SaMD Classification

SaMD Classification is a risk-based framework developed by the IMDRF to categorize Software as a Medical Device according to its potential impact on patient health. This classification system helps regulatory authorities and manufacturers determine appropriate regulatory pathways, clinical evidence requirements, and quality management system expectations for medical software.

IMDRF SaMD classification framework:

The IMDRF framework classifies SaMD based on two key dimensions:

Dimension 1: Significance of information provided by SaMD
The role that information from SaMD plays in healthcare decisions:

Treat or Diagnose:
- Directly drives treatment decisions or diagnoses
- Clinician relies primarily on SaMD output for intervention
- Examples: diagnostic imaging analysis, treatment planning software

Drive Clinical Management:
- Guides or influences treatment decisions
- Clinician uses SaMD output to make management choices
- Examples: disease risk calculators, monitoring alerts for intervention

Inform Clinical Management:
- Provides information to support healthcare decisions
- One of several inputs to clinical decision-making
- Examples: patient monitoring displays, health trackers that inform discussions

Dimension 2: State of healthcare situation or condition
The severity and urgency of the patient's medical situation:

Critical:
- Life-threatening or immediately serious condition
- Time-sensitive intervention required
- Examples: acute stroke, cardiac arrest, severe trauma, critical care patients

Serious:
- Condition requires intervention to avoid serious deterioration
- Significant morbidity if untreated
- Examples: chronic disease management, cancer staging, surgical planning

Non-Serious:
- Condition would not result in serious health consequences
- Self-limiting or minor conditions
- Examples: minor skin conditions, general wellness, cosmetic applications

SaMD classification matrix:

The intersection of these two dimensions creates four risk categories:

| Healthcare Situation | Treat/Diagnose | Drive Clinical Management | Inform Clinical Management |
|---------------------|----------------|---------------------------|---------------------------|
| Critical | Class IV | Class III | Class II |
| Serious | Class III | Class II | Class I |
| Non-Serious | Class II | Class I | Class I |

Class I - Lowest risk:
- Inform clinical management for non-serious or serious conditions
- Examples: health and wellness apps, patient education software
- Regulatory pathway: Typically low regulatory burden, may be exempt or Class I in most jurisdictions

Class II - Low-to-moderate risk:
- Treat/diagnose non-serious conditions
- Drive clinical management for serious conditions
- Inform clinical management for critical conditions
- Examples: diabetes management apps, remote patient monitoring, clinical calculators
- Regulatory pathway: Moderate regulatory requirements, typically 510(k) in USA, Class IIa/IIb in EU

Class III - Moderate-to-high risk:
- Treat/diagnose serious conditions
- Drive clinical management for critical conditions
- Examples: cancer diagnostic algorithms, intensive care monitoring systems
- Regulatory pathway: More stringent requirements, clinical data often needed, Class IIb/III in EU

Class IV - Highest risk:
- Treat/diagnose critical conditions
- Examples: software for critical life-support decisions, acute stroke diagnosis, real-time arrhythmia detection
- Regulatory pathway: Most stringent requirements, typically PMA in USA or Class III in EU

Applying the classification framework:

Step 1: Define intended use
- What is the medical purpose of the SaMD?
- What information does it provide?
- Who is the intended user?
- What is the patient population?

Step 2: Determine significance of information
- Does the software treat or diagnose the condition?
- Does it drive clinical management decisions?
- Or does it merely inform clinical decisions?

Step 3: Assess healthcare situation
- Is the patient's condition critical (life-threatening)?
- Is it serious (requires intervention to avoid deterioration)?
- Or is it non-serious (minor or self-limiting)?

Step 4: Apply classification matrix
- Use the matrix to determine risk category (I, II, III, or IV)
- Consider all intended uses if software has multiple functions

Step 5: Map to regional regulations
- Translate IMDRF class to local regulatory classification
- Determine appropriate regulatory pathway

Examples of SaMD classification:

Class IV - Treat/Diagnose Critical:
- Real-time arrhythmia detection and treatment recommendation for ICU patients
- AI software for acute intracranial hemorrhage detection in emergency stroke
- Ventilator control algorithms for critically ill COVID-19 patients
- Software analyzing ECG to diagnose life-threatening cardiac conditions

Class III - Treat/Diagnose Serious or Drive Critical:
- Cancer diagnostic imaging analysis software (serious condition, diagnose)
- Software recommending insulin dosing for diabetic patients (serious, drive management)
- Sepsis prediction algorithms in critical care (critical, drive management)
- Radiation therapy planning software for cancer treatment (serious, treat)

Class II - Various moderate-risk scenarios:
- Diabetic retinopathy screening software (serious, inform)
- AI-assisted polyp detection in colonoscopy (serious, drive management)
- Fall risk assessment tools for elderly (serious, inform)
- Mobile app for acne diagnosis (non-serious, treat/diagnose)

Class I - Inform non-serious/serious:
- Fitness trackers monitoring heart rate for general wellness (non-serious, inform)
- Patient symptom tracking apps for chronic disease (serious, inform)
- Medication reminder apps (serious, inform)
- General health risk calculators (non-serious/serious, inform)

