Skip to main content

AI/ML-Enabled Medical Devices

SFDA approach to AI/ML devices​

The SFDA regulates AI and machine learning-enabled medical devices under the existing Medical Devices Law and MDS-REQ 1 framework. There is no separate AI-specific regulation (unlike the EU AI Act), but the SFDA follows IMDRF and international guidance on AI/ML SaMD.

Classification of AI/ML devices​

Classification follows the standard SFDA rules, based on:

  • The intended purpose of the AI function (diagnostic, therapeutic, monitoring)
  • Seriousness of the condition the device addresses
  • Whether the output drives independent clinical decisions or is reviewed by a clinician

High-risk AI/ML devices (e.g. autonomous diagnostic systems for life-threatening conditions) are likely Class C or D and require the most comprehensive technical files.

Technical file requirements for AI/ML devices​

In addition to standard SaMD requirements, AI/ML devices should address in the technical file:

  • Algorithm description — training data, model architecture, intended population
  • Validation and verification — test dataset performance, generalisability across populations
  • Transparency and explainability — how clinicians can interpret model outputs
  • Bias and fairness assessment — performance across demographic subgroups
  • Cybersecurity risk — specific to AI model integrity and adversarial attacks
  • Version and change management — how algorithm updates are controlled

Predetermined Change Control Plans (PCCPs)​

For adaptive AI/ML algorithms (those that learn or update after deployment), the SFDA aligns with IMDRF guidance on Predetermined Change Control Plans (PCCPs) — pre-agreed protocols describing the types of changes the algorithm may undergo without requiring a new MDMA submission. This is an emerging area and manufacturers should monitor SFDA guidance updates.

Further reading​

When PCCPs are Required

Adaptive algorithms — those that incorporate continuous learning, post-deployment model updates, or dynamic re-training — require Predetermined Change Control Plans. Examples include diagnostic algorithms that learn from new patient data or monitoring systems that adjust thresholds based on population feedback. Manufacturers should prospectively define in the PCCP which types of algorithm updates can proceed without re-submission and which trigger new MDMA submissions. Non-adaptive, static algorithms do not require PCCPs.