DEV Community: Alexander Thomas

Medical device classification for software and AI: EU, UK and FDA basics

Alexander Thomas — Thu, 08 Jan 2026 09:51:27 +0000

Medical device classification for software and AI rests on two fundamental questions: Is the software a medical device at all (qualification), and if so, which risk class applies (classification)?

Unlike physical hardware, software and AI risk is driven primarily by the medical purpose of the output and its impact on clinical decisions, rather than physical invasiveness.

Under the EU MDR, classification for medical device software is commonly determined via Rule 11: software intended to provide information used to take diagnostic or therapeutic decisions is Class IIa unless those decisions may cause serious deterioration/surgical intervention (Class IIb) or death/irreversible deterioration (Class III).

In the US, FDA class (I, II, or III) depends on the specific device type and classification regulation, so it cannot be generalised from clinical "seriousness" alone.

Many founders realize too late that their "wellness app" is actually a regulated medical device. It is often a harsh realization. You may believe you are building a consumer tech product, only to find yourself facing a notified body audit and complex clinical evaluation requirements.

This guide aims to navigate the complexities of qualification and classification without getting lost in legal jargon. While this is not legal advice, it is based on the current regulatory text and common pitfalls observed in the industry.

We will focus on the EU MDR and IVDR first, as they represent comprehensive modern frameworks, followed by the FDA context for the US market. While the underlying logic is often similar across regions, the vocabulary differs, which can be a source of frustration for global companies.

Qualification vs classification (why it matters for software)

A critical distinction that teams often overlook is the difference between qualification and classification. Qualification asks "is it a device?", whereas classification asks "how risky is it?". You cannot classify a product until it has been qualified.

Debating whether a product is Class I or Class IIa is futile if you have not yet established that it is a medical device. It is akin to arguing over speed limits before deciding if you are driving a car or riding a bicycle.

Qualification is a binary step. Under the EU MDR 2017/745, a medical device is any software intended by the manufacturer to be used for specific medical purposes. These include diagnosis, prevention, monitoring, prediction, prognosis, treatment, or alleviation of disease.

The inclusion of "prediction and prognosis" in the MDR was a significant shift, effectively pulling a generation of AI predictive tools into the regulatory net. If your software claims to predict the onset of sepsis within four hours, that is a medical purpose.

Once you accept the device status, you move to classification, which determines your regulatory burden. The EU uses classes I, IIa, IIb, and III, while the US uses Class I, II, and III. A higher class correlates with a higher evidence requirement.

A Class I device may only require a self-declaration and basic documentation, whereas a Class III device demands extensive clinical data and pre-market approval.

Misclassification can be fatal for a startup; classifying too high wastes capital on unnecessary trials, while classifying too low risks enforcement action by authorities.

EU guidance is explicit that qualification and classification are separate steps for software. You must first apply the MDR or IVDR definitions, and only then apply the classification rules. Mixing these steps leads to confusion.

While some consultants may complicate this process, the core logic is sound and centered entirely on the "intended purpose."

Your intended purpose is defined by what you claim the device does, not just what the code is capable of. It is determined by your marketing, labeling, and instructions for use.

If the software has no intended medical purpose, it may fall outside the MDR definition of a medical device; if it is intended for a medical purpose, even basic functions (including display) can be within scope.

EU approach: MDR + MDCG software guidance

The European regulatory landscape shifted significantly with the introduction of the MDR. Under the previous MDD, most standalone software was Class I. Those days are over. Relying on outdated advice from the pre-MDR era is a significant risk.

The central component of the new framework is Rule 11 in Annex VIII of the MDR.

Rule 11 is the specific classification rule for software. While complex, the core principle is that software providing information used for diagnostic or therapeutic decisions is classified based on the risk associated with that decision.

If the decision could cause death or irreversible deterioration of health, the software is Class III. If it could cause a "serious deterioration" or lead to surgical intervention, it is Class IIb. If it could cause a non-serious deterioration, it is Class IIa.

Consequently, software performing decision-support functions often falls into Class IIa at a minimum. If your software informs a decision concerning a medical condition, it is difficult to argue that an error would not cause at least a "non-serious deterioration."

Therefore, many digital health applications in Europe now require a notified body assessment, preventing self-certification.

