Comparative Analysis of Regulatory Pathways for Software as a Medical Device (SAMD) In The US, EU, And Asia-Pacific Regions

Software as a Medical Device (SaMD) represents a medical software which is used independently for medical purposes that are not incorporated into any physical medical device.^[1] The role of SaMD is growing involving diagnostics using AI and decision support for therapy, so growth needs rules that balance new tech progress with health needs for patients and people. Local healthcare contexts plus legal traditions with technological readiness have influenced throughout the divergent frameworks. Around the world, regulatory authorities have developed these frameworks. Yet, the different levels of regulatory science maturity and the diverse culture in managing risk have created divergent timing to adopt AI-based SaMD. Since developers aim for multinational markets, navigating all these diverse pathways is just complex and also critical. With its diverse range of established and developing regulatory frameworks-including those in China, Japan, Australia, and Singapore-the Asia-Pacific area provides insightful viewpoints on how regulations are changing to meet the demands of digital health. This research undertakes a comparative assessment of SaMD regulatory pathways in the US, EU, Japan, China, and Australia, Singapore elucidating convergence and divergence, and highlighting challenges in regulatory science for emerging technologies. Furthermore, the advent of cloud platforms, interoperability needs, and cybersecurity issues further complicated the regulation of SaMD and rendered cross-border compliance a complex challenge. The use of real-world evidence (RWE) in regulatory decision-making is also becoming more critical, as conventional clinical trial models might not necessarily reflect the dynamic aspects of AI/ML-powered SaMD. Moreover, differences in post-market surveillance infrastructures—ranging from voluntary reporting to mandatory adverse event reporting—can have profound impacts on monitoring patient safety and regulatory action.^[2] Global collaborative efforts, like those led by the IMDRF, are striving for more harmonization, but regional priorities and market-related obstacles still continue to restrict complete regulatory convergence. As digital health ecosystems expand, whether the regulation systems can match fast adaptation with being stringent on regulatory control will be the defining feature of global success for SaMD innovation.^[3]

Data Sources:

This study employed qualitative comparative policy analysis in studying regulatory frameworks governing SaMD across the US, EU, Japan, China, and Australia. Data were collected from:

• Statutes and guidance documents issued by TGA, PMDA, European Commission, and FDA regulatory groups.
• IMDRF consensus documents, including position papers on SaMD risk categorization and standards. In particular, the “SaMD: Key Definitions” and “SaMD: Risk Categorization” guidance provide the baseline for most national frameworks, ensuring conceptual consistency even where procedural approaches differ.
• Expert commentaries with peer-reviewed literature published from 2012-2024, stressing AI-based SaMD oversight with regulatory analysis.^[4,5,6,7]
• National legal and regulatory texts are those which do include the US Federal Food, Drug, and Cosmetic Act, EU MDR Regulation (EU) 2017/745, Japan’s Pharmaceuticals and Medical Devices Act, and the Australian Therapeutic Goods Act.

A comparative content analytic approach extracted then compared definitions of SaMD, classification criteria plus risk stratification, requirements for premarket submission or conformity assessment, clinical evidence along with evaluation standards, post-market surveillance mechanisms, plus regulatory approaches to AI-driven as well as continuously learning software. A comparative matrix showed similarities and differences, regulating toward maturity, easing innovation, and challenging.

Definitional And Guiding Framework:

Understanding what Software as a Medical Device (SaMD) is constitutes a significant aspect of comparing and analysing regulatory frameworks. With nations converging or diverging in their respective interpretations of the regulations, terminology with clear definitions contribute to their respective interpretations of the regulations, terminology with clear definitions contributes to the identification of borders and compliance risks to this software. This International Medical Device Regulators Forum (IMDRF) plays a central role in promoting harmonization on an international level.  IMDRF defines SaMD as “software intended to be used for one or more medical purposes that perform these purposes without being part of a hardware medical device”.^[1,8] SaMD is a medical device and also covers in-vitro diagnostic (IVD) medical device. It can operate on general purpose (non-medical purpose) computing platforms and it can also be combined (e.g.as a module) with other products such as medical devices.^[8] It can be interfaced with other medical devices including hardware medical devices and other SaMD software, as well as general purpose software.  Software is not considered to be SaMD if its intended use is to control a hardware medical device. Mobile applications which satisfy the above definition are SaMD.^[1,8] By establishing a consistent framework for identification and classification, this expansive definition supports international regulatory alignment initiatives. Crucially, it focusses on standalone software designed for illness diagnosis, prevention, monitoring, treatment, or management, excluding software that is essential to a hardware medical equipment.

