Colombia’s medical device regulations include software in their scope and define classification rules, documentation requirements, and registration processes managed by INVIMA. This framework is primarily contained in Decree 4725 de 2005.
Rapid progress in digital health (AI diagnostics, mobile monitoring, dose calculators) means stakeholders need clear criteria to determine when software is regulated as a device, how to classify risk, and which registration route applies for Colombian commercialization. Colombia also participates in international harmonization efforts and references the IMDRF SaMD concept, which many regulators use to align expectations for standalone medical software.
What counts as “Software as a Medical Device” (SaMD) in Colombia?
According to IMDRF, SaMD refers to software intended for one or more medical purposes that performs those purposes without being part of a hardware medical device. Mobile apps may qualify when they meet this intended medical purpose.
Colombia’s decree mirrors this scope by including software within the medical device definition and by instructing that software used to operate or influence the use of a device is automatically included in the same category as that device (Article 6). Practically, if software is necessary to drive a hardware device (e.g., embedded control), it is regulated with that device rather than as standalone SaMD.
Examples: software that is and is not a medical device in Colombia
Typical SaMD examples (depending on intended use and claims):
- Computer‑aided detection (CAD): post‑processing of medical images to flag potential pathologies (e.g., lung lesions, stroke indicators).
- Clinical decision support that aggregates patient data and recommends diagnostic or therapeutic actions for a specified condition.
- Mobile viewers for diagnostic images (e.g., MRI viewing on phones) used in clinical interpretation.
- Dose calculators that compute patient‑specific drug dosing using clinical parameters.
- Remote monitoring apps that display near real‑time vital signs for clinical use.
Common exclusions (usually not SaMD when claims are non‑medical or purely administrative):
- Maintenance/asset software that reports device operating status or error codes.
- Embedded firmware or closed‑loop control software integral to device hardware (regulated with the device).
- Workflow/communication tools (patient registration, scheduling, messaging) without medical claims.
- Educational content for professionals without diagnostic/therapeutic functionality.
Risk classification in Colombia (I, IIa, IIb, III)
Under Decree 4725, manufacturers classify medical devices by potential risk using rules based on invasiveness, duration of use, energy interaction, and intended purpose; software falls under these rules via its medical function and impact on diagnosis, monitoring, or therapy. Classes are: I (low), IIa (moderate), IIb (high), III (very high).
Although designed for physical devices, these rules also apply to SaMD under Article 6(b), based on clinical context. As a practical orientation, consistent with IMDRF’s risk framework, software that informs clinical decisions or monitors physiological processes typically sits in IIa/IIb, whereas software that drives decisions where error could cause irreversible harm or death may warrant III. Pure image viewing without diagnostic algorithms often aligns with I, provided no clinical decision claims are made. Final classification depends on specific intended use and documented risk analysis.
Managing SaMD updates: how to handle new versions in Colombia
INVIMA outlines procedures for updating registered software. Depending on the change, the action differs:
- Performance optimizations (same intended use) → file an annex to the dossier with technical information and updated manuals/IFU.
- Complementary functions within the original intended use → request a modification to add references (new software reference under the existing registration).
- Changed intended use (new medical purpose or different claims) → treat as a new product and seek a separate sanitary registry or commercialization permit, as applicable.
FAQs: Colombia SaMD, Classification, and Software Updates
- What is Software as a Medical Device (SaMD) in Colombia?
SaMD is software intended for medical purposes thatoperates independently of hardware. Under Decree 4725, software that influences a device or provides diagnostic/therapeutic functionality is regulated as a medical device. - How is SaMD classified under Colombian regulations?
Classification follows risk-based rules: Class I (low),IIa (moderate), IIb (high), III (very high). Software impacting clinical decisions or therapy often falls under IIb or III. - What is the process for updating a registered medical software in Colombia?
Performance improvements require an annex; adding complementary functions needs a modification; changes in intended use requirea new registration.
If you plan to register SaMDs or other medical devices in the Colombian market, please feel free to contact us at contact@veraqueconsulting.com, or check our guidelines.