Korea Digital Medical Products Act: Scope, Classes and Implementation Timeline

1. Key takeaways

Korea has carved digital medical products out of the Medical Device Act into separate legislation. The Digital Medical Products Act was enacted and promulgated on 23 January 2024 and comes into force in two stages: 24 January 2025 for digital medical devices and digital drug-device combination pharmaceutical products; 24 January 2026 extending to digital medical and health support devices. With these three steps completed, the full life cycle of digital medical products is governed by the special act.

The act divides the products into three classes: digital medical devices, digital drug-device combination pharmaceutical products, and digital medical and health support devices. The classification result decides which set of premarket procedures and document requirements applies; the grades and routes of the Medical Device Act can no longer be used for these products.

Four institutional changes are key: software usability evaluation, the predetermined change control plan (PCCP), cybersecurity requirements and the excellent management system certification. Among these, the PCCP affects AI and software products most: changes submitted under a plan are exempt from licence by licence approval within the scope of the plan, shifting the iteration rhythm from one approval per change to one plan covering many iterations.

2. Legal basis

The Digital Medical Products Act and its relationship with the Medical Device Act system rest on the following instruments.

Implementation timetable (supplementary table)

3. Expert insights

Insight 1: The applicability determination must come first, and its result is a change of act, not an added requirement.

Since 24 January 2025, digital medical devices are no longer governed by the Medical Device Act; what applies is the Digital Medical Products Act and its subordinate rules. What GRZAN has encountered in projects is a technical dossier prepared under the Medical Device Act that, once the special act applied, needed to be reorganised along a new documentation logic rather than topped up with extra chapters. Putting the determination before dossier preparation is the single most cost-saving step under this regime.

Insight 2: The PCCP changes the cost structure of iteration.

The predetermined change control plan writes the foreseeable changes (algorithm updates, performance optimisation, extension of indications and the like) into a plan in advance and obtains its acknowledgement; changes within the scope of the plan are exempt from licence by licence approval. For software and AI products that iterate frequently, this regime compresses the cost of change from one review fee plus one review period per change to one plan plus retrospective reporting. GRZAN advises writing the change types, trigger conditions, verification methods and risk control measures of the PCCP as a verifiable checklist; plans of insufficient granularity are hard to get acknowledged in review.

Insight 3: Software usability evaluation and cybersecurity requirements run in parallel, and both point to verification evidence.

Software usability evaluation focuses on use-error risks in real use scenarios; cybersecurity requirements focus on data integrity and access control. Their common point is the demand for a verifiable chain of evidence rather than principled statements. GRZAN advises managing the usability engineering documents and the cybersecurity test records by version, matched one to one with the software version numbers.

Insight 4: Where the Basic Act on Artificial Intelligence overlaps, the Digital Medical Products Act prevails.

When an AI medical device falls within both AI-related legislation and the Digital Medical Products Act, the matter is handled under the principle that the special act prevails. GRZAN advises stating the order of applicable acts explicitly in the compliance documents, to avoid duplicate investment from running two compliance regimes in parallel.

Insight 5: The excellent management system certification is both a plus and a lever for system preparation.

The Digital Medical Products Act establishes an excellent management system certification. For companies planning a long-term presence in the Korean market, GRZAN advises using the requirements of this certification as the reference standard for quality system construction and positioning early, rather than catching up at the filing stage.

4. Practical recommendations

• First determine whether the product falls into one of the three classes. The determination for digital medical devices, digital drug-device combination pharmaceutical products or digital medical and health support devices must be put into a written document stating the decision date and the basis.
• Confirm the governing act by the implementation date. 24 January 2025 and 24 January 2026 are the two dividing points; projects spanning them must confirm which set of rules applies at the time of filing.
• Prepare the PCCP early. Write the change types, trigger conditions, verification methods and risk controls as a checklist-style plan aligned with the product iteration roadmap.
• Build a versioned evidence library. Archive usability engineering documents, cybersecurity test records and algorithm change records by software version number, so they can be retrieved directly during review.
• State the order of applicable acts. Where AI-related legislation overlaps, state in the compliance documents that the Digital Medical Products Act prevails, to avoid duplicate compliance investment.

5. Verification checklist

• □ Product class attribution: check against the definitions and scope of the three classes; assigned to one of digital medical device, digital drug-device combination pharmaceutical product or digital medical and health support device.
• □ Governing act confirmed: check the two implementation dates against the filing date; a single governing act determined and documented.
• □ PCCP preparation: check the four items of change types, trigger conditions, verification methods and risk controls; all four present at verifiable granularity.
• □ Software usability evaluation: check the usability engineering documents against the versions; documents correspond one to one with software versions.
• □ Cybersecurity requirements: check the access control and data integrity test records; test records exist and are archived by version.
• □ Excellent management system certification: assess whether to apply and check the system gaps; a gap list issued and scheduled.
• □ Overlap with other acts: check the applicability relationship with AI-related legislation; the order of priority stated.

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, Korean licence holder and local testing support for the Republic of Korea. Our team manages MFDS premarket approvals and KGMP conformity, coordinates import requirements, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com