Regulatory Requirements for AI/ML-Enabled Medical Devices in South Africa

1. Key takeaways

On 19 August 2025 SAHPRA issued its communication on the Regulatory requirements for medical devices powered by artificial intelligence and machine learning (AI/ML) (MD08-2025/2026). The core conclusions are: all AI/ML-enabled medical devices, including standalone software and software integrated into hardware, must obtain SAHPRA authorisation before being placed on the market; classification is still determined under the standard Class A to Class D four-tier system; the establishment licence is a precondition for advancing formal product registration; and manufacturers must demonstrate conformity with existing device regulations, including quality management system requirements. The frame behind these conclusions is worth internalising: software has been part of the statutory device definition since 1965, so there is no legal gap to argue into, and AI/ML does not create a new category. For a software company with no South African entity, no authorised representative and no ISO 13485 certificate, the establishment licence and AR appointment therefore become the first milestone of the programme rather than the last, and the interface between agile model iteration and South African change management should be clarified with SAHPRA in writing before submission.

2. Legal basis

3. Expert insights

Insight 1: Software was written into the device definition as early as 1965, so AI/ML needs no new category. The device definition of Act 101 of 1965 already includes software. This explains why SAHPRA can impose requirements directly through a single communication: there is no legal gap, only a lack of dedicated rules. For companies, this means it is not open to argue that AI software falls outside the device definition. Any software with a medical purpose, whether standalone or embedded, enters the same regulatory space as any other device, and the strategic question is not whether to comply but under which classification and through which pathway the authorisation is obtained.

Insight 2: Section 3.2 of SAHPGL-MD-04 v5 already sets out four principles for classifying software. These are: software that meets the device definition is also an active medical device, because its operation depends on an energy source; software used to drive, control or influence the function of a device is generally classified in the same class as that device; software that serves as an accessory is classified separately; and software not necessary for the device to operate is treated as an accessory. AI/ML software does not form a class of its own and still proceeds under these four principles. The classification decision should therefore be documented against the four principles explicitly, because it drives the depth of the conformity evidence and the timing expectations of the review.

Insight 3: The establishment licence precondition is where AI/ML companies most often get stuck. MD08-2025/2026 makes clear that the establishment licence must be obtained before formal product registration is advanced. For a software company with no South African entity, no AR and no ISO 13485, this means the full set of entity-level compliance must be completed first before the product work can proceed. Practical estimate: software companies should list the establishment licence and the AR appointment as the first milestone of the programme, not the last. Entity-level steps involve third parties, residence requirements and certification timelines that the company does not fully control, which makes them the schedule risk to surface early.

Insight 4: The iterative nature of AI/ML is in structural tension with South African change management. Under the South African licensing system, a change of product name or composition, or re-labelling, triggers a full change. Whether the continuous iteration of an algorithmic model constitutes a change is a question SAHPRA has not yet fully clarified. Practical estimate: confirm the version management strategy with SAHPRA in writing before submission, and link algorithm version control to change assessment. A documented trigger framework, describing which model updates stay within the authorised version and which require a change application, protects both the company and the AR, and gives reviewers a governance loop they can inspect.

Insight 5: Quality management system requirements apply to software companies equally. MD08-2025/2026 requires manufacturers to demonstrate conformity with existing device regulations, including quality management system requirements, while ISO 13485 is being made mandatory step by step under a five-stage roadmap. Software companies often build their systems on IEC 62304 and agile development, and the gap to ISO 13485 must be assessed. The assessment should focus on design controls, document control, supplier control and post-market feedback loops, the areas where agile practice most commonly diverges from the standard’s expectations, and should produce a concrete remediation plan rather than a gap list alone.

4. Practical recommendations

1. First confirm that the software falls within the device definition: do not argue that AI software is unregulated.
2. Classify per the four principles of Section 3.2 of SAHPGL-MD-04 v5, and document the reasoning.
3. List the establishment licence and AR appointment as the first milestone of the programme.
4. Clarify in advance the boundary between algorithm version management and change, in writing with SAHPRA.
5. Assess the system integration gap between IEC 62304 and ISO 13485, with a remediation plan.
6. Prepare data governance and algorithm explainability evidence: as support for Essential Principles conformity.

5. Verification checklist

• □ It has been confirmed that the software / AI/ML product falls within the device definition of Act 101 of 1965
• □ Classification has been determined per Section 3.2 of SAHPGL-MD-04 v5 (Class A-D)
• □ The current text of MD08-2025/2026 has been obtained
• □ The establishment licence and AR appointment have been listed as the first milestone
• □ The algorithm version management strategy has been confirmed with SAHPRA (practical estimate)
• □ The gap between ISO 13485 and the software development system (such as IEC 62304) has been assessed
• □ Data governance and algorithm explainability evidence has been prepared
• □ It has been confirmed that SAHPRA authorisation must be obtained before market placement

Regulatory information verified as of 29 October 2026. The regulations, guidance documents and effective dates described in this article are limited to the official sources listed under Legal basis as published on that date; where official documents are subsequently updated, the latest published version prevails.

• South Africa local resources: GRZAN assists manufacturers from the Chinese mainland and overseas with SAHPRA medical device establishment licence (MDEL) applications and product registration preparation, including authorised representative (AR) scheme design, ISO 13485 certification pathway planning and CAB selection, GMDN coding and classification determination, technical dossier preparation, and the setup of vigilance and adverse event reporting mechanisms.
• Service capabilities: product attribute determination and risk classification (Class A/B/C/D), establishment licence applications and renewals, reliance pathway justification, technical dossier and Essential Principles conformity argumentation, labelling and IFU localisation in English, and support for post-market vigilance and annual compliance information submissions.
• Contact: info@grzanglobal.com; hito.lin@grzan.cn; website www.grzan.cn.