Digital healthcare technologies are evolving relentlessly, and software plays a crucial role among them, driving innovation at a fast rate.
Specifically, Software as a Medical Device (SaMD) has gained momentum over the past few years. It has improved healthcare delivery in many ways, from diagnostic tools to patient monitoring.
SaMD is software used for medical reasons that works on its own, not as part of a physical medical device. So its uniqueness means it needs consistent rules that go beyond traditional medical devices. It needs global requirements for its development and maintenance so as to guarantee constant innovation while still keeping patients safe.
Given the sensitive nature of SaMD, the regulatory framework for developers and manufacturers is getting much harder to navigate. It is a shifting landscape of international standards, new AI-specific laws, and rigorous security protocols.
What is the SaMD Regulatory Framework?
The SaMD regulatory framework is structured as a tiered system where broad regional or national laws set the legal requirements, while specific technical standards and guidelines provide the "how-to" for compliance.
Typically, the most notable regulations are:
- European Union: Governed primarily by the MDR (2017/745) and IVDR (2017/746).
- United States: Governed by the FDA under federal laws such as the FD&C Act.
- Country-specific variations: Individual countries could have their own unique requirements despite harmonization within a region.
EU: MDR & IVDR
In Europe, the Medical Device Regulation (MDR 2017/745) and the In Vitro Diagnostic Regulation (IVDR 2017/746) are the reference. These regulations require solid clinical evidence and continuous post-market supervision. Under the MDR, the classification rules for SaMD (especially Rule 11) generally result in a higher-risk designation than before, while IVDR requires many software-based diagnostic tools to undergo strict compliance assessments by Notified Bodies. However, the EU Commission made a legislative proposal for a new law in December 2025 to streamline the enforcement of both MDR and IVDR, which includes rewriting Rule 11.
Regulatory Pathways: FDA 510(k) Clearance vs CE Marking Submission
Regulatory pathways change depending on the region. The FDA 510(k) is based on the concept of substantial equivalence, which means you must demonstrate that your device is as safe and effective as a product already on the market. It's a centralized process managed directly by the FDA. Differently, the CE Marking is based on compliance with safety and performance requirements. Comparison with an existing product is not required, but rather rigorous clinical evidence and ongoing post-market surveillance. It is a decentralized process that requires the involvement of a private Notified Body.
Quality Management System (QMS) & Governance
The Quality Management System (QMS) is the formalization of collected policies, processes and procedures that grants an organization is compliant with regulations and its products live up to expectations. A QMS for SaMD needs to include and consistently apply all SaMD life cycle processes, making sure they scale with the organization size.
The Global Standard: ISO 13485
ISO 13485 is the foundational QMS standard for the medical device industry. It dictates everything from how you handle documentation to how you manage suppliers, helping organizations meet regulatory requirements while managing risks. ISO 13485 is recognized as the one and only harmonized standard for claiming QMS compliance within the EU. In the US, the new QMSR mandates ISO compliance (not certification). In Canada, it is required for Class II, III, IV medical devices.
US: The Shift Toward QMSR
Historically, the US FDA operated under its own Quality System Regulation (QSR). However, the FDA has worked to make things more consistent and reduce redundancy. They are now adopting the Quality Management System Regulation (QMSR), which aligns their rules (21 CFR Part 820) with ISO 13485:2016. This new rule became effective on February 2, 2026. In the US, FDA 21 CFR Part 11 sets the standard that ensures electronic records and signatures are as trustworthy and reliable as paper records.
Software Development Life Cycle (SDLC) & Engineering
Regulations mandate the high-level requirements needed to perform well and address patient safety. Relying on structured processes for software development helps meet these requirements and denote compliance.
The Gold Standard for SaMD Development: IEC 62304
The reference standard for SaMD (and SiMD) development is IEC 62304. This international standard defines all the requirements that characterize the life cycle processes for medical device software. It demands that developers classify their software by safety class (A, B, or C) and apply corresponding rigor in testing, architecture and problem resolution. It bridges the gap between Agile development methodologies and the strict documentation required by regulators.
