Anvisa Resolution No. 657/2022 – Standard for registration and notification of Software as a Medical Device
On March 30, 2022, Anvisa edited Resolution RDC No. 657/2022 (“RDC 675/22”) establishing the rules applicable to Software as a Medical Device – SaMD. As part of Anvisa’s Regulatory Agenda, RDC 675/22 was the subject of Public Survey No. 1.035/2021 and has the purpose of creating a legal standard for registration and notification of software that operate as a medical device or as in vitro diagnostic medical device.
Developers and importers of SaMD were already subject to Anvisa’s rulings by means of Resolution No. 185/2001 (“RDC 185/01”). Nevertheless, as RDC 185/01 was conceived for hardware as medical devices, compliance with its provisions was unfeasible for SaMD and it did not attend the demands of the healthtech sector, because, among other issues, (a) there was no definition of the categories of SaMD subject to Anvisa’s inspection; (b) the validation procedures necessary for registration/ notification and the changes to the SaMD that required notice to Anvisa were not clear; (c) it required that all manuals and instructions of the SaMD were provided in hardcopies, in addition to the obligation of fixing labeling information on the medical device.
RDC 657/22 brought the Brazilian regulation closer to international standards on SaMD, especially on the topics below:
- Definition of SaMD. Software defined as SaMD and subject to Anvisa’s surveillance have at least one of the following medical purposes: prevention, diagnosis, treatment, rehabilitation or contraception.
RDC 657/22 expressly excluded from Anvisa’s surveillance software (i) intended to promote well-being; (ii) included in Anvisa’s list (available in: https://www.gov.br/anvisa/pt-br/setorregulado/regularizacao/); (iii) used exclusively for administrative and financial management in health services; (iv) that process demographic and epidemiological health data, without any clinical diagnostic or therapeutic purpose; and (v) intended exclusively for use in hardware medical devices subject to the supervision of Anvisa (in which case only the hardware is subject to registration or notification).
- Procedures to validate the SaMD and post-registration changes. SaMD continue to be classified in risk classes I, II, III and IV, as provided for in RDC 185/01. However, the list of documents to be submitted to Anvisa was adapted to describe the functionalities, validation procedures and cybersecurity of SaMD.
In addition, notice to Anvisa is only required in case of changes to the existing SaMD features, creation of new functionalities or if the SaMD front-end has been significantly modified, to the point of no longer being recognizable. Such provision resolves an old question from software developers regarding the need to notify Anvisa of each version update or minor change.
- Labeling information and use instructions. RDC 657/22 provides that information, such as labeling, use instructions, alerts, warnings, information of cybersecurity etc., that, pursuant to RDC 185/01 should be affixed to the medical device or printed, may, as of now, be on the SaMD front-end and no longer need to be printed if the SaMD is distributed online only. Further, if certain requirements are met, parts of SaMD front-end may be either in English or Spanish.
Despite the progress indicated above, some claims of the healthtech sector were not implemented by this new Resolution, such as the creation of a regulatory Sandbox to promote the national innovation environment. Besides, other regulations still need to be adapted, for instance, the legal requirements for the granting of operation authorization by Anvisa (AFE) to SaMD developers and the standards applicable to clinical research using SaMD.
RDC 657/22 shall be effective as of July 1st, 2022 and it did not revoke any previous resolutions. Therefore, its standards shall be interpreted jointly with the other resolutions applicable to medical devices, such as RDC 185/01 and Resolution No. 340/2020.