Regulatory Focus™ > News Articles > 2021 > 8 > The SaMD regulatory landscape in the US and Europe

The SaMD regulatory landscape in the US and Europe

Posted 06 August 2021 | By Vatsal Chhaya, MSc, and Kapil Khambholja, PhD  | PDF Link PDF | ©

The SaMD regulatory landscape in the US and Europe

The advent of artificial intelligence (AI) in the healthcare industry has resulted in a proliferation of novel health technologies with intuitive features. However, the regulatory landscape for such innovative products has yet to be fully understood. The US Food and Drug Administration (FDA) published a discussion paper on AI- and machine learning (ML)‒based software as a medical device (SaMD) in April 2019, which led to the release of an action plan that incorporated stakeholder feedback on original discussion paper. The present article sheds light on the regulatory landscape for SaMD in the US and Europe and examines the future direction for SaMD.
Advances in all aspects of healthcare have made medicines and medical devices a part of our daily lives. Medical devices now go hand in hand with drugs for sustaining healthy life. Currently, around 2 million different types of medical devices are available in globally. The newest addition to this list is SaMD, which is paving the way for future of the healthcare. Software can retain a history of patient data, for example, for blood sugar and blood pressure levels. An accumulation of that history can inform future decisions about patient care and therapy and help in reducing the workload of doctors and nurses.
The healthcare industry is being transformed by this technological breakthrough, and there is an increasing trend and inclination toward deploying AI-ML-based technologies in the field. Artificial intelligence is the science and engineering of developing intelligent and intuitive software programs using the concepts of computational statistics and machine learning. While there is increasing attention toward remote telemonitoring of patient vitals on continuing basis, AI-ML can further help in the interpretation of that data to inform clinical practice. The utility applications can include diagnosis recommendations based on AI-driven digital image processing, identification of disease patterns, prescription trends, and patients’ brand-seeking behavior regarding medicines, to name a few. The most recent and promising application is the development of AI-ML-based devices for surgical precision – advanced robotics. Therefore, AI-ML technology integrated into medical devices can assist healthcare providers in improving decision making, delivery of care, and subsequent clinical outcomes. Such technologies, that acquire feedback from the real world and adapt to different situations, have made SaMD a rapidly developing area of research.
The FDA recently updated its position statement on AI-ML‒based SaMD.1 This article aims to summarize the current regulatory scenario for AI-ML‒based software as a medical device within the context of recently released regulatory documents by the FDA and EU. It also aims to provide futuristic insights on rational diffusion of such technology in compliance with the regulatory requirements.
Software as a medical device
The International Medical Device Regulators Forum (IMDRF), a voluntary group of medical device regulators from countries around the world, defines SaMD as “software intended to be used for one or more medical purposes that perform these purposes without being part of a hardware medical device.” 2 Furthermore, it is a medical device and may include an in vitro diagnostic device. It might not be considered as SaMD if its intended purpose is to drive a hardware medical device. However, it can be interfaced with hardware or other SaMD software and can run on general or nonmedical purpose computing platforms.
An SaMD software produces an output using algorithm (a set of rules or a model) based on the input data, which may be patient data such as laboratory results, imaging data, symptoms, or even data from wearable devices.1 Examples of SaMD include software used by a smartphone to view images from magnetic resonance imaging device for diagnosis, and computer-aided detection software that performs image postprocessing for detection of breast cancer.3
In February 2020, the FDA announced marketing authorization of the first cardiac ultrasound software that uses AI to guide users.4 With such devices starting to roll out, the regulatory agencies have begun to realize the impact of AI-ML in healthcare and the need for its regulation to ensure quality and safe use.
US regulatory framework

FDA discussion paper
In April 2019, the FDA published a discussion paper on AI-ML‒based SaMD,1 describing the agency’s plan to regulate premarket review for AI- and ML-driven software modifications. As the part of its proposed framework, agency put forward a “predetermined change control plan” in premarket submissions, which included SaMD prespecifications and algorithm change protocol to enhance the mechanism of safeguarding the patients. The traditional regulatory pathway includes premarket approval, 510k notifications (premarket clearance), and de novo classification.
The software modifications can involve changes to the algorithm architecture and can be performed regarding performance and inputs (without changing intended use) and related to SaMD’s intended uses.