It is essential to consult MDCG 2019-11. This guidance document is the authority on the qualification and classification of software. It explains how to interpret Rule 11 with specific examples.

It clarifies that software intended to monitor physiological processes is Class IIa, unless it monitors vital parameters where variations could result in immediate danger, in which case it elevates to Class IIb.

Common software claims that trigger medical purpose

Specific vocabulary can trigger regulatory scrutiny. Verbs that imply agency, intelligence, or definitive action are usually indicators of a medical claim.

"Detects" is a major trigger (e.g., "Detects atrial fibrillation from wrist data"). This is a diagnostic claim. "Diagnoses" is explicitly medical.

"Calculates" can be nuanced; calculating BMI is generally acceptable, but calculating a proprietary heart failure risk score classifies the software as a device.

"Predicts" is increasingly scrutinized. A claim like "Predicts 30-day readmission risk" is a prognosis, which constitutes a medical purpose.

Another critical term is "Recommends" (e.g., "Recommends insulin dose" or "Recommends triage priority"). If software instructs a human on clinical management, it is considered high risk.

Even with a disclaimer stating "for information only," regulators assess the functional reality. If the user is expected to rely on the output, it is a medical device.

Risk thinking for SaMD (IMDRF concepts)

The International Medical Device Regulators Forum (IMDRF) is a collaborative group of global regulators. They developed a framework for "Software as a Medical Device" (SaMD) that is instrumental in understanding risk. Both the EU and US regulations borrow heavily from this conceptual framework.

The IMDRF framework utilizes a two-axis matrix to categorize risk, forcing manufacturers to be honest about their product's function.

The first axis is the Significance of the Information (what the output is used for):

Treat or Diagnose (Highest risk)
Drive Clinical Management
Inform Clinical Management (Lowest risk)

The second axis is the State of the Healthcare Situation (the patient's condition):

Critical (Life-threatening)
Serious
Non-serious

Combining these axes results in a category from I to IV.

Category IV represents the highest risk, such as software that treats or diagnoses a critical condition (e.g., AI that identifies a stroke on a CT scan to guide surgery).

Category I represents the lowest risk, such as software informing clinical management for a non-serious condition (e.g., an app tracking physical therapy exercises for a minor injury).

This matrix is an excellent tool for internal strategy. If a product manager claims a tool is "low risk," this chart can verify whether the software drives the management of a serious condition.

If it does, it is not low risk; it is likely Category II or III. In the EU, this translates to Class IIa or IIb. In the US, it likely indicates a Class II device requiring clinical data.

FDA classification overview for software (high level)

The FDA operates differently than the EU. Rather than a single rule like Rule 11, the FDA maintains a comprehensive database of "product codes" and regulations. Classification involves identifying the code that matches your device.

Class I represents the lowest risk. These devices are subject to "General Controls," including company registration, device listing, adverse event reporting, and quality system regulations (transitioning to the Quality Management System Regulation, QMSR, effective February 2026).

Most Class I devices are exempt from premarket notification, meaning you do not need prior permission to sell.

However, very few AI products fit this category, with exceptions for simple image viewers or calculators for standard medical formulas.

Class II covers the majority of digital health and AI software. These are moderate-risk devices subject to General Controls plus "Special Controls," which may include performance standards, labeling requirements, or specific guidance documents.

Most Class II devices require a 510(k) premarket notification, where you must prove "substantial equivalence" to a predicate device already on the market.

Finding a predicate for novel AI can be challenging. If a device has no predicate but is low-to-moderate risk, a De Novo request may be necessary. This process creates a new classification regulation. It requires more effort than a 510(k) but is less burdensome than a PMA.

Class III is reserved for the highest risk devices—those that sustain life, support life, or present a high risk of illness or injury. These require Premarket Approval (PMA), involving a full scientific review that takes years and costs millions.

Few standalone software products are Class III unless they are integral to a high-risk hardware system, such as a pacemaker or artificial pancreas.

The FDA has shown progressiveness through its Digital Health Center of Excellence. Guidance on Clinical Decision Support (CDS) attempts to exempt certain software from regulation if the physician can independently review the basis of the recommendation.

However, for "black box" AI where the algorithm's logic is opaque, this exemption rarely applies.

