SAHPRA Communication: Regulatory Requirements for AI/ML-Enabled Medical Devices in South Africa

Artificial Intelligence (AI) and Machine Learning (ML) are transforming healthcare globally, offering powerful tools for diagnosis, treatment, monitoring, and patient care. Recognising this shift, the South African Health Products Regulatory Authority (SAHPRA) has released regulatory guidance for "AI/ML-enabled medical devices and in vitro diagnostics (IVDs)".

SAHPRA acknowledges the transformative potential of AI/ML-enabled medical devices but stresses that safety, compliance, and responsible innovation must come first. Although SAHPRA has not yet initiated full product registrations for medical devices under Regulation 8 of the 2016 Medical Devices Regulations, the rapid adoption of AI/ML technologies requires proactive regulatory engagement.

The communication aligns with international best practices, referencing frameworks from IMDRF, US FDA, EU, UK MHRA, Singapore HSA, and WHO, while tailoring requirements to South Africa’s healthcare and data governance context. AI/ML-enabled Medical Device

A medical device (including Software as a Medical Device – SaMD or Software in a Medical Device – SiMD) that incorporates AI/ML algorithms for its medical purpose. Examples include:

• Imaging analysis tools (e.g., AI tumour detection in scans)

• Predictive risk models (e.g., patient deterioration alerts)

• Clinical decision support systems

• Wearable health monitors

SAHPRA outlines internationally harmonised guiding principles for responsible innovation:

1. Patient Safety & Risk Management – Safeguards against algorithmic errors, with human oversight in critical applications.

2. Transparency & Explainability – Clear documentation of AI logic, outputs, limitations, and performance metrics.

3. Cybersecurity & Data Privacy – Compliance with South Africa’s POPIA Act, ensuring data protection and integrity.

4. Performance Monitoring & Adaptability – Continuous monitoring for accuracy and bias; strict controls on adaptive learning systems.

5. Clinical Evaluation & Fairness – Evidence of real-world benefits across diverse populations, minimising bias.

Regulatory Requirements

(a) Regulatory Authorisation & Licensing

• All AI/ML-enabled devices require SAHPRA authorisation before market entry.

• Importers/manufacturers must obtain a Medical Device Establishment Licence under Section 22C of the Medicines and Related Substances Act.

(b) Risk Classification

• Devices are classified into Classes A to D (A = lowest risk, D = highest risk).

• AI devices influencing clinical decisions directly usually fall under Class C or D.

(c) Quality Management System (QMS)

• Mandatory compliance with ISO 13485:2016.

• Includes controls for software design, validation, and data governance.

(d) Evidence of Safety & Performance

• Technical File: Device description, software documentation, risk analysis, validation results, cybersecurity details.

• Clinical Evidence: Real-world validation studies, subgroup performance analysis, bias mitigation.

• Reference Approvals: For higher-risk devices (C & D), prior approval from trusted regulators (FDA, EMA, PMDA, TGA, Health Canada, ANVISA, WHO) is required.

(e) Post-Market Surveillance

• Continuous Monitoring: Detecting algorithm drift and maintaining accuracy.

• Incident Reporting: Adverse events reported per SAHPRA’s adverse event reporting guideline (SAHPGL-MD-03).

• Regulatory Oversight: SAHPRA may conduct audits, impose corrective actions, or revoke authorisation.

Manufacturers must:

• Define intended use clearly

• Ensure compliance with risk classification and QMS standards

• Provide strong technical and clinical validation

• Plan for post-market surveillance and regulatory change control

By aligning with international best practices while addressing South Africa’s unique needs, SAHPRA aims to integrate AI/ML technologies safely and responsibly into the healthcare system Reference: Read Full Document Here