Revision 4 of GL-04: Singapore Enhances Oversight of Machine Learning-Enabled Software Medical Devices

Singapore’s Health Sciences Authority (HSA) has published Revision 4 of GL-04: Regulatory Guidelines for Software Medical Devices including Machine Learning-Enabled Medical Devices – A Life Cycle Approach. This update introduces enhanced lifecycle governance, stronger cybersecurity requirements, and clarified oversight of machine learning (ML) functions within Software as a Medical Device (SaMD).

The guideline applies to embedded software, SaMD, Artificial Intelligence-enabled Medical Devices (AIMD), and Machine Learning-enabled Medical Devices (MLMD). Manufacturers implementing pre-specified changes under HSA’s Change Management Program (CMP) must also follow these updated expectations.

Purpose of GL-04 Revision 4

GL-04 Revision 4 was released to:

• Clarify the inclusion of machine learning features in medical device software

• Expand regulatory expectations across the software lifecycle, including cybersecurity and post-market responsibilities

• Align definitions and terminology with international standards (IMDRF, ISO 81001-1)

• Formally incorporate the Change Management Program (CMP) as a pathway for pre-approved software and ML updates

Scope of Application

This guideline applies to:

• Software embedded in medical devices

• Software as a Medical Device (SaMD)

• Artificial Intelligence-enabled Medical Devices (AIMD), including Machine Learning

• Manufacturers implementing software changes under the CMP framework

Revision 4 explicitly clarifies that ML-enabled software falls under HSA’s regulatory oversight.

Key Highlights of Revision 4

1. Expanded Scope and Definitions

• Section 1.1 confirms ML-enabled functions are regulated under SaMD requirements

• Section 1.4 introduces updated definitions harmonized with IMDRF:

• Artificial Intelligence-enabled Medical Device (AIMD)

• Machine Learning (ML) and MLMD

• Cybersecurity per ISO 81001-1

• Compensating controls per IMDRF guidance

2. Cybersecurity Enhancements

• Section 8 reorganizes cybersecurity expectations, with added focus on Operating System End-of-Support (EOS)

• Key points include:

• Post-market planning for patches and updates

• Documentation and labelling related to EOS

• Prohibition of devices running unsupported OS if risks cannot be mitigated

3. Machine Learning-Enabled Medical Devices (MLMD)

• Section 9 refines oversight for MLMD, including:

• Regulatory classification

• Pre-market registration requirements for ML functions

• Documentation and evaluation of ML models

• Ensures consistent regulatory review of ML algorithms

4. Change Management Program (CMP)

• Section 10 formally incorporates CMP, aligned with GN-37 Revision 1

• Allows faster deployment of pre-approved software and ML updates

• Manufacturers must submit implementation records within 1 year of CMP approval, followed by annual declarations

Implications for Manufacturers and Stakeholders

GL-04 Revision 4 reflects HSA’s strengthened focus on continuous lifecycle governance. Manufacturers are expected to implement:

• Strong change control processes

• Robust cybersecurity risk management including EOS planning

• Comprehensive post-market monitoring

• Clear documentation of ML model behavior and updates

The CMP provides a streamlined mechanism for deploying updates efficiently while maintaining regulatory oversight. Organisations with mature QMS and well-defined change boundaries will benefit the most from this framework.

Regulatory Resources

• Full guideline: HSA GL-04 Revision 4 PDF

• HSA Singapore Medical Device Registration

Cost Planning for Manufacturers

Manufacturers can now generate an instant cost estimate for regulatory services across multiple markets using Pure Global’s interactive Fee Calculator.

‍