FDA proposed the application of the total product lifecycle (TPLC) regulatory approach to AI-ML‒based SaMD. The TPLC approach allows evaluation and monitoring of the product from the premarketing application stage to the postmarketing surveillance stage to ensure quality, safety, and effectiveness. The TPLC approach is based on the following principles:

  • Quality systems and good machine learning practices (GMLP). The GMLP ensures delivery of high-quality products conforming to the standard requirements throughout the product lifecycle. Valid clinical association and analytical and clinical validation are required to ensure clinical evaluation of the SaMD.
  • Initial premarket assurance of safety and effectiveness. This principle allows manufacturers to voluntarily submit a “predetermined change control plan” to the FDA for premarket review of AI-ML‒based SaMD. The plan anticipates two types of modifications:
  • SaMD prespecifications (SPS) – Changes in the model and re-orientations are required when the SaMD is already in use.
  • Algorithm change protocol (ACP) – This protocol implements the changes in a controlled manner to manage the risks to patients.
  • Approach for modifications after initial review with an established SPS and ACP. If the change is within the limits of the SPS and ACP, then only documentation of the changes in the existing 510(k) is sufficient. If the change leads to a new intended use, then submission of new 510(k) is required for premarket review.
  • Transparency and real-world performance (RWP) monitoring of AI-ML‒based SaMD. This principle assures continued safety and effectiveness of the product to the patients. Transparency regarding the functions and modifications is crucial for safety. The FDA expects manufacturers to submit periodic updates about the changes implemented as per the SPS and ACP and the performance metrics of the SaMD.


FDA action plan

Given the announcement of marketing authorization of a breakthrough device – cardiac ultrasound software – through de novo regulatory pathway since February 2020, there has been immense interest in the innovation of AI-based SaMD using the proposed framework. The authorization trend for similar devices continued thereafter.5 Thus, the FDA’s Digital Health Center of Excellence6 has delineated an action plan with operational guidance for both SaMD and software in a medical device, or SiMD.
In January 2021, the FDA published an action plan on AI-ML‒based SaMD.7 The paper was published in response to the feedback on the FDA discussion paper on proposed regulatory framework for AI in SaMD. The paper summarized the feedback and briefly described a plan containing five major actions.


