If you’re involved in sourcing, agency work, or compliance related to medical software with AI capabilities (SaMD — Software as a Medical Device), there’s one scenario particularly worth understanding: the same event — updating an AI algorithm — can trigger completely different regulatory procedures in the US, EU, and China. This piece doesn’t discuss the clinical performance of any algorithm — it covers the structural differences between these markets’ regulatory frameworks, and what “updating the algorithm” specifically means in each one.
1. First, what SaMD actually is: standalone software, not embedded firmware
Per the International Medical Device Regulators Forum (IMDRF) definition, SaMD refers to software that achieves a medical purpose “without being part of” a hardware medical device — the key phrase is “without being part of.” It’s not the same as the control firmware inside a ventilator or the software built into a CT scanner. SaMD runs independently and qualifies as a medical device based purely on its own intended purpose — examples include a mobile app that analyzes dermatoscopic images, or a cloud-based algorithm that interprets ECG data to detect atrial fibrillation.
2. Four markets, four different classification floors
- United States (FDA): historically regulated AI software under the existing device classification framework (Class I-III), using the same premarket pathways (510(k), De Novo, PMA). In June 2026, the FDA established a dedicated new device class specifically for one type of AI software — under 21 CFR Part 892, “Radiological Machine Learning-Based Quantitative Imaging Software with Predetermined Change Control Plan” — classified as Class II with Special Controls, showing the FDA is actively carving out more specific classification pathways for AI software rather than simply reusing the older framework.
- European Union (MDR): apart from pure “wellness” applications, nearly all AI-related SaMD starts at Class IIa or higher — a much higher default floor than the US’s risk-dependent approach. And starting August 2026, the EU’s AI Act layers a second set of obligations on top: most EU AI medical software requiring Notified Body review under MDR will also qualify as a “high-risk AI system” under the AI Act, meaning compliance with MDR alone isn’t sufficient — separate data governance and model performance monitoring documentation is also required.
- China (NMPA): classifies AI/ML diagnostic software as Class II or Class III depending on clinical risk — AI software capable of providing autonomous diagnostic conclusions for serious conditions is typically classified as Class III (the highest risk tier). China has published a dedicated Guiding Principle for AI Medical Device Registration Review (issued March 2022), plus a specific guiding principle for “AI-assisted detection” products (lung nodules, breast nodules, fracture detection, and similar, issued 2023), explicitly classifying this product type as Class III.
- United Kingdom (MHRA): under new 2026 rules, most SaMD will be reclassified to Class IIa or higher (aligning with the EU MDR/IMDRF approach) — a significant tightening compared to the UK’s current regime, where many SaMD products remain Class I.
3. The core illustrative case: how each market handles an algorithm update
This is the scenario that shows the structural differences most clearly — an already-marketed AI diagnostic software needs to update its core algorithm. Here’s how each market handles it:
- United States (FDA): if the company filed a Predetermined Change Control Plan (PCCP) at original submission, and the update falls within the pre-specified parameters, no new submission is required. If there was no PCCP, or the update exceeds the pre-defined scope, clinical validation documentation of the change must be provided.
- European Union (MDR + AI Act): the update requires Notified Body review before the CE mark can reflect the change; from August 2026, the updated technical file must also separately document data governance and model performance monitoring.
- China (NMPA): official guidance draws a clear distinction between a “major software update” and a “minor software update.” If the algorithm update affects the product’s safety or effectiveness, it’s a major update requiring a change-registration application. If it doesn’t affect safety or effectiveness, it’s a minor update, controlled through the company’s own quality management system — no separate change-registration application is required, with supporting documentation simply submitted at the next scheduled registration renewal. Changes to the algorithm itself, its architecture, or its processing logic, or retraining on entirely new data, are generally treated as major updates.
Each market handles this same underlying action (an algorithm update) through a different logic — the US relies on a pre-filed change-control envelope, China assesses major-versus-minor after the fact, and the EU combines Notified Body review with a second layer of AI Act obligations. Understanding this structural difference matters more than simply asking “which country is stricter.”
The bottom line
Medical software with AI capabilities faces different classification floors in the US, EU, China, and UK (the EU’s default threshold is highest, China classifies by clinical risk with autonomous diagnostic tools defaulting to the top tier, and the US is actively carving out AI-specific classification pathways) — and even a routine scenario like updating an algorithm after launch triggers entirely different compliance procedures: a pre-filed change-control mechanism in the US, an after-the-fact major/minor assessment in China, and a Notified Body review plus a second AI Act layer in the EU. Any cross-border sourcing, agency work, or supply chain decision involving AI-enabled medical software needs to verify this process separately for each target market — never assume one market’s approach transfers to another.
Regulatory details reflect FDA guidance (including the June 2026 21 CFR Part 892 device class), EU MDR 2017/745 and the EU AI Act, China’s CMDE Guiding Principle for AI Medical Device Registration Review (2022) and its AI-assisted detection guiding principle (2023), and UK MHRA 2026 reforms, as of mid-2026. Frameworks in this area are evolving — verify current requirements against official regulatory sources before making sourcing, registration, or compliance decisions. General regulatory framework information, not clinical, medical, or legal advice.