Software & AI/ML — SaMD in Brazil
See SaMD Classification for classification details and Digital Health & SaMD for ANVISA's broader digital health framework.
Key SaMD regulatory requirements
- Classification under RDC 751/2022 using the IMDRF-aligned SaMD classification
- Full IEC 62304 software lifecycle documentation
- ISO 14971 risk management incorporating software-specific hazards
- Usability engineering per IEC 62366-1
- Cybersecurity documentation addressing security risks
- Change management protocol — especially for AI/ML algorithms with potential to evolve
Verify all information against official ANVISA sources before making regulatory decisions.
For AI/ML-based SaMD, ANVISA requires: documentation of training data sources and characteristics, validation across different patient populations, procedures for algorithm updates and versioning, documented performance monitoring post-market, and change management that triggers new clinical validation if algorithm modifications alter intended use or performance beyond pre-defined parameters.
ANVISA SaMD Classification Framework: SaMD is classified using an IMDRF-aligned approach based on risk and clinical significance. Classification takes into account whether the SaMD: (1) detects, diagnoses, monitors, or treats a serious condition, (2) provides information for irreversible clinical decisions, (3) controls or directly influences therapeutic delivery, or (4) is ancillary/supportive. This determines whether the device is Class I, II, III, or IV. Devices that only provide information for clinical decision-making (not direct control) are typically lower risk than devices that actively control therapy.