Software as a Medical Device (SaMD): Global Regulation & Registration

For every regulator below we answer the three questions software teams ask first: what class is my product, how long will it take, and what will it cost.

What is Software as a Medical Device (SaMD)?

Software as a medical device (SaMD) is the IMDRF term for software that performs a medical purpose — diagnosing, treating, monitoring, or informing clinical decisions — on its own, without being part of a hardware medical device. AI that reads radiology images, dose calculators, apps that turn CGM data into therapy guidance, and digital therapeutics are all SaMD; embedded software that drives a hardware device (SiMD) is regulated as part of that device instead, and general wellness apps usually fall outside regulation entirely.

The catch is that every jurisdiction draws the line differently. The same product can be an unregulated wellness app in one market, a Class IIa device in Europe under MDR Rule 11, and a cleared Class II device in the United States — which is why a structured qualification analysis across your target markets is the first deliverable of any serious SaMD program. Every cost below has two parts: the government fee, and our own flat annual service fee per market, from US$1,000 per year in the US (device listing and US Agent representation) and from US$2,000 per year in most other markets. Exact current figures live in our pricing calculator.

FDA SaMD regulation (United States)

FDA regulates SaMD through the same risk framework as hardware devices, with software-specific expectations layered on top: software documentation levels, premarket cybersecurity evidence, and Predetermined Change Control Plans (PCCP) for AI models that keep improving after clearance.

• Classification. Most clinical software lands in Class II with a 510(k); novel functions without a predicate go De Novo. Some low-risk categories sit under enforcement discretion and need no submission — the qualification memo settles this first.
• Timeline. A 510(k) typically runs 3 to 9 months end to end including preparation and FDA interaction; De Novo programs plan for 9 to 15 months. A Pre-Sub meeting adds a few weeks up front and routinely saves review cycles later.
• Cost. Government fees: US$26,067 for a standard 510(k) review (US$6,517 for qualified small businesses) plus US$11,423 per year in establishment registration; De Novo runs far higher. Our flat US$1,000 per year covers FDA establishment registration and device listing maintenance plus US Agent representation; 510(k) preparation and submission are scoped as a separate project.

FDA's PCCP: the Predetermined Change Control Plan for AI

A PCCP lets you pre-authorize the model updates you already know are coming — retraining on new data, performance tuning, expanded inputs — so anticipated changes ship without a new 510(k). FDA finalized its PCCP guidance for AI-enabled device software, and a well-drafted plan is now the difference between shipping model improvements monthly and re-filing every quarter. We author PCCPs as part of every AI submission.

Start from our United States market page for the full FDA pathway.

EU MDR Rule 11: SaMD classification and CE marking

Under MDR Rule 11, software is regulated as a device in its own right, the EU AI Act layers extra obligations on high-risk medical AI, and a notified body sits in the middle of your timeline.

• Classification. Rule 11 pushes most clinical software to Class IIa or higher; software informing decisions with potential for serious deterioration or death reaches IIb or III. Genuinely Class I software is now the exception.
• Timeline. Plan 9 to 18 months with a notified body for a first IIa certification, driven by notified body capacity and the maturity of your technical documentation and clinical evaluation (MDCG 2020-1).
• Cost. There is no central government fee; the money goes to the notified body — typically €30,000 to €70,000 across the first certification cycle for Class IIa, plus annual surveillance — and to building MDR-grade documentation. Our EU Authorized Representative service is a flat annual fee from US$2,000, capped at US$4,000 as your portfolio grows, and covers EC REP representation, document review, and EUDAMED support; CE-marking work with your notified body is scoped separately.

Notified body strategy should shape your EU plan early; see the European Union market page for the MDR route.

SaMD registration in Brazil and Latin America (ANVISA RDC 657)

Brazil regulates SaMD explicitly through RDC 657/2022, with risk classification under RDC 751, and anchors any Latin American strategy; Mexico's COFEPRIS is the region's second gate. Both require a local representative — we act as Brazil Registration Holder without taking control of your registration.

