How is SaMD classified?

SaMD is classified according to the risk associated with its intended purpose and the significance of the information it provides to healthcare decisions. Depending on the jurisdiction and device function, software may fall into Class I, IIa, IIb, or III. Higher classifications generally require greater levels of clinical evidence, regulatory scrutiny, and independent conformity assessment.

Do I need UKCA marking for my software?

If your software qualifies as a medical device and is being placed on the Great Britain market, UKCA marking requirements apply. The route to compliance depends on the device classification and applicable regulations. Manufacturers must also register relevant devices with the MHRA before placing them on the market.

What is the difference between SaMD and AIaMD?

Artificial Intelligence as a Medical Device (AIaMD) is a subset of SaMD. While all AIaMD products are software medical devices, not all SaMD products use artificial intelligence. AIaMD solutions utilise AI or machine learning techniques to perform medical functions such as diagnosis, prediction, monitoring, or clinical decision support.

Does IEC 62304 apply to my software?

IEC 62304 is the internationally recognised standard for medical device software lifecycle processes. In most cases, manufacturers developing SaMD are expected to apply IEC 62304 principles throughout software development, maintenance, verification, and change management activities. Compliance helps demonstrate that software has been developed using a controlled and risk-based approach.

Do I need ISO 13485 for software?

While requirements vary depending on device classification and market, most manufacturers benefit from implementing an ISO 13485-compliant Quality Management System. ISO 13485 provides a structured framework for design controls, document management, supplier oversight, corrective actions, and ongoing regulatory compliance, supporting both market access and organisational maturity.

How does SaMD relate to DTAC and NHS deployment?

Medical device compliance and NHS procurement requirements are not the same. While SaMD regulation focuses on safety, performance, and market access, NHS organisations may also require suppliers to demonstrate compliance with the Digital Technology Assessment Criteria (DTAC), covering areas such as cybersecurity, clinical safety, interoperability, and data protection.

How long does SaMD approval take?

Timescales vary significantly depending on the complexity of the software, its classification, the maturity of existing quality systems, and the target markets. Early-stage products may require several months to establish the necessary documentation and evidence, while higher-risk products requiring external conformity assessment can take considerably longer.

What is an Emergency Use Authorisation (EUA)?

An Emergency Use Authorisation (EUA) is a regulatory mechanism that allows certain medical products to be deployed during declared public health emergencies before full regulatory approval has been completed. EUAs are jurisdiction-specific and typically apply only in exceptional circumstances where there is an urgent public health need.

Do I need a UK Responsible Person (UKRP)?

Manufacturers based outside the United Kingdom who wish to place medical devices on the Great Britain market generally require a UK Responsible Person (UKRP). The UKRP acts as the manufacturer's local regulatory representative, supports communications with the MHRA, and fulfils specific regulatory obligations required under UK medical device regulations.

Software as a Medical Device (SaMD)

Software as a Medical Device (SaMD) and Artificial Intelligence as a Medical Device (AIaMD) products must meet specific regulatory requirements before they can be placed on the UK market.

AbedGraham provides end-to-end regulatory, quality, and compliance support for digital health, health technology, medical device, and AI developers seeking access to the UK healthcare market. Our experts support manufacturers throughout the product lifecycle, including device classification, regulatory strategy, clinical evaluation, quality management systems, UKCA marking preparation, post-market requirements, and UK Responsible Person (UKRP) services for international organisations.

We help companies navigate complex regulatory requirements efficiently while maintaining a focus on patient safety, compliance, and commercial success.

Talk to a specialist

What is Software as a Medical Device?

Software as a Medical Device (SaMD) is software intended to perform one or more medical purposes without being part of a hardware medical device. The International Medical Device Regulators Forum (IMDRF) defines SaMD as "software intended to be used for one or more medical purposes that perform these purposes without being part of a hardware medical device." In Great Britain, the Medicines and Healthcare products Regulatory Agency (MHRA) is responsible for regulating SaMD and determining how applicable regulatory requirements are applied.

