EU MDR Rule 11 Classification for SaMD & CE Mark Process

In this blog, we have explained the EU MDR Rule 11 classification for SaMD. Additionally, we have detailed the CE mark certification process for SaMD.

What is SaMD?

Software as a Medical Device (SaMD) refers to standalone software that has a medical purpose on its own, such as diagnosing, preventing, monitoring, or treating disease, without being part of or driving a hardware medical device. It is regulated under EU MDR, Annex VIII, Rule 11. The EU MDR Rule 11 classification sets out a risk-based classification framework. Thus, SaMD is software intended to be used for medical purposes. It should be able to perform its functions independently of a physical medical device.

Examples:

• Diagnostic software: AI tools analyzing medical images for cancer detection.
• Therapeutic software: Apps delivering cognitive behavioral therapy.
• Monitoring software: Apps tracking chronic conditions like diabetes or heart disease.

What is a software that drives or influences a medical device?

Software that is integral to the functioning of a hardware medical device and does not have a medical purpose on its own. However, it enables the device to perform its intended function is a software that drives or influences a medical device. It is regulated as part of the device or as an accessory and not as standalone SaMD.

Examples:

• Software controlling an insulin pump’s dosage delivery.
• Embedded code in a ventilator regulating airflow.
• Imaging software that simply operates an MRI scanner (but does not interpret results).

SaMD vs software driving a device

SaMD is a medical device in itself while software driving a device is part of or accessory to a medical device.

Aspect	SaMD	Software Driving a Device
Independence	Functions standalone and has no hardware dependency	Dependent on hardware device
Regulatory Status	Classified under EU MDR Rule 11 classification	Classified as part of the device or accessory
Purpose	Direct medical purpose (diagnosis, treatment, monitoring)	Operational purpose (device control, measurement)
Examples	Tumor detection AI, chronic disease management apps	Insulin pump controller, ventilator software

Why is it important to understand the difference?

• SaMD requires its own CE marking, technical file, and risk classification under EU MDR Rule 11 classification system.
• Device-driving software is regulated under the conformity assessment of the hardware device it supports.
• Misclassification can lead to regulatory non-compliance, audit findings, or delays in market access. Hence, it is essential to understand this difference.

EU MDR regulations for SaMD

EU MDR broadened the scope for SaMD compared to the old Medical Device Directive (MDD). Many software products previously considered low risk under MDD are now moderate or high risk under MDR. As per EU MDR, SaMD is treated as a medical device in its own right. Hence, it requires CE marking, compliance with General Safety and Performance Requirements, and conformity assessment.

Key compliance requirements under EU MDR for SaMD

• EU MDR Rule 11 classification: EU MDR Rule 11 classification is applicable to SaMD.
• Quality management system (QMS): ISO 13485 compliance is required for Class IIa and above SaMDs.
• Technical documentation: Annex II and III files cover risk management, validation, usability, cybersecurity, and clinical evaluation. These will be required as part of technical documentation.
• Notified body involvement: Notified body will be required for Class IIa, IIb, III SaMDs.
• CE marking: As per EU MDR guidelines, SaMDs require CE marking.
• Post-market surveillance: Continuous monitoring and reporting of performance and safety is necessary for SaMD.

EU MDR Rule 11 classification for Software as a Medical Device (SaMD)

EU MDR Rule 11 classification is the cornerstone regulation for classifying Software as a Medical Device (SaMD). It applies a risk-based framework to determine whether software falls into Class I, IIa, IIb, or III, depending on its intended purpose and the potential impact on patient safety. Previously, MDD classified SaMD as Class I. Now, EU MDR has classified SaMD has Class IIa or higher. Rule 11 is part of Annex VIII of EU MDR, which specifically addresses software. It ensures that software with medical purposes is classified consistently as per its risk profile.

The EU MDR SaMD classification depends on the intended use and the severity of harm that could result from incorrect functioning or reliance on the software. Many software developers underestimate classification level. However, notified bodies scrutinize Rule 11 classifications closely. Hence, manufacturers must justify risk assessments with traceability and clinical evidence. Higher classes require extensive technical files, risk management, and clinical evaluation. Thus, manufacturers must carefully document intended use, risk analysis, and justification for classification to satisfy regulators.

