Austria — SaMD Regulatory Gap Analysis

Competent Authority: BASG — Bundesamt für Sicherheit im Gesundheitswesen
Secondary Authority: AGES MEA (Austrian Medicines & Medical Devices Agency)
National Registry: Medizinprodukteregister (Austrian Medical Device Registry)
Governing Law: EU MDR 2017/745 · Medizinproduktegesetz 2021 (MPG 2021) · Medical Devices Reporting Ordinance 2024
SaMD Classification: Typically Class IIa–III under EU MDR Rule 11 (software used for diagnosis/therapy decisions)
AI-enabled SaMD: Also subject to EU AI Act 2024/1689 (high-risk AI system from August 2026)

Gap Analysis Summary

1. Regulatory Framework & Classification

✅ Covered

What's in Place

• Austria is an EU Member State — EU MDR 2017/745 applies directly, no separate national approval
• Risk-based classification: Class I, IIa, IIb, III (MDR Annex VIII rules; Rule 11 governs SaMD)
• SaMD providing information for diagnosis/therapeutic decisions → typically Class IIa, IIb, or III
• National legislation: MPG 2021 (Medizinproduktegesetz 2021) — Austria's implementing law
• BASG is the designated national competent authority (NCA)

SaMD Classification Detail

Source: BASG Medical Devices · EU MDR 2017/745 · MDX CRO SaMD Guide

2. CE Marking & Conformity Assessment

✅ Covered

• CE marking is mandatory for all SaMD placed on the Austrian/EU market
• For Class IIa/IIb/III SaMD: a Notified Body must conduct conformity assessment
• Declaration of Conformity (DoC) required — must be drawn up by the manufacturer
• EU DoC must be provided to BASG on request and in German on request
• For Class I SaMD: self-declaration is sufficient (unless sterile/measuring/reusable surgical)
• Certificates issued under MDD/AIMDD lost validity by May 27, 2024

Source: BASG · OMC Medical

3. National Registration

⚠️ Partial — Needs Update (rules changed May 2024)

Current State (post May 1, 2024)

The Medical Devices Reporting Ordinance 2024 (effective May 1, 2024) significantly changed national registration obligations:

• No longer required for manufacturers, authorized representatives, importers, system/procedure pack producers — if their EU-level obligations via EUDAMED are fully met
• Still mandatory for:
  • Austrian-based manufacturers of custom-made devices
  • Distributors of medical devices in Austria
  • Testing, Inspection & Certification (TIC) bodies
• Registration in the Medizinprodukteregister is free of charge
• Manufacturers must pay an annual fee to BASG (separate from registry registration)

Gap / Action Needed

Backend tile should reflect the post-May 2024 reform: old content stating all actors must register nationally is now outdated. EUDAMED compliance replaces national registration for most SaMD manufacturers.

Source: Medizinprodukteregister FAQs · BASG · Preslmayr Law 2024

4. Quality Management System (QMS)

✅ Covered

• ISO 13485 compliance is mandatory for all medical device manufacturers, including SaMD
• QMS must cover software lifecycle management; for SaMD: IEC 62304 (software lifecycle) applies
• Risk management per ISO 14971 required
• For AI-enabled SaMD (from Aug 2026): QMS must additionally cover EU AI Act requirements (data governance, monitoring, human oversight)

Source: SimplerQMS · Maven Prof Serv

5. Clinical Evaluation

✅ Covered

• A Clinical Evaluation Report (CER) is required for all device classes including Class I SaMD
• Must follow EU MDR Annex XIV and MEDDEV 2.7/1 Rev 4
• SaMD-specific: clinical evidence must demonstrate clinical validity and analytical performance
• PMCF (Post-Market Clinical Follow-up) plan required for Class IIa and above
• For AI-enabled SaMD: real-world performance monitoring must be integrated into the clinical evaluation cycle

Source: BASG · EU MDR 2017/745 Annex XIV

6. Clinical Investigations (Clinical Trials)

⚠️ Partial — Incomplete Detail on SaMD-Specific Pathway

What Applies

• Clinical investigations require BASG approval + ethics committee opinion
• Application process: Submit via EU portal → BASG validates within 10 days → assessment report within 45 days
• Class I & non-invasive Class IIa/IIb devices: may commence immediately after validation
• All other classes: BASG approval required before start
• Electronic submission via BASG's dedicated form is mandatory
• BASG publishes Annual Report on clinical investigations annually

Gap

Backend tile lacks SaMD-specific context: for SaMD, "clinical investigation" may mean usability studies, retrospective data collection, or algorithm validation studies — these nuances (MDCG 2020-1 guidance on clinical evaluation for SaMD) should be in the tile.