  • Tailored regulatory framework for AI-ML‒based SaMD. To this effect, the FDA will issue a draft guidance on a predetermined change control plan. The guidance will give recommendations on what should be included in SPS and ACP to prove safety and effectiveness, thereby updating existing regulatory framework.
  • Good machine learning practice. The agency will encourage GMLP development and robust cybersecurity for SaMD by working with different communities, such as the Institute of Electrical and Electronics Engineers’ P2801 Artificial Intelligence Medical Device Working Group and the International Organization for Standardization’s Joint Technical Committee 1, Subcommittee 42 on AI. The underlying objective is to harmonize GMLP development through collaborative effort.
  • Patient-centered approach incorporating transparency to users. Understanding the device, the role of its output, and demonstration of its performance are essential to building the patient confidence in these technologies. To this end, the FDA will hold a public workshop to understand how device labeling can support transparency to users and build trust in AI-based SaMDs.
  • Regulatory science methods related to algorithm bias and robustness. The agency will encourage robust methodological framework for the evaluation and implementation of machine learning algorithms, including identification and elimination of bias and promotion of algorithm robustness in scientific community.
  • Real-world performance. FDA will collaborate with stakeholders who pilot the RWP process regarding SaMD. This data will be used to establish thresholds and quality metrics that are critical to the RWP of AI-ML‒based SaMD.
 To speed up the process of approval, the FDA has announced that SaMD will be assessed by the agency or an accredited third party for the design and functioning of the SaMD. Depending on the recommendation and the risk category of the product, premarket review may be waived. Substantial postmarketing data on safety and effectiveness might be considered to continue marketing of the product.8
European regulatory landscape for medical device software
The EU has separate set of regulations for medical devices, the EU Medical Device Regulation (MDR; 2017/745), and for in vitro diagnostic medical devices, the EU In Vitro Diagnostic Regulation (IVDR; 2017/746).9 The European Commission, in association with the Medical Device Coordination Group (MDCG), is working on developing regulations for SaMD. MDCG, an expert committee appointed by EU member states, works to assist in implementing the EU MDR and EU IVDR. The working groups oversee the issues, from notified bodies, clinical investigation, postmarketing surveillance, international issues, implementing the EUDAMED database, and inputs on implementing IVD, Annex-IV products.
As described in MDCG guidance documents on medical device regulations, software integration in medical devices is better known as medical device software (MDSW), especially in European countries.
MDSW can be classified as low risk (Class Ia), medium risk (Class IIa), medium-high risk (Class IIb), or high risk (Class IIIa).9 It can be used alone or in combination (Article 2(1), EU MDR 2017/745).
The MDCG guidelines provide the requirements for a product to qualify as an MDSW under both the EU MDR and the EU IVDR. There are two ways in which an MDSW product can reach the market – as a medical device in its own right, or as the integral component of any medical device. The former requires a specific, in-depth regulatory process that includes a conformity assessment to determine whether the medical device meets EU MDR requirements. However, that requirement is not applied with the same rigor for products in the latter category.9 As a result, MDSW as an integral component of a medical device can be placed on the market with a conformity assessment specific to the device only and not on the basis of its own regulatory process.
MDCG has been instrumental in formulating the harmonized regulatory standards for all EU member states regarding trustworthy AI through a first-ever legal framework dedicated to AI. This is also expected to include products qualified as MDSW with AI-driven functionalities.
Risk management associated with the use of SaMD/MDSW
Setting up standards and limits for the devices can be a daunting task because of racial and ethnic diversity across different countries. Building a nonbiased regulatory framework with constant updates in MDSW will be a challenge for the EC.10
Data integrity, patient privacy, racial and ethnic differences in biological parameters, and judicious use of data are going to be the important factors in building a robust regulatory framework. The General Data Protection Regulation 2016/679 (GDPR) imposes stringent regulations on use of personal data of subjects living in the EU. For example, Article 22 of the GDPR poses restrictions on automated decision making and profiling. It becomes applicable when a decision is based on automated processing, including profiling, which includes legal effects or affects the person associated with the data. This can pose complex issues in use of medical records in clinical trials and software updates for medical devices.11
Global regulatory alternative pathways to approve AI-ML‒based SaMD
Regulations set by the EU and FDA standardize the regulatory process for a product to qualify and be approved as a medical device. However, few other countries or regions have similar regulatory approaches tailored to their specific health needs. The advantages of a tailored regulatory process include having an accelerated approval process, improved consumer access to effective products, and improved product efficiency in meeting patient needs.
In Japan, for instance, where the SaMD regulatory process is controlled by the Ministry of Health and Labour Welfare (MOHLW) and the Pharmaceuticals and Medical Devices Agency (PMDA), classifies SaMD into four classes – general, controlled, specially controlled (high-risk), and specially controlled (life-threatening) medical device.
In December 2019, amendments to the country’s Pharmaceutical and Medical Devices Act introduced the Sakigake designation system to accelerate the regulatory approval process for medical device. The system is based on four criteria, including innovation, effectiveness, severity of disease, and development plan in Japan. The regulations stated prioritized review for a specific-use product (e.g., pediatric use), orphan drugs, and Sakigake products. PMDA and MOHLW developed the IDATEN [Improvement Design within Approval for Timely Evaluation and Notice] framework, which allows continuous improvements for AI-ML‒based medical devices by reducing the regulatory burden while improving safety and effectiveness through seamless monitoring by manufacturers and the PMDA. In place of approval or amendment process, postmarketing changes can be done by change notification.12