EU MDR Rule 11 classification: EU MDR SaMD classes

Class	Criteria	Examples
Class III	Software that provides information used to make decisions with potential to cause death or irreversible deterioration of health.	Sepsis detection app triggering urgent interventions; software controlling pacemakers
Class IIb	Software that provides information used to make decisions with potential to cause serious deterioration of health or surgical intervention	Oncology decision-support tools; advanced diagnostic imaging analysis
Class IIa	Software that provides information used to make decisions with potential to cause moderate harm	Chest X-ray interpretation software; chronic disease management apps
Class I	Software not intended to provide diagnostic/therapeutic information, or where risks are minimal	Administrative apps, appointment scheduling, fitness trackers without medical claims

EU MDR Rule 11 classification also distinguishes software based on monitoring functions:

• Class IIa: Monitoring physiological processes (e.g., heart rate tracking).
• Class IIb: Monitoring vital parameters where variations could result in immediate danger (e.g., ICU patient monitoring software).

Thus, EU MDR Rule 11 is stricter than past directives. The classification is based on what the manufacturer claims the software does. The higher the potential harm, the higher the class.

EU MDR compliance requires QMS and other important technical documentation. Notably, Class IIa and above require notified body involvement.

EU MDR Rule 11 classification: Factors influencing EU MDR SaMD classification

• Intended purpose: Defined by the manufacturer in labeling and instructions.
• Impact of malfunction: Severity of harm if the software fails.
• User type: Professional vs layperson use can affect risk profile.
• Integration: Whether software operates independently (SaMD) or as part of a device (SiMD).

MDCG 2019-11 guidance on EU MDR Rule 11 classification for SaMD

The Medical Device Coordination Group (MDCG) has clarified how to apply Rule 11. Medical purpose is the key to qualify for the classification.

• Critical conditions:  Class III if software is used to treat or diagnose a medical condition.
• Serious conditions: Class IIb or IIa depending on significance of information provided by the software.
• Non-serious conditions: Generally the software would be considered Class IIa.
• Non-medical purposes: Not classified as medical device software

CE mark certification process for SaMD: 8 Step guide

Having a CE mark ensures the SaMD is safe, effective, and EU MDR compliant before being marketed in the EU.

1. Determine intended use and classification: Define the medical purpose of the software (diagnosis, monitoring, treatment, prevention). Apply the EU MDR Rule 11 classification rule for SaMD and categorise the medical device as Class III, Class II, Class IIa, or Class I. Notably, correct classification is critical because it dictates the conformity assessment route.
2. Establish a quality management system (QMS): A QMS is required for Class IIa and above, which should typically be aligned with ISO 13485. It should cover processes for design, development, risk management, validation, and post-market surveillance.
3. Prepare technical documentation: The technical documentation must comply with Annex II and III of EU MDR. The documentation should include device description and intended use, risk management file (ISO 14971), clinical evaluation (MDR Annex XIV), usability engineering and cybersecurity controls, verification and validation evidence, and post-market surveillance plan.
4. Appoint an EU authorized representative (if non-EU manufacturer): The EU authorized representative is required under Article 11 MDR. The representative will act as the legal contact point within the EU.
5. Register in EUDAMED: The company and device must be registered in the European Database on Medical Devices (EUDAMED). This provides transparency and traceability.
6. Conformity assessment: For class I, manufacturer must self-declare conformity and affix CE mark. On the other hand, Class IIa, IIb, III requires notified body involvement. The notified body will review technical documentation and audit QMS.
7. Affix CE mark: Once conformity is established, the CE mark is affixed on the software/device. The CE mark demonstrates compliance with EU MDR and allows marketing in the EU.
8. Post-market surveillance and vigilance: Continuous monitoring of performance and safety is a requirement for CE mark for SaMD. Additionally, reporting of serious incidents and field safety corrective actions is necessary. Moreover, periodic safety update reports (PSUR) will be required for Class IIa and above.

Pharmadocx Consultants: Your trusted consultant for EU MDR and CE mark for SaMD

We at Pharmadocx Consultants will help you correctly classify your SaMD as per EU MDR Rule 11 classification, which is a critical step for EU MDR compliance. Our team will help you prepare the necessary documentation, establish a robust QMS, and provide audit support. Email at [email protected] or call/Whatsapp on 9996859227 to avail our exclusive CE mark certification service for SaMD.