Singapore SaMD Registration: GL-04, GL-07, GN-37 and GL-10

1. Key takeaways

Singapore maintains a distinct and fairly complete guidance set for software as a medical device. GL-04 R4, the regulatory guidelines for software medical devices on a life cycle approach of December 2025, sets the overall method. GL-07 R2 of July 2025 sets risk classification for clinical decision support software. GN-37 R1 sets out the change management plan for SaMD including machine-learning enabled SaMD. GL-10 R1, the best practices guide on medical device cybersecurity of August 2026, sets the cybersecurity expectations. Separately, a standalone medical mobile application in Class B or Class C holding one independent reference agency approval may take the immediate registration route.

• Four instruments govern the field: GL-04 R4 for the life cycle method, GL-07 R2 for decision support classification, GN-37 R1 for change management and GL-10 R1 for cybersecurity.
• General classification remains GN-13 R2.1 of 18 September 2025, but software classification does not follow the invasiveness logic.
• A standalone medical mobile application in Class B or Class C with one independent reference agency approval can use the immediate route, subject to the common safety conditions.
• The conventional Class C routes cost SGD 3,340 for 120 working days on Expedited and SGD 6,250 for 220 working days on Full, which is the measure of what the immediate route saves.
• GN-21 R7, effective 1 August 2026, limits each listing to a maximum of two changes under review at any one time, which interacts directly with software iteration speed.

2. Legal basis

The software framework is layered rather than consolidated. GL-04 R4 of December 2025 provides the life cycle approach that governs how software is developed, documented and maintained for regulatory purposes. GL-07 R2 of July 2025 addresses risk classification for clinical decision support software specifically. GN-37 R1 provides for a change management plan, including where machine learning is involved. GL-10 R1 of August 2026 supplies the cybersecurity expectations. General device classification sits in GN-13 R2.1 of 18 September 2025, and the route provisions sit in GN-15 R15 of October 2026.

The immediate route provision is the part of the framework with the clearest commercial consequence. It does not remove the safety conditions that apply to every immediate application, and it does not apply to software that is embedded in a device rather than supplied as a standalone mobile application. What it does is collapse the review pathway for a defined category of product, and the definition is narrow enough that eligibility has to be checked rather than assumed. Regulatory information in this article was verified to 26 October 2026 against secondary sources, namely GL-04 R4, GL-07 R2, GN-37 R1, GL-10 R1, GN-15 R15 and GN-21 R7.

3. Expert insights

Software enjoys the most permissive registration channel in the Singapore system. A standalone medical mobile application in Class B or Class C holding one independent reference agency approval may take the immediate route, provided the common conditions are met: no safety events, no deaths, no open field safety corrective action and no rejected applications. Set that against the conventional Class C pathway, where Expedited costs SGD 3,340 and takes 120 working days and Full costs SGD 6,250 and takes 220 working days, and the value of the channel becomes obvious. For a mobile application, route eligibility is worth checking before anything else in the file is drafted.

Software classification looks at the influence of information on decisions, not at invasiveness. GL-07 R2 supplies classification rules for clinical decision support software, and the logic turns on the degree to which the information the software produces influences a clinical decision, multiplied by the severity of the condition concerned. Applying the invasiveness and duration framework used for general devices to software produces the wrong answer, because a piece of software has no physical interface with the patient at all. The question is what happens to the patient if the software is wrong.

The change management plan is a pre-approved change rule and has to exist before launch. The CMP under GN-37 R1 is a key document for a software product. Its value lies in writing foreseeable iterations, including updates to machine learning models, into a plan that is reviewed and accepted in advance, so that later iterations do not each require the full change procedure. For an AI product with a frequent release cycle, this is the difference between a sustainable Singapore operation and one that spends its time queueing change applications.

Cybersecurity has moved from a favourable feature to a standalone guidance document. GL-10 R1 of August 2026 is HSA’s best practices guide on medical device cybersecurity. Software and connected devices should arrive at submission with cybersecurity documentation already assembled: threat modelling, vulnerability management, patch strategy and a software bill of materials. Preparing these after a question arrives is slower and usually produces a weaker document, because the material has to be reconstructed from engineering records rather than written as part of the design process.

Software change volume interacts with the two-change cap, so the release cadence needs planning. GN-21 R7, effective 1 August 2026, limits each listing to a maximum of two changes under review at any one time. Software iterates quickly, so the constraint bites harder on software than on hardware. This is where the CMP gains a second value: pre-approved changes can travel through a lighter channel, which relieves pressure on the review queue and keeps the two-change cap from becoming a release bottleneck.

4. Practical recommendations

• Check immediate route eligibility first for a software product line, since a standalone mobile application needs only one reference agency approval.
• Classify under GL-07 R2 using the decision-influence logic rather than general device criteria.
• Submit the change management plan together with the registration and do not defer it to the first iteration.
• Prepare cybersecurity documentation to GL-10 R1 before submission, covering threat modelling, vulnerability management, patching and the software bill of materials.
• Plan the change queue on two tracks, the CMP channel and the GN-21 limit, so that release timing is set by the plan rather than by the queue.

5. Verification checklist

• □ Software risk classification determined under GL-07 R2.
• □ Immediate route eligibility checked for the standalone medical mobile application.
• □ Change management plan prepared under GN-37 R1 and filed with the registration.
• □ Cybersecurity documentation prepared to GL-10 R1.
• □ Change queue planned against both the CMP channel and the GN-21 limit.
• □ Life cycle documentation consistent with GL-04 R4.

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support across Southeast Asia, including Singapore. Our team prepares dossiers to ASEAN CSDT structure, manages submissions and deficiency responses with HSA, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com