Digital Health, SaMD and AI Regulation in Israel

1. Key takeaways

Israel has no dedicated legislation on medical artificial intelligence. Software containing AI/ML whose intended use falls within diagnosis, prevention, monitoring or treatment is regulated as an ordinary medical device, subject to the same reference-state reliance and the three registration routes. In April 2023 the Ministry of Health issued guiding principles for the development of digital-health AI technologies, but the document is non-binding. For software-device companies this means two things: reference-country approval evidence carries greater weight, and privacy obligations run independently in parallel (Protection of Privacy Law, 5741-1981, and its 2017 data security regulations). Planning an entry therefore means sequencing three evidence streams: the device approval, the algorithm governance documentation and the privacy compliance file. Of the three, only the first has a fixed official timeline; the other two are company-side obligations that should be completed before submission rather than after it.

• AI/ML software for diagnosis, prevention, monitoring or treatment is regulated as an ordinary medical device.
• Reference-state reliance and the three registration routes apply without AI-specific review.
• The Ministry of Health’s April 2023 guiding principles for digital-health AI are non-binding.
• Protection of Privacy Law, 5741-1981, and the 2017 data security regulations apply in parallel.
• A regulatory sandbox initiative with the Israel Innovation Authority is tracked as a future variable.

2. Legal basis

The binding obligations for AI software come from the privacy regime and the general device legislation; the AI-specific documents are soft law. The elements cited in this article are listed below.

3. Expert insights

The absence of a dedicated law produces three consequences in practice, and they run against intuition.

First, reference-country evidence becomes the decisive asset. Because Israel sets no separate review standard for AI, AMAR’s substantive judgment relies on the assessments already completed by FDA or a notified body. The quality of the approval obtained in the EU or the US for an AI device is therefore transplanted directly into the Israeli review conclusion. GRZAN recommends that before entering Israel, an AI device completes its reference-country certification including algorithm change control and transparency documentation.

Second, privacy and data security are an independent compliance line. The Protection of Privacy Law and its 2017 data security regulations apply across the whole life cycle – from model training to deployment. The Israel Privacy Protection Authority (PPA) takes an active enforcement stance on health data, and in 2024 it published a supervisory inspection report on digital-health providers. This line is not managed by AMAR, but it forms a market-entry threshold all the same.

Third, the sandbox is a future variable. The Ministry of Health and the Israel Innovation Authority launched a regulatory sandbox request for information in 2025, closing in April 2026; if the sandbox materialises, autonomous medical AI will gain a controlled testing environment, and the certification path may change structurally.

The combined effect on project planning is that an AI/ML submission to Israel is built from three separate evidence streams that mature on different schedules. The device stream is the reference-country approval itself, which must be current and must cover the algorithm version actually deployed. The governance stream is the algorithm documentation – version control, change history, training-data representativeness and bias assessment – which the reference-country file can supply directly if it was prepared to that standard. The privacy stream is independent of both: it is assessed under the Protection of Privacy Law and its 2017 data security regulations, it starts with the lawful basis for processing rather than with the device file, and it remains in force for as long as data continues to be processed, which in practice is longer than any single registration period. Sequencing these three streams is the substance of planning an AI device entry into Israel.

4. Practical recommendations

• Follow the ordinary-device reliance route: obtain FDA or CE approval first, then take the corresponding Israeli route; do not expect a separate shortcut for software.
• Run privacy compliance in parallel: assess and document the lawful basis for processing, informed consent, transparency notices and limits on data scraping separately under the Protection of Privacy Law.
• Prepare algorithm governance evidence: version control, change history, training-data representativeness statements and bias assessments can be reused directly from reference-country materials.
• Track the sandbox: follow the possible legislation of the sandbox through 2026–2027 as a quarterly tracking item and assess its relevance to your product line.

5. Verification checklist

• □ Whether the software’s intended use falls within the medical device scope (diagnosis / prevention / monitoring / treatment) has been determined
• □ Reference-country (FDA or CE) approval has been obtained and covers the current algorithm version
• □ A privacy impact assessment has been completed under the Protection of Privacy Law, 5741-1981, and the 2017 data security regulations
• □ Database registration and data security measures are in place (where applicable)
• □ Algorithm change control and version management documentation is included in the technical file
• □ Sandbox and AI-related documents are on the quarterly tracking list

Regulatory information verified as of 29 October 2026. All law names, numbers, publication dates and article numbers cited in this article were checked on that date against the official Israeli legal database and authoritative public sources; AMAR procedural documents are updated frequently, so before any formal submission please rely on the current version published on the Ministry of Health website.

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support for the Israeli market. Our team manages Ministry of Health (MOH) registrations under the Medical Devices Law 5772-2012, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com