Software-based medical devices FAQs

Your software comes under the TGA regulations if it meets the definition of a software-based medical device.

What you need to do

• Work out if your software is a software-based medical device.
  To do this: read the TGA guidance documents.
• Work out if your software is exempt or excluded from TGA regulations.
  To do this: read the TGA guidance documents. Some software-based medical devices have been exempted from the need to be included in the ARTG or excluded from regulation altogether.
• If your software meets the definition of a software-based medical device (and is not exempted or excluded), that means you must get it registered by the TGA (and include it on the Australian Register of Therapeutic Goods (ARTG)) before supplying it in Australia.

'Excluded' means the software is not a software-based medical device and is not regulated by the TGA. You do not need to get it registered with the TGA, although some other regulatory body may have oversight of this product.

'Exempt' means the software is a software-based medical device but you do not need to. Instead, it only has to comply with TGA regulations on safety and performance, advertising, adverse events and notification.

Some software developed for health or medical purposes in Australia is considered by the TGA to be a software-based medical device (including 'software as a medical device' or 'SaMD').

If your software is a software-based medical device, that means it comes under the TGA regulations and must be registered on the Australian Register of Therapeutic Goods (ARTG) before being supplied in Australia unless exempt or excluded

What you need to do

• Work out if your software is a software-based medical device.
• To do this: read the TGA guidance documents.
• Work out if your software is exempt or excluded from TGA regulations.
  To do this: read the How the TGA regulates software-based medical devices guidance. If your software is a software-based medical device, that means it comes under the TGA regulations and you must get it registered by the TGA (who will include it on the ARTG ) before supplying it in Australia.

When you, as the software developer, are working out if your software is a software-based medical device, you need to confirm your software's 'intended purpose'.

'Intended purpose' means:

• what your software's core functions are (what it does – e.g., takes a photograph of a rash and
• what your software's desired purpose or outcome is (what you intend it to achieve – e.g., to diagnose measles or another disease).

What you need to do

• Read the Regulations (especially the Dictionary of terms at the end) to thoroughly understand 'intended purpose' to help you work out if your software is a software-based medical device. Also, read the How the TGA regulates software-based medical devices guidance.
• If it is a software-based medical device, having a clear statement of the intended purpose will also help you determine which risk-based classification your software fits into.

'Sponsor' is a term that is used frequently within the TGA regulations. A software 'sponsor' is a person or company which does one or more of these things:

• exports a software-based medical device from Australia
• imports a software-based medical device into Australia
• manufactures (develops) a software-based medical device for supply in Australia or elsewhere
• arranges for another party to import, export or manufacture (develop) a software-based medical device.

The sponsor must be a resident of Australia or be a legally incorporated body (a legal entity in its own right) located in Australia that is conducting business in Australia and whose representative is resident in Australia.

If you are developing and supplying software in Australia, you may be both the sponsor and the manufacturer/developer. Or, you may be the software manufacturer/developer but not the sponsor; in that case you may have relationships with multiple sponsors to distribute your software.

What you need to do

• Identify the sponsor for your software. Is it you? Is it someone else? To do this: read Chapter 1, Section 3 of the Therapeutic Goods Act 1989.
• Ensure the sponsor has a commercial arrangement with the manufacturer/developer to supply the software in Australia
• Review the definition of a medical device and consider the intended purpose of the medical device to determine if your software comes under the TGA regulations. To do this: read our guidance. If your software does come under the TGA regulations, you need to apply to the TGA to get it registered (the TGA will include the software in the Australian Register of Therapeutic Goods (ARTG)) before supplying it in Australia.
• Comply with the law (i.e. the Therapeutic Goods Act 1989 and the regulations).

'Clinical practice' is a term that is used frequently within the TGA regulations.

Here is a summary of the definition: 'clinical practice' refers to when a software-based medical device is used, prescribed or recommended by a health professional. This can be in a healthcare facility (e.g., GP clinic, pathology lab, health centre, hospital, COVID–19 vaccination centre), via telehealth or administered on a home visit.

What you need to do

• You need to consider the settings in which your software is intended to be used and who is intended to use it (general consumers and/or health professionals).

'Manufacturer' is a term that is used frequently in the TGA regulations. For the purposes of these FAQs and the TGA regulations, 'software manufacturer' and 'software developer' are the same thing.

