F&G StrategyF&G Strategy Academy
← All modules
Module 3

SaMD Classification Rules: UK MDR, EU MDR, and How to Apply Them to DMHT

Advanced60 to 90 min

How to determine the risk class of a DMHT product once SaMD status is confirmed. The UK MDR 2002 framework (Rule 9, Rule 10, Rule 12 carried forward from the EU MDD), the EU MDR 2017/745 Rule 11 three-step severity test, MDCG 2019-11, and the practical Class IIb / Class III boundary in a digital mental health context.

Common issues: Applying the wrong rule for the market; conflating the UK MDR direct-diagnosis analysis with the EU MDR Rule 11 severity test; defaulting every SaMD to Class IIa; or treating disclaimers and clinician-in-the-loop arrangements as classification reductions when they are not.

Progress: 0 of 8 sections complete0%

The current UK classification framework: a transitional note

Modules 1 and 2 established whether the product is SaMD at all. This module determines its risk class.

Read this note before applying any rule below: the MHRA DMHT guidance (last updated July 2025) is explicit that the legal text for classification of SaMD in the new UK framework is still being developed; the current UK framework for Great Britain therefore applies the EU MDD classification rules as carried forward into UK MDR 2002. This is the stated current position, not a gap in the guidance.

CE marking under EU MDR is currently accepted on the GB market until 30 June 2030, which means EU MDR Rule 11 is practically relevant for any GB product pursuing CE certification, and a proposal to make that recognition indefinite was consulted on between February and April 2026 and awaits a government response. Northern Ireland sits under EU MDR directly: products placing on the NI market must comply with EU MDR including Rule 11.

Practitioners must verify the current MHRA position before relying on any classification analysis in this module, because the new UK framework is in active development and may change the rules for DMHT. The content below reflects the MHRA guidance as last updated in July 2025, with later developments noted where they arise.

Two rulebooks, one product: which applies where

The single largest source of confusion in DMHT classification is that two different rulebooks ask two different questions about the same product. Rule 10 asks what the function is: does it allow direct diagnosis?

Rule 11 asks what the worst incorrect output could do: how severe is the foreseeable harm? Which question you answer depends only on where the product is placed, and a GB product relying on CE acceptance answers the EU question in practice.

Market and routeRulebookClassification ruleThe questions it asks, and the classes they reach
Great Britain, UKCA routeUK MDR 2002 (EU MDD rules carried forward)Rules 9, 10 and 12A function test. Does the function allow direct diagnosis? If yes, Class IIa. Could incorrect information put vital physiological parameters (cardiac, respiration, CNS) in immediate danger? If yes, Class IIb. Class III is effectively out of reach for standalone DMHT under these rules. If no rule engages, Class I.
EU and Northern Ireland, CE routeEU MDR 2017/745Rule 11 with MDCG 2019-11A severity test. What could the worst incorrect output directly cause? Death or irreversible deterioration: Class III. Serious deterioration or surgical intervention: Class IIb. Any other diagnostic or therapeutic decision: Class IIa.

The GB rulebook: Rules 9, 10 and 12

The MHRA DMHT guidance identifies three rules from UK MDR 2002 (which carries forward the EU MDD classification rules) as most applicable to DMHT: Rule 9, Rule 10 and Rule 12. Rule 9 covers active therapeutic devices intended to administer or exchange energy.

For DMHT this is a narrow category: it applies to software that drives or controls a device delivering physical energy to the body, such as a transcranial direct current stimulation app. Most conversational AI, CBT and mood-monitoring products do not engage Rule 9.

Rule 10 covers active devices intended for diagnosis. It produces Class IIa where the device allows direct diagnosis or monitoring of vital physiological processes, and escalates to Class IIb only where incorrect information could cause immediate danger through variations in vital physiological parameters specifically named in the rule: cardiac performance, respiration, and CNS activity.

That escalation trigger is narrow and most DMHT products do not meet it under the UK framework. The Class IIa net, by contrast, is wide: under the MHRA's reading of direct diagnosis below, a large share of DMHT products reach Class IIa.

Rule 12 is the residual rule: all other active devices are Class I. This is where products that do not allow direct diagnosis and do not engage Rule 9 sit.