When IVDR becomes relevant (IVD-related software)

The In Vitro Diagnostic Regulation (IVDR) is frequently overlooked. As the sibling of the MDR, it covers tests performed on biological samples such as blood, urine, or tissue. If software processes data derived from an IVD, it may itself be classified as IVD software.

This is particularly relevant in genomics and precision medicine. An AI analyzing genetic sequencing data to predict cancer risk is likely an IVD medical device, not an MDR device.

The IVDR uses a different classification system: Classes A, B, C, and D, with Class A being the lowest and Class D the highest.

Under the previous directive, most IVDs were self-certified. Under the IVDR, the vast majority now require a notified body.

Software providing information for diagnosis or treatment based on IVD data will typically fall into Class C (high risk). Screening for transmissible diseases like HIV pushes this to Class D.

Complexity arises when software utilizes both IVD data and other physiological data—for example, a risk calculator using blood pressure (MDR) and cholesterol levels (IVD).

MDCG guidance suggests looking at the principal intended purpose, but manufacturers often must satisfy the stricter of the two regulations.

Specialized consultancy is highly recommended for IVDR, as general MDR expertise may be insufficient.

Evidence and documentation (intended purpose, clinical association, validation)

Regardless of the jurisdiction (EU vs. US) or regulation (MDR vs. IVDR), evidence is mandatory. The depth of evidence required correlates with the device classification.

First, you must establish Scientific Validity (or Clinical Association). Does the underlying concept make scientific sense? Is there a proven link between the input data and the clinical condition?

For example, detecting diabetes from voice patterns requires strong peer-reviewed literature proving that voice patterns change specifically due to diabetes. Without this, the algorithm lacks a foundation.

Next requires Analytical Performance, or technical validation. Does the software accurately and reliably process input data?

For AI, this includes testing for bias, robustness across demographics, and performance on different hardware configurations.

Finally, you must prove Clinical Performance. Does the software output actually aid the patient or yield a correct diagnosis in a real-world setting?

For Class IIa/IIb (EU) or Class II (FDA), this usually necessitates a clinical performance study, which may be retrospective (using historical data) or prospective.

Documentation is a critical failure point for startups. You require a Quality Management System (QMS), typically compliant with ISO 13485; software lifecycle documentation compliant with IEC 62304; and risk management compliant with ISO 14971.

These cannot be retroactively generated at the end of a project. "Backfilling" a design history file is rarely successful and is easily detected by auditors. Standards must be integrated from day one.

Common mistakes and pitfalls

Avoiding common errors can save significant time and resources. The following are frequent missteps in the industry.

The "Wellness" Trap: Founders often claim to be a "wellness tool" to avoid regulation, yet pitch investors on "revolutionizing healthcare." You cannot have it both ways.

If the product claims to manage a disease, it is a medical device. Diluting claims to remain in the wellness category often results in a product with limited utility that customers are unwilling to pay for.

Advice vs. Information: There is a critical distinction between providing information and giving advice.

A prompt saying "Go to the ER now" is advice—a command with high risk. A display stating "Heart rate is 140 bpm" is information.

User interface copy is often too prescriptive. Phrases like "Take 5mg of this drug" are dangerous for non-regulated apps; "Consult your doctor about your medication" is the compliant alternative.

Underestimating Timelines: In Europe, securing a slot with a notified body and completing the review process is time-intensive.

Recent manufacturer surveys indicate that the average time for technical documentation assessment can exceed 18 to 22 months. Launch plans must account for this regulatory lag to ensure sufficient financial runway.

Post-Market Surveillance (PMS): Certification is not the finish line. Manufacturers must monitor the device throughout its lifecycle.

For AI models, this includes monitoring for data drift. If a model's performance degrades because the patient population changes, the manufacturer must detect and correct it.

Regulators are increasingly focused on this aspect of AI lifecycle management.

Recent developments and trends

The regulatory field is evolving rapidly. The most significant trend is Generative AI and Large Language Models (LLMs) in healthcare.

These non-deterministic models pose a challenge for regulators because they can hallucinate. Determining classification for these tools still relies on the intended purpose and existing rules, though validating their safety remains a complex, evolving area.