In Singapore, the Ministry of Health and the Health Sciences Authority have drafted a guidance document on software medical devices and implementing AI in healthcare. It classifies medical devices and describes software qualification criteria, data quality, safety and effectiveness, and other aspects of AI-ML‒based SaMD.13 However, neither of these regulatory authorities has a unique classification for SaMD and neither complies with the IMDRF’s risk categorization framework.
RWE in medical device regulations
Advances in technology have facilitated and increased the availability of real-world data (RWD). RWE derived from RWD may help serve nonregulatory purposes, such as payment decisions, analysis of clinical outcomes associated with medical device usage, or even for establishing benchmark practices for handling medical device and equipment. However, RWD and RWE can also be leveraged for pre- and postmarketing regulatory decision making. In the EU, MDR 2017/745 requires data to be continually produced during the lifetime of product as a basis for postmarketing clinical follow-up. It also requires the generation of RWE on safety and effectiveness.14 The data can be obtained from various sources, including electronic health records, medical device registries, pharmacy data, and patient feedback. High-quality RWE can reflect many aspects of a product (e.g., SaMD or health technology), including safety and effectiveness of new and existing products, and can be used to assess product performance once it is on the market. The FDA is highly supportive of drawing on RWE and uses it for regulatory decision making.15,16 Examples of RWE and RWD in postmarketing approval and surveillance would be:
  • RWE in postmarketing approval for expansions of indications – The sponsor used RWD from two registry databases and performed Bayesian hierarchical analysis. The analysis gave safety and effectiveness endpoints that served as primary basis for approval of indication expansion of drug-eluting coronary stents in patients with diabetes.16
  • RWD in postmarketing surveillance – A postapproval study was conducted to evaluate safety and effectiveness of glucose sensor device for continuous glucose monitoring using device-generated and patient-reported outcomes data.16
AI-based SaMD and MDSW – Looking ahead
AI-ML is going to become an integral part of our lives, just as medicines and medical devices already are. The COVID-19 pandemic has taught us we constantly need to be ready for change. Medical devices with software bring additional convenience to healthcare products and allow people to be self-sufficient. Monitoring RWP to induce transparency will be instrumental in the practical use of SaMD. With the increasing need for and scope of AI MDSW, it is important to have a system or regulation for identifying the challenges and ensuring safe, sustainable, and secure AI. The regulatory agencies in US and EU are proactively instrumental in establishing a robust regulatory framework to enable optimum use and prevent abuse of AI in healthcare. Given the country-specific differences in regulatory mechanisms for approving AI-based SaMDs and getting them to market, the challenges for harmonization of regulatory standards and their implementation are substantial. Nevertheless, future applications of AI-based SaMD, with its total diffusion in health systems of individual countries and supported by health technology assessment‒like neutral mechanisms, could be a reality in the near future.
It is also crucial to adopt an intersectoral approach with the convergence of various government ministries to inform the regulatory guidance. At the same time, it is essential there should be a legal framework focusing on bioethics – including laws respecting human rights, diversity, data transparency, and privacy – for regulating AI-based MDSW, especially in low- and middle-income countries. Along with clinicians, paramedical staff and pharmacists have a vital role in patient-related issues concerning to medical devices. Thus, there should be appropriate training to ensure adequate use of AI-ML‒based SaMD, increasing efficiency, and reporting RWD. Last, but not the least, patients and providers’ community must be involved for any regulatory framework planning, execution, and assessment to provide end-user’s perspective.
ACP, algorithm change protocol; AI, artificial intelligence; EU MDR, EU Medical Device Regulation; ; EU IVDR, EU In Vitro Diagnostic Regulation [for medical devices]; FDA, [US] Food and Drug Administration; GDPR, General Data Protection Regulation; GMLP, good machine learning practices; IMDRF, International Medical Device Regulators Forum; MDCG, Medical Device Coordination Group; MDSW, medical device software; ML, machine learning; MOHLW, Ministry of Health and Labour Welfare; PMDA, Pharmaceuticals and Medical Devices Agency; RWD, real-world data; RWE, real-world evidence; RWP, real-world performance; SaMD, software as a medical device; SPS, SaMD prespecifications; TPLC, total product lifecycle.
About the authors
Vatsal Chhaya, MSc, is a senior executive medical writer and project manager at Genpro Research, with expertise in health economics and outcomes research, health technology assessment, RWE, evidence-based medicine, and market access, and more than 7 years’ experience. He has a master’s degree in clinical research from Cranfield University, UK. Chhaya can be reached at
Kapil Khambholja, PhD, is vice president and head of medical writing, RWE, and health economics and outcomes research at Genpro Research. He has more than 16 years’ experience in medical and scientific writing and clinical research. He has a master’s degree in pharmacy from the University of Mumbai and a doctorate in pharmacy from Ganpat University. Khambholja can be reached at;
The authors thank Divya Patel and Supriya Kharkar of the Genpro Research medical writing team for editorial support during the preparation of this paper.
Citation Chhaya V, Khambholja K. The SaMD regulatory landscape in the US and Europe. Regulatory Focus. Published online 6 August 2021.

