Navigating the UK Medical Device Regulations for Software as a Medical Device

The Evolving Landscape of SaMD Regulation in the UK

The healthcare sector is increasingly reliant on Software as a Medical Device (SaMD) to enhance diagnostics, deliver therapies, and monitor patient health.¹ As the UK forges its regulatory path following its departure from the European Union, the landscape for medical devices, including SaMD, is undergoing significant transformation.

The UK Medical Device Regulations 2002 (UK MDR 2002) are being amended to reflect a future regulatory framework, with key changes slated to come into effect in 2025 and beyond.² These regulatory updates necessitate a thorough understanding and proactive adaptation from manufacturers to ensure uninterrupted access to the Great Britain market.² This article aims to provide a comprehensive, up-to-date guide to the regulation of SaMD in the UK post-Brexit.

Defining Software as a Medical Device (SaMD)

To establish a clear understanding of the regulatory scope, it is essential to define Software as a Medical Device (SaMD).

According to the International Medical Device Regulators Forum (IMDRF) and the US Food and Drug Administration (FDA), SaMD is software intended to be used for one or more medical purposes that perform these purposes without being part of a hardware medical device.¹ A fundamental aspect of this definition is the manufacturer’s intended purpose, which ultimately determines whether software qualifies as a medical device.⁵

It is crucial to distinguish SaMD from Software in a Medical Device (SiMD). While SaMD operates independently, SiMD is embedded software that functions within or controls a hardware medical device.¹ Examples of SaMD are diverse and include mobile applications for viewing medical images, artificial intelligence (AI)-powered software for diagnostic support, and digital therapeutics designed to treat medical conditions.¹ Within the UK regulatory framework, the Medicines and Healthcare products Regulatory Agency (MHRA) plays a vital role in interpreting and regulating SaMD, with a dedicated Software Group focused on ensuring the safety and compliance of such technologies.⁷ Therefore, while international definitions provide a foundation, understanding the MHRA’s specific interpretations and the manufacturer’s clearly defined intended use are paramount for navigating UK regulations.

Key Changes Introduced by the UK Medical Device Regulations 2025 for SaMD

The future regulation of medical devices in the UK is being implemented through a phased approach, with legislation enacted in 2024, 2025, and 2026.² This staged rollout allows manufacturers time to adapt to the evolving requirements. A significant aspect of these changes involves enhanced Post-Market Surveillance (PMS). Legislation in 2024, which will come into force on 16 June 2025, introduces detailed requirements for PMS systems, emphasizing methods for data collection and harmonization across manufacturers.² Manufacturers will face enhanced obligations for reporting serious incidents, facilitating earlier detection of safety issues.² Furthermore, clearer responsibilities regarding Field Safety Corrective Actions (FSCA) and the issuance of Field Safety Notices (FSN) are being established to better inform at-risk patients and users.² More stringent periodic reviews of PMS data, particularly for implantable devices, will be required to support the early identification of trends impacting device safety.²

In terms of pre-market regulations, legislation in 2025 and 2026 will introduce several key changes. Certain software as a medical device may be subject to up-classification, leading to more rigorous pre-market scrutiny.² A Unique Device Identifier (UDI) will be mandated for all devices, potentially replacing the physical UKCA mark.² Technical documentation requirements will be strengthened, with a specific focus on incorporating cybersecurity considerations for SaMD, including those utilizing artificial intelligence.² The UK is also establishing a framework for international reliance, now termed “international reliance,” which aims to expedite market access for devices already approved by comparable international regulators such as the EU, USA, Canada, and Australia.² Additionally, new requirements will ensure that claims made by manufacturers about their medical devices align with their stated intended purpose.² Overall, the future regulations aim for greater alignment with EU Essential Requirements, particularly in areas like cybersecurity for AI-powered SaMD.²