Post-Brexit, the UK is developing its own framework via the MHRA. They are aiming for a more agile, pro-innovation approach, exploring concepts like "AI Airlocks" for controlled device testing.

The UK currently accepts CE marked devices, with dates extending to June 2028 or 2030 depending on the device type and certification status, though a UKCA mark will eventually be required.

Globally, there is a convergence of standards. The FDA, Health Canada, and the UK are collaborating on "Good Machine Learning Practice" (GMLP).

This suggests that following best practices for data management and validation will position companies well globally, even if a single global approval remains unlikely.

Final Thoughts

Medical device classification for software can feel overwhelming, dense, and bureaucratic. However, these regulations exist to prevent patient harm.

Software errors can be lethal; an algorithm missing a cancer diagnosis carries risks comparable to physical surgical failures.

Success in this space requires respecting the rules rather than attempting to circumvent them.

Embrace the classification process. A Class IIa certification is a significant asset that validates the product, proves it works, and differentiates it from unregulated competitors. It serves as a competitive moat.

The best approach is to study MDCG 2019-11 thoroughly and build compliance into the company's DNA from the start.

How to set up your home workstation for less than $1,000

Alexander Thomas — Thu, 15 Oct 2020 14:12:25 +0000

If you work from home, your home office workspace is where you spend a considerable chunk of your time. Working from home brings up many different distractions you didn’t have to worry about when making the daily commute to work.

Maybe your significant other sings along to his or her new favourite song while doing the dishes, especially when you’re on a video call. Perhaps you were previously unaware of the fact that your dog loves barking at every car that drives down your street during the day.

It becomes more challenging to separate work and life when your professional space merges with your personal space.

Because you’re home, it’s tempting to catch up on household tasks you otherwise would be unable to do from a traditional office.

Having a specific place to do your work is essential to your mental and psychological wellbeing, productivity, and efficiency.

Whether you’ve been working from home as a freelancer for years or are new to the home office due to COVID-19, here is how to create a fabulous home office for under $1,000.

Invest in a standing desk - $394.17

It’s time to get to work, but is your super comfortable office chair bringing down your mood, energy level, and productivity? Recent studies say yes.

The study surveyed over 140 people who changed from a sedentary working position into a standing desk workspace. 52 percent of them said they felt more engaged in their work, and 43 percent of them reported a massive uptick in performance.

Luckily, there is a sleek, modern, and easy solution to your desk chair blues. This adjustable height standing desk from UpDownDesk. Retailing at just $290, this desk comes in a variety of colors and textures.

It’s adjustable, making sure that it caters to all kinds of workers and allows you to bring it to sitting level if you need a few breaks during the day.

Score some noise-canceling headphones - $199

Do you need to strategize and be creative? Maybe you head bob to some chill folk music. Are you pumping out some copy for a client? Perhaps it’s upbeat pop music for the next few hours. Are you pulling a coding binge with a pot of coffee right next to you? Maybe it’s time for some hip hop or metal.

Whatever mood you are in or music you like, having some good tunes while you work is always a good bet. There’s nothing better than noise-cancelling headphones to jam out with. Repeatedly regarded as the best over-ear headphones on the market, the Bose Quiet Comfort 35 II nearly transfers you right inside the recording studio.

Your brain starts to associate specific playlists with tasks, so get busy creating mood-boosting playlists for different work tasks. You’ll be done with that pitch, article, or project before you know it.

Buy a living, breathing friend - $96 plant holder/bonsai tree

Humans have an inherent need to be around nature. Lock yourself in a windowless basement with nothing but technology for a few weeks, and it will make an impact on your mental and psychological wellbeing.

Biophilia, defined as “a love of life and the living world and the affinity of human beings for other life forms,” proves humans thrive when within nature, but suffer when isolated from it.

On top of reducing all types of stress and just being a joy to look at, having plants around you can also help your concentration and memory.

This levitating plant holder will not only give you a place to hold your new friend but will rotate 360 degrees for your viewing pleasure. If you selected the maple standing desk, this holder would match perfectly. But what to plant inside it?

This rock juniper bonsai tree encapsulates the essence of a giant bonsai in miniature form. Its unique shape and size make it a perfect starter tree for your home office.