All references accessed 26 July 2021.
  1. Food and Drug Administration. proposed regulatory framework for modifications to artificial intelligence/machine learning (AI/ML)-based software as a medical device (SaMD). Published April 2019.
  2. International Medical Device Regulators Forum. Software as a medical device (SaMD): Key definitions. Dated 9 December 2013.
  3. Food and Drug Administration. What are examples of software as a medical device? Current as of 6 December 2017.
  4. Food and Drug Administration. FDA authorizes marketing of first cardiac ultrasound software that uses artificial intelligence to guide user. Current as of 7 February 2020.
  5. Food and Drug Administration. FDA authorizes marketing of first device that uses artificial intelligence to help detect potential signs of colon cancer. Current as of 9 April 2020.
  6. Food and Drug Administration. Digital Health Center of Excellence website. Current as of 9 July 2021.
  7. Food and Drug Administration. Artificial intelligence/machine learning (AI/ML)-based software as a medical device (SaMD) action plan. Published January 2021.
  8. Shuren J, et al. FDA regulation of mobile medical apps. JAMA. 2018;320(4):337-8.
  9. European Commission, Medical Device Coordination Group Document. Guidance on qualification and classification of software in Regulation (EU) 2017/745 - MDR and Regulation (EU) 2017/746 - IVDR. Published October 2019.
  10. Cohen IG, et al. The European artificial intelligence strategy: Implications and challenges for digital health. Published online July 2020.
  11. Minssen T, et al. Clinical trial data transparency and GDPR compliance: Implications for data sharing and open innovation. Published 4 March 2020.
  12. Fumihito T. Update on medical device and IVD Regulation in Japan. Presented at 4th India-Japan Medical Products Regulatory Symposium. March 7 2020.
  13. [Singapore] Health Sciences Authority. Regulatory guidelines for software medical devices-a life cycle approach. Published April 2020.
  14. EU Parliament and Council. Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices, amending Directive 2001/83/EC, Regulation (EC) No 178/2002 and Regulation (EC) No 1223/2009 and repealing Council Directives 90/385/EEC and 93/42/EEC. Published 5 April 2017.
  15. Food and Drug Administration. Leveraging real-world evidence in regulatory submissions of medical devices. Current as of 16 March 2021.
  16. Food and Drug Administration. Examples of real-world evidence (RWE) used in medical device regulatory decisions. Published 2020.


© 2021 Regulatory Affairs Professionals Society.

Tags: EU, MDSW, SaMD, US

Regulatory Focus newsletters

All the biggest regulatory news and happenings.