The MHRA guidance defines direct diagnosis precisely. A device allows direct diagnosis when it provides the diagnosis of the disease or condition by itself, provides decisive information for making a diagnosis, or claims to perform as or support the function of a clinician in performing diagnostic tasks.

For lay users, provision of an indicative diagnosis may be enough. On DMHT, the guidance states: “DMHTs that provide the probability of mental health conditions or probability of symptoms highly correlated to mental health conditions, where there is a reliance on this to determine clinical management options, may be considered as providing decisive information.

As such, they would be considered as providing a ‘direct diagnosis’ as per rule 10 of the EU MDD and should be regulated as a class IIa medical device.” UK MDR 2002 contains no classification rules of its own: it gives legal force in Great Britain to the MDD's Annex IX rules, which is why the MHRA cites rule 10 of the EU MDD as the GB rule.

Note the breadth: symptoms highly correlated to conditions count, not only named conditions. A mood score, a sleep pattern, or a worry index relied on for clinical management triggers the rule just as a named diagnosis would.

RuleTrigger for DMHTOutcome
Rule 9 (active therapeutic, energy exchange)Software that drives or controls a device delivering physical energy to the body (e.g. tDCS app). Rarely engaged by conversational AI, CBT or mood-monitoring products.Class IIa, with escalation to IIb where the energy delivery is potentially hazardous.
Rule 10 (active diagnostic)Device allows direct diagnosis: provides the diagnosis itself, provides decisive information for making a diagnosis, or claims to perform or support a clinician's diagnostic function. DMHTs giving the probability of a mental health condition, or of symptoms highly correlated to one, that is relied upon to determine clinical management fall here.Class IIa by default. Class IIb only where incorrect information could cause immediate danger through variations in vital physiological parameters (cardiac performance, respiration, CNS activity); a narrow trigger, rarely met by DMHT.
Rule 12 (residual)All other active devices: software that does not allow direct diagnosis and does not engage Rule 9. Therapeutic-only products and purely descriptive monitoring sit here.Class I.
Self-assessment
A developer says their product is Class IIa under EU MDR Rule 11 and therefore does not need a separate UK MDR assessment. Is this correct?
Framing note

A note on interpretation

Rule 10 as written refers to vital physiological processes and vital physiological parameters. It does not mention mental health conditions, symptom probability, or clinical management decisions.

The MHRA DMHT guidance v1.2 extends the direct diagnosis concept to include software that provides decisive information for making a diagnosis of a mental health condition, where clinicians rely on that output to determine clinical management options. The guidance treats such products as allowing direct diagnosis under Rule 10.

This module applies the MHRA's interpretation throughout. The authority for that application is MHRA DMHT guidance v1.2, Section 8.1.

The direct diagnosis analysis for Rule 10: the questions to ask

This is the analytical sequence a practitioner uses to classify a DMHT product under UK MDR Rule 10. Apply it function by function; the highest classification reached across all functions determines the overall product class.

UK MDR Rule 10 — direct diagnosis analysis
Direct diagnosis?No → Class I (Rule 12).
Vital-parameters danger?Yes → Class IIb (rare for DMHT).
Class IIaThe usual outcome when Rule 10 engages.
Step 1 — Does the product allow direct diagnosis?

Apply the MHRA three-part definition. Does the function provide the diagnosis itself?

Does it provide decisive information for making a diagnosis (for lay users, an indicative diagnosis may be enough; a probability output relied upon to determine clinical management counts)? Or does it claim to perform as or support the function of a clinician in performing diagnostic tasks?

If none of these apply, Rule 10 does not engage and the function defaults to Class I under Rule 12, unless Rule 9 applies.

Step 2 — If Rule 10 engages, the default is Class IIa.

Escalation to Class IIb requires that incorrect information could cause immediate danger through variations in vital physiological parameters specifically named in the rule: cardiac performance, respiration, or CNS activity. For most DMHT products this threshold is not met and Class IIa is the correct UK MDR classification.

Step 3 — Note the important asymmetry.

Under UK MDR, therapeutic software such as CBT applications and AI therapy chatbots does not engage Rule 10 directly because Rule 10 covers diagnostic functions. Therapeutic software defaults to Class I under Rule 12 unless it also performs a diagnostic function that engages Rule 10.