Jurisdictional Interpretations

United States: The FDA follows the IMDRF definition but uses enforcement discretion for low-risk software (such as wellness applications) to avoid over-regulation, focusing on functional risk and not on the type of software. This discretion reflects the FDA’s prioritization of resources toward higher-risk digital health technologies, recognizing that excessive oversight for benign applications could stifle innovation. This adaptive model facilitates iterative software revisions and agile development, essential in the rapidly changing AI/ML-based SaMD industry.^[5,9,10]

European Union: Under Regulation (EU) 2017/745 (EU MDR) software is classifies as a medical device if its intended purpose fits into “medical purposes” defined in Article 2. The EU clarified software qualification more with landmark rulings such as the CJEU’s Snitem ruling, acknowledging prescription support software as SaMD despite no direct physical contact with humans.^[5,11] This ruling was significant in shaping EU jurisprudence on SaMD, as it established that clinical decision support software could qualify as a medical device even in the absence of direct patient interaction. The qualification criteria are outlined in MDCG guidance documents (e.g., MDCG 2019-11), providing additional specificity for manufacturers regarding qualification.^[5,11]

Asia-Pacific:

Japan: The Pharmaceuticals and Medical Devices Act (PMD Act) explicitly covers SaMD, applying a risk based approach conforming to IMDRF classes and requiring pre-market approval for non-low-risk devices. Japan’s utilization of third-party review organizations expedite4s the examination of some SaMDs, particularly Class II devices.^[8,12]

China: The National Medical Products Administration (NMPA) has independent medical software as part of its medical device classification, with specific registration requirements, particularly for more risky categories. The regulation emphasizes localisation and local clinical data. In recent developments, the NMPA highlights pilot zones for innovation in digital health, with custom clinical trial policies for AI-driven software.^[8,13]

Australia: The Therapeutic Goods Administration (TGA) regulates software in line with IMDRF, recently making it possible for low-risk software to avoid registration to promote innovation. Risk classification determines regulatory requirements. Regulatory sandboxes have also been introduced by TGA to facilitate early-stage digital health technologies with less compliance burden.^[8,12]

Singapore: The Health Sciences Authority (HSA) classifies SaMD into four risk classes (A-D), with registration depending on risk and intended use, and permits acceptance of international regulatory clearances to facilitate expediting evaluations. This reliance mechanism significantly reduces time-to-market for products already reviewed by stringent regulatory authorities, improving access without compromising safety. The collaboration of HSA with APEC centers further enhances regulatory convergence and capacity building in digital health.^[8] All studied regions align substantially with software that is intended for medical purposes independent of hardware medical devices according to the IMDRF’s foundational definition of SaMD.^[4] Because the IMDRF SaMD working group has guidance documents on risk categorization along with quality management, those documents have become de facto international references shaping national regulations with easing efforts toward harmonization.^[4] “Medical purpose” interpretation and classification rules show slight regional differences given this shared foundation. These variations impact upon regulatory requirements.^[5] Such definitional inconsistencies can arise from different national legal languages, healthcare institutions, and readiness for new technologies. For example, some regulators will emphasize clinical context more than others; others will emphasize what the software does, functionality, and real-time risk. Also, new technologies like AI/ML-integrated SaMD creates architectural tension and requires updates in guidance. Jurisdictions have the tooling to develop specific regulatory policies directly reflecting how software meets the threshold of "medical purpose,” especially under rapidly changing digital health environments such as in the US.   In conclusion, while national interpretations of SaMD will inherently measure against the IMDRF definition, there are subtle legal and procedural differences that reflect local priorities and regulatory philosophies. These definitional bases have direct implications for classification, evidence, and market entry approaches that set the stage for a comparative assessment on policy.^[14,15]

RESULTS:

Regional Analysis:

1. United States (FDA):

FDA follows the IMDRF definition but uses enforcement discretion for low-risk devices to avoid over-regulation, focusing on functional risk and not on the type of software. This discretion reflects the FDAs prioritization of resources toward higher-risk digital health technologies, recognising that excessive oversight for benign applications could stifle innovation. ^[5,10] FDA regulates the SaMD through its Center for Device and Radiological Health (CDRH).^[16] It considers SaMD under the Federal Food, Drug, and Cosmetic Act, applying a risk-based classification system from Class I (low risk) to Class III (high risk) distinctions.^[4]

Class I: Low risk devices.^[16] These are exempted from pre-market notification.