SaMD can support a wide range of healthcare functions, including diagnosis, disease monitoring, treatment planning, clinical decision support, and patient management. Examples include diagnostic algorithms, digital therapeutics, clinical risk calculators, and AI-powered diagnostic tools. By contrast, software embedded within a medical device is generally regulated as part of that device, while general wellness or lifestyle applications without a medical purpose typically fall outside medical device regulations. Artificial Intelligence as a Medical Device (AIaMD) is a subset of SaMD that uses AI or machine learning to perform a medical function.

Understanding whether software qualifies as SaMD is critical because a medical purpose can trigger regulatory obligations, device classification requirements, quality management expectations, and market access requirements before the product can be legally placed on the UK market.

Who Needs SaMD Support?

Organisations developing, marketing, or deploying software with a medical purpose often require specialist SaMD regulatory support to achieve compliance and market access. This includes digital health startups bringing innovative products to market, established medical device manufacturers expanding into software-based solutions, and AI developers creating diagnostic, monitoring, or decision-support technologies.

SaMD support is also valuable for clinical decision support vendors and health IT suppliers seeking to supply software solutions to NHS organisations, where regulatory compliance, clinical safety, and assurance requirements are subject to increasing scrutiny. Companies planning to place products on both the Great Britain and European Union markets must additionally navigate differing regulatory frameworks, including UKCA, UKRP and CE marking requirements.

Many organisations seek support at key stages of product development and commercialisation. Common triggers include preparing a product for UK market entry, establishing an appropriate regulatory classification, implementing a quality management system, supporting NHS procurement requirements, responding to customer/regulator due diligence requests, or preparing for investor scrutiny during funding and acquisition processes. Early regulatory planning can help reduce delays, avoid costly remediation, and support a more efficient route to market.

Common Software as a Medical Device Challenges

Bringing Software as a Medical Device (SaMD) or Artificial Intelligence as a Medical Device (AIaMD) to market can present a range of regulatory and compliance challenges. One of the most common is determining whether software qualifies as a medical device in the first place and, if so, identifying the correct classification based on its intended purpose and risk profile.

Many organisations also struggle to retrofit medical device requirements onto products that have already been developed using agile software practices. Implementing ISO 13485 quality management processes and IEC 62304 software lifecycle controls after development has begun can create delays, additional costs, and documentation gaps.

For manufacturers targeting multiple markets, navigating the differing regulatory requirements in Great Britain and the European Union has become increasingly complex following Brexit. Separate registration, conformity assessment, and market access requirements may apply.

AIaMD developers face additional challenges around clinical evidence generation, algorithm change management, transparency, explainability, and demonstrating ongoing safety and performance.

Given the complexity of SaMD and AIaMD regulation, experienced regulatory support can help organisations reduce risk, avoid costly remediation, and achieve a more efficient route to market.

BOOK A DISCOVERY CALL

How AbedGraham Supports SaMD

The AbedGraham Group provides specialist regulatory, quality, and compliance support for organisations developing Software as a Medical Device (SaMD) and Artificial Intelligence as a Medical Device (AIaMD), from early-stage startups through to established multinational manufacturers.

Qualification and Classification Assessment

We help organisations determine whether software qualifies as a medical device, establish the appropriate classification, and develop a regulatory strategy aligned to UK and international market requirements.

End-to-End Regulatory Delivery

Our team supports manufacturers throughout the regulatory journey, from initial assessment through to UKCA marking, MHRA registration, technical documentation development, and market access activities.

Quality Management and Software Lifecycle Implementation

We design, implement, and optimise ISO 13485 quality management systems and support compliance with IEC 62304 software lifecycle requirements, helping organisations build scalable and audit-ready development processes.

AIaMD and Clinical Evaluation Support

Our experts provide specialist support for AIaMD products, including clinical evaluation, performance evidence generation, risk management, validation activities, and regulatory documentation required to demonstrate safety and effectiveness. Where appropriate, we also support manufacturers seeking Emergency Use Authorisations (EUAs) and other accelerated regulatory pathways, helping organisations prepare robust evidence packages while maintaining compliance with applicable regulatory requirements.