Updated Conformity Assessment Pathways for SaMD and the UKCA Mark

Demonstrating compliance with the UK MDR 2002 and obtaining the UKCA mark for the Great Britain market necessitates navigating the established conformity assessment processes.¹⁷ As SaMD falls under the definition of a medical device, it is subject to these procedures.¹⁷ The specific conformity assessment route that a manufacturer must undertake is determined by the risk classification of the medical device.¹⁷ For Class I devices, a self-declaration of conformity is generally sufficient, although devices with sterile products or a measuring function require assessment by a UK-approved body.¹⁷ Class IIa devices necessitate both a declaration of conformity and a conformity assessment by an approved body.¹⁷ Class IIb devices require either a full quality assurance system audit or a type-examination, along with certain assessment options available for Class IIa devices.¹⁷ For the highest-risk Class III devices, manufacturers must undergo either a full quality assurance system audit including a design dossier examination or a type-examination combined with specific assessment options.¹⁷ Upon successful completion of the relevant conformity assessment and receipt of the necessary certifications from a UK-approved body (where required), the UKCA mark can be affixed to the medical device.⁹ A signed declaration of conformity is also mandatory before the UKCA mark can be placed on the product.¹⁷ It is important to note the potential future removal of the physical UKCA mark in favor of a Unique Device Identifier (UDI).⁹ For the Northern Ireland market, CE marking remains mandatory, and compliance with EU rules is still required.¹⁷ In cases where a UK notified body is used for mandatory third-party conformity assessment for devices intended for Northern Ireland, a UKNI mark may also be required in addition to the CE mark.¹⁷

The SaMD Regulatory Pathway in the UK: A Detailed Overview

The journey to regulatory compliance for SaMD in the UK involves a series of interconnected steps. The initial stage requires a thorough assessment to determine if the software meets the definition of a medical device based on its intended purpose.⁵ Following this, the SaMD must be classified according to the UK MDR 2025 classification rules, which will be discussed in greater detail later.¹³

Establishing a robust Quality Management System (QMS) that aligns with the requirements of ISO 13485:2016 is essential.¹⁷ Furthermore, the software development lifecycle processes should adhere to the principles outlined in IEC 62304.¹ Comprehensive technical documentation must be prepared to demonstrate the safety and performance of the SaMD. This documentation should encompass details of the design and development processes, a thorough risk management assessment, and comprehensive validation data.² For SaMD specifically, the technical documentation should reference the Software Development Lifecycle Processes as per IEC 62304, alongside detailed verification, usability data, and evidence pertaining to data security considerations.¹⁵

Based on the classification of the SaMD, the appropriate conformity assessment procedure must be undertaken.¹⁷ This may involve engaging with a UK-approved body for independent assessment. Upon successful completion of the conformity assessment, the UKCA mark must be affixed to the SaMD, and a declaration of conformity must be signed. Subsequently, the SaMD needs to be registered with the MHRA before it can be placed on the UK market.²¹ Finally, a robust Post-Market Surveillance (PMS) system must be established and maintained to continuously monitor the performance and safety of the SaMD once it is available on the market.²

Leveraging International Standards: ISO 13485 and IEC 62304 for UK SaMD Compliance

International standards play a crucial role in facilitating compliance with the UK MDR for SaMD.

ISO 13485:2016 serves as an internationally recognized model for a Quality Management System (QMS) within the medical device industry.¹⁷ Its acceptance as the foundation for UKCA marking under the UK MDR 2002 underscores its importance.¹⁹ Adherence to ISO 13485 helps manufacturers demonstrate compliance with a wide range of regulatory requirements.¹⁹