Class II: Moderate risk devices.^[16] These require 510(k) clearance demonstrating substantial equivalence to already FDA approved reference device, also called as predicate devices.

Class III: High risk devices.^[16] These require Premarket Approval (PMA) with stringent clinical evidence.^[16]

Regulators do allow for exemptions for some low-risk devices which is just one type for submissions.  Initiatives such as that of the Digital Health Software Precertification Pilot Program and also the AI/ML Action Plan exemplify leadership from the FDA adapting regulatory pathways to digital health innovations that are designed for addressing the challenges of continuously learning algorithms.^[4,6] However, critiques note potential gaps regarding evidence requirements, especially when 510(k) clears moderate-risk devices, because predicate device equivalence has sometimes caused insufficient clinical validation and post-market safety issues.^[6,7] For novel devices which is having no predicate device with low-moderate risks, De Novo Classification is employed for premarket evaluation. For high-risk SaMD, requiring rigorous clinical evidence  Premarket application should be submitted.^[6]  FDA  also encourages the use of Real-World Evidence (RWE) to assess the performance and safety of Software as a Medical Device (SaMD) after they are approved for market release, leveraging initiatives such as the National Evaluation System for health Technology (NEST). AI-driven SaMD that adapt their algorithms over time introduce unique regulatory concerns. To address these, recent FDA guidance emphasizes the importance of structured approaches to software modifications, including the use of predefined "Predetermined Change Control Plans”, that define the scope of accepted algorithm updates without necessitating a new submission for every change ensuring regulatory oversight is maintained across the product’s lifecycle.^[17,18] The FDA’s post-market surveillance reveals software-related recalls, showing many recalled devices entered the market without strong safety, which spotlights regulatory gaps.^[6] FDA also issues guidance on cybersecurity in premarket submissions and post market risk management.^[2]

2. European Union (MDR):

The EU’s Medical Device Regulation (MDR 2017/745) strengthened pre-market requirements as well as provided regulatory oversight for SaMD, beyond it replaced the previous MDD framework.^[2,9] By reason of MDR software classification rules, Rule 11 in Annex VIII, in particular, has resulted in more SaMDs falling under higher risk classes such as IIa or above therefore Notified Body assessment and CE marking are indeed needed.^[2,5] Software that provide information are typically classified as Class IIa, but if its incorrect outputs could leads to serious deterioration or surgical intervention, then it moves up to Class IIb and if it could result in death or irreversible deterioration, it moves up to Class III. Unless the parameter being monitored is critical to sustaining life, in which case it is brought to Class IIb, software intended for monitoring physiological functions is typically Class IIa. All other SaMDs not meeting these criterias are classified as Class I. This framework results in stringent regulatory scrutiny as  those software applications that were once categorised as low-risk under the MDD are now categorised as moderate or high risk. In addition to shift structured post-market surveillance has become a part of it, and also includes Periodic Safety Update Reports(PSUR). For Class IIb and III SaMD, PSUR is to be updated not less than yearly, but for Class IIa devices not less than every two years.^[2,9] Under the MDR in EU, it is mandatory for devices significantly software based devices like SaMD to demonstrate that it performs their intended functions with high standards of clinical evidence, conformity assessment including cybersecurity considerations and post-marketing surveillance.^[2,19] Designated third-party organizations known as Notified Bodies are responsible for conducting conformity assessments to ensure that products meet the requirements set out in the Medical Device Regulation (MDR). Their role is particularly significant in evaluating software and digital health solutions; however, the level of technical expertise varies across these bodies, which can influence both the duration of the approval process and the ability to enter the market. Once a product successfully passes the assessment, it is granted the CE mark, signifying its compliance with the EU’s safety and performance criteria. EU MDR 2017/745 also mandates use of Unique Device Identification system for all medical devices including SaMD.^[2,20] Based on the MDR classification, SaMD manufacturers encounter various conformity assessment pathways: Class I SaMD are eligible for self-certifications while Class IIa, IIb, and III devices requires notified body participation, which includes thorough technical file reviews and audits of the quality management systems.  International standards like ISO 13485 for quality management, ISO 14971 for risk management, IEC 62304 for software lifecycle processes, and IEC 62366 for usability engineering must be followed in order to be considered compliant. To prove compliance, manufacturers must provide comprehensive technical documentation that addresses software design, validation, risk assessment, and cybersecurity considerations.^[2,19] Regardless of risk class, all SaMDs are required to undergo clinical evaluation under Article 61 of the MDR. Producers are also encouraged to include post-market clinical follow-up (PMCF) studies in their surveillance plans to mitigate lingering risks and uncertainties regarding long-term performance. By requiring a more thorough demonstration of safety and performance through clinical data—which can include clinical investigations, scientific literature, and real-world evidence (RWE)—the MDR strengthens previous regulations. By requiring a more thorough demonstration of safety and performance through clinical data—which can include clinical investigations, scientific literature, and real-world evidence (RWE)—the MDR strengthens previous regulations.^[5,21] MDR also mandates post-market surveillance (PMS) by which manufacturers have to set up and maintain PMS systems proportionate to risk of the device. Regular submission of Periodic Safety Update Reports (PSURs) and Post-Market Clinical Follow-Up (PMCF) reports is required for Class IIa and higher. The goal of PMS activities is to record performance trends, efficacy information, and emerging safety signals in authentic clinical settings. Along with traceability measures like Unique Device Identification (UDI) to enable effective field safety corrective actions (FSCAs), the vigilance system requires the timely reporting of serious incidents with a specified urgency based on event severity.^[2,21]  The general safety and performance criteria in the MDR include cybersecurity requirements, despite the absence of clear, stand-alone cybersecurity clauses. Manufacturers are required to put policies in place to guard against illegal access, preserve the confidentiality and integrity of data, and guarantee safe software updates. In addition to MDCG guidance (MDCG 2019-16), pertinent standards such as ISO/IEC 27001 and IEC 62443 offer comprehensive instructions on how to manage cybersecurity risks that are appropriate for the software's connectivity and functional criticality. These clauses attempt to reduce risks without sacrificing clinical utility in light of the growing vulnerability of networked medical software.^[2,17] The analysis indicated that stringent enforcement of clinical evaluation and post-market evaluation within MDR could potentially enhance the safety and performance of AI-based SaMDs entering the European market, assuming there is proper enforcement and expertise within the Notified Bodies.^[2,7] However, there are still inconsistencies due to the implementation across other member states and the use of private Notified Bodies with varying measurement benchmarks.^[7]