This is a known structural limitation of the current UK MDR framework, not an error in classification methodology. It means a therapeutic tool treating suicidal ideation may be Class I under UK MDR while the same tool would be Class IIb or III under EU MDR Rule 11.

Apply the Rule 11 analysis for EU market classification and for any GB product pursuing CE certification.

Worked illustration: AI triage chatbot

A chatbot assesses symptoms and recommends self-care, GP appointment, or A&E. UK MDR Rule 10 analysis: Step 1: yes, the product provides decisive information determining clinical pathway, which the MHRA guidance treats as allowing direct diagnosis.

Step 2: the named vital physiological parameters (cardiac performance, respiration, CNS activity) are not at stake in the rule's narrow sense, so the IIb escalation threshold is not met. Outcome under UK MDR Rule 10: Class IIa.

EU MDR Rule 11 analysis: Step 1: yes; Step 2: yes, the worst foreseeable incorrect output is 'self-care' for a patient in acute crisis, which could directly cause death or irreversible deterioration. Outcome under Rule 11: Class III.

The same product reaches different classifications under the two frameworks, and each governs its own route: Class IIa requirements for UKCA, Class III requirements for CE.

Self-assessment
A mood tracker shows the patient only a trend chart of their self-reported mood scores over twelve weeks, with no clinical recommendation. Does Rule 10 push it above Class I under UK MDR?

The EU rulebook: Rule 11 and the three-step severity test

Rule 11 is the EU MDR classification rule applicable to CE marking for the EU market and Northern Ireland, and to any GB product relying on CE acceptance. It uses a severity-based three-step test that is structurally different from the UK MDR Rule 10 direct-diagnosis analysis.

IMDRF significance ↓ / Healthcare situation →CriticalSeriousNon-serious
Treat or diagnoseIMDRF IV — MDR IIIIMDRF III — MDR IIbIMDRF II — MDR IIa
Drive clinical managementIMDRF III — MDR IIbIMDRF II — MDR IIaIMDRF I — MDR IIa
Inform clinical managementIMDRF II — MDR IIaIMDRF I — MDR IIaIMDRF I — MDR IIa
EU MDR Rule 11 — severity escalation ladder
Step 1 — In scope?Information for a diagnostic or therapeutic decision. If no → Class I.
Step 2 — Death or irreversible harm?If an incorrect output could directly cause it → Class III.
Step 3 — Serious deterioration or surgery?If yes → Class IIb. Otherwise → Class IIa.
Highest trigger sets the classProbability and disclaimers do not change it.
What Rule 11 says
  • Software intended to provide information used to take decisions with diagnosis or therapeutic purposes is classified as Class IIa, except if such decisions have an impact that may cause: death or an irreversible deterioration of a person's state of health (Class III); or serious deterioration of a person's state of health or surgical intervention (Class IIb).
  • Software intended to monitor physiological processes is Class IIa, except if intended for monitoring of vital physiological parameters where variations could result in immediate danger to the patient (Class IIb).
  • All other software is Class I.
The structural problem with Rule 11

Rule 11 is severity-based rather than risk-based. It asks what could occur in the worst case if the software produces an incorrect output, without considering the probability of that outcome.

Risk, properly understood, is a function of both severity and probability. Rule 11 assesses severity only.

The practical consequence for DMHT is significant: under a strict application of Rule 11, most software with any clinical contact can be pushed to Class IIb or Class III by constructing a sufficiently severe worst-case scenario. The German notified-body coordination group EK-Med has documented this problem explicitly, noting that Rule 11 will tend to produce higher classifications for digital health applications and will increasingly require notified body involvement and clinical trial evidence.

The result is that Class I is effectively unavailable in the EU for any software with clinical purpose. This is a recognised flaw in the current framework, not a product-specific classification error.

