Medical Devices: Software Applications and Apps in the UK

1. Defining Software as a Medical Device (SaMD) In the UK, software (including mobile apps) is considered a medical device if it is intended by the manufacturer to be used for a medical purpose, such as diagnosis, prevention, monitoring, treatment, or alleviation of disease. If the software merely records data or provides general information without individualised interpretation, it may not fall under medical device regulations.   Source: MHRA Guidance: Medical devices: software applications (apps)

2. Classification and Risk Assessment Software is classified based on its intended purpose and the potential risk it poses to users. The UK Medical Devices Regulations 2002 (UK MDR 2002) provide rules for categorising software into Class I, IIa, IIb, or III.  

Class I: Low risk (e.g., apps for managing healthy lifestyle without clinical intervention).  

Class IIa/IIb: Medium risk (e.g., software used to monitor physiological processes).  

Class III: High risk (e.g., software used for life-critical diagnostic decisions).   Source: MHRA Guidance: Medical devices: software applications (apps)

3. Manufacturer Obligations Manufacturers of medical device software must ensure their products meet specific safety and performance requirements. Key responsibilities include:

Affixing the UKCA mark (or CE mark during the transition period) before placing the product on the Great Britain market.  

Registering with the Medicines and Healthcare products Regulatory Agency (MHRA).  

Implementing a Quality Management System (QMS) and maintaining technical documentation.   Source: MHRA Guidance: Medical devices: software applications (apps)

4. Clinical Evaluation and Post-Market Surveillance Manufacturers must provide clinical evidence to demonstrate that the software achieves its intended medical benefits without compromising safety. Once the software is on the market, ongoing Post-Market Surveillance (PMS) is required to monitor performance, address bugs, and report any adverse incidents via the Yellow Card scheme.   Source: MHRA Guidance: Medical devices: software applications (apps)

5. Changes to Software and Re-certification Significant changes to the software's intended purpose, core algorithms, or risk profile may require a new conformity assessment. Routine updates for security or minor bug fixes generally do not require re-certification but must be documented within the QMS.   Source: MHRA Guidance: Medical devices: software applications (apps)