• Classification. RDC 751 rules track the IMDRF model: Class I-II software qualifies for the streamlined notificação route, Class III-IV requires full registro with deeper technical evidence.
• Timeline. Notification is typically a matter of weeks; Class III-IV registration plans for 6 to 12 months. In Mexico, COFEPRIS runs 6 to 12 months on the standard route, faster where reliance on FDA or CE approvals applies.
• Cost. ANVISA government fees: R$1,406 to notify a Class I-II product; Class III-IV family registration runs R$8,510-19,856, plus a one-time international B-GMP certification of R$72,805 where required. COFEPRIS charges MX$16,499-30,798 per product. Our registration service starts at US$2,000 per year (US$3,000 for high-risk classes) in both markets.

Start with the Brazil market page; labeling, instructions for use, and submissions are prepared natively in Portuguese and Spanish.

SaMD registration in Asia-Pacific: Singapore first, then ASEAN

Most overseas software teams enter Asia-Pacific through Singapore: HSA works in English, follows the IMDRF model, has dedicated software guidance, and rewards a good FDA or CE dossier with a fast abridged review. A Singapore approval then anchors expansion across ASEAN — Malaysia, Thailand, Indonesia, Vietnam, the Philippines — where reliance-friendly frameworks make each additional market incremental rather than a new program. Japan and Korea are the region's big mature prizes with their own systems and languages. China is the largest market but the hardest entry — local type testing, dedicated AI review guidance, and the longest timelines — so treat it as its own program when the business case justifies it, not as a default stop.

• Classification. Singapore's HSA uses risk classes A through D with software-specific guidance, and ASEAN members track the same IMDRF-style model under the ASEAN MDD. Japan classifies against JMDN codes with a dedicated SaMD program; Korea's MFDS uses Classes I-IV. China places most diagnostic AI in Class II or III — autonomous diagnosis pushes to III.
• Timeline. HSA abridged evaluation with a reference approval closes in 2 to 6 months; ASEAN registrations typically run 3 to 9 months per market on the back of the same dossier. Japan plans for 9 to 14 months via PMDA approval (certification routes for lower classes are faster); Korea 6 to 12 months including KGMP; China 12 to 24 months including type testing.
• Cost. Singapore's government fees are light: a SGD 560 application plus SGD 2,010-6,250 evaluation by class, and ASEAN peers are similar (Malaysia MYR 500-3,750; Thailand THB 3,100-74,000). Japan's PMDA review fees start around ¥1 million; China's NMPA fees for imported Class II-III run roughly RMB 210,000-310,000 before type testing. Our registration service starts at US$2,000 per year across Singapore and ASEAN.

One well-built reference dossier does most of the region's work — sequencing is the strategy. See the Singapore, Malaysia, Thailand, Japan, South Korea, and China market pages.

SaMD registration in Saudi Arabia and MENA (SFDA)

The Gulf is the fastest-growing digital health region in our portfolio, and its regulators are built around reliance: a strong FDA, CE, or other reference approval does most of the work if the dossier is assembled correctly. SFDA regulates SaMD explicitly, including AI/ML-specific guidance, and requires a local Authorized Representative.

• Classification. SFDA classifies software into risk classes A through D on the IMDRF model, mirroring your reference-market class in most cases; the UAE's MOHAP and other MENA authorities lean on the reference approval's classification.
• Timeline. With a reference approval in hand, SFDA marketing authorization (MDMA) typically closes in 2 to 6 months; UAE registration runs a similar range. Without a reference approval, expect materially longer.
• Cost. Government fees across the Gulf are modest — generally a few thousand US dollars' equivalent per authority — so the real spend is dossier assembly, Arabic labeling where required, and local representation. We quote MENA registration programs flat per market, on the same transparent model as our calculator markets.

See the Saudi Arabia and UAE market pages; we cover the wider region from Egypt to Israel under one program.

Evidence, quality system, and lifecycle

Software changes faster than any other device type, and every market has an opinion about what a change means. We set up ISO 13485 and FDA QMSR processes sized for software release cycles and aligned with IEC 62304, the medical device software lifecycle standard,, the medical device software lifecycle standard, plan clinical evidence once for reuse across FDA, EU MDR, and APAC submissions, and maintain cybersecurity documentation that satisfies FDA, EU MDR, and IEC 81001-5-1. After launch, change assessments, version control, and vigilance keep every registration current.

One program, every major market

A global SaMD program is a sequencing problem: pick the anchor market, build the dossier once, and reuse qualification analyses, evidence, and QMS artifacts everywhere else. We run the full program from a single team — strategy, submissions, in-country representation, and post-market maintenance — with transparent government fees and timelines in our pricing calculator.