Similarly, IEC 62304:2006+AMD1:2015 CSV is an international standard that specifies the requirements for the lifecycle processes of medical device software.¹ It provides guidance on the development, maintenance, and risk management of software used in medical devices, including SaMD.¹ Regulatory bodies worldwide, including the UK MHRA, acknowledge IEC 62304 as a dependable framework for creating safe and effective medical device software.²⁰ The standard outlines five key processes: software development, software maintenance, software risk management, software configuration management, and software problem resolution.¹ IEC 62304 also employs a software safety classification system with three levels: Class A (no injury possible), Class B (non-serious injury possible), and Class C (serious injury or death possible).¹ The requirements of ISO 14971, which focuses on risk management for medical devices, are closely linked to those of IEC 62304, particularly in areas such as analyzing software contributions to hazardous situations and implementing risk control measures.¹ Integrating IEC 62304 with a QMS based on ISO 13485 is a recommended practice for achieving comprehensive compliance.²⁰ It is important to note that IEC 62304 is currently undergoing updates to better align with advancements in software, AI, and evolving regulatory frameworks, with the publication of the updated standard anticipated in 2026.²³

Clinical Investigations for SaMD under the New UK MDR

Clinical investigations may be necessary to demonstrate compliance with the UK MDR 2002, especially for SaMD that falls into higher risk categories or when sufficient evidence of safety and performance is lacking.¹⁷ For medical devices that are not already UKCA or CE marked for the specific purpose under investigation, manufacturers must notify the MHRA of their intention to conduct a clinical investigation at least 60 days prior to commencement.¹⁷ The notification to the MHRA requires the submission of detailed information, including an application form, an investigator’s brochure, a clinical investigation plan or protocol, an ethics committee opinion, and proof of insurance coverage.²⁴ Following the submission of a valid application, the MHRA undertakes a 60-day assessment period to evaluate the safety and performance aspects of the device and the design of the proposed clinical investigation.¹⁷ For clinical investigations involving devices that do not yet have UKCA or CE marking, the study must be designed to verify the device’s performance characteristics under normal conditions of use and to identify and assess any undesirable side effects against the intended performance.²⁵ Furthermore, manufacturers are obligated to continuously update their clinical evaluation with data obtained from post-market surveillance activities. This may necessitate conducting a Post-Market Clinical Follow-up (PMCF) study in various situations, such as when the device incorporates new technology, is intended for a sensitive patient population, or poses well-known risks.²⁵ It is also important to be aware of the ongoing overhaul of clinical trial regulations in the UK, with new regulations expected to come into force in early 2026, which may have implications for the conduct of clinical investigations for SaMD.²⁶

Registration Requirements for Placing SaMD on the UK Market Post-2025

Before placing any medical device, including SaMD, on the market in Great Britain, manufacturers are legally required to register it with the MHRA.¹⁸ For manufacturers located outside the UK, this registration process must be facilitated by their appointed UK Responsible Person (UKRP).¹⁸ The registration is completed online through the MHRA’s Device Online Registration System (DORS).²² The information required for registration includes proof of the UKRP’s appointment (if applicable), the manufacturer’s legal details, the type of device, the specific regulations to which the device conforms (e.g., UK MDR 2002), the Global Medical Device Nomenclature (GMDN) code, the device’s classification, its sterility and implantable/active status, whether it is custom-made, evidence of conformity assessment (such as a UKCA mark or a CE mark during the transitional period), and the device’s name, model, and catalogue numbers.²¹ Transitional arrangements are in place that allow CE-marked medical devices to continue being placed on the Great Britain market for defined periods beyond 30 June 2023. For general medical devices compliant with the EU MDD or EU AIMDD, this period extends until the earlier of the certificate expiry or 30 June 2028. For in vitro diagnostic medical devices (IVDs) compliant with EU IVDD, the deadline is the sooner of certificate expiry or 30 June 2030. General medical devices (including custom-made) compliant with the EU MDR and IVDs compliant with the EU IVDR can be placed on the Great Britain market until 30 June 2030.² A registration fee is applicable, and the registration needs to be renewed annually for the first year and every two years thereafter.²¹ It is important to note that for the Northern Ireland market, only CE marking is accepted, and registration requirements may differ.²¹