The three-step severity test
  • Step 1: Does this function provide information used to take decisions with diagnosis or therapeutic purposes? Rule 11 explicitly includes therapeutic purposes, so a CBT skills application, a therapy support chatbot, or any software providing information for therapeutic decision-making falls within Step 1. If no: Class I (rare for any software with clinical contact). If yes: continue.
  • Step 2: Could an incorrect output from this function directly cause death or irreversible deterioration of health? If yes: Class III for this function. If no: continue.
  • Step 3: Could an incorrect output from this function directly cause serious deterioration of health or lead to surgical intervention? If yes: Class IIb. Otherwise: Class IIa.
Two things the Rule 11 test does not do
  • It does not ask what is likely. The probability of harm does not affect classification. A function that could directly cause death even in rare circumstances sits at Class III regardless of estimated frequency. Probability is a risk management question addressed in the ISO 14971 hazard log; it is not a classification input.
  • It does not look at disclaimers or safety features. A function that could directly cause serious deterioration is Class IIb whether or not the product carries a disclaimer stating it is not a medical device, and whether or not the product includes crisis signposting or other safety controls. Design controls reduce the likelihood of harm and belong in the risk management file as residual-risk mitigations. They do not reduce the classification of the function that triggers the rule.
MDCG 2019-11 and the IMDRF matrix

The Medical Device Coordination Group recognised that pure Rule 11 application was producing disproportionate classification outcomes. MDCG 2019-11 introduced the IMDRF 3x3 classification matrix as a supplementary framework to enable more proportionate classification.

The matrix classifies SaMD across two dimensions: the significance of the information provided to healthcare decisions (treat or diagnose / drive clinical management / inform clinical management) and the state of the healthcare situation (critical / serious / non-serious). The MDCG mapping has a notable consequence: IMDRF Class I (the lowest risk category) maps to MDR Class IIa.

There is no MDR Class I outcome for any software providing information with clinical purpose under MDCG 2019-11. For DMHT products in the EU, Class I is not available regardless of how low the actual risk is.

Self-assessment
A DMHT product is Class I under UK MDR because Rule 10 does not engage (no direct diagnosis) and Rule 12 applies. The developer assumes it is also Class I for CE marking purposes. Is this correct?

Serious deterioration in mental health: where is the line?

Under Rule 11 the most contested classification call for DMHT products is whether an incorrect output could cause serious deterioration (IIb) or only significant deterioration (IIa). The EU MDR text does not define these terms with clinical precision and no notified body has published condition-specific guidance for mental health.

The framework below represents F&G Strategy's interpretation based on current EU MDR text, established clinical definitions, and the reasoning a notified body would be expected to apply. It is not formal MHRA, EU Commission or notified body guidance.

Notified body decisions are product-specific and may differ.

Likely serious deterioration — IIb territoryProbably not serious deterioration — stays at IIa
Suicide attempt resulting from delayed or incorrect clinical intervention.Slower symptom improvement than optimal care would have achieved.
Psychotic episode requiring emergency inpatient admission.A missed opportunity for earlier intervention that does not result in a crisis event.
Relapse to substance use requiring medical detoxification.Distress or discomfort resulting from unhelpful or incorrect advice.
Self-harm requiring A&E attendance.The need to try a different therapeutic approach following an ineffective one.
Significant loss of employment or housing resulting from an unmanaged mental health crisis.
Heuristic for borderline cases

Does the harm require emergency clinical intervention or cause significant lasting impact on the person's life circumstances? If yes, it is likely serious deterioration.

If the harm is sub-optimal clinical outcomes without an acute crisis event, it is likely significant deterioration only.

Self-assessment
Does adding crisis signposting links to every conversation reduce a Class IIb chatbot to Class IIa under Rule 11?

UK MDR vs EU MDR Rule 11 in practice; MDR 2.0

For most DMHT products, EU MDR Rule 11 produces an equal or higher classification than UK MDR, never lower. The table below illustrates the divergence for representative product types.

Product typeUK MDR Rule 10 classificationEU MDR Rule 11 + MDCG 2019-11
CBT skills app, fixed exercises, no personalised outputClass I (does not allow direct diagnosis; defaults to Rule 12). Illustrates the therapeutic asymmetry.Class IIa (therapeutic purpose satisfies Step 1).
Mood tracker, trend chart, no recommendationClass I (descriptive output; does not allow direct diagnosis).Class IIa.
AI therapy chatbot for diagnosed depression, adaptiveClass IIa if it provides decisive information for clinical management; Class I if Rule 10 does not engage.Class IIb minimum, Class III if crisis assessment is within scope.
Relapse prediction flagging high-risk patients to care coordinatorsClass IIa (provides decisive information for clinical management decisions).Class IIb, with a worst-case severity argument to III.
Dual-market practice

Today, a CE mark under EU MDR covers GB, NI and EU access, so most founders will not run a parallel UKCA conformity assessment. Classify under EU MDR Rule 11 with MDCG 2019-11 for CE marking and use that route for all three markets.

