If your software qualifies as a medical device, the next question is its class under Annex VIII of Regulation (EU) 2017/745 (MDR). The class picks the conformity assessment route, and with it whether a notified body is involved, how much evidence you need and how long the project runs. Classify early, before the roadmap and the budget are fixed.
Before you apply the rules
Annex VIII has definitions, implementing rules and 22 classification rules. A few points decide most software cases before Rule 11 is even read:
- Software is an active device under the MDR, so the active-device rules apply.
- The intended purpose governs, not the technology.
- Software that drives or influences the use of a device takes the class of that device. Software independent of any other device is classified in its own right.
- Accessories are classified in their own right.
- If several rules apply, the strictest one, giving the higher class, applies.
As an active device, software can fall under rules 9, 10, 11, 12, 13, 15 and 22. In practice, Rule 11, written for software, decides most cases.
What Rule 11 says
Information used to take decisions for diagnosis or therapy is class IIa. It goes up to class IIb if those decisions may cause a serious deterioration of health or a surgical intervention, and to class III if they may cause death or an irreversible deterioration of health.
Software that monitors physiological processes is class IIa. It is class IIb if it monitors vital physiological parameters whose variations could result in immediate danger to the patient. MDCG 2019-11 gives respiration, heart rate, cerebral functions, blood gases, blood pressure and body temperature as examples.
All other software is class I.
That last line looks generous. It is not. The first part of the rule covers almost any software that gives information someone will use for a diagnostic or therapeutic decision, which is why very little medical device software ends up in class I under the MDR. Under the old Directive, much of it did.
The table that helps
MDCG 2019-11, the Medical Device Coordination Group’s guidance on qualifying and classifying software (revised June 2025), adapts an international framework into a table. It crosses the state of the healthcare situation or patient condition with the significance of the information the software gives:
| Situation or condition | Treat or diagnose | Drives clinical management | Informs clinical management |
|---|---|---|---|
| Critical | III | IIb | IIa |
| Serious | IIb | IIa | IIa |
| Non-serious | IIa | IIa | IIa |
Critical means timely, accurate diagnosis or treatment is vital to avoid death, long-term disability or serious deterioration; the condition is life-threatening or time-critical, or the population fragile. Serious covers conditions where accurate diagnosis matters to avoid unnecessary interventions or long-term irreversible consequences, but the intervention is not usually time-critical. Non-serious covers slow, predictable conditions managed with minor, usually non-invasive interventions.
On the other axis, treat or diagnose means the output is used for immediate or near-term action. Drives clinical management means it aids treatment or diagnosis, triages, or identifies early signs to guide the next step. Informs clinical management means it gives options or aggregates information without triggering near-term action.
Use the table as a check on your reasoning, not a replacement for it. Your classification rationale has to quote the rule.
Two things that are still moving
Software that is or contains an AI system and needs a notified body also falls under Regulation (EU) 2024/1689 (the AI Act) as high-risk. That does not change the MDR class; it adds obligations. MDCG 2025-6 (June 2025) addresses how the two fit together.
The Commission’s December 2025 proposal to amend the MDR and IVDR (COM(2025) 1023) would revise several classification rules. Until it is adopted and applies, Rule 11 as written is the rule.
What it means for your product
Write down which branch of Rule 11 your software sits in, why, and which row and column of the table support it. Be honest about the worst plausible consequence of a wrong output, because that is how a notified body will read it. A class IIa or higher result means a notified body; plan the technical documentation, the clinical evaluation and the quality management system for that from the start.
We classify software, including software as a medical device, in a written qualification and classification report: Qualification and classification.
Related briefing: Is your software a medical device? SaMD qualification under MDCG 2019-11