Event roundup: MHRA x techUK – introduction to software as a medical device (SaMD) regulation

In a member webinar hosted by techUK, experts from the Medicines and Healthcare products Regulatory Agency (MHRA) provided a comprehensive introduction to the UK’s regulatory framework for software as a medical device (SaMD). The session aimed to demystify core regulatory requirements for developers, manufacturers, and NHS adopters – particularly as software and AI-driven tools continue to advance rapidly and generate questions around compliance, clinical evidence and post market expectations.

MHRA speakers covered the end-to-end regulatory journey: from determining whether software qualifies as a medical device, to clinical investigations, to strengthened post‑market surveillance requirements introduced in 2025. Throughout the session, the team emphasised their commitment to supporting innovators to navigate regulatory obligations in an increasingly complex and fast‑moving landscape.

Clarifying the regulatory foundations: definitions, intent and legislative pathways

The MHRA opened by outlining the legislative context for medical devices across the UK, highlighting the distinctions between Great Britain – where UKCA or CE marking is accepted – and Northern Ireland, which continues to follow EU Medical Device Regulations. Developers were encouraged to be precise about the markets they intend to serve, noting ongoing consultations on the future of CE recognition in Great Britain.

A central theme was the importance of intended purpose – the foundational statement that determines whether software qualifies as a medical device, its classification, and the evidence required to demonstrate safety and performance. MHRA reiterated that clear, specific intended use statements are critical, as they shape all subsequent regulatory activity, from software architecture and risk management to clinical evaluation and post‑market responsibilities.

To support industry, the MHRA has published detailed guidance and a software flowchart that helps manufacturers assess whether their product meets the definition of a medical device and how different use cases – including calculators, decision-support tools and AI‑enabled systems – should be interpreted.

Clinical evidence: when a clinical investigation is required

The MHRA’s clinical investigations team set out the expectations for generating clinical evidence. All medical devices, regardless of class, must demonstrate safety and performance. If sufficient clinical evidence cannot be established through existing literature or by claiming equivalence with similar devices, manufacturers must conduct a regulated clinical investigation.

Key points included:

A clinical investigation must be reviewed and authorised by MHRA within a 60‑day statutory window before it can begin.
Applications must be submitted via the IRAS system and include mandatory documentation—supported by ISO/IEC 62304 as best practice for medical device software development.
Sites will require a Letter of No Objection before commencing a study.
Studies are complemented by separate approval from a Research Ethics Committee.

The MHRA also clarified distinctions between pre‑market clinical investigations (regulated) and post‑market studies (unregulated by MHRA, but still requiring ethics approval). Attendees particularly welcomed guidance on grey areas such as digitised clinical calculators, emerging AI tools and the role of equivalence in reducing unnecessary burden.

Strengthened post‑market surveillance: new requirements from June 2025

The MHRA’s market surveillance lead outlined significant updates that came into force in June 2025, applying to both CE and UKCA‑marked devices placed on the market after that date. These reforms were designed to improve traceability, increase reporting consistency and accelerate regulatory responses to emerging safety concerns.

Key changes include:

Shorter reporting timeframes: serious incidents must now be reported within 15 working days, with even tighter timescales for deaths and public health risks.
Mandatory reporting of a broader range of incidents, including certain side effects.
Stronger oversight of field safety corrective actions, which must be submitted within three working days on request.
Pre‑publication review of Field Safety Notices by the MHRA.
A requirement to collect real‑world data to support ongoing vigilance – particularly relevant for software and AI tools which may evolve over time.

All incident reporting must be submitted via the MORE online portal, which enables consistent tracking and risk assessment.

What this means for developers and NHS adopters

For manufacturers, the session reinforced the need to:

Establish a clear intended purpose early, supported by MHRA guidance.
Understand when clinical investigations are required and plan evidence generation accordingly.
Ensure compliance with strengthened post‑market surveillance rules.
Use MHRA’s published flowcharts, standards and guidance to reduce ambiguity.

For NHS organisations procuring or deploying SaMD, the MHRA emphasised that:

Medical device status does not replace the need for local clinical safety assessment (including DCB 0129/0160).
Products listed on the MHRA register meet regulatory requirements, but local due diligence remains essential to assess workflow fit, risk management, and integration considerations.
The MHRA is available to support with clarifications but cannot provide consultancy on individual implementation decisions.

Looking ahead

The session underscored MHRA’s commitment to open dialogue with innovators and the health and care system. With software and AI‑enabled tools becoming increasingly embedded in clinical pathways, the regulator is continuing to expand guidance, improve clarity and address emerging areas where industry requires additional support.

techUK will continue working closely with MHRA to develop a practical resource pack summarising key guidance, common questions, and examples raised by members.

Rachel Kennedy

Programme Manager Health and Social Care, techUK

Rachel joined techUK in December 2024, as a Programme Manager in the Health and Social Care team.

Prior to this, Rachel worked at a specialist health and social care public affairs agency, working with a range of organisations and trade bodies across the medical technology, pharmaceutical, digital health and social care sectors. As well as this, Rachel was part of the Secretariat for a number of health and care related All-Party Parliamentary Groups.

Rachel has a Masters in Global Governance and Diplomacy from the University of Leeds, as well as a first-class honours in Politics BA from Newcastle University.

Read lessmore

Health and Social Care Programme activities

techUK is helping its members navigate the complex space of digital health in the UK to ensure our NHS and social care sector is prepared for the challenges of the future. We help validate new ideas and build impactful strategies, ultimately ensuring that members are market-ready. Visit the programme page here.