MDCG Guidance for SaMD: The Documents That Shape How Regulators Assess Your Software

Why SaMD has its own guidance landscape

The general MDR guidance documents — on clinical evaluation, technical documentation, GSPR — apply to SaMD. But software has accumulated its own body of MDCG guidance that interprets those general requirements specifically for standalone software and AI/ML systems. If you're building a SaMD technical file without this guidance in view, you're working with an incomplete picture of what auditors and Notified Bodies will expect.

The SaMD-specific guidance landscape has grown significantly since MDR came into force. Some documents are now on their second or third revision. A few are still in draft. Knowing which documents apply to your situation, what they say, and when they were last updated is a baseline competency for any team preparing a SaMD technical file.

The qualification and classification documents — read these first

MDCG 2019-11 — Guidance on qualification and classification of software in Regulation (EU) 2017/745 and Regulation (EU) 2017/746 This is the starting document for any SaMD project. It provides the decision framework for determining whether your software qualifies as a medical device under MDR and, if it does, how to begin the classification analysis. The document uses a decision tree structure that is both more useful and more rigorous than reading the regulation text alone. Read this before making any qualification or classification decisions.

MDCG 2021-24 — Guidance on classification of medical device software under Rule 11 of Annex VIII of Regulation (EU) 2017/745 This is the classification document that MDCG 2019-11 points toward for software-specific classification under Rule 11. It extends the guidance with worked examples covering common SaMD scenarios: diagnostic software, monitoring software, treatment planning software, and AI/ML-based software. Class IIa and above SaMD cannot be classified defensibly without referencing this document. Notified Bodies use it as the framework for evaluating your classification rationale.

Together, these two documents form the pair you reference in your technical file's classification section. If your file cites only Annex VIII without these guidance documents, expect a finding.

Cybersecurity

MDCG 2019-16 rev.2 — Guidance on cybersecurity for medical devices (2022 update) The cybersecurity guidance that Notified Bodies use as their benchmark. Rev.2 was published in 2022 and represents a substantial update from the original. It covers the full security lifecycle: threat modelling, security requirements, secure design, vulnerability management, and end-of-life. If your cybersecurity documentation was written against the original version, check whether it still meets the rev.2 requirements — there are differences that matter.

The document also addresses the integration between cybersecurity and ISO 14971 risk management. This integration is a common gap; teams often produce a standalone security risk assessment without connecting it to the main risk file. MDCG 2019-16 rev.2 makes clear that this connection is required.

Clinical evaluation

MDCG 2020-5 — Guidance on clinical evaluation for medical devices The general clinical evaluation guidance applies to SaMD but doesn't address software-specific evidence challenges in depth. Read it for the methodological framework — the staged evaluation process, the requirements for literature search methodology, the structure of a compliant CER.

MDCG 2020-6 — Guidance on sufficient clinical evidence for legacy devices Less directly relevant for new SaMD products, but worth knowing if you're managing a product that has been on the market under a prior framework and is now transitioning to MDR conformity.

MDCG 2020-13 — Clinical evaluation of medical device software This is the software-specific clinical evaluation guidance and arguably the most important clinical evaluation document for SaMD manufacturers. It addresses the question that the general clinical evaluation guidance leaves open: what does clinical evidence for software actually look like? It covers performance studies, the use of literature for software-based clinical claims, and the relationship between clinical evaluation and PMCF for software. If you have one document on your clinical evaluation team's reading list for SaMD, this is it.

Post-market surveillance

MDCG 2020-6 (Part B) — PMCF guidance The PMCF obligations for all devices, with some software-specific observations. The key point the guidance reinforces: PMCF is not complaint handling. It is active, structured clinical data collection. The document provides templates for the PMCF plan and PMCF evaluation report.

MDCG 2022-21 — Guidance on PMS for devices under MDR The comprehensive PMS guidance that consolidates the Article 83-92 requirements into a practical framework. For SaMD manufacturers setting up or reviewing their PMS system, this document provides the structure.

UDI and EUDAMED

MDCG 2019-2 — UDI assignment and registration for standalone software The specific UDI guidance for software. It addresses the questions that the general UDI guidance doesn't: when does a software update require a new UDI-DI, how is the UDI displayed when there is no physical label, how are SaaS and cloud-deployed software handled. Updated periodically as EUDAMED systems develop — check for the latest version before finalising your UDI assignment documentation.

MDCG 2018-1 (latest version) — EUDAMED guidance The overarching EUDAMED guidance for all device types, updated regularly. Follow the current version for device registration workflows.

AI/ML

MDCG 2021-24 (same document as the classification guidance noted above) The classification guidance for AI/ML-based medical device software extends beyond classification to address AI-specific lifecycle issues: the locked vs. adaptive algorithm distinction, training data requirements, and validation methodology for machine learning systems. It is the closest thing the EU currently has to a dedicated AI/ML SaMD compliance guidance document.

Note that the EU AI Act implementing guidance for medical devices is still developing. MDCG is expected to publish further guidance specifically addressing the MDR/AI Act interface as the AI Act application timeline matures. Monitor the MDCG guidance registry for new documents in this area.

Keeping up as the guidance evolves

The MDCG guidance registry is maintained on the European Commission website. For SaMD manufacturers, a practical discipline is to check the registry for updates to the software-relevant documents listed here at each PSUR cycle — at minimum annually for Class IIb/III devices. Guidance updates can shift what Notified Bodies expect, and documentation that was written against an older version may need revision even if the regulation itself hasn't changed.

The documents that change most frequently are the cybersecurity guidance (MDCG 2019-16), the clinical evaluation guidance (MDCG 2020-5), and the UDI/EUDAMED operational documents. Build version tracking for these into your document management process — note the guidance version you relied on when writing each section of your technical file, so you can assess the impact of updates at review time.