Singapore HSA SaMD registration: 2026 lifecycle guide

Why Singapore matters for SaMD companies

Singapore's HSA is one of Asia's most rigorous and internationally respected medical device regulators. An HSA registration is often used as a gateway to broader ASEAN market access — several ASEAN member states recognise HSA approvals through the ASEAN Medical Device Directive mutual recognition framework. For SaMD companies with EU MDR certification, Singapore is frequently the first Asian market to target. Once certified under EU MDR and UKCA, both because of HSA's international alignment and because the documentation requirements are compatible with MDR evidence.

Singapore also has a particular focus on digital health and AI. The city-state has positioned itself as Asia's digital health hub, and the HSA has been proactive in developing specific guidance for AI medical devices — guidance that has now been updated in December 2025 to reflect the rapid evolution of AI in healthcare.

The December 2025 HSA guidance update — what changed

The December 2025 update to HSA's GL-04 Regulatory Guidelines for Software Medical Devices (Life Cycle Approach) is the most significant revision to Singapore's SaMD regulatory framework since the guidance was first published. Key changes:

AI-enabled medical device provisions

The updated guidance now explicitly addresses machine learning-enabled SaMD as a distinct category. New requirements include:

• Training and validation dataset documentation — HSA now expects manufacturers to document dataset size, demographic composition, source clinical settings, labelling methodology, and quality assurance processes for training data
• Performance monitoring — AI SaMD must have a documented post-market performance monitoring process that includes detecting model drift, distribution shift, and degradation in prediction quality over time
• Continuous learning controls — for AI models that update based on post-deployment data, HSA requires documented controls governing when and how model updates are implemented, including the change management classification of model updates
• Explainability documentation — for clinical decision support AI, documentation of how the model's outputs should be interpreted and what the clinical users should do when the algorithm's output conflicts with their clinical judgment

Revised change management provisions

The 2025 revision provides clearer criteria for classifying SaMD changes under HSA's tiered change management framework:

• Significant changes (requiring full Technical and Review submission): Changes to intended use, changes to the risk classification of the software, major algorithm changes that affect clinical performance, new clinical indications, changes to cybersecurity architecture
• Notification changes (technical notification required): Changes to device connectivity, OS changes, changes to cybersecurity controls, interface changes affecting usability
• Non-significant changes (notification only): Bug fixes, minor UI improvements that do not affect intended use, cybersecurity vulnerability patches

Cybersecurity strengthening

The December 2025 update strengthens HSA's cybersecurity expectations significantly, with new provisions covering operating system end-of-life management. SaMD manufacturers must now document a plan for managing cybersecurity risks when the device's underlying operating system approaches end of support — this is relevant for software deployed on clinical infrastructure where OS updates may be constrained.

How EU MDR documentation maps to HSA requirements

For companies with existing EU MDR certification, the HSA registration process is significantly more efficient than starting from scratch. Here is how EU MDR documentation maps to HSA requirements:

• Technical documentation: EU MDR Annex II documentation generally covers the essential information HSA requires. The device description, risk management file (ISO 14971), software documentation (IEC 62304), and usability engineering documentation (IEC 62366) satisfy HSA's technical evidence requirements. HSA uses the ASEAN CSDT (Common Submission Dossier Template) format, which maps closely to IMDRF guidance that EU MDR already aligns to.
• Clinical evidence: EU MDR CER clinical evidence can be used for HSA submission. HSA accepts clinical performance data from other markets if the patient population is broadly representative.
• QMS: ISO 13485 certification is the prerequisite for HSA manufacturer licensing — which is already required for EU MDR compliance. No additional QMS certification is needed.
• Cybersecurity: MDCG 2019-16 compliant cybersecurity documentation generally satisfies HSA cybersecurity expectations, with additions for the OS end-of-life management provisions in the December 2025 update.

The HSA registration process for SaMD

1. Determine device classification under HSA's Class A–D framework. Most clinical SaMD is Class B or C. AI diagnostic tools are often Class C or D.
2. Establish a Singapore Product Registrant — unless you are a licensed importer yourself, you need a Singapore-based licensed distributor to hold the registration.
3. Prepare the CSDT dossier — compile your submission in ASEAN Common Submission Dossier Template format, with Singapore-specific sections.
4. Submit via HSA's MEDICS online platform for device registration.
5. Respond to HSA queries — HSA typically issues queries during the review. Response timelines matter: slow responses can significantly extend review times.
6. Maintain post-market obligations — once registered, Singapore requires ongoing adverse event reporting, change notifications, and periodic renewal.