Enhanced Post-Market Surveillance (PMS) Requirements for SaMD

The UK MDR 2025 introduces significant enhancements to post-market surveillance (PMS) requirements, which will come into force on 16 June 2025, through The Medical Devices (Post-market Surveillance Requirements) (Amendment) (Great Britain) Regulations 2024.² These new regulations mandate that manufacturers establish detailed PMS systems, including robust methods for collecting and analyzing data related to the quality, performance, and safety of their devices, incorporating feedback from patients and the public.² There will be stricter obligations for reporting serious incidents and for implementing Field Safety Corrective Actions (FSCAs) ², with shorter timelines for reporting serious incidents.⁹ Manufacturers of certain classes of devices will be required to prepare Periodic Safety Update Reports (PSURs), providing a comprehensive assessment of the device’s benefit-risk balance. The frequency of these reports will depend on the device’s classification.⁸ A robust vigilance system for reporting adverse incidents related to SaMD is also essential.⁷ This includes reporting any malfunctions, deteriorations, or inaccuracies that could potentially lead to harm.⁸ The MHRA will be providing updated guidance on reporting, including specific information for software as a medical device, and changes to submission processes are expected in early 2025.¹¹

Classification of SaMD under the UK MDR 2025: Aligning with International Frameworks

The UK’s regulatory framework for medical devices is currently based on the former EU Directives.³ However, the UK MDR 2025 will bring about changes in the classification of several types of devices, including an increase in the class of certain software as a medical device, aligning with the classifications used by the International Medical Device Regulators Forum (IMDRF).² The MHRA has confirmed its adoption of the IMDRF risk categorization for SaMD, mapping IMDRF Categories I, II, III, and IV to UK MDR Risk Classes I, IIa, IIb, and III, respectively.¹³

This aligns with the principles of EU MDR classification under Rule 11, which classifies software intended for diagnosis or therapy as Class IIa or higher based on the potential impact of the information provided. Software intended for monitoring physiological processes is generally classified as Class IIa, unless it monitors vital parameters where changes could pose immediate danger, in which case it is Class IIb. All other software typically falls under Class I.¹³ It is anticipated that under the new UK rules, many SaMD products that are currently self-certified as Class I will be reclassified as Class IIa or higher, leading to increased regulatory requirements.⁴ This higher classification will necessitate greater involvement of UK-approved bodies in the conformity assessment process.¹⁷

Cybersecurity Considerations for SaMD in the UK Regulatory Context

Cybersecurity is an increasingly critical aspect of the regulatory landscape for SaMD, given the growing prevalence of cyberattacks in the healthcare industry.¹ The UK MDR 2025 aims to bring the essential requirements for medical devices in Great Britain into closer alignment with those of the EU, which includes robust cybersecurity requirements for both SaMD and AI-powered medical devices.² The MHRA’s dedicated Software Group plays a crucial role in ensuring the safety and regulatory compliance of SaMD and AIaMD, including addressing cybersecurity concerns.⁷ The MHRA plans to publish specific guidance on cybersecurity for SaMD in the second quarter of 2025.⁹ Furthermore, guidance on the development and deployment of AI in medical devices, which will likely encompass cybersecurity considerations, is also anticipated.⁹ While not a direct UK requirement currently, the concept of a Software Bill of Materials (SBOM), which provides an inventory of third-party software components, is gaining traction internationally as a means to enhance SaMD cybersecurity.¹ It is therefore crucial for manufacturers to integrate cybersecurity considerations early in the design and development lifecycle of their SaMD products.¹

International Recognition and Reliance for SaMD Market Access in the UK

To facilitate quicker access to the UK market for medical devices, the UK is introducing a framework for international recognition, now referred to as “international reliance”.² This framework aims to recognize approvals from comparable international regulatory authorities (CRCs), which currently include the EU, USA, Canada, and Australia.³ Specific eligibility criteria apply based on the device’s risk class and the regulatory approval pathway in the CRC.¹⁴ While this initiative intends to streamline market access, certain devices may be excluded. Notably, SaMD products, including those utilizing AI, that do not meet MHRA’s intended purpose guidelines or those approved in the US via a route relying on equivalence to a predicate device (510(k)) are excluded from this pathway.¹⁶ Manufacturers seeking to utilize the international reliance framework will likely need to submit a dossier, evidence of approval in the CRC, and a post-market surveillance plan along with associated reports to the MHRA.¹⁶

