Module 1 · MHRA SaMD Regulation

MHRA Certification Pathways for Software as a Medical Device

Ownership and documentation per device class. Select a class to explore the pathway.

Last reviewed: June 2026 · Next planned review: September 2026

F&G StrategyClinical Safety Leadership

Dev teamEngineering / dev team

Third partyUK Approved Body / specialist

SharedCollaborative ownership

Before you pick a class — read this

Intended Purpose is the single most common source of classification dispute

The Approved Body classifies your product against the Intended Purpose statement you put in writing, assessed together with your marketing claims, product mechanics, in-app copy, partnership communications and clinician-facing materials. Mismatches between these — for example, a cautious Intended Purpose document paired with marketing that claims diagnostic or treatment benefit — are the most common reason a product's classification is challenged and pushed upwards.

Before committing to a pathway, write the Intended Purpose statement first, then audit every external signal (website, app store listing, decks, NHS contract language) for consistency. The pathway you read below assumes the Intended Purpose stated for your class actually matches what the product does and claims.

Typical timeline

14 to 20 weeks (typical, from standing start)

Approximate cost (illustrative only)

£20k to £80k (approximate)

UK Approved Body

Not required

Certification pathway — Class I

Class I SaMD is self-certified. No UK Approved Body review is required. MHRA registration via DORS is administrative only. Cost varies significantly.

Go deeper

Related Academy modules

Module — SaMD Classification Rules (Rule 10, Rule 11 & the three-step test)
Apply when scoping classification in Step 1.
Module — The Multi-Modular Minefield
For products bundling wellness and clinical functions.
Module — ISO 14971 risk management for DMHT (including AI/ML)
Use when building the risk file in Step 2.

Summary comparison across classes

Class	Best case	Typical	Extended	Approved Body	ISO 13485
Class I	10–14 weeks	14–20 weeks	20–24 weeks	No	No (recommended)
Class IIa	9–12 months	12–18 months	18–24 months	Yes	Yes
Class IIb	12–18 months	18–24 months	24–36 months	Yes (full QMS audit)	Yes
Class III	18–24 months	24–36 months	36–48 months	Yes (design dossier + QMS audit)	Yes

Planning principles and limitations

Figures here are planning estimates derived from published ISO 13485 certification data (2024 to 2026) and Approved Body process documentation. All timelines are from a standing start: product built and tested, no existing QMS, no existing technical documentation, first-time manufacturer. If any of these are already met, the relevant stage is shorter. These are not worst-case figures — products with novel AI features, paediatric populations, or unresolved clinical evidence gaps will routinely exceed the extended ranges. Before committing to a pathway, obtain a scoping opinion from your chosen Approved Body.

Start ISO 13485 immediately. For any product heading toward Class IIa or above, ISO 13485 QMS implementation is the critical path item most frequently underestimated. It takes 6 to 12 months from scratch and must be running for 2 to 3 months before an Approved Body will conduct a Stage 2 audit.
Engage your Approved Body before your technical file is complete. Approved Bodies have queue times for initial assessments. Waiting until documentation is complete before making contact adds months to the overall timeline unnecessarily.
Clinical evidence is not a documentation task. For Class IIb and Class III products, the clinical evidence stage involves real-world study execution that runs on its own timeline regardless of regulatory resource applied. It should be designed and initiated as early as possible, in parallel with QMS and technical documentation work.
Budget 20 to 30 percent contingency on timeline. Approved Body query rounds, documentation gaps identified late, and QMS audit findings are normal parts of the process and each adds weeks to months to the overall timeline.

UK Responsible Person

Any manufacturer based outside Great Britain must appoint a UK Responsible Person (UKRP) before registering their device with the MHRA. The UKRP is a legal entity based in Great Britain responsible for holding copies of the technical documentation and Declaration of Conformity, acting as the formal point of contact with the MHRA, and managing post-market vigilance reporting. This requirement applies across all device classes. The UKRP role is distinct from the Clinical Safety Officer role: the UKRP carries legal and administrative responsibility, while the CSO carries clinical governance responsibility.

Last reviewed: June 2026. Next planned review: September 2026.