Source: BASG Clinical Investigations

7. Labeling Requirements

⚠️ Partial — Language Requirement Detail Missing

General Labeling

• EU MDR Annex I (General Safety & Performance Requirements) governs labeling
• Mandatory label elements: manufacturer name/address, device name, intended purpose, lot/serial/UDI, contraindications, CE mark
• For SaMD: IFU (Instructions for Use) mandatory; may be provided electronically (eIFU) for professional-use SaMD

Austria-Specific Language Requirements

• German language required for:
  • Information accompanying the device for lay/consumer use
  • EU Declaration of Conformity (upon request)
  • Conformity documents (upon BASG request)
  • Information enclosed with implantable devices
  • Field safety corrective action (FSCA) communications
• For professional-use SaMD: English may suffice for IFU (BASG discretion)

Gap

Language requirement granularity (consumer vs. professional) should be explicitly documented per the BASG position.

Source: BASG Importer · Arazy Group Austria Guide

8. Unique Device Identification (UDI)

✅ Covered

• EU MDR UDI system applies fully in Austria
• UDI = UDI-DI (device identifier) + UDI-PI (production identifier)
• Machine-readable (1D/2D barcode or RFID) + Human-Readable Interpretation (HRI) required on device and all higher packaging levels
• Class I SaMD UDI deadline: May 26, 2025 (confirmed implemented)
• EUDAMED UDI/Device registration mandatory for new devices from May 28, 2026; existing devices: November 27, 2026
• For SaMD: UDI applies to the software itself (not physical packaging only); version-specific UDI required for major software changes

Source: BASG · MDI Europa

9. Authorized Representative

✅ Covered

• Manufacturers outside the EEA must designate an EU Authorized Representative
• AR name and address must appear on all device labeling
• AR can be based anywhere in the EEA; if AR is in Austria and device first enters EU via Austria → registration in Austrian registry may apply
• AR is the primary contact for BASG on all regulatory matters

Source: BASG · EU MDR Art. 11

10. Importation

✅ Covered

• Importers placing devices from third countries on the EU market must comply with EU MDR Art. 13
• Must verify CE marking, AR appointment, and MDR compliance before placing on market
• Must immediately notify BASG, manufacturer, and AR if device presents a serious risk or is suspected counterfeit
• EORI number required for EU customs clearance
• For SaMD (digital delivery): "importation" concept is less applicable — focus is on manufacturer's EEA AR and EUDAMED registration
• Note: Annual fee declaration to BASG required by June 30 for all entities supplying devices to end-users in Austria

Source: BASG Importer page · EU MDR Art. 13–14

11. Distributor Obligations

⚠️ Partial — National Registration Requirement Needs Clarification

• Distributors must verify CE marking and MDR compliance before supply
• Must store and transport per manufacturer requirements
• Must report serious incidents to BASG and manufacturer
• National registration in Medizinprodukteregister is still mandatory for distributors (post-2024 reform did not remove this obligation)
• Must submit annual fee declaration to BASG by June 30

Gap

Backend tile should clarify that while manufacturer registration shifted to EUDAMED, distributors in Austria still must register nationally. This distinction is a common source of confusion post-2024.

Source: Medizinprodukteregister FAQs · EU MDR Art. 14

12. Post-Market Surveillance (PMS) & PMCF

✅ Covered

• PMS plan mandatory for all SaMD; Class IIa and above: also PMCF plan required
• Periodic Safety Update Report (PSUR): Class IIa annually; Class IIb/III annually or more frequently
• From May 2026: EUDAMED becomes central repository for PMS reporting in the EU
• For AI-enabled SaMD (EU AI Act): PMS plan must include AI-specific performance monitoring (accuracy drift, bias detection, real-world performance)
• BASG conducts market surveillance and may request PMS data at any time

Source: BASG Market Surveillance · EU MDR Art. 83–86

13. Adverse Events / Vigilance Reporting

✅ Covered

• Serious incidents must be reