Ecuador SaMD and AI/ML Regulation: Software Classification Rules under ARCSA-DE-2026-003-DASP

1. Key takeaways

For the first time the new regulation addresses software in dedicated provisions, producing a three-way classification: independently commercialized SaMD is classified under the IMDRF/N12 risk matrix (Article 22(e)); software used in combination with other devices automatically takes the same risk class and the same registration certificate as the device to which it is applied (Article 22(d)); and control software without an independent medical purpose is exempt from registration (Article 29(d)). Article 3 additionally incorporates the official definitions of AI (artificial intelligence) and SaMD. The dividing lines between the three branches determine whether a software product files at all, files alone, or rides on the host device’s certificate.

2. Legal basis

Relevant definitions incorporated in Article 3: IA (Inteligencia Artificial), artificial intelligence; SaMD (Software as a Medical Device); the abbreviation table additionally includes MLMD. Together these entries signal that software-bearing and algorithm-driven products are within the ordinary scope of the regulation rather than at its margins.

3. Expert insights

Insight 1: a single article, Article 22, resolves the three forms of software, one of the structurally most elegant designs of the new regulation.

• Item (d), accompanying software: software used in combination with other devices automatically takes the same risk class as the device to which it is applied, and consequently is covered by the same registration certificate; no separate classification decision and no separate certificate are needed.
• Item (e), standalone SaMD: SaMD commercialized on its own is classified under the IMDRF/N12 risk matrix; it must be classified and certified independently.
• Article 29(d), control software: software that controls or drives a hardware device without having a medical purpose itself, or that forms an integral part of its operation, is exempt from registration.

Insight 2: the decisional core is whether the software is independently commercialized and whether it has an independent medical purpose. The watershed between the three branches is not technical complexity but commercial form and medical purpose: software sold together with the hardware follows the host device; software sold separately is classified under the N12 matrix; software with purely control functions and no medical purpose is not registered. Distribution and pricing decisions therefore have direct regulatory consequences and should be coordinated with the regulatory team before launch.

Insight 3: the IMDRF/N12 matrix maps directly onto the four Ecuadorian classes. The N12 matrix classifies along two dimensions: the significance of the information provided by the software to healthcare decisions (treatment or diagnosis, driving clinical management, informing clinical management) crossed with the seriousness of the healthcare condition or patient state (critical, serious, non-serious). Because Ecuador also uses a four-class system, the N12 outcome can be translated directly into classes I–IV. A documented N12 assessment therefore serves simultaneously as internal classification evidence and as the filing rationale.

Insight 4: artificial intelligence is written into the definitions but the body text sets no dedicated documentation requirements, a point that must be clarified. Article 3 incorporates the definition of IA, showing that the legislator is aware of such products; however, the body of the new regulation sets no separate documentation items on algorithm transparency, training data validation or performance monitoring. Claims in some secondary interpretations that AI/ML devices must submit algorithm transparency and training data validation documents are currently not in the regulation and must await ARCSA implementing instructions. Filing strategies should neither ignore AI-specific evidence nor over-prepare against requirements that do not yet exist.

Insight 5: the clinical evaluation obligation for SaMD is separately provided in Article 24(2.3). The original wording refers to clinical studies, or a SaMD clinical evaluation for the medical technology of the device, applicable to classes III and IV of DMI, DMA and DMDIV. SaMD falling into classes III/IV therefore requires clinical evaluation documentation in addition to classification. Manufacturers accustomed to lighter software oversight elsewhere should budget for this early in the project.

Insight 6: general provision 3 adds a second confirmation for SaMD. It provides that the registration classification of devices, including SaMD, shall apply the guidelines and classification rules developed by GHTF and now carried forward by IMDRF. This double-anchors the applicability of IMDRF rules to software, leaving little interpretive room for treating software as outside the classification system.

4. Practical recommendations

1. Determine the software form first: accompanying, standalone, or purely controlling; this choice defines the registration obligation.
2. Self-assess standalone SaMD against the IMDRF/N12 matrix and archive a written determination.
3. File accompanying software together with the host device certificate without submitting a separate classification argumentation.
4. File AI/ML products under the existing framework while tracking whether ARCSA issues dedicated instructions on algorithm transparency and training data.
5. State the software version and intended use explicitly in the registration dossier to leave a traceable basis for later change management.

5. Verification checklist

• □ Completed the software form determination (accompanying / standalone SaMD / purely controlling)
• □ Completed and archived the IMDRF/N12 matrix self-assessment for standalone SaMD
• □ Included accompanying software in the host device certificate application
• □ Confirmed absence of an independent medical purpose (where the registration exemption applies)
• □ Recorded the software version and intended use in the registration dossier
• □ Established tracking of dedicated AI/ML instructions
• □ Prepared the clinical evaluation documentation of Article 24(2.3) for class III/IV SaMD

Regulatory information verified as of October 29, 2026

Core service areas

1. Global market access: EU CE (MDR/IVDR), US FDA (510(k)/De Novo/PMA), UK UKCA, Australia TGA, Canada Health Canada, Brazil ANVISA and Russia RZN, plus premarket registration pathway planning and filing execution across Latin America, Southeast Asia, the Middle East and other markets.
2. Authorized representative services: EU authorized representative (EC REP), UK responsible person (UK RP), Swiss authorized representative (CH REP), Australia sponsor and US Agent, together with neutral certificate-holder structure design.
3. Quality system compliance: ISO 13485 implementation and maintenance, MDSAP audit preparation, GMP conformity coaching, and technical documentation (TD) authoring and remediation.
4. Clinical and evaluation: clinical evaluation plans (CEP) and reports (CER), equivalence argumentation, PMCF planning and execution, and IVD performance evaluation.
5. Post-market compliance: vigilance and adverse event reporting, FSCA and recall execution, registration change and renewal management, and maintenance of national regulatory databases.

Why GRZAN

• Local regulatory teams: filings in each target market are executed by locally licensed regulatory professionals and prepared directly in the official language of the market, without secondary translation.
• Neutral holding structure: certificate-holding arrangements that are not tied to any distribution channel, keeping registrations independent of channel partners.
• Regional leverage: a single technical dossier can be reused across Andean Community and Mercosur member states, spreading regional compliance cost.
• Full lifecycle support: end-to-end service from classification, pathway design and dossier preparation through certificate holding, customs clearance, post-market vigilance and renewal.

Contact

• GRZAN provides medical device registration support in Ecuador for manufacturers, importers and authorized representatives.
• Email: info@grzanglobal.com
• Service inquiries: Ecuador and Andean market registration plans, certificate-holding structure design, official fee and timeline estimation