Event roundup: MHRA x techUK – introduction to software as a medical device (SaMD) regulation
MHRA speakers covered the end-to-end regulatory journey: from determining whether software qualifies as a medical device, to clinical investigations, to strengthened post‑market surveillance requirements introduced in 2025. Throughout the session, the team emphasised their commitment to supporting innovators to navigate regulatory obligations in an increasingly complex and fast‑moving landscape.
Clarifying the regulatory foundations: definitions, intent and legislative pathways
The MHRA opened by outlining the legislative context for medical devices across the UK, highlighting the distinctions between Great Britain – where UKCA or CE marking is accepted – and Northern Ireland, which continues to follow EU Medical Device Regulations. Developers were encouraged to be precise about the markets they intend to serve, noting ongoing consultations on the future of CE recognition in Great Britain.
A central theme was the importance of intended purpose – the foundational statement that determines whether software qualifies as a medical device, its classification, and the evidence required to demonstrate safety and performance. MHRA reiterated that clear, specific intended use statements are critical, as they shape all subsequent regulatory activity, from software architecture and risk management to clinical evaluation and post‑market responsibilities.
To support industry, the MHRA has published detailed guidance and a software flowchart that helps manufacturers assess whether their product meets the definition of a medical device and how different use cases – including calculators, decision-support tools and AI‑enabled systems – should be interpreted.
Clinical evidence: when a clinical investigation is required
The MHRA’s clinical investigations team set out the expectations for generating clinical evidence. All medical devices, regardless of class, must demonstrate safety and performance. If sufficient clinical evidence cannot be established through existing literature or by claiming equivalence with similar devices, manufacturers must conduct a regulated clinical investigation.
Key points included:
A clinical investigation must be reviewed and authorised by MHRA within a 60‑day statutory window before it can begin.
Applications must be submitted via the IRAS system and include mandatory documentation—supported by ISO/IEC 62304 as best practice for medical device software development.
Sites will require a Letter of No Objection before commencing a study.
Studies are complemented by separate approval from a Research Ethics Committee.
The MHRA also clarified distinctions between pre‑market clinical investigations (regulated) and post‑market studies (unregulated by MHRA, but still requiring ethics approval). Attendees particularly welcomed guidance on grey areas such as digitised clinical calculators, emerging AI tools and the role of equivalence in reducing unnecessary burden.
Strengthened post‑market surveillance: new requirements from June 2025
The MHRA’s market surveillance lead outlined significant updates that came into force in June 2025, applying to both CE and UKCA‑marked devices placed on the market after that date. These reforms were designed to improve traceability, increase reporting consistency and accelerate regulatory responses to emerging safety concerns.
Key changes include:
Shorter reporting timeframes: serious incidents must now be reported within 15 working days, with even tighter timescales for deaths and public health risks.
Mandatory reporting of a broader range of incidents, including certain side effects.
Stronger oversight of field safety corrective actions, which must be submitted within three working days on request.
Pre‑publication review of Field Safety Notices by the MHRA.
A requirement to collect real‑world data to support ongoing vigilance – particularly relevant for software and AI tools which may evolve over time.
All incident reporting must be submitted via the MORE online portal, which enables consistent tracking and risk assessment.
What this means for developers and NHS adopters
For manufacturers, the session reinforced the need to:
Establish a clear intended purpose early, supported by MHRA guidance.
Understand when clinical investigations are required and plan evidence generation accordingly.
Ensure compliance with strengthened post‑market surveillance rules.
Use MHRA’s published flowcharts, standards and guidance to reduce ambiguity.
For NHS organisations procuring or deploying SaMD, the MHRA emphasised that:
Medical device status does not replace the need for local clinical safety assessment (including DCB 0129/0160).
Products listed on the MHRA register meet regulatory requirements, but local due diligence remains essential to assess workflow fit, risk management, and integration considerations.
The MHRA is available to support with clarifications but cannot provide consultancy on individual implementation decisions.
Looking ahead
The session underscored MHRA’s commitment to open dialogue with innovators and the health and care system. With software and AI‑enabled tools becoming increasingly embedded in clinical pathways, the regulator is continuing to expand guidance, improve clarity and address emerging areas where industry requires additional support.
techUK will continue working closely with MHRA to develop a practical resource pack summarising key guidance, common questions, and examples raised by members.
