1. The problem CMP solves

Software changes constantly. Under the traditional HSA change notification framework, every new software version — every X.Y.Z update — requires a formal Change Notification (CN) submission to HSA. This creates a structural problem: you cannot submit the next CN until the previous one is fully reviewed and closed.

For a SaMD company shipping monthly releases, or an AI/ML product retraining its model quarterly, this cascade of queued CNs makes agile development practically incompatible with regulatory compliance. You are either delaying releases to wait for regulatory approval, or deploying without it — both of which create serious problems.

Before CMP

Traditional CN process

  • Every version requires a new CN submission
  • Next CN blocked until previous is closed
  • Each CN: separate HSA review cycle
  • ML model retrain = full CN each time
  • Release delays of weeks to months
  • Cascading queue during rapid iteration
With CMP

Pre-Specified Change pathway

  • Anticipated changes pre-approved by HSA once
  • Future updates implemented via your QMS
  • No new CN required for pre-specified changes
  • ML model updates with defined boundaries: faster
  • Annual declaration instead of per-change submission
  • HSA monitors via post-market surveillance
CMP is optional, not mandatory

CMP is an optional regulatory pathway. Companies can continue using the standard CN process. CMP makes most sense for SaMD with frequent, well-defined update patterns — particularly ML-enabled devices where model retraining is a regular operational activity. If your SaMD releases are infrequent and changes are unpredictable, the standard CN process may be more appropriate.

2. Three documents you need to know: GL-04, GN-37, GN-21

Understanding CMP requires reading three HSA guidance documents together. Each one covers a different layer of the framework:

GL-04 Revision 4 (December 2025) — the master guideline

GL-04 is HSA's core regulatory guidelines document for software medical devices. Revision 4, published December 2025, is the first version to formally incorporate CMP into the regulatory framework. It also expanded cybersecurity requirements to align with ISO 81001-1:2021, clarified the scope for machine learning features, and updated terminology to align with IMDRF standards. If you last read GL-04 before December 2025, you need to re-read it — the changes are material.

GN-37 Revision 1 — the CMP rulebook

GN-37 R1 is the dedicated guidance document for the Change Management Program. It defines the eligibility criteria, the Pre-Specified Change (PSC) concept, how to structure a CMP application, reporting obligations, and HSA's monitoring approach. This is the document your regulatory team needs to read in full before preparing a CMP enrolment submission. It covers both standard SaMD and machine learning-enabled medical devices (MLMD) within the same framework.

GN-21 Revision 6 (July 2025) — change notification rules

GN-21 is HSA's guidance on change notifications for all registered medical devices. Revision 6, published July 2025, is significant for SaMD teams for two reasons: it expanded the list of changes that do not require formal notification, reducing administrative burden for minor updates; and it introduced Flowchart 2.5 — a dedicated decision flowchart specifically for machine learning-enabled medical devices to determine the correct change category for model updates, algorithm changes, and retraining activities.

3. Change categories under GN-21 R6

Every software change to a registered SaMD must be classified into one of three categories before implementation. The category determines whether HSA review is required before you can deploy, and whether the change can be managed under a CMP Pre-Specified Change envelope.

Category Definition & SaMD examples Process CMP eligible?
Notification Changes that must be notified to HSA but do not require prior approval. Examples: minor UI changes with no clinical output effect, bug fixes affecting non-safety functions, OS compatibility updates that do not change device behaviour, labelling updates (version number, contact details). Notify post-implementation Yes — can be pre-specified
Technical Changes requiring HSA technical review and approval before implementation. Examples: changes to algorithms affecting clinical output, modification of user interface affecting clinical decision points, changes to intended use population, SOUP updates affecting safety-critical functions. HSA review before deploy Yes — can be pre-specified with defined boundaries
Review Most significant changes requiring full HSA review comparable to a new registration element. Examples: change of intended purpose, major new clinical indication, change of device risk classification, fundamental change to algorithmic approach. Full review, NB-equivalent scrutiny Generally not eligible for PSC
The classification determines everything

Misclassifying a Technical change as Notification and deploying without prior HSA approval is a regulatory violation — regardless of CMP status. The significant change assessment must happen before deployment for any Technical or Review change. GN-21 R6 provides decision flowcharts for GMD, IVD, and AI/ML devices to guide this classification. Do not skip them.

4. Machine learning-enabled devices — Flowchart 2.5

Before GN-21 R6, there was no dedicated guidance on how to classify changes specific to ML-enabled medical devices. Flowchart 2.5, introduced in GN-21 R6 (July 2025), fills this gap. It is the most practically important addition for AI/ML SaMD teams in Singapore.

Flowchart 2.5 covers three types of ML-specific changes:

Model retraining with the same algorithm

If you retrain your existing model on new data without changing the algorithm architecture, the classification depends on whether performance metrics remain within pre-defined thresholds and whether the intended use population changes. Within-threshold retraining on the same patient population is typically a Notification or Technical change. Out-of-threshold performance, or training on a substantially different population, moves into Technical or Review territory.