Mapping IMDRF classification to regional regulations:

USA FDA:
IMDRF framework influences but doesn't directly determine FDA class:
- IMDRF Class I → Often FDA Class I or exempt
- IMDRF Class II → Often FDA Class II (510(k))
- IMDRF Class III → Often FDA Class II (510(k)) or Class III (PMA)
- IMDRF Class IV → Often FDA Class III (PMA)

EU MDR:
EU classification rules in Annex VIII apply, influenced by IMDRF:
- IMDRF Class I → Often EU Class I or IIa
- IMDRF Class II → Often EU Class IIa or IIb
- IMDRF Class III → Often EU Class IIb or III
- IMDRF Class IV → Often EU Class III

Canada Health Canada:
Aligns closely with IMDRF framework:
- Risk-based classification system
- Similar considerations for significance and healthcare situation

Australia TGA:
- Software risk classification framework aligned with IMDRF
- Maps to TGA Class I, IIa, IIb, III

Special classification considerations:

Multiple functions:
If SaMD performs multiple functions:
- Classify based on highest risk function
- Consider each intended use independently
- Apply most stringent classification

Clinical Decision Support Software (CDS):
Special category of SaMD that assists clinicians:
- Classification depends on autonomy and clinician reliance
- If clinician independently reviews underlying data: may be lower risk
- If SaMD output is primary basis for decision: higher risk
- FDA and other regulators have specific CDS guidance

AI and Machine Learning SaMD:
Adaptive algorithms present unique challenges:
- Locked algorithm (doesn't change): traditional SaMD classification applies
- Continuously learning algorithm: may require higher classification or special controls
- FDA has Predetermined Change Control Plan (PCCP) for certain AI updates
- Consider explainability and transparency in risk assessment

Risk-benefit considerations:
Classification also considers:
- Consequence of incorrect information (false positive vs. false negative)
- Availability of alternative diagnostic/treatment methods
- Patient population vulnerability (pediatric, immunocompromised, elderly)
- Time sensitivity of decision-making

Regulatory implications by classification:

Higher classification (III, IV) typically requires:
- Clinical validation with real-world patient data
- More rigorous software validation and verification
- Detailed risk management and hazard analysis
- Post-market surveillance and real-world performance monitoring
- Quality Management System per ISO 13485
- Cybersecurity assessment and ongoing monitoring
- Usability and human factors engineering per IEC 62366

Lower classification (I, II) may allow:
- Reliance on analytical validation (non-clinical testing)
- Literature-based clinical evidence
- Streamlined regulatory submissions
- Less frequent post-market reporting
- Quality systems proportionate to risk

Clinical evidence requirements:

IMDRF MDCE (Medical Device Clinical Evaluation):
Clinical evidence should be commensurate with SaMD classification:

Class IV:
- Prospective clinical studies typically required
- Real-world patient data in intended use setting
- Comparison to gold standard or current standard of care
- Sufficient sample size for statistical significance

Class III:
- Clinical studies often required
- May use retrospective clinical data or literature
- Real-world evidence demonstrating clinical validity

Class II:
- Clinical evidence from literature or real-world use
- Analytical validation may suffice in some cases
- Performance testing in simulated environments

Class I:
- Analytical validation often sufficient
- Literature review to support low-risk designation
- May be self-declared in some jurisdictions

Post-market considerations:

Post-Market Surveillance (PMS):
Intensity based on classification:
- Higher class: Active surveillance, real-world performance studies
- Lower class: Passive complaint monitoring, trend analysis

Software updates and changes:
- Major changes affecting classification: new regulatory submission
- Minor changes (bug fixes, UI improvements): may use streamlined process
- Continuously learning algorithms: require ongoing validation

International harmonization:

Benefits of IMDRF framework:
- Common language across regulators
- Predictable classification globally
- Facilitates multi-market strategies
- Reduces regulatory burden for manufacturers

Ongoing IMDRF work:
- SaMD clinical evaluation guidance
- SaMD quality management system guidance
- Real-world evidence for SaMD
- AI/ML specific considerations

Best practices for SaMD classification:

Early classification assessment:
- Classify SaMD early in development
- Engage regulatory consultants if complex
- Consider Pre-Submission meetings with regulators

Document classification rationale:
- Clear intended use statement
- Justification for significance of information
- Evidence supporting healthcare situation assessment
- Comparison to similar SaMD classifications

Plan for clinical evidence:
- Understand clinical evidence expectations for your class
- Design validation studies appropriate to risk
- Collect real-world data to support claims

Monitor for classification changes:
- Re-assess if intended use evolves
- Re-classify if patient population changes
- Update classification if new evidence emerges about risks

Prepare for multi-market strategy:
- Understand how IMDRF class maps to each target market
- Prepare documentation suitable for highest classification
- Engage local regulatory experts

SaMD classification is a critical step in the regulatory pathway for medical software. The IMDRF framework provides a rational, risk-based approach that balances patient safety with innovation, enabling safe and effective software to reach patients while maintaining appropriate regulatory oversight.