Back to Canada Overview
SaMD & IEC 62304
Medical Device Software, SaMD & Cybersecurity
Software-enabled medical devices and standalone software require a regulatory strategy that connects intended use, classification, software functions, risk controls, verification and validation, cybersecurity and lifecycle change management.
Software & Cybersecurity Compliance Framework
Determine whether the software qualifies as a medical device (SaMD / SiMD)
Assess classification under the Canadian framework (SOR/98-282)
Define software architecture, clinical algorithms, and system boundaries
Review software development lifecycle evidence (IEC 62304:2006+A1:2015)
Review software verification and validation (unit, integration, system testing)
Review SOUP / COTS / third-party software library controls and bill of materials
Cybersecurity risk management, threat modeling, and vulnerability mitigation
Interoperability and medical device data system (MDDS) interface evidence
Usability and human factors engineering for software interfaces (IEC 62366-1)
Clinical/performance evidence for software-driven diagnostic or treatment claims
Predetermined change/change-control strategy for machine-learning-enabled functions
Post-market monitoring, patching, and software update controls
Expert Focus:
For software, the licensing question is not only whether the code works. Health Canada must be able to understand what the software does clinically, how failure could affect the user or patient, and how the manufacturer controls changes after licensing.
Authorize Your Digital Health and SaMD Software in Canada
Our software regulatory experts audit lifecycle files, prepare cybersecurity threat analyses, and construct AI/ML change plans.