Conclusion: Navigating the Future of SaMD Regulation in the UK

The UK’s regulatory landscape for Software as a Medical Device is undergoing significant changes with the implementation of the UK MDR 2025. Key updates include enhanced post-market surveillance requirements, the potential for up-classification of certain SaMD, an increased focus on cybersecurity, and the introduction of an international reliance framework that, while promising, has limitations for certain SaMD products. It is imperative for SaMD manufacturers to remain well-informed about these evolving regulations and to proactively adapt their processes and documentation to ensure continued compliance and access to the UK market. Manufacturers should consult the official guidance documents published by the MHRA and other relevant resources from organizations like ISO and IEC for the most detailed and up-to-date information.

Table: UK MDR 2025 Implementation Timeline for SaMD Relevant Aspects

Works cited

1. SaMD: Software as a Medical Device [The Ultimate Guide] – Greenlight Guru, accessed on April 2, 2025, https://www.greenlight.guru/blog/samd-software-as-a-medical-device
2. Implementation of the future regulations – GOV.UK, accessed on April 2, 2025, https://www.gov.uk/government/publications/implementation-of-the-future-regulation-of-medical-devices/implementation-of-the-future-regulations
3. UK MHRA 2024-2025 Medical Device Regulation Plan – Casus Consulting, accessed on April 2, 2025, https://casusconsulting.com/uk-mhra-2024-2025-roadmap-of-medical-device-regulation/
4. Update on regulatory change for software-based medical devices, accessed on April 2, 2025, https://www.penningtonslaw.com/news-publications/latest-news/2025/update-on-regulatory-changes-for-software-based-medical-devices
5. Software as medical device: definition and classification, accessed on April 2, 2025, https://blog.johner-institute.com/iec-62304-medical-software/software-as-medical-device-definition-and-classification/
6. Beyond the Acronyms: Understanding SaMD and SiMD – Mantra Systems, accessed on April 2, 2025, https://www.mantrasystems.co.uk/articles/understanding-samd-simd-beyond-the-acronyms
7. MHRA Guidance on Software and AI as a Medical Device – RegDesk, accessed on April 2, 2025, https://www.regdesk.co/mhra-guidance-on-software-and-ai-as-a-medical-device/
8. The Medical Devices (Post-market Surveillance Requirements) (Amendment) (Great Britain) Regulations 2024: guidance on implementation – GOV.UK, accessed on April 2, 2025, https://www.gov.uk/government/publications/medical-devices-post-market-surveillance-requirements/the-medical-devices-post-market-surveillance-requirements-amendment-great-britain-regulations-2024-guidance-on-implementation
9. Regulating medical devices – The MHRA’s plans for 2025 – Stevens & Bolton LLP, accessed on April 2, 2025, https://www.stevens-bolton.com/site/insights/articles/regulating-medical-devices-the-mhras-plans-for-2025
10. PMS Statutory Instrument + MHRA Guidance released | Regulatory update – QbD Group, accessed on April 2, 2025, https://www.qbdgroup.com/en/regulatory-updates/pms-statutory-instrument-mhra-guidance-released
11. Medical devices: post-market surveillance – GOV.UK, accessed on April 2, 2025, https://www.gov.uk/government/collections/medical-devices-guidance-for-manufacturers-on-vigilance
12. MHRA publishes guidance on new UK medical device post-market surveillance requirements – Hogan Lovells, accessed on April 2, 2025, https://www.hoganlovells.com/en/publications/mhra-publishes-guidance-on-to-new-uk-medical-device-post-market-surveillance-requirements
