Software as a Medical
Device, Demystified Worldwide

What is the IMDRF SaMD risk categorisation and how does it affect my global strategy?

The IMDRF framework categorises SaMD from I to IV based on two factors. These are the significance of the information your software provides to a healthcare decision, and the seriousness of the healthcare situation it's used in. Most national regulators, from the UK to Australia to the UAE, build their own classification rules on this same underlying logic, so understanding your IMDRF category early gives you a reliable baseline before adapting to each market.

If I'm already CE marked or FDA cleared, can I reuse that approval in other markets?

Often, yes, at least partially. Many jurisdictions, including the UAE and parts of the GCC, offer recognition or reliance pathways that accept prior CE marking or FDA clearance as supporting evidence for faster local registration. It's rarely a straight pass-through though; you'll typically still need market-specific technical documentation, labelling and local representation. Sequencing your target markets around where you already have approvals can save real time and cost.

Which country should I get regulatory approval in first for my software?

There's no single right answer. It depends on where your priority customers are, but many companies start with the market that gives them the most reusable evidence, since a strong technical file built to one major framework's standard usually transfers well to others sharing IMDRF's underlying logic. We help clients sequence markets strategically rather than tackling each one from scratch, which is where most of the wasted time in global expansion actually comes from.

Do different countries classify the same software differently?

Yes, and it catches a lot of founders out. Even though most frameworks share IMDRF's core logic, the specific classification thresholds, categories and evidence requirements are set independently by each regulator, so software that's low-risk in one jurisdiction can be classified significantly higher in another. Planning your classification market by market, rather than assuming one result applies everywhere, avoids delays late in your expansion timeline.

What's the minimum documentation I need before expanding my SaMD into multiple markets?

At minimum, you need a robust software lifecycle file built to IEC 62304, a risk management file under ISO 14971, and clinical evidence proportionate to your IMDRF risk category. This core package forms the backbone that most jurisdictions' local requirements build on top of. Getting this foundation right once, rather than rebuilding it per country, is what actually makes multi-market expansion efficient.

Does my AI-based software need a different global strategy than standard SaMD?

Yes. AI-based software faces an extra layer of jurisdiction-specific requirements on top of standard SaMD rules, from the EU AI Act's high-risk provisions to FDA's Good Machine Learning Practice expectations, and these don't always align neatly with each other. Building AI governance evidence, such as alignment with ISO/IEC 42001, into your core technical file early makes it much easier to adapt as you enter each new market.

Do I need to repeat testing or clinical evaluation for every country I sell my software in?

Not always from scratch. Your clinical evaluation and verification and validation evidence is often reusable across markets provided the software, its intended use and its algorithm stay the same, and some regulators will lean on an existing CE mark or FDA clearance rather than demanding entirely new evidence. What does still need addressing per market is local technical documentation and registration, plus any market-specific requirements such as the UK's DTAC for NHS software. We review what you already have before recommending any new work.

Do you review marketing claims, social media, paid ads and influencer content, not just your app store listing?

Yes. Claims compliance doesn't stop at your product listing, so we review marketing wherever it appears, including your website, social media, paid advertising and influencer or affiliate content, since regulators treat all of these as regulated marketing for a medical device. It's often overlooked material like a website claim or a paid ad headline that creates risk, even when the technical file itself is solid.

Do you monitor for upcoming regulatory changes, or just handle one-off compliance projects?

Yes, horizon scanning is part of our ongoing support. We track upcoming changes to UK MDR, EU MDR, the EU AI Act and other regional software-specific requirements across the markets you sell in, so you hear about a change that affects your product before it becomes a compliance problem, rather than finding out after the fact. It's built into our ongoing compliance service rather than something you need to ask for separately.

What trade associations is Taylored Consultancy a member of?

We're members of PAGB, the trade association for the UK consumer healthcare industry, which represents OTC medicines, self-care medical devices and food supplements. That connection keeps us close to how digital health and software regulation is actually developing, which feeds directly into the advice we give clients.

Still have questions? Contact us and we'll be happy to help.