Keep the UK MDR analysis (Rule 9, Rule 10, Rule 12 with the MHRA direct-diagnosis interpretation) documented in the technical file as a precaution, so the classification rationale is ready if the MHRA withdraws transitional acceptance or later requires a UKCA-specific assessment. This is documentation hygiene, not a blocking step.

If transitional arrangements end and the two frameworks produce different classes on your product, each framework then governs its own route; until then, the working position is CE-based access with the UK rationale on file.

MDR 2.0: the proposed revision to Rule 11

In December 2025 the EU Commission published a proposed revision to the MDR that includes a rewrite of Rule 11. The proposed revision takes a more risk-based approach aligned with IMDRF, incorporating three dimensions: purpose, criticality of the healthcare situation, and severity of possible harm.

It would reintroduce Class I as a possible outcome for non-critical, low-significance software. The proposal has attracted criticism for imprecision and incomplete harmonisation with the IMDRF framework.

It is not yet enacted. Until it comes into force, MDCG 2019-11 applies in full.

The Johner Institute analysis in the sources below covers the Rule 11 problem in depth.

Sources

The MHRA's Software and AI as a Medical Device Change Programme is developing a new UK-specific classification framework for SaMD, including DMHT. The rules summarised in this module may change; verify against current MHRA publications before relying on them for client work.

Read the source
MHRA guidance on Digital Mental Health Technology

The primary source (v1.2, last updated July 2025). Section 8 covers classification, including the direct-diagnosis interpretation this module applies.

Open MHRA guidance →
UK MDR 2002, Annex IX classification rules

The legal text for the current GB framework, carrying forward the EU MDD classification rules.

Open legislation →
EU MDR 2017/745, Annex VIII

The EU regulation containing Rule 11.

Open regulation →
MDCG 2019-11 Rev 1

Guidance on qualification and classification of software, introducing the IMDRF matrix mapping.

Open guidance →
IMDRF SaMD N12

The international framework for SaMD risk categorisation behind the 3x3 matrix.

Open framework →
Johner Institute on Rule 11

Extended analysis of the Rule 11 classification problem.

Open analysis →

Exercises

Form your own view first. Reveal the reference answer to compare reasoning.

Exercise 1 — The relapse prediction algorithm (deployment context matters)

The same relapse prediction algorithm is deployed in three different contexts. Context A: the algorithm generates a risk score; a care coordinator reviews all scores weekly and uses the output as one factor among several when deciding who to contact, reviewing the patient's full clinical record before acting. Context B: the algorithm automatically generates an outreach task for patients scoring above a threshold; a care coordinator reviews the task list each morning and decides whether to action each item, managing 80 patients and reviewing 15 to 20 tasks daily. Context C: the algorithm automatically sends a message to high-risk patients stating 'Your care team has been alerted. Please call us today.' The care coordinator sees sent messages retrospectively. Apply the Rule 11 three-step severity test to each context.

Classification for Context A.
Classification for Context B.
Classification for Context C.
Pick an option for each question to compare against the reference answer.
Framing note

Context versus control

Exercise 1 shows deployment context changing the classification. Exercise 2 shows a clinician review step failing to change it.

These are not in conflict, and the distinction between them is the most useful analytical tool in this module.

Classification under Rule 11 and MDCG 2019-11 follows the intended purpose, and the intended purpose includes the role the output is designed to play in decision-making. That role is what the IMDRF matrix grades as significance: does the information inform clinical management, drive it, or treat or diagnose?

Deployment context changes classification when, and only when, it changes that role. In Context A, the score is designed as one input among several, reviewed against the full clinical record before anyone acts: the information informs.

