Summary
Software as a Medical Device (SaMD) represents a rapidly growing segment of digital health innovation in the UAE. Under Federal Decree-Law No. 38 of 2024, which came into effect on January 2, 2025, SaMD is subject to comprehensive regulatory oversight by the Emirates Drug Establishment (EDE).
Key points:
- Digital health tools that diagnose, treat, or monitor medical conditions require regulatory approval as SaMD, distinct from general wellness products
- SaMD is classified from Class I (low-risk) to Class IV (high-risk), with higher classifications requiring more rigorous clinical evidence and documentation
- Marketing approval involves submission through EDE, adherence to international standards like ISO 13485, and ongoing post-market surveillance obligations
What Exactly is a SaMD?
Software as a Medical Device refers to software intended to perform medical functions such as diagnosis, monitoring, or treatment guidance, operating independently of hardware medical equipment. In practical terms, SaMD can be standalone software or software embedded in hardware where the software itself performs the core medical function. Examples include diagnostic algorithms that identify diseases, monitoring tools that track patient data, and therapeutic applications that guide clinical decisions.
The UAE treats SaMD as part of the broader category of medical equipment, ensuring it receives appropriate regulatory scrutiny based on its intended medical purpose and associated risks. Companies developing such software often collaborate with a life sciences law firm to navigate complex regulatory requirements and ensure compliance with UAE law.
What Is the Current Regulatory Framework?
The primary legislation governing SaMD is Federal Decree-Law No. 38 of 2024 concerning Medical Products, the Pharmacy Profession, and Pharmaceutical Establishments.
This comprehensive law, which became effective from January 2, 2025, establishes a centralized system for the approval, circulation, and oversight of medical products, including medical software.
The Emirates Drug Establishment (EDE) now serves as the central regulatory authority responsible for granting marketing approvals, licensing establishments, and enforcing compliance. During the transition period, the Ministry of Health and Prevention (MoHAP) continues to handle certain operational aspects while EDE provides oversight.
Importantly, the law explicitly prohibits the import, distribution, possession, sale, or use of any medical product, including SaMD, without proper marketing approval from EDE, except for specifically exempted cases.
How can I Tell If My Digital Health Tool Needs a SaMD License?
This is often the first question developers and entrepreneurs ask, and there’s no bright-line rule to tell exactly when a digital health tool or product might be considered SaMD. However, some broad guidelines that regulators will consider include:
- Does the software diagnose, treat, cure, relieve, or prevent diseases or injuries?
- Does it influence clinical decision-making or treatment pathways?
- Does it analyze patient data to generate medical insights or recommendations?
- Does it monitor vital signs or physiological parameters for medical purposes?
Software designed purely for administrative record-keeping, general wellness support, or patient education without diagnostic capabilities typically falls outside SaMD classification. The distinction between medical products and general healthcare products is significant. If you are uncertain whether your software qualifies as SaMD, consulting a technology law firm and lawyers specializing in digital health and medical devices can help prevent regulatory violations and market delays.
Always consult a legal specialist if you are unsure whether your product qualifies as SaMD. Misclassification can lead to regulatory violations and market access delays.
How is SaMD classified in the UAE?
SaMD follows a risk-based classification system divided into four classes (I, II, III, and IV), determined by the intended use, potential for harm, and the criticality of the medical function performed. Higher-risk classes demand more rigorous evidence of safety and efficacy.
The classification ranges from Class I (low-risk, such as basic administrative software) through to Class IV (high-risk, such as AI-driven therapeutic decision support systems for critical care). The specific class assigned to your SaMD will significantly impact the documentation, clinical evidence, and approval timeline required.
What does the Registration Process Involve?
Registration requires marketing approval from EDE, submitted electronically by the manufacturer or an authorized local representative. The process is designed for licensed entities such as marketing offices, medical warehouses, or manufacturers.
Applicants must compile and submit various documents, including but not limited to factory registration certificates, agency contracts for local representation, conformity certificates (such as CE Mark or FDA approvals), product documentation, and evidence of compliance with Good Manufacturing Practices. Higher-risk classifications require additional safety and efficacy data, including clinical studies.
The specific documentation requirements, attestation procedures, and submission protocols can be intricate and vary based on your product’s classification and origin.
A licensing expert can help you organize your documentation and assist with your filings, ensuring you meet all requirements efficiently and avoid common pitfalls that delay approval.
Upon approval, EDE issues a certificate valid for a specified period, enabling import and distribution within the UAE.
What Compliance Standards Must SaMD Meet?
Adherence to international standards forms the foundation of SaMD compliance. Key standards include ISO 13485 for quality management systems and ISO 14971 for risk management. Manufacturers must also implement comprehensive traceability systems, quality assurance protocols, and intellectual property protections.
Labelling requirements mandate that device details, risks, and instructions appear in both Arabic and English for circulation within the UAE. Local representatives assume legal responsibilities for market placement and ongoing compliance, making the selection of your UAE representative a critical business decision.
Post-market Surveillance: What Are My Ongoing Obligations?
Regulatory approval is not the end of the compliance journey. EDE enforces pharmacovigilance through mandatory adverse event reporting, which extends to software malfunctions and data inaccuracies for SaMD products. Manufacturers must maintain post-market surveillance plans, report recalls according to specific protocols, and cooperate with regulatory inspections. The law introduces a national database for monitoring SaMD performance, and EDE retains the authority to suspend or withdraw approvals for safety concerns.
The scope and specifics of these ongoing obligations can be substantial. Establishing a compliance framework with legal guidance ensures you meet these requirements without disrupting your business operations.
Key Takeaways
The UAE’s regulatory framework for SaMD reflects a sophisticated, risk-based approach aligned with international standards. While this framework supports innovation in digital health, it requires careful navigation.
The classification of your product, the documentation required, the approval pathway, and ongoing compliance obligations all depend on nuanced regulatory interpretations.
Whether you’re launching a new SaMD product or seeking to understand how recent regulatory changes affect your existing approvals, professional guidance is invaluable. The complexity of the regulatory landscape means that informed legal and licensing counsel is not just helpful but essential for successful market entry and sustained compliance in the UAE.
Authors: Shantanu Mukherjee, Alan Baiju