Algorithm or model architecture changes

Changing the underlying ML architecture (e.g. switching from a convolutional network to a transformer-based approach, or adding an ensemble layer) typically constitutes a Technical or Review change, because it affects the nature of the clinical output generation process even if intended purpose appears unchanged.

Expansion of model use conditions

Any extension of the conditions under which the model is deployed — new clinical settings, new hardware environments, new patient subgroups — requires careful assessment under Flowchart 2.5. These frequently move into Review category and may require updated clinical validation evidence.

CMP and ML — the winning combination

CMP Pre-Specified Changes are particularly powerful for ML retraining that falls in the Notification or Technical category. If you can pre-specify the conditions under which retraining will occur (data volume thresholds, performance metric bands, population scope), HSA can pre-approve that retraining envelope — and future retraining events within those boundaries can proceed without a new CN each time. This is the core value proposition of CMP for AI/ML SaMD companies.

5. How CMP works — Pre-Specified Changes explained

The Pre-Specified Change (PSC) is the mechanism that makes CMP work. A PSC is a description of an anticipated change type — not a specific version, but a category of change — along with the conditions under which it will be made and the V&V activities that will validate it. HSA reviews and approves the PSC as part of the CMP application. Once approved, you can implement any change that falls within the PSC envelope without submitting a new CN.

1
Prepare CMP application Submit via pre-market product registration or Change Notification application. Include: CMP scope (which product, which change types), description of Pre-Specified Changes with implementation boundaries, V&V protocol for each PSC type, QMS change management procedure, ISO 13485 / MDSAP certificate, IEC 62304 lifecycle evidence. No additional enrolment fee
2
HSA reviews and approves CMP HSA assesses the PSC descriptions, implementation boundaries, and V&V protocols. If boundaries are well-defined and the QMS evidence is sufficient, CMP is approved. Approval confirms which changes are covered under the PSC envelope and any conditions on implementation. Standard CN review timelines apply
3
Implement pre-specified changes via QMS When a software update falls within an approved PSC boundary, you implement it using your internal QMS change management procedure — no new CN required. Run the V&V activities defined in the PSC, document the results, update the SMDR registration information with the new software version. No per-change CN submission
4
Submit declaration and implementation record Within 1 year of CMP approval, submit a declaration and implementation record to HSA covering all changes implemented under the CMP during that period. Annual declarations are required thereafter. HSA uses this to monitor CMP activity and verify that implementations stayed within approved boundaries. Annual cycle
5
Out-of-boundary changes: standard CN applies Any change that falls outside the approved PSC envelope must follow the standard GN-21 change notification process. A well-scoped CMP application anticipates most routine changes and keeps the out-of-boundary cases to significant events only. Standard process for out-of-scope changes

6. CMP eligibility and enrolment requirements

CMP is not available to every registered SaMD. HSA requires evidence of regulatory maturity before a manufacturer can operate with the reduced oversight that CMP implies. The eligibility criteria reflect this directly:

Is your QMS ready for CMP enrolment? ISO 13485 certification and IEC 62304 compliance are prerequisites. We help SaMD companies build the QMS foundation that makes CMP possible.
See QMS implementation →

7. CMP and Malaysia — what it means for your MDA registration

Since March 2026, Malaysia MDA permanently accepts Singapore HSA approvals via the Verification Route — the reliance pathway we covered in detail in our Singapore + Malaysia reliance guide. CMP creates an additional layer of benefit for companies with registrations in both markets.

The connection works at two levels:

Change approvals under reliance

When HSA approves a change under the standard CN process, that HSA approval becomes the reference document for a corresponding MDA change notification in Malaysia via the Verification Route. In practice, this means that a Technical change approved by HSA does not require an independent Malaysian technical review — MDA relies on HSA's assessment. The same logic applies to changes approved within a CMP PSC envelope: HSA's oversight of the CMP programme effectively covers the Malaysian regulatory position for reliant devices.

QMS requirements alignment

Both HSA CMP enrolment and Malaysia MDA Verification Route require ISO 13485 certification. A single ISO 13485 certificate covering the relevant scope satisfies both requirements simultaneously. If you are building or extending your QMS for CMP enrolment in Singapore, you are also strengthening your position for the Malaysian market at no additional QMS cost.

Practical recommendation

If you are registering a new SaMD in Singapore and plan to enter Malaysia within 12 months, include a CMP application in your Singapore registration submission from the start. The incremental effort is modest compared to the benefit: you exit initial registration with both an SMDR listing and an approved change management pathway — which then supports both the Singapore ongoing compliance and the Malaysian reliance route simultaneously.

What CMP does not change for Malaysia

CMP is a Singapore-only regulatory pathway. Changes implemented under CMP still need to be communicated to your Malaysian Authorised Representative and assessed against MDA's own change notification requirements. The Verification Route does not create automatic Malaysian acceptance of all HSA-approved changes — it creates a streamlined pathway, not a full bypass. Verify the current MDA change notification requirements for your product class with your Malaysian AR before assuming automatic acceptance.