IVD and Software Considerations: Annex 3 and Digital Health

1. Key takeaways

Two product categories receive special treatment in Cambodia:

• In vitro diagnostic (IVD) medical devices: the DDF explicitly regulates the import, sale and circulation of IVDs; classification follows AMDD Annex 3 (not Annex 2). Registration applications for all classes of medical devices and IVDs are submitted through the same manual channel to the DDF.
• Software and digital health: Cambodia currently has no dedicated regulation for health information technology (digital health) and mobile health applications; such products may be handled under the same rules as medical devices. Software is explicitly listed within the scope of the device definition.

The same-channel treatment has an administrative consequence that is easy to miss. Because IVDs and devices are filed through the same manual channel to the DDF, a portfolio containing both product types is prepared, checked and lodged as one coherent submission effort, and errors in one stream can hold up the other. The differences between the two streams — the classification annex, and for software the substitute for physical samples — therefore need to be managed inside a single project calendar rather than as separate workstreams that meet only at submission. It also means the documentary standard expected of an IVD submission is the CSDT standard, not a separate template.

GRZAN note: IVDs are classified under Annex 3, non-IVDs under Annex 2; software is one of the 11 categories of objects explicitly listed in the device definition; the number of dedicated digital-health regulations in Cambodia is 0.

2. Legal basis

3. Expert insights

1. The IVD classification logic differs completely from that for general devices — the single most useful reminder in this article. Annex 3 classifies IVDs by their purpose and risk (screening, diagnosis, monitoring, blood-supply screening and the like), a different approach from Annex 2’s classification by contact mode, degree of invasiveness and site of action. Applying Annex 2 to an IVD is one of the most typical technical errors in Cambodian projects.

1. ‘No dedicated rules’ is not good news for software. No dedicated rules means neither a registration exemption nor a simplified pathway: software is still classified A/B/C/D and still documented under the CSDT. And because software has no physical form, the ‘samples or catalogue’ route available to Class A is hard to apply; in practice a software version description plus verification reports substitutes for it (practical interpretation).

1. Software version consistency is a hidden focus of the Cambodian review. Active and software products should provide a one-page cross-reference of the software version numbers, release notes, verification report numbers and the version sold in Cambodia, showing that ‘the software version sold in Cambodia’ is identical to ‘the verified version’. This practice is not an explicit Cambodian requirement, but it is a natural consequence of the traceability Module D demands.

1. For software, the absence of physical form changes what the review can inspect, so the written record has to carry more weight. A device reviewer can examine a sample; a software reviewer can only examine descriptions, versions and verification evidence. That is why the version cross-reference recommended below matters more for software than for hardware: it is the closest available equivalent to holding the product in hand. A software submission in which versions cannot be reconciled across documents leaves the reviewer with no way to confirm what was actually verified.

1. Digital-health products face a definitional question that has no form to fill in. With no dedicated rules, whether a given application counts as a medical device is decided by the device definition, and the answer shapes the whole project: classification, CSDT documentation and the registration pathway. Because the definition lists software explicitly, the default expectation is that health-related software is in scope; the residual uncertainty concerns products whose health function is indirect. Raising that question with the local entity and the DDF early, as recommended below, converts a definitional risk into a settled premise before any document is drafted.

4. Practical recommendations

1. For IVDs, state ‘classified under Annex 3’ and the rule relied on in the first document (the classification document). This avoids divergences when reviewers re-check against Annex 2 later; stating the annex in the classification document also protects every downstream document, since each later module inherits the class determined there.
2. Submit a version cross-reference table with Module D for software products. Treat version upgrades as changes and declare them early.
3. Prepare digital-health products as devices and allow time for classification disputes. With no dedicated rules, whether the product counts as a device may need to be confirmed with the local entity and the DDF before submission — bring that confirmation forward to before document preparation.

5. Verification checklist

• □ IVDs classified under Annex 3 with the rule cited
• □ Confirmed that IVDs and non-IVDs do not mix the annexes
• □ Software products confirmed to fall within the objects of the device definition
• □ Version cross-reference table in place (version sold = verified version)
• □ Device status of digital-health products confirmed in advance
• □ Active products provide IEC 60601 series conformity evidence

Regulatory information verified as of 29 October 2026.

In Southeast Asia, GRZAN’s core capabilities focus on three areas. First, tracking the legislative progress of dedicated medical-device laws across member states — Singapore, Malaysia, Thailand, Indonesia, the Philippines and Vietnam have each established written device regulatory frameworks, whereas Cambodia still has no dedicated Medical Device Act; the current rules are pieced together from three layers: the registration-number legal basis provided by the Law on Drug Management 1996 and its 2007 amendment, the classification and procedures provided by Prakas No. 1258 (2012), and the technical framework provided by the ASEAN Medical Device Directive, so compliance certainty is markedly lower than in markets that have completed legislation. Second, local authorised representative services: GRZAN can act as the manufacturer’s statutory representative in Cambodia, handling registration submissions, regulatory communication and post-market reporting obligations, and assisting with the practical arrangements for a Cambodian registered pharmacist and the licence for pharmaceutical import and export enterprises. Third, quality-system and testing support: GRZAN assists in establishing a quality management system conforming to ISO 13485 and in organising the technical dossier under the ASEAN Common Submission Dossier Template (CSDT).

Business enquiries: info@grzanglobal.com