SaMD Classification in Colombia Under Decreto 4725

1. Key takeaways

Software as a Medical Device (SaMD) in Colombia has no independent classification scheme; it must return to the classification criteria of Article 6 of Decreto 4725 de 2005 and the 18 classification rules of Article 7. The problem lies in Article 6 itself: one of its four classification logics is that software follows its host device, and SaMD by definition has no host device. That logic works for embedded software but leaves an unclosed mapping gap for standalone software.

GRZAN’s position: a gap is neither an exemption nor a license to self-down-classify. The approach is to apply the 18 rules of Article 7 independently, according to the software’s intended use — deriving the risk class from the degree to which the software’s output information influences the diagnostic or treatment decisions at stake — and to initiate a pre-submission classification consultation when the conclusion is uncertain. Two grounds support this position: the Article 6 logic that conflicting rules resolve to the highest class, and the direction of the draft new decree, which expressly brings SaMD into the unified framework.

2. Legal basis

3. Expert insights

#### Of Article 6’s four logics, only one addresses software, and it addresses embedded software

The four classification logics established by Art. 6 are: components of a system or kit are assessed independently, software follows its host device, multi-purpose devices take the highest risk, and conflicting rules resolve to the highest class. The second of these expressly takes the host device as its reference. That logic fully covers software that forms part of a device — equipment control software and embedded algorithms — but lacks a reference point for SaMD running standalone on general-purpose computing platforms. GRZAN’s judgment: this is not a vacuum created by legislative carelessness but a limit of the technical context in which the 2005 legislation was drafted — SaMD had not yet become a mainstream form.

#### The mapping gap should be filled with Article 7, not with analogy

Facing the gap, the industry has two roads: analogize from foreign systems — the EU MDR’s SaMD rules or the IMDRF framework — onto Colombia’s four-tier classification, or return to the 18 rules of Article 7 and derive the class rule by rule from the software’s intended use and the influence of its output. GRZAN chooses the latter. The reason: Art. 7 is the set of rules expressly given by Colombian law, so the derivation can be traced, challenged and re-checked within the filing; an analogy has no legal anchor, and once challenged in review there is no way to answer it.

#### The high-dispute zone: diagnostic-assistance and decision-support software

Disputes concentrate on software whose output influences clinical decisions. The same image-analysis software, positioned as providing quantitative reference versus delivering diagnostic conclusions, lands on different Art. 7 rules, takes different risk classes, and may move from automatic registration (2 business days) to standard registration (90 business days). GRZAN’s governing principle: derive the classification from the use actually claimed in the instructions for use and labeling, not from the company’s internal technical positioning. The claim is a legal fact; the technical positioning is not.

#### The draft writes SaMD into a unified framework, but waiting is not an option now

The draft Proyecto de Decreto would bring IVDs and SaMD into a unified framework. The draft was published in January 2026, went through WTO international notification on May 18, 2026, closed its comment period on July 17, 2026, and itself proposes an 18-month transition period; as of the verification date it has not been signed or promulgated. GRZAN’s recommendation: file now and derive under current law; do not delay market entry while waiting for a framework that has not entered into force. Two reasons — certificates are valid for 10 years, so an earlier certificate means earlier benefit, and the transition arrangements of drafts like this normally leave bridging room for existing certificates.

4. Practical recommendations

1. For every SaMD product, the GRZAN regulatory team issues a software classification derivation memo stating the intended use, the type of output information and the degree of influence on clinical decisions, compared rule by rule against the 18 rules of Art. 7.
2. Product and registration teams unify the use claims in the instructions for use and labeling, ensuring the derivation rests on the actual claim and preventing divergence between technical positioning and claims.
3. For conclusions landing in Class IIb/III, model the schedule on standard registration (90 business days) plus the 90-day deficiency window; for Class I/IIa, prepare for automatic registration (2 business days) while archiving to post-issuance verification standards in parallel.
4. For products with uncertain derivations, the titular’s local apoderado initiates a pre-submission classification consultation with INVIMA and retains the written reply as a filing basis.
5. Compliance completes the UDI-DI and GMDN semantic reporting required under Resolución 1405 de 2022, maintaining coding and registration information in step with software version changes.
6. The strategy function tracks the final wording of the SaMD provisions in the new draft decree and assesses migration arrangements for existing certificates into the unified framework.

5. Verification checklist

• □ A software classification derivation memo has been issued, compared rule by rule against the 18 rules of Art. 7
• □ The derivation basis is confirmed as the Article 7 rules, without direct analogy to foreign systems
• □ Use claims in the instructions for use and labeling are fully consistent with the premises of the derivation
• □ The pathway (automatic or standard registration) has been set from the derivation and the schedule model completed
• □ Uncertain items have entered a pre-submission classification consultation with the written reply retained
• □ UDI-DI and GMDN semantic reporting is complete, with a maintenance mechanism for software version changes
• □ Official fees have been checked against the 2026 fee schedule (321.91 UVB or 364.36 UVB)
• □ A tracking ledger exists for the draft decree’s SaMD provisions

Regulatory information verified as of October 29, 2026

All external conclusions rest on the current regulatory texts published by the competent authority, verified provision by provision before delivery.

GRZAN provides SaMD manufacturers with INVIMA classification derivation, pathway selection and UDI compliance support for the Colombian market, closing the Article 6 mapping gap with rule-based, defensible analysis. For inquiries, contact info@grzanglobal.com.