The South African Health Products Regulatory Authority (SAHPRA) has published its first consolidated requirements for Artificial Intelligence and Machine Learning (AI/ML)-enabled medical devices and IVDs, signalling how such products will be assessed and controlled in South Africa.
What SAHPRA is saying, at a glance
- Authorisation & licensing: AI/ML devices (SaMD and SiMD) will require SAHPRA authorization before use in South Africa. Importers/manufacturers must hold a medical device establishment licence under Section 22C, with device listings included in the licence.
- Risk classification: Apply SAHPRA’s existing four-tier rules (A–D). Many decision-influencing AI SaMD will fall into Class C or D; final class is determined by SAHPRA. Use SAHPGL-MD-04 for classification.
- Reference jurisdiction evidence (Class C/D): Applications for higher-risk AI/ML devices should include evidence of prior approval from at least one of SAHPRA’s six reference regulators (TGA, ANVISA, Health Canada, EU MDR/IVDR, PMDA, FDA) or WHO prequalification.
- Quality system & lifecycle standards: Expect ISO 13485 QMS, software lifecycle per IEC 62304, and risk management per ISO 14971.
- Technical & clinical evidence: Provide a detailed technical file (algorithm purpose/logic, inputs/outputs, V&V, cybersecurity) and clinical validation with representative populations, addressing bias and generalisability (e.g., performance on local populations).
IMPORTANT NOTE: Manufacturers must assess if the device was trained on data from outside South Africa, and whether it performs equally well on local populations within South Africa
- Post-market surveillance: Continuous performance monitoring for drift, incident reporting per SAHPGL-MD-03, and readiness for audits or inspections.
- Data protection: Compliance with POPIA (Act 4 of 2013) for privacy, data integrity, and security.
- Change control (PCCP): SAHPRA is monitoring international approaches; until formalised, significant AI/ML changes must be notified, with robust change control documentation.
- Generative AI: SAHPRA flags material challenges (intended use scoping, inconsistent outputs, SOUP provenance, validation of open-ended outputs). GenAI devices will be classed by risk; the standard AI/ML requirements apply. Early engagement advised where standard evidence cannot be met.
Background
SAHPRA has not yet commenced with product registration of medical devices and IVDs under Regulation 8 of the general regulations for medical devices (Regulation No. 1515, Government Gazette No. 40480, December 2016). However, with the rapid development and adoption of AI/ML-driven technologies, the authority is moving proactively to establish a regulatory position.
This approach aligns with SAHPRA’s 2025–2030 Strategic Plan, which highlights the need for updated legislation and clear guidelines to regulate AI-enabled health technologies. The stated objective is to promote patient safety, ensure compliance, and support responsible innovation in South Africa’s healthcare system.
What manufacturers should do now
1. Confirm device qualification and classification
Determine if your product qualifies as an AI/ML-enabled medical device or IVD. Apply SAHPRA’s risk classification rules and document the rationale. Consult SAHPRA where classification is uncertain.
2. Prepare the technical file
Compile AI-specific documentation, including model description, training and validation datasets, verification and validation (V&V), and cybersecurity measures. Include clinical validation on representative populations, with subgroup analyses and disclosure of limitations or bias.
3. Ensure QMS and standards compliance
Maintain a QMS aligned with ISO 13485, supported by IEC 62304 for software lifecycle processes and ISO 14971 for risk management.
4. Plan for post-market performance monitoring
Establish systems to monitor algorithm performance and detect drift. Align incident reporting processes with SAHPGL-MD-03 and prepare for regulatory audits.
5. Provide reference-jurisdiction evidence (Class C/D)
For higher-risk devices, support submissions with evidence of clearance or approval from reference regulators (e.g., FDA, EU CE Mark, Health Canada) or WHO prequalification.
6. Manage change proactively
Develop a documented change control plan. Engage SAHPRA before implementing significant algorithm updates, particularly those impacting safety or performance.
7. Comply with data protection requirements
Ensure full compliance with POPIA (Act 4 of 2013) regarding privacy, integrity, and security of personal health data used in training, inference, or monitoring.
Scope and Alignment
The communication sets out definitions, fundamental principles, and regulatory requirements for AI/ML-enabled devices. Importantly, it draws from international frameworks and best practices developed by:
- International Medical Device Regulators Forum (IMDRF)
- U.S. Food and Drug Administration (FDA)
- European Union (EU) regulators
- UK Medicines and Healthcare products Regulatory Agency (MHRA)
- Singapore Health Sciences Authority (HSA)
- World Health Organization (WHO)
By referencing these global approaches, SAHPRA signals its intent to harmonise with international regulatory trends while tailoring requirements to South Africa’s healthcare needs and data governance context.
Conclusion
SAHPRA’s communication marks a pivotal step in shaping the regulatory landscape for AI/ML-enabled medical devices in South Africa. By aligning with international standards while addressing local healthcare needs, the authority is setting the foundation for safe and responsible adoption of these technologies. For manufacturers and developers, early alignment with these requirements will be essential to ensure compliance and market readiness.
Full communication available on SAHPRA’s website: Read the document here.
If you are developing or planning to introduce AI/ML-enabled medical devices in South Africa or internationally, our team at MedQAIR can help you navigate the evolving regulatory frameworks. Get in touch with us to discuss your compliance strategy.