Product-Level Safety: IEC 82304
IEC 62304 is the reference for processes. For the complete product, the standard is IEC 82304, though this applies only to stand-alone software (SaMD). Its primary focus is to grant the safety, security and effectiveness of SaMD at product level.
AI-Native Governance & Performance Monitoring
This is perhaps the most dynamic area of the current regulatory framework. As AI integrates SaMD, regulators are scrambling to ensure the AI implementation is transparent, reliable, safe and sustainable.
Global Best Practices: GMLP
On a global scale, the Good Machine Learning Practices (GMLP) principles, jointly developed by the FDA, Health Canada, and the UK's MHRA, establish the 10 guiding principles to develop transparent, robust AI. They emphasize that ML models must be trained on data representative of the real population, ensuring that AI works equally well across different demographics and equipment sets to avoid bias.
The EU AI Act
Europe has taken a bold lead with the EU AI Act, mandatory for high-risk AI systems as of August 2, 2026. This regulation imposes strict obligations on data governance, human oversight, and transparency. If your SaMD uses AI for critical diagnostic or therapeutic purposes, it will likely be categorized as High-Risk AI, requiring a conformity assessment and rigorous technical documentation before it can enter the EU market.
US Innovations: FDA PCCP
SaMD manufacturers using AI-generated components must comply with FDA's GMLP but also have a plan for post-market updates of AI models: the Predetermined Change Control Plan (PCCP). This approach recognizes the need for AI model evolution, moving beyond traditional regulations that required new submissions for every significant change. The PCCP allows manufacturers to agree in advance with the FDA on how AI will evolve and be validated. Once approved, the plan permits iterative updates, such as retraining on new data, without requiring a new 510(k) submission, as long as the updates remain within defined limits. This shifts regulation from a static to a dynamic model, supporting continuous software learning.
Risk Management & Safety Assurance
Risk management is the thread that ties all these domains together. It is not a one-time effort but a continuous life cycle process because you must deal with patient safety.
Assessing the Risk: ISO 14971
ISO 14971:2019 is the international standard for the mandatory application of risk management to medical devices. It requires manufacturers to identify hazards, estimate risks, and implement control measures to reduce those risks to acceptable levels. For SaMD, this means considering the impact of a cloud server failure, algorithm misinterpretation of an image, or a confusing user interface. Every risk identified must be mitigated, and the effectiveness of that mitigation must be verified. Clear traceability of risks, requirements and test cases shapes the core evidence for audits.
Usability: IEC 62366-1
Safety also depends on the human element. IEC 62366-1 focuses on Usability engineering. It ensures that the User Interface (UI) is designed in a way that minimizes risks and use errors. A confusing dashboard that leads a doctor to make mistakes is a failure just as much as a software crash is.
Cybersecurity & Security by Design
As organizations increasingly integrate AI into their workflows, preemptive cybersecurity and digital provenance are crucial due to ethical and safety concerns. Cybersecurity is no longer just an IT problem; it's essential for patient safety.
The Global Reference Standard for Cybersecurity: IEC 81001-5-1
IEC 81001-5-1 is the global standard to manage the security of health software throughout its entire life cycle. It mandates that security is inherent to the development process, rather than an afterthought.
US: The Mandatory SBOM
In the AI-driven world, the Software Bill of Materials (SBOM) has become a crucial resource to have full visibility into individual components of software and AI-generated content, securing compliance, fostering trust and strengthening the supply chain. Under the FDA's Cybersecurity Guidance (Section 524B), providing an SBOM is now mandatory for device submissions. You must list every open-source library and third-party component in your software so that when a new vulnerability is discovered globally, you can instantly know if your device is affected.
EU: SOUP transparency, SBOM and Cyber Resilience Act
While the MDR mandates transparency of third-party components (SOUP) via MDCG 2019-16, the Cyber Resilience Act (CRA) turns this best practice into a strict legal mandate. Notably, while the full product requirements apply in 2027, the mandatory reporting of exploited vulnerabilities begins as early as September 2026, making an automated SBOM an immediate necessity for compliance.
