developments in both jurisdictions
4. Risk-based approach: Prioritizing compliance activities based on target markets and classification

B. Quality Management System Integration

A robust QMS is essential for SaMD development and should:

1. Incorporate software lifecycle processes: Integrate IEC 62304 requirements into the QMS
2. Address risk management: Implement ISO 14971 methodologies
3. Include usability engineering: Consider IEC 62366-1 for user interface design
4. Support regulatory compliance: Maintain procedures for monitoring and implementing regulatory changes

C. Post-Market Surveillance Considerations

Post-market activities are increasingly important for SaMD and should include:

1. Active data collection: Gathering real-world performance data
2. Performance monitoring: Tracking key performance indicators
3. Incident reporting: Maintaining vigilance systems for adverse event reporting
4. Update management: Procedures for handling software updates and determining regulatory implications

VII. Conclusion

The classification and conformity assessment of SaMD within the UK and EU regulatory frameworks represent a complex landscape that continues to evolve, particularly in the post-Brexit environment. While the fundamental principles remain similar, the divergence in implementation and specific requirements necessitates careful attention from manufacturers.

For SaMD developers, a thorough understanding of both classification systems and their implications for conformity assessment is essential. This understanding must be paired with robust quality management processes, comprehensive technical documentation, and diligent post-market surveillance to ensure ongoing compliance.

As the regulatory landscape continues to evolve, particularly with respect to AI-based SaMD, manufacturers must maintain vigilance and adaptability to navigate the increasingly divergent UK and EU approaches. By adopting a strategic, risk-based approach to regulatory compliance, SaMD developers can effectively bring innovative products to market while ensuring patient safety and regulatory conformity.

References

• European Commission. (2021). Proposal for a Regulation of the European Parliament and of the Council laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) and amending certain Union legislative acts. COM(2021) 206 final.
• European Parliament and Council. (2017). Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices, amending Directive 2001/83/EC, Regulation (EC) No 178/2002 and Regulation (EC) No 1223/2009 and repealing Council Directives 90/385/EEC and 93/42/EEC. Official Journal of the European Union, L117/1.
• Gerke, S., Minssen, T., & Cohen, G. (2020). Ethical and legal challenges of artificial intelligence-driven healthcare. In Artificial Intelligence in Healthcare (pp. 295-336). Academic Press.
• IMDRF. (2013). Software as a Medical Device (SaMD): Key Definitions. IMDRF/SaMD WG/N10FINAL:2013.
• IMDRF. (2025). Good Machine Learning Practice (GMLP) for Medical Devices (N88, 2025).
• International Electrotechnical Commission. (2006). IEC 62304: Medical device software – Software life cycle processes.
• MDCG. (2019). Guidance on Qualification and Classification of Software in Regulation (EU) 2017/745 – MDR and Regulation (EU) 2017/746 – IVDR. MDCG 2019-11.
• Medicines and Healthcare products Regulatory Agency. (2022a). Using the UKCA marking. Retrieved from https://www.gov.uk/guidance/using-the-ukca-marking
• Medicines and Healthcare products Regulatory Agency. (2022b). Software and AI as a Medical Device Change Programme. Retrieved from https://www.gov.uk/government/publications/software-and-ai-as-a-medical-device-change-programme
• Medicines and Healthcare products Regulatory Agency. (2023). Medical devices: software applications. Retrieved from https://www.gov.uk/government/publications/medical-devices-software-applications-apps
• Medicines and Healthcare products Regulatory Agency. (2024). Software and artificial intelligence (AI) as a medical device. Retrieved from https://www.gov.uk/government/publications/software-and-artificial-intelligence-ai-as-a-medical-device/software-and-artificial-intelligence-ai-as-a-medical-device
• Taylor Wessing. (n.d.). UK approach to regulating AI in Life Sciences. Retrieved from https://www.taylorwessing.com/de/synapse/2025/ai-in-life-sciences/uk-approach-to-regulating-ai-in-life-sciences
• UK Government. (2021). Medicines and Medical Devices Act 2021. Retrieved from https://www.legislation.gov.uk/ukpga/2021/3/contents/enacted