Software and AI as medical devices (SaMD/AIaMD)

Software as a Medical Device (SaMD) is standalone software that qualifies as a medical device in its own right. It is not software that is part of a hardware medical device (which is regulated as part of the hardware device).

SaMD is regulated under the UK Medical Devices Regulations 2002 and must be registered with MHRA before being placed on the GB market. AI as a Medical Device (AIaMD) is a subset of SaMD that uses artificial intelligence or machine learning algorithms.

Is your software a medical device?

Software is a medical device if it has a medical intended purpose, such as:

• Diagnosis, prevention, monitoring, prediction, prognosis, or treatment of disease
• Diagnosis, monitoring, treatment, or alleviation of an injury or disability
• Investigation, replacement, or modification of anatomy or a physiological process

Software that only stores, archives, communicates, or performs simple searches of patient data without processing or analysing it for a medical purpose is not a medical device.

Current classification

Under the current UK MDR 2002, SaMD is classified using the same Annex IX criteria as other general medical devices. Under the UK MDR 2002, many SaMD products are classified as Class I, allowing self-certification without UK Approved Body involvement.

Future reclassification

MHRA will adopt the IMDRF SaMD risk categorisation framework, which considers:

• The significance of the information provided by the SaMD to the healthcare decision
• The state of the healthcare situation or condition

Under the MHRA's planned rules, most SaMD will be reclassified as Class IIa at minimum, requiring UK Approved Body involvement. This represents an up-classification for many SaMD products that are Class I under the 2002 rules. The reclassification is expected via a statutory instrument in 2026.

Good Machine Learning Practice (GMLP)

MHRA expects AIaMD manufacturers to apply GMLP principles:

• Transparency: Document algorithm design, training data sources, and known limitations
• Clinical evidence: Demonstrate clinical validity and safety appropriate to the risk classification
• Predetermined change control plans: For adaptive algorithms that learn over time, establish predetermined change control plans describing what changes the algorithm may make without requiring a new conformity assessment
• Monitoring: Implement robust post-market surveillance for algorithm performance drift