Guides & updates for medical software teams

NB intake queues are running 13–18 months. The 2027 deadlines will make it worse. Six strategies to pick the right NB, time your submission, and move through review without losing months to avoidable delays.

The EU AI Act's high-risk provisions apply from August 2026. What overlaps with your existing MDR obligations, what is genuinely new, and the AI Act's adversarial robustness requirements for AI SaMD.

IEC 62304 is the standard every NB checks first. Class A, B, C, SOUP management, and how Agile/DevOps teams implement the standard without switching to waterfall.

The CER is the #1 cause of NB major non-conformities for SaMD. What clinical evidence software actually needs, how the systematic literature search works, and how to write a CER that passes on first submission.

NBs now expect ISO 14971:2019. Using the 2007 version routinely generates major non-conformities. Five key changes and exactly what your SaMD risk management file must include to pass NB review in 2026.

New UK medical device regulatory framework in 2026. UKCA vs CE mark transitional rules, the MHRA international reliance route, new GB post-market surveillance requirements from June 2025, and the Northern Ireland split.

CE mark is not the finish line. Once your medical software is live, every bug report and update carries regulatory weight. Support tier structure (L1–L3), ISO 14764:2022 maintenance types, incident classification with SLA table, and the critical question: when does a fix in production become a regulatory event requiring NB notification?

HSA updated its SaMD guidance in December 2025 with new AI provisions, revised change management rules, and strengthened cybersecurity requirements. How EU MDR certified companies register in Singapore and access ASEAN markets.

HSA's CMP (formally incorporated in GL-04 R4, December 2025) lets registered SaMD skip individual Change Notifications for pre-approved update types. Pre-Specified Changes, Flowchart 2.5 for ML-enabled devices, eligibility requirements, and what CMP means for your Malaysia MDA registration via the March 2026 Verification Route.

Practical criteria for selecting the right NB for your SaMD — capacity, SaMD expertise, audit timelines, fees — and the 10 questions to ask before you apply.

Rule 11 of EU MDR 2017/745 determines whether your software qualifies as a medical device. Four-step classification logic, common grey areas (wellness apps, AI diagnostic tools, CDS), and the documents you need.

A 47-point checklist covering the most common QMS gaps in early-stage medical software companies. Use it before your first internal audit or Notified Body engagement to know exactly where you stand.

EU MDR CE mark is your most powerful asset for entering Southeast Asia. Singapore, Malaysia, Thailand, Philippines and Vietnam all have reliance pathways built on your CE certification. Six markets in 24 months — the complete strategy.

TGA explicitly accepts EU MDR 2017/745 certification as conformity assessment evidence, exempting most Class IIa SaMD from mandatory audit. August 2025 TGA guidance aligns with EU MDR. Your existing documentation gets you most of the way there.

TFDA accepts EU NB certificates as reference approvals and has issued SaMD-specific guidelines. The Malaysia–Thailand reliance pilot (Feb–Apr 2026) opens a new fast-track cascade. Everything EU MDR companies need to know about the Thai SaMD market.

47+ point checklist covering all EU MDR Annex II & III requirements: device description, IEC 62304 software lifecycle, ISO 14971:2019 risk management, clinical evaluation, cybersecurity, and PMS/PSUR. Critical NB non-conformity items highlighted.

2-page cheat sheet: all critical 2026 deadlines (EUDAMED 28 May, EU AI Act August, MDD transition), key standards with typical NB gaps, and complete SaMD technical documentation map with checklist. Print and keep on your desk.

CE mark is the start of regulatory obligations, not the end. EU MDR introduces four named post-market documents with mandatory content and update frequencies. PMS Plan vs PMCF Plan vs PSUR vs PMCF Report — what each requires for SaMD, Class IIa/IIb update timelines, and the five findings that trigger non-conformities in NB surveillance audits.