3. Asia-Pacific Region:

Japan (PMDA/MHLW): 

Japan controls SaMDs within the boundaries of Pharmaceutical and Medical Device Act (PMDA)  administered by the Pharmaceuticals and Medical Devices Agency (PMDA) alongside Ministry of Health, Labour and Welfare (MHLW) with a risk classification as class I to class IV. Moderate to high risk SaMDs need to go through detailed scrutiny (Shonin) by PMDA and MHLW.^[4,22] Pre-market applications are necessary for Class II,III and IV medical device programs, but not for Class I programs since they are not governed by the Pharmaceutical and Medical Device Act. Third Party Certification Bodies designed by MHLW evaluate 128 applications for Class II Medical Device Programs in accordance with the Certification Standard. The PMDA reviews the majority of the Class III and IV Medical Device Program Applications.^[22,23] Japan is at the forefront of regulatory innovation and is testing “dynamic approvals”, a form of real-time update for AI and ML-based SaMDs which showcases a positive attitude toward adaptive algorithms.^[4,22] Japan’s regulatory framework also adapts a risk-based approach to classifying medical devices, placing greater scrutiny on novel AI-driven Software as a Medical Device (SaMD), For such technologies, detailed clinical and technical assessments are mandatory. Current regulatory expectations highlights the need for algorithm validation using clinical evidence and clearly defined performance indicators.  Clinical assessment requirements for SaMD, especially for new technologies such as AI and ML, are strict. Japan mandates disclosure of detailed performance characteristics and data underlying AI algorithms, including training, validation and testing databases, in addition to clinical trial data when relevant. Review by the PMDA  meticulously examines algorithm accuracy (sensitivity, specificity) and risk-benefit profiles with real-world use applicability.^[17,24]  Cybersecurity requirements are officially integrated into Japan's SaMD requirements for regulation. The applications need to demonstrate secure software lifecycle management with regard to encryption, access controls, and secure updates, with conformance promoted to international standards like ISO/IEC 27001 and IEC 62304. Additionally, these security practices need to be maintained throughout the lifecycle of the device, with appreciation for ongoing threats due to software updates or patching operations. Patient privacy is also ensured under Japan's Act on the Protection of Personal Information (APPI), particularly relevant for cloud-based SaMD working with sensitive information.^[9,18] In September 2023, MHLW introduced “Digital Transformation Action Strategies (DASH) for SaMD 2”. It focuses on creating a clearer and faster route to commercialization for SaMDs.  This introduced two stage approval system. Initial approval is granted for limited set of intended uses based on how well software performs during preliminary testing, even if clinical significance is not fully established. Second stage of approval system is obtained after additional data and real world evidence become available. DASH for SaMD 2 has established guidelines for review approval and marketing procedures for SaMD for the general public. It also promote overseas recognition of review outcomes such as English translation of review reports. Furthermore it give financial support through subsides to assist SaMD developers with their development costs and provides guidance to help them expand their business into international market.  Japan requires strong post-market surveillance measures that align with its lifecycle strategy for device safety. These are mandatory adverse event reporting within specified time windows, serious events directly reported to PMDA and MHLW. Significantly, post-marketing review for some Class III SaMD is done between 6-10 years following approval, allowing review of the device’s risk-benefit profile in light of clinical experience and real-world evidence- a strategy slightly more engaged than most Western equivalents. Renewals and recertifications on an ongoing basis also help to ensure safety and efficacy benchmarks in changing clinical settings.^[9,22]

