Three regions, one evidence base

Your class sets the size of the job.

The Medical Device Regulation sorts devices into four classes by risk: I, IIa, IIb and III. A Class I device you can declare compliant yourself. From Class IIa upward an independent organisation has to examine your file before you are allowed to sell. Rule 11 of the regulation puts software that informs a diagnosis or a treatment decision at Class IIa or higher, so most clinical software needs that examination.

You need a Notified Body, and they choose you.

A Notified Body is a private organisation appointed by an EU country to examine technical files on the regulator's behalf. They are limited in number, they specialise by device type, and they decide which manufacturers to take on. Waiting several months to begin is normal. You apply with a finished file, and if it comes back with questions you answer them and wait again.

If your device uses AI, a second law applies on top.

The EU AI Act runs alongside the Medical Device Regulation. A device that needs a Notified Body is automatically treated as a high-risk AI system, which adds obligations covering training data, testing, record keeping and human oversight. Both sets have to be satisfied inside the same technical file.

First you find out whether the FDA treats your product as a device.

General wellness products sit outside FDA device regulation. Software that supports a clinical decision usually sits inside it. The line is drawn by what your product claims to do, so the words you use to describe it can move you across that line without the product changing.

A 510(k) is an argument that your device is like one already on sale.

You name an existing cleared device, called a predicate, and show that yours is substantially equivalent to it. Choosing a predicate that does not hold up is the most common reason a submission fails, and it usually surfaces after the money is spent. Where nothing comparable exists there is no predicate, and the route is De Novo, which asks the FDA to classify a genuinely new type of device.

A CE mark does not get you into the United States.

The two systems are separate, and the FDA does not clear a device because Europe certified it. Most of the underlying evidence can be reused. The argument built on top of it has to be made again.

Saudi Arabia asks for an approval you already hold.

Marketing authorisation from the SFDA is granted on the back of an approval from a recognised jurisdiction: the European Union, the United States, Japan, Canada or Australia. A CE certificate is what makes the application possible in the first place. Your technical file transfers substantially, in a different structure.

A company inside the country has to hold the registration for you.

Both markets require a locally resident Authorised Representative, a licensed local company that submits on your behalf and is named on your labelling. In the UAE that company must itself be registered with the regulator before your product application can begin. Changing representative later is possible and slow.

In the UAE the regulator itself changed.

Medical device registration moved from the Ministry of Health and Prevention to the Emirates Drug Establishment, and the handover finished at the end of 2025. Applications now go through the EDE. Guidance published before 2026 names the wrong authority.