Being a 'software manufacturer' doesn't necessarily mean you are making a physical device. But it does mean that you are taking legal responsibility as the manufacturer of the device.

What you need to do

• Make sure you know who the manufacturer/developer of your software is. Is it you? Is it someone else?
• To do this: read the definition in Section 41BG of the Therapeutic Goods Act 1989.

A software developer/manufacturer may have relationships with multiple sponsors to distribute its software.

If your software is a software-based medical device it will fit into one of more classifications.

The classifications explain how high or low the risks are to the health of an individual and/or the general public from a range of medical actions, such as diagnosing a disease or providing therapy. They consider how serious the outcome might be of these things - for example 'may cause harm' or 'death'.

The higher the risk, the higher the classification number. Class III is higher risk than Class II. Class IIb higher risk than Class IIa.

What you need to do

• You need to work out which risk-based classification your software fits into.
• Your software might fit into more than one classification (if it has more than one use, for example), so you need to understand all the classification rules that apply to your software and then take the highest one (e.g. class I is the lowest risk, class III the highest risk, and class IIb is higher risk than class IIa) as the overall classification for your software.

To do both these things: read the How the TGA regulates software-based medical devices guidance

When you know the classification of your software-based medical device you can apply to the TGA for it to be registered. You also need to make sure you have all the necessary documentation to apply, including certificates and evidence.

There is a specific definition for 'serious condition' that you need to follow if you want to supply software-based medical devices in Australia.

Here is a summary of the definition: 'serious condition' refers to a condition that should be diagnosed and/or treated by a registered health professional only and not someone who does not have that professional training and position.

What you need to do

• You need to know the full definition of 'serious condition'. You can read the full definition in the legislation, but for ease we've also added it below:

There is a specific definition for 'serious disease' that you need to follow if you want to supply software-based medical devices in Australia.

Here is a summary of the definition: A 'serious disease' is one that may be incurable or need major therapeutic intervention (e.g., surgery) and may result in death or long-term disability. It could also pose a high risk to public health.

What you need to do

• You need to know the full definition of 'serious condition'. You can read the full definition in the legislation, but for ease we've also added it below:

You can only supply a software-based medical device in Australia if you are the sponsor of that software (or a distributor acting on behalf of the sponsor).

You cannot supply a software-based medical device in Australia that has a different sponsor, even if that device is already TGA-registered (i.e. in the Australian Register of Therapeutic Goods (ARTG)). This is called 'piggybacking' and it is illegal.

Each software-based medical device must have its own sponsor. That sponsor is responsible for registering the software-based medical device with the TGA, who will include it in the ARTG.

The manufacturer of a device may have relationships for distribution purposes with multiple sponsors.

You need to complete all the testing and validation of your software before you can register it with the TGA (who will include it in the Australian Register of Therapeutic Goods (ARTG)) and supply it in Australia.

If you make changes to the software after you have registered it you may need to check to see if you need to notify the TGA of the changes you have made. You may also need to recheck the classification. If the changes mean that the classification of your software has changed you may need to reapply to have it registered at the new classification.

Software-based medical devices involved in clinical trials are not excluded and do come under the TGA regulations. Why? Because the software still meets the definition of a medical device and is still being used to determine results or outcomes for people, even though it is not available to the wider public at this trial stage.

If your software-based medical device is not registered and is to be used in a clinical trial, then you (as the sponsor) will need to complete a Clinical Trial Notification (CTN) form to legally import and supply the software as an 'unapproved' therapeutic good in Australia for use in a clinical trial.

What you need to do

• Read the following four guidance documents:
  1. Clinical Trial Notification (CTN) form and user guide
  2. Clinical Trial Notification (CTN) Scheme
  3. Clinical Trial Approval (CTA) Scheme
  4. Clinical Trial Guidance
• Work out who is the Australian clinical trial sponsor. Is it you? Is it someone else? To do this: read the Clinical Trial FAQs .
• The clinical trial sponsor will need to notify the TGA in order to use the unapproved software-based medical device for the purpose of the trial (either via the CTN or the CTA scheme).

If your software runs on a medical device, the software is part of that device. Such software is already covered by the registration of the medical device it runs on. You do not need to certify and register that software separately.

