Software as a medical device (SaMD)

Software as a medical device (SaMD) is software that diagnoses, monitors or treats a patient on its own, and is therefore regulated in the same way as a medical device such as a pacemaker or a scanner. An AI model that reads a chest X-ray and flags tuberculosis is one example. The software runs on an ordinary computer, phone or cloud server. But a doctor or a patient acts on what it reports, so a mistake can harm a patient. That is why the maker needs a regulator's approval before it sells the software, and again before many later changes.

Here is how it works in general. What decides it is the software's intended purpose, which is the medical use that the maker claims for it. A step-counting app that encourages you to walk is a wellness app, and it is not regulated as a device. An app that claims to detect an irregular heartbeat is a medical device. The regulator places the software in a risk class: the more harm a wrong answer could do, the stricter the class. The maker must prove that the software does what it claims, usually with tests on real patient data. It must also keep records of how the software was designed, tested and changed. In India, the regulator is the Central Drugs Standard Control Organisation (CDSCO). In America, it is the Food and Drug Administration (FDA), whose approval many device software teams in India also work towards.

Changes are the hard part. An ordinary app can be updated every week. A medical device's software cannot change how it behaves without fresh evidence, and a significant change needs approval again. This matters most for AI models, which improve when they are retrained. Regulators now let a maker agree a plan in advance for how a model will be retrained and tested, so that changes within that plan do not need a fresh approval each time.

Take, for example, AI radiology. A model that reads CT scans and flags a likely stroke is itself the medical device, and it is approved on how accurately it found strokes in thousands of past scans.

Consider an insulin pump. The software that calculates each dose from a glucose sensor is built into the pump. Strictly, this is called software in a medical device, but every new version is checked in the same way before it reaches patients.

Say a clinic sends an ECG for AI ECG analysis. The model that reads the ECG has its own approval as a medical device, separate from the ECG machine that recorded it.

How is SaMD different from ordinary firmware? The maker of a washing machine can update its firmware whenever it wants. A medical device's software must first be proven safe, like any other part of the device. The closest idea outside medicine is the safety certification of a car's braking system or a railway signal, where software must also be proven safe to a regulator before it is used.