In Context C, the product communicates directly with the patient and the clinician sees it afterwards: the information drives, with no mediation at all. These are, for classification purposes, three different intended purposes, and the manufacturer must document which one is theirs.

A control added around an unchanged function does no such work. In Exercise 2, the product still generates the pathway recommendation, including A&E attendance for potentially acute presentations; the clinician is positioned as the approver of the device's decision, not as a decision-maker for whom the output is one input.

The information is still intended to drive clinical management. What the review step changes is the probability that an incorrect recommendation reaches the patient, and probability is not a classification input.

It is a residual-risk mitigation that belongs in the risk management file, where it does valuable work.

The test to apply at the borderline: would redescribing the intended purpose honestly, in the technical documentation and to the user, change the significance of the information? Redesigning the triage tool so it presents synthesised symptom information without a recommendation, leaving pathway selection to the clinician, changes what the information does, and the classification analysis with it.

Requiring a clinician to countersign the same recommendation does not. The first is a different product.

The second is the same product with a safety net, and Rule 11 classifies the product, not the net.

Exercise 2 — The clinician-in-the-loop question

A mental health triage tool uses AI to recommend one of three pathways: self-care resources, GP referral, or A&E attendance. The developer adds a requirement that a clinician must review and approve every recommendation before it is communicated to the patient. The developer argues this brings the product to Class IIa because clinical oversight removes the direct causal link between the AI output and patient action. Evaluate this argument under EU MDR Rule 11.

What is the most defensible classification?
Does mandatory clinician review change the classification?
Pick an option for each question to compare against the reference answer.

Exercise 3 — Kova, independently

Apply the EU MDR Rule 11 three-step severity test to each of Kova's three features independently. Feature 1: conversational AI providing supportive responses adapted to the young person's ongoing conversation history and mood check-in scores. Feature 2: weekly mood check-in using a bespoke non-validated five-item questionnaire, with results displayed to the young person as a trend chart with no clinical recommendation attached. Feature 3: parent and carer dashboard displaying the young person's weekly mood check-in scores as a numerical summary and trend line. State a Rule 11 classification for each feature and an overall classification.

Feature 1 — conversational AI.
Feature 2 — mood check-in trend chart shown to the young person only.
Feature 3 — parent / carer dashboard.
Overall product classification.
Pick an option for each question to compare against the reference answer.

The following exercises apply the UK MDR Rule 10 direct diagnosis analysis. For EU MDR Rule 11 exercises see above.

Exercise UK1 — The mood monitoring app

A consumer app tracks self-reported mood daily using a single sliding scale from one to ten. At the end of each week it displays a trend chart to the user with no clinical recommendation attached. The app's marketing describes it as helping users understand their emotional patterns. Apply the UK MDR Rule 10 direct diagnosis analysis.

Does Rule 10 engage?
Pick an option for each question to compare against the reference answer.

Exercise UK2 — The PHQ-9 scoring tool

A web application administers the PHQ-9 to patients before a GP consultation, calculates the total score using the validated algorithm, and displays the score and severity band to the GP in the consulting room. The GP uses the score alongside their own clinical assessment. Apply the UK MDR Rule 10 direct diagnosis analysis.

Does Rule 10 engage and if so what is the classification?
Pick an option for each question to compare against the reference answer.

Exercise UK3 — The relapse prediction algorithm in a staffed community team

A machine learning algorithm generates a weekly risk score predicting clinical deterioration for patients on a community mental health team caseload. Care coordinators review all scores weekly and use the output as one factor among several when deciding who to contact, reviewing the patient's full clinical record before acting. Apply the UK MDR Rule 10 direct diagnosis analysis.

What is the most defensible classification under UK MDR?
Pick an option for each question to compare against the reference answer.

Downloadable resources

Print-friendly companions to this module.

Three-Step Test Reference Card (PDF) ↓
Single-page reference: UK MDR Rule 10 direct-diagnosis questions and EU MDR Rule 11 three-step severity test side by side, plus the serious-deterioration table for mental health.
Classification Exercise Workbook (PDF) ↓
Five blank classification exercises with UK MDR and EU MDR Rule 11 templates for self-study. Answers not included; for the worked answers, contact info@fgstrategy.co.uk.

Educational resource. Not formal regulatory or legal advice.