13. MHRA Update on Classification of Software as a Medical Device (SaMD) | Emergo by UL, accessed on April 2, 2025, https://www.emergobyul.com/news/mhra-update-classification-software-medical-device-samd
14. MHRA Consults on New UK Pre-Market Medical Device Measures | Inside EU Life Sciences, accessed on April 2, 2025, https://www.insideeulifesciences.com/2024/11/28/mhra-consults-on-new-uk-pre-market-medical-device-measures/
15. Regulatory Consulting for Software as a Medical Device (SaMD) – Mantra Systems, accessed on April 2, 2025, https://www.mantrasystems.co.uk/solutions/regulatory-consulting-for-samd-software-as-a-medical-device
16. UK MHRA Announces Intention To Recognize Certain International Approvals For Certain Medical Devices | Inside EU Life Sciences, accessed on April 2, 2025, https://www.insideeulifesciences.com/2024/05/22/uk-mhra-announces-intention-to-recognize-certain-international-approvals-for-certain-medical-devices/
17. Medical devices: conformity assessment and the UKCA mark – GOV …, accessed on April 2, 2025, https://www.gov.uk/guidance/medical-devices-conformity-assessment-and-the-ukca-mark
18. UK Medical Device Regulation – Qserve Group, accessed on April 2, 2025, https://www.qservegroup.com/eu/en/market-access/uk-medical-device-regulation
19. ISO 13485 following Brexit and the validity of QMS certificates – BSI Group, accessed on April 2, 2025, https://www.bsigroup.com/en-IL/medical-devices/news-centre/enews/2021-news/iso-13485-following-brexit/
20. IEC 62304 Standard – Best Regulatory Consultants – I3CGlobal, accessed on April 2, 2025, https://www.i3cglobal.com/iec-62304-standard/
21. (2025) UK MHRA Medical Device Registration: Steps, Time, Cost – Casus Consulting, accessed on April 2, 2025, https://casusconsulting.com/services/uk/device-registration/
22. UK MHRA Medical Device & IVD Registration: Step-by-Step Guide – Casus Consulting, accessed on April 2, 2025, https://casusconsulting.com/uk-mhra-medical-device-ivd-registration-step-by-step-guide/
23. IEC 62304 Update: What’s Changing & Why It Matters – LFH Regulatory, accessed on April 2, 2025, https://lfhregulatory.co.uk/iec-62304-update-whats-changing-and-why-it-matters/
24. Clinical investigations for medical devices – GOV.UK, accessed on April 2, 2025, https://www.gov.uk/guidance/notify-mhra-about-a-clinical-investigation-for-a-medical-device
25. MHRA Guidance Document on Clinical Investigations in UK – Greenlight Guru, accessed on April 2, 2025, https://www.greenlight.guru/blog/mhra-guidance-document-on-clinical-investigations-in-uk
26. New Year Update: incoming changes to UK regulation of clinical trials – BioSlice Blog, accessed on April 2, 2025, https://www.biosliceblog.com/2025/01/new-year-update-incoming-changes-to-uk-regulation-of-clinical-trials/
27. Regulating medical devices in the UK – GOV.UK, accessed on April 2, 2025, https://www.gov.uk/guidance/regulating-medical-devices-in-the-uk
28. Implementation of medical devices future regime – GOV.UK, accessed on April 2, 2025, https://www.gov.uk/government/publications/implementation-of-the-future-regulation-of-medical-devices
29. New Medical Device Regulations in 2025: Opportunities and Challenges, accessed on April 2, 2025, https://www.mpo-mag.com/new-medical-device-regulations-in-2025-opportunities-and-challenges/
30. MHRA Publishes Revised Roadmap of Future Regulatory Framework for Medical Devices, accessed on April 2, 2025, https://www.emergobyul.com/news/mhra-publishes-revised-roadmap-future-regulatory-framework-medical-devices

New roadmap sets out U.K. device regulation timelines | AgencyIQ by POLITICO, accessed on April 2, 2025, https://www.agencyiq.com/blog/new-roadmap-sets-out-u-k-device-regulation-timelines/