Software as a Medical Device – Health Canada Guidance Overview

Purpose and Scope

The Software as a Medical Device (SaMD) guidance document provides Health Canada’s framework for regulating standalone software intended to diagnose, prevent, monitor, treat, or alleviate disease or injury, or to assist in diagnosis or treatment. It applies to software that operates independently of hardware medical devices and is not embedded within them. The document outlines classification rules, evidence requirements, and regulatory pathways to ensure SaMD products are safe and effective. Software as a Medical Device (SaMD) - Canada.ca

Definition and Key Criteria

SaMD is defined as software intended to be used for one or more medical purposes without being part of a hardware medical device. Key criteria include:

• Performs clinical functions independently (e.g., diagnosis, treatment planning).
• Not necessary for basic hardware functionality.
• Can run on general-purpose computing platforms (e.g., smartphones, PCs) or dedicated platforms.

Software that merely stores, transmits, or displays data without modifying it for medical decision-making is generally not SaMD.

Risk-Based Classification

SaMD is classified using a risk-based approach aligned with IMDRF principles:

• Class I: Low risk (e.g., software providing information without direct impact on treatment).
• Class II: Moderate risk (e.g., software aiding diagnosis where incorrect output may lead to non-serious consequences).
• Class III: High risk (e.g., software providing diagnosis or treatment recommendations where incorrect output may cause serious injury).
• Class IV: Very high risk (e.g., software controlling life-sustaining or life-supporting functions).

Classification considers the state of the healthcare condition and the impact of incorrect information or action.

Premarket Requirements

• Licence Application: Class II, III, and IV SaMD require a medical device licence; Class I requires establishment licensing only.
• Evidence Requirements: Proportionate to risk class, including clinical evidence, validation, verification, and risk management per ISO 14971.
• Quality Management System: Compliance with ISO 13485 or equivalent.
• Cybersecurity: Address software security risks as part of risk management.

Post-Market Obligations

• Mandatory problem reporting for incidents and recalls.
• Annual licence renewal for licensed SaMD.
• Change notification for significant modifications affecting safety or performance.
• Continued risk management and post-market surveillance.

Practical Considerations

• Use the SaMD categorization framework to determine risk level early.
• Engage in pre-submission consultations for complex or novel SaMD.
• Ensure robust documentation of clinical validation and cybersecurity measures.
• Monitor international alignment (e.g., IMDRF) for global market access.

This guidance supports innovation in digital health while protecting public health through risk-appropriate regulation. Detailed classification rules, evidence expectations, submission pathways, and examples are provided in the official Health Canada SaMD guidance document. Software as a Medical Device (SaMD) - Canada.ca