Here's an example:

• A ventilator runs controller software for the user interface and for controlling the ventilation. This controller software is pre-loaded on the ventilator. As long as the ventilator is registered with the TGA and included on the ARTG, you do not have to register that controller software separately.

Software is excluded from the TGA regulations if:

• the software has a single purpose and that purpose is excluded or
• the software does not meet the definition of a medical devices.

It's more likely that some of your software functions are excluded but others are not. If your software has only one function that is not excluded then the whole software comes under the TGA regulations. The TGA will focus on the function that is not excluded but will also look at the overall purpose of the software.

Here's an example: your app includes a body mass index (BMI) calculator function and another function that diagnoses diabetes. The calculator function displays the calculations and outputs in a manner that may be validated by the user – therefore the calculator function is excluded (see Exclusion 14L for more information).

But, diagnosing diabetes is not excluded for two reasons: a) because it involves diagnosis and b) because diabetes is a serious disease. Because your app has at least one non-excluded function that is for a medical purpose, it is not excluded and comes under the TGA regulations.

• Your app has a BMI calculator and diagnoses diabetes
  • BMI calculator: excluded
  • Diagnosing diabetes: not excluded
    • The 'not-excluded' function takes priority
• App as a whole: not excluded

What you need to do

• You need to examine each of your software's different functions individually to work out if each one is excluded or not.
• If your product is excluded it is not a medical device and does not need to be registered by the TGA
• If your software is not excluded, you may need to consider whether the Clinical Decision Support Software (CDSS) exemption applies to your software. To do this: read the CDSS guidance.
• When you apply to the TGA to register your software you need only include details on those functions of the software that meet the definition of a software-based medical device. However, the TGA may also want to know how the device functions as a whole and how the different functions interact.

When a software-based medical device has several functions, multiple classification rules are likely to apply. Those classifications are determined by looking at each function. It is your responsibility as the sponsor to determine these classifications.

The classifications for some functions may be higher than others. Overall, your software is classified at the highest individual function classification. For example, if your software has four functions and three are Class I (lowest classification) but one is Class III (a higher classification), your software will be Class III.

What you need to do

• You need to examine each of your software's different functions individually to work out their classification.
• When you are working out the classification of each function, you need to always classify it based on the highest risk. To do this: read the How the TGA regulates software based medical devices guidance (p10).
• You may need to consider whether the Clinical Decision Support Software (CDSS) exemption applies to your software. To do this: read the CDSS guidance.
• When you apply to the TGA to register your software you need only include details on those functions of the software that meet the definition of a software-based medical device. Although the TGA may also want to know how the device functions as a whole and how the different functions interact.

TGA regulates software-based medical devices that are being supplied or distributed in Australia. It does not matter where the server is based, where your website is hosted or if the data is stored in the cloud and/or in a different country.

If you want to supply software-based medical devices in Australia, you will need to apply to the TGA to get your software registered by the TGA, who will include it on the Australian Register of Therapeutic Goods (ARTG).

It's best to think of the TGA regulations being technology agnostic.

In other words, the regulations apply to all software including mobile or watch-based apps but also things such as enterprise systems with lots of users (like those in hospitals, for example), plus websites and more traditional software packages that meet the definition of a medical device.

If your software is to be used by a general consumer (or their carer) to manage an existing disease or condition but not used by a health professional and/or clinical practice, then it is considered to be 'intended for self-management'.

If the general consumer shares information generated by your software with a health professional and/or a clinical practice but neither of them uses it for diagnosis or treatment (instead, just for information), then the software is also considered to be 'intended for self management'.

In both the above cases, the software may be excluded from the TGA regulations as long as it is for a disease or condition that is not serious.

But, if a health professional and/or clinical practice does use the information for any diagnosis or treatment, the software is no longer 'intended for self-management'. In that case, the software is not excluded and it does come under the TGA regulations.

What you need to do

You need to confirm if your software comes under the TGA regulations or is excluded. To do this: we encourage you to email digital.devices@tga.gov.au to discuss your software and its intended use.

If your software meets the definition of a medical device, then it does not matter if it uses open-source code as part of its design or not – it still comes under the TGA regulations. You must ensure that you test all open-source code including any libraries and links when testing for validation.