Outsourced Regulatory Leadership and Post-Market Surveillance Support

For organisations requiring ongoing expertise, we provide outsourced regulatory leadership, post-market surveillance support, vigilance processes, regulatory change management, and UK Responsible Person (UKRP) services for international manufacturers seeking access to the Great Britain market.

Frequently asked questions

SaMD

Software may qualify as a medical device if it is intended to diagnose, prevent, monitor, predict, treat, or alleviate a disease or medical condition. The intended purpose of the software is the primary factor regulators consider when determining whether it falls within medical device regulations. General wellness, administrative, or lifestyle applications typically do not qualify as Software as a Medical Device (SaMD).

Why Choose AbedGraham for SaMD Compliance?

The AbedGraham Group combines deep expertise in healthcare, medical device regulation, and digital health to help organisations navigate complex SaMD and AIaMD requirements with confidence. Our consultants work with organisations of all sizes, from innovative startups seeking their first market authorisation to multinational manufacturers managing global compliance programmes.

We bring together regulatory, clinical safety, and cybersecurity expertise to provide practical, proportionate support aligned to your product, risk profile, and commercial objectives. Our focus is on producing clear, defensible documentation that stands up to regulatory scrutiny while supporting efficient market access.

Rather than operating as external advisors alone, our consultants integrate closely with your regulatory affairs, quality, clinical, and development teams to deliver pragmatic solutions that support long-term compliance and growth.

Services Related to SaMD

Organisations developing Software as a Medical Device (SaMD) often require support across multiple regulatory, clinical, quality, and cybersecurity disciplines. Explore our related services below.

DCB0129 Clinical Safety

Clinical safety support for software manufacturers supplying digital health technologies to the NHS, including hazard assessments, safety cases, and compliance with DCB0129 requirements.

Find out more

DSPT Audit Services

Independent assessment and support for organisations seeking compliance with the NHS Data Security and Protection Toolkit (DSPT), helping demonstrate good data security and information governance practices.

Find out more

Talk to a SaMD Specialist

Book a discovery call today to discuss your SaMD requirements for the UK market.

BOOK A DISCOVERY CALL

What Does SaMD Involve?

The route to market for Software as a Medical Device (SaMD) and Artificial Intelligence as a Medical Device (AIaMD) involves a series of regulatory, quality, clinical, and post-market activities designed to demonstrate safety, performance, and compliance.

1. Qualification and Classification

The first step is determining whether the software qualifies as a medical device and establishing its classification based on intended purpose and risk. Depending on its function, software may be classified from Class I to Class III. Key outputs include an Intended Use Statement, regulatory strategy, and classification rationale.

2. Quality Management System

Manufacturers should implement an ISO 13485-compliant Quality Management System (QMS) to manage design, development, supplier controls, documentation, and ongoing compliance. Typical outputs include quality manuals, procedures, records, and quality policies.

3. Software Lifecycle and Risk Management

Software development should align with IEC 62304, while risks are managed using ISO 14971. This stage covers software planning, design, verification, validation, cybersecurity, and risk control activities. Outputs include software lifecycle documentation and a Risk Management File.

4. Clinical Evaluation

Manufacturers must demonstrate that the software achieves its intended medical purpose and delivers clinical benefit. This may involve literature reviews, performance testing, validation studies, and clinical data analysis. The primary output is a Clinical Evaluation Report (CER).

5. Conformity Assessment and Market Access

Once the required evidence has been assembled, manufacturers can pursue UKCA or CE marking and complete market registration activities. International manufacturers placing products on the Great Britain market must appoint a UK Responsible Person (UKRP) and register with the MHRA. The principal output is the Technical File.

6. Post-Market Surveillance

After launch, manufacturers must monitor product performance, manage complaints, investigate incidents, and maintain ongoing compliance. Post-market surveillance plans, vigilance records, and updates to the Technical File, Risk Management File, and Clinical Evaluation Report support continued market access.