China (NMPA):

China’s regulatory body, National Medical Products Administration (NMPA) previously known as China Food and Drug Administration (CFDA) regulates the SaMD under the scope of Medical Device Supervision and Administration Regulation (MDSAR). NMPA has classified SaMD based on their intended use, clinical significance of provided information and potential patient harm into three classes:

Class I: Low risk SaMD. Generally do not require pre-market clinical evaluation. Only record filing is necessary.

Class II: Moderate risk SaMD. Requires registration with NMPA, pre-market clinical evaluation in some cases and more stringent technical review and testing.

Class III: High risk SaMD. Require full NMPA registration with mandatory pre-market clinical review and detailed cybersecurity and validation of performance.

NMPA has strict controls whereby Class I requires filing and class II and III products require extensive clinical testing, as well as providing clinical evidence, and voluminous paperwork.^4,22 Notable features are the compulsory provision of source code, strict regulations regarding data storage localization, and translation to local languages.⁴ These global requirements continue to strain manufacturers, but recent guidance seems to allow room for AI-based Software As A Medical Device (SaMD) and for novel technologies to be considered, which indicates some form of progress towards regulatory modernization.^[4,22] China needs an end-to-end cybersecurity compliance program under several concurrent overlapping legislation: The Cybersecurity Law (2017), Data Security Law (DSL, 2021), and Personal Information Protection Law (PIPL, 2021). All SaMD developers need to ensure a safe software development process, patient data encryption for useful data, audit trails, and user authentication. China has robust data localization laws prohibiting the export of sensitive healthcare data until certain government approval is received.   These converging laws require more stringent and nationally directed cybersecurity controls than US and EU counterparts, in which privacy law (e.g., GDPR) and device-specific regulation exist but do not typically feature obligatory data localization.^[2,24]

China has active post-market surveillance for Class II and III SaMD, including:

• 15 calendar-day mandatory adverse event reporting.
• 5-year review cycles for devices.
• Provincial and national regulatory oversight.
• Manufacturers’ obligation to report software changes that impact safety or clinical performance, subject to review by the regulators; small user interface modifications can be submitted as notifications.^[24,25]

Post-market vigilance in China is more conservative compared to US and EU systems, particularly in managing software changes, indicative of a conservative attitude towards software updates that can impact clinical effects.

Australia (TGA):