The Trio - $299.99

For those of you that work on multiple projects per day, often at the same time, it is often necessary to have more than one screen open at once.

Instead of filtering through windows or tabs on your laptop, score two extendable and adjustable monitors just by connecting a few USB cables.

The Trio is one of the most-funded Kickstarter campaigns of the past year and allows you to connect two external monitors right onto your laptop and extend them out for a total of three screens.

Just fasten four magnets to the back of your computer and attach the monitors. When your tasks are all done, the thin monitors lay on the back of your laptop until you need them next.

Now that’s efficiency!

LED desk lamp $9.99

Let’s face it; not all home offices are created equal. If you have a big, bright window you can set your desk up next to, it will give you access to most of the natural sunlight your body craves.

But for those that have turned their small spare room into their home office, or don’t have the optimal space for a large workspace, getting natural sunlight can be a problem when spending long hours alone.

That’s where this LED light comes into play. It mimics natural sunlight, so when you get the winter blues, feel down in the dumps or feel lonely, you can get an extra kick of simulated Vitamin D. This one is available for just $10.

If you’ve been adding along, that’s a total of $999.15.  The minimalist home office theme is often fresh, crisp, clean, and modern. It consists of the bare essentials to maximize production and limit distractions. There are limitless ways to customize a minimalistic workspace to tailor it to your wants, likes, and desires.

The thought is to only add the most necessary items to your workspace. When you approach your home office every morning, you’ll have an uncluttered mind that matches your workspace.

5 Reasons Your Digital Marketing Plan Needs Buyer Personas

Alexander Thomas — Mon, 30 Mar 2020 09:39:02 +0000

You may think you have a good grasp of your target market, but, hand on heart, can you really say you know it inside out? More importantly, is every piece of content you’re producing tailored specifically for your potential customers?

If you’ve never heard the phrase ‘buyer persona’ before, don’t worry – you’re not alone. It can easily be labelled as just another marketing term especially by an SEO agency, but the humble buyer persona holds the key which will enable you to create content that will be consumed, shared and acted upon.

What is a buyer persona?

Put simply, a buyer persona is a fictional depiction of your ideal customer. Let’s call him Jim from Bolton. You know he’s middle-aged, has plenty of disposable income, prefers traditional forms of communication and likes the finer things in life.

Instantly, you know the kind of content to push Jim’s way. The tone, method of delivery and call-to-action can all be finely tuned to gain maximum engagement.

Buyer personas are built using a simple framework coupled with plenty of market research. You’ll likely have more than one persona, too, because, for every Jim, there’s the twenty-something Sarah who is addicted to

Facebook and is always on the hunt for a deal.
Now we know what buyer personas are, here’s 5 reasons they should form part of your digital marketing strategy:

You’ll know what motivates your customers

You could create the best, most engaging content in the world, but if it doesn’t hit upon the things which motivate your potential customers, it’s next to useless. By developing buyer personas, you’ll know what motivates them and you’ll be able to motivate them to click your call-to-action.

You’ll know who your target buyers are

Knowing that your target buyers are women in their mid-40s isn’t enough – you need to know who they are. What drives them? What buyer’s journey do they follow? What are their specific pain points? What kind of home life do they lead? This stuff really matters in marketing.

You’ll save time creating content

If you’ve ever stared at a blank screen wondering what on earth you’re going to write for your latest blog post, you’re not alone, but by having a solid, ever-present grasp of your target buyers, you’ll have a key set of wants and desires to target with your content. The ideas will come far quicker as a result.

Your products will benefit

Buyer personas offer benefits which extend far beyond the marketing team. Product development will improve immeasurably, too, as you’ll be able to narrow down the stuff that matters most to your potential buyers and include only that in the services you offer.

You’ll know your customers’ goals – finally!

When boiled down, the customer journey always ends with a defined goal, but rarely is it immediately apparent to you, the business. By developing buyer personas, you’ll be able to work out what those goals are. Once you know your buyers’ goals, you can develop content and calls-to-action which provide the end-point for them.

Summary

Writing buyer personas isn’t a simple task; it requires time, research and honesty. However, once developed, your buyer personas will become the cornerstone of your marketing strategy and help you produce rich content that will turn website visitors into paying customers.