Vulnerability Management: ISO/IEC 29147
You also need a plan for when things go wrong. ISO/IEC 29147 is the international standard that provides requirements and recommendations for vulnerability disclosure. It dictates how you receive reports of security flaws from the outside world and how you investigate and resolve them.
Privacy: A Fragmented Global Map
While standards like ISO 13485 and IEC 62304 are harmonized globally, privacy laws remain fragmented and highly localized, framing a maze of national requirements.
EU: GDPR and Local Nuances
The General Data Protection Regulation (GDPR) sets the baseline for data privacy in Europe, mandating privacy by design. Essentially, data handling needs to be lawful, fair, and transparent. Data must be purpose-limited, minimized, accurate, kept no longer than necessary, and protected by security measures.
However, specific countries have added their own layers for health data:
- Italy: In addition to GDPR, you must adhere to the specific guidelines of the Garante Privacy regarding electronic health records and patient consent.
- France: You cannot legally deploy SaMD that hosts personal health data unless your infrastructure has HDS (Hébergeur de Données de Santé) certification. This is a mandatory certification for any cloud provider hosting French patient data.
- Germany: The BDSG (Federal Data Protection Act) imposes strict rules on sensitive processing. Furthermore, the DVG (Digital Healthcare Act) paved the way for Digital Health Applications (DiGA), leading to prescribable health apps. To become a DiGA, your app must undergo a rigorous assessment of data security and privacy by the BfArM.
US: HIPAA and HITECH
In the US, the Health Insurance Portability and Accountability Act (HIPAA) governs the privacy and security of Protected Health Information (PHI). The HITECH Act reinforces HIPAA by increasing penalties for non-compliance and requiring mandatory breach notifications. Unlike GDPR, which is broad, HIPAA is specific to the healthcare sector, but the penalties for negligence are still severe.
UK: The Post-Brexit Landscape (UK GDPR)
Following Brexit, the UK retained the basic principles of the EU GDPR in the form of the UK GDPR. The main difference lies in the UK's greater operational flexibility: while the EU maintains a strict and uniform approach, the UK has introduced simplified legal bases (such as "recognized legitimate interests"), less restrictive criteria for international data transfers, and more streamlined procedures for handling data subject requests, aiming to reduce the bureaucratic burden on businesses.
Simplify Compliance with P4SaMD
The complexity of this regulatory framework is undeniable. Trying to manage ISO standards documentation, international protocols, privacy impact assessments, or SBOM generation using scattered tools is a recipe for chaos and non-compliance.
This is why Mia-Care built P4SaMD.
P4SaMD is an AI-powered platform solution from Mia-Care designed to address the challenges of the modern SaMD regulatory framework, customizable for region-specific regulation. It doesn't just store documents or return random snippets; it actively orchestrates your compliance.
- Automated evidence: P4SaMD structures your evidence to align with the company QMS, reducing manual work and keeping you audit-ready 24/7.
- Guided SDLC: P4SaMD tailors the developer experience to IEC 62304, streamlining adherence to best practices, and supporting developers throughout the life cycle of these standards.
- Risk-proof: P4SaMD enables a risk-based approach, with a predefined framework and live traceability across all the phases of development and post-market.
- AI Governance: The tool provides automated controls for High-Risk AI systems (such as per the EU AI Act) and manages the technical logs required for conformity. It also automates controls on AI/LLMs management outputs to ensure transparency and validation of AI-based system usage.
- Cybersecurity ready: P4SaMD automatically generates your SBOM files, and provides a vulnerability mitigation framework, ensuring you meet 81001-5-1 requirements effortlessly.
- Privacy by design: P4SaMD includes a requirement framework to track and manage data privacy in the final SaMD product, enforcing compliance with the most notable international regulations such as EU GDPR and US HIPAA.