Australia’s regulatory body, Therapeutics Goods Administration regulates the SaMD under various existing medical device frameworks such as Therapeutic Goods Act 1989 and Therapeutics Goods (Medical Devices) Regulations 2002. It lays down the rules for classification, essential principles and conformity assessment procedures. Australia follows an IMDRF-compliant risk classification system and in the 2021 reforms, the classification level of some types of SaMD, like mental health apps, was upgraded.^[1] Regulatory pathways include self-declaration for Class I and Conformity Assessment with ARTG listing for higher classes.^[4] The TGA streamlines regulatory burden by recognizing some foreign approvals (FDA, EU) which reduces overlap in evaluation and streamlines access to markets.^[4]  The new rule 11 of the TGA classification system (2021) gives additional nuance specifically for software, differentiating instances like AI-diagnosis tools (Class III) from lifestyle or low-risk classification software (usually exempt). The classification reflects global trends but has nuanced differences, e.g., Singapore’s first four-class system compared to the US and EU’s three-class ones.^[9,23] Australian clinical assessment is risk-stratified: low-risk SaMD can be supportive by literature reviews or predicate equivalence, whereas more risky SaMD require high-quality clinical performance data. TGA recognizes the utility of Real-World Evidence (RWE) and post-market clinical follow up in supplementing premarket data, especially relevant as AI/ML solutions increase in prevalence. This method, with its focus on adaptive clinical evidence generation and lifecycle assessment, is in line with global programs, such as FDA’s adaptive regulatory strategies and the EU MDR’s Enhanced Clinical Evaluation Reports (CERs).[^9,23,26] Australia’s policy approach to AI/ML-driven SaMD is in transition, with emphasis on regulation of “locked” algorithms-those which do not evolve after approval. Dynamic, learning algorithms are still prohibited unless robust prospective control is shown, echoing international conservatism regarding risks of emergent AI bias and unpredictability in clinical decision-making. The TGA is actively involved in IMDRF’s AI working groups and is increasingly aligning policy with international approaches like the FDA’s Total Product Lifecycle (TPLC) strategy, supporting explainability, transparency, dataset diversity, and post-market monitoring of Continuous Learning AI performance. Standard setting for continuous learning AI, however represents a regulatory frontier necessitating iterative stakeholder consultation. Australia's policy approach to AI/ML-driven SaMD is in transition, with emphasis on regulation of "locked" algorithms-those which do not evolve after approval. Dynamic, learning algorithms are still prohibited unless robust prospective control is shown, echoing international conservatism regarding risks of emergent AI bias and unpredictability in clinical decision-making. The TGA is actively involved in IMDRF's AI working groups and is increasingly aligning policy with international approaches like the FDA's Total Product Lifecycle (TPLC) strategy, supporting explainability, transparency, dataset diversity, and post-market monitoring of Continuous Learning AI performance. Standard setting for continuous learning AI, however, represents a regulatory frontier necessitating iterative stakeholder consultation.^[24,26,27] TGA enforces conformity with established cybersecurity standards (e.g., IEC 62304, ISO/IEC 27001), where manufacturers are required to provide evidence of secure design of software, patch management, authentication control, encryption, and cyber incident response processes. Guideline documents ensure manufacturers take responsibility for continuous risk reduction across the software life cycle, such as security vulnerability management and timely notification of cyber incidents likely to impact safety or performance. These steps mirror the increasing attention on cybersecurity evidenced in US and EU policy, supporting patient data protection in the face of growing digital health threats.^[9,18]

Singapore (HSA):

In Singapore, SaMD is regulated by Health Sciences Authority under the Health Products Act (HPA). SaMD are classified into four tier classes

• Class A: Low risk
• Class B: Low-moderate
• Class C: Moderate-high
• Class D: High risk ^[9,28]

It is based on the intended use of the software and potential impact on patient safety. This classification relies mainly on two elements: the severity of the health issue being tackled and the importance of the information the software delivers to clinical choices.^[11] Unless excluded, SaMD must register with the HAS in order to be sold in Singapore. The Verification Route, The Abridged Evaluation Route, and the full Evaluation Route are the three primary regulatory processes. When a SaMD needs a comprehensive technical dossier with clinical proof and has not been approved by any reference regulatory body, the Full Evaluation Route is utilized. With less paperwork needed, the Abridged Evaluation route enables quicker clearance for SaMDs at have already received approval from reference organizations such as the FDA,TGA, or EU Notified Bodies.  For SaMDs that are identified in design and labelling to devices registered with these reference organizations, the Verification Route is the fastest. The Common Submission Dossier Template format, which conforms with GHTF and IMDRF, is typically used for the submission dossier.^[9,23] In Singapore, it is mandated to conduct clinical evaluation for Class C and D SaMDs. Singapore does not have a separate regulatory framework especially for AI/ML based SaMD, these are reviewed under existing SaMD regulations. HSA focuses on algorithm transparency, cybersecurity and clinical validation. It is necessary to report changes in algorithms or functionalities.^[5,24] Post-marketing surveillance in Singapore is rigorous than FDA and EU MDR. Serious adverse events should be mandatorily reported within 10 calendar days and field safety corrective actions are also implemented. Whenever necessary field safety notices are issued to inform users of potential risks.^[5,28] HSA also encourages adoption of stringent cybersecurity practices and software lifecycle management.^[9,23]

Comparative Summary Table: