Anvisa approves new regulatory framework for Software as a Medical Device

​

On March 23, 2022, the Brazilian Health Regulatory Agency (Anvisa) approved Anvisa RDC No. 657/2022, which regulates Software as a Medical Device (SaMD). Effective from July 1, 2022, the new resolution results from a public consultation in 2021 that received over 440 submissions – 22 of which were fully approved, with another 68 partially approved.

Anvisa RDC No. 185/2001 determines general requirements for health products, including SaMD, Anvisa already requires these products to be approved or registered prior to being released on the market. The new resolution is supplementary to Anvisa RDC No. 185/2001.

In light of a Regulatory Impact Analysis Anvisa conducted on the subject, it became apparent that current regulations included requirements that software developers were unable to meet. While to date, the requirements have been designed with more tangible goods in mind, many are not applicable to SaMD – for example, the need for tags, labels or printed manuals, even when these apps are distributed over the internet or through mobile stores. On the other hand, certain information deemed necessary for monitoring the sanitary aspects of this software (such as how they are updated) was not properly covered in the regulations.

With the new resolution now covering the specific aspects of medical software, Anvisa has also brought Brazilian regulations in line with recommendations from international health authorities and the International Medical Device Regulators Forum (IMDRF) – which Brazil is a signatory of, along with the European Union, the United States, Canada and Australia. Indeed, Anvisa took these recommendations into account when developing the new resolution.

Key aspects of the new resolution are outlined below:

General definitions and requirements

The new resolution defines SaMD as a system for medical, dental or laboratory use or applications, intended for prevention, diagnosis, treatment, rehabilitation, or contraception. Moreover, it must have no pharmacological, immunological, or metabolic effect on humans. SaMD falls under the definition of medical device, including if linked to in vitro diagnosis, provided it is intended for one or more of the above purposes and not part of any medical device hardware. Software licensed under subscription or centrally hosted software (Software as a Service) also meet this definition.

The definition of SaMD does not include any software:

• Used for the purpose of well-being, i.e., software that encourages healthy lifestyles, physical exercise that is not intended for prevention, diagnosis, treatment, rehabilitation or contraception;
• Linked to products that Anvisa does not regulate;
• Used solely for health service providers’ administrative or financial management;
• That processes medical demographic or epidemiological data, with no clinical or treatment-related purposes;
• Linked to medical devices Anvisa has already regularized.

Class-I or Class-II SaMD developed solely for the health providers’ in-house systems (either by their parent company or subsidiaries) do not require regularization with Anvisa – provided the software does not interfere with the operation of medical devices that are subject to the agency’s regulations. However, applications developed for health providers’ in-house systems must have approved documentation by 2024 and may not be sold or donated.

SaMD user instructions and labeling requirements

According to Anvisa RDC No. 657/2022, SaMD user instructions and labels must observe the provisions of Anvisa RDCs No. 185/2001 and No. 431/2020. They must also include the following content:

• Procedures for updating SaMDs;
• Minimum hardware and software requirements;
• Information on how the software operates, including generic descriptions of the algorithms, routines and formulas used for clinical processing (prevention, diagnosis, treatment, rehabilitation or contraception) and their valid clinical associations;
• Necessary alerts and warnings;
• Interoperability specifications, indicating software, hardware, and technological environment compatibility and incompatibility;
• Cybersecurity information.

Companies are not required to provide physical labels and user instructions for software distributed over the internet. Furthermore, the menus that feature on SaMD should preferably be in Portuguese. However, English or Spanish are also permitted as alternatives, as long as:

• The meaning of each menu item and command is explained in Portuguese in the user instructions;
• The software is not intended for the general public or to be used at home;
• The risk level is deemed acceptable by the company’s risk management area; and
• The necessary language skill level in these languages for using the software is clearly defined in the user instructions.

Changes after SaMD approvals

The new regulation also determines that any software should be resubmitted for approval or updates if:

• New clinical features are added, or the software indicates different forms of clinical use;
• Significant changes are made to the software’s clinical features, safety and efficacy;
• The software is intended for purposes other than those previously determined;
• There are changes to the software’s visual identity that no longer make it recognizable from the images submitted to Anvisa.

Minor changes that do not alter the visual identity of the software, as well as corrected bugs, coding reviews, or changes to the security of the information do not require Anvisa’s post-marketing authorization – as long as they have no impact on the SaMD’s indicated use, efficiency, or on patient safety.

Approval procedures for SaMD in regulations established prior to the new resolution must be adjusted in line with it, should such regulations be changed in the future.

For further information on SaMD, please contact Mattos Filho’s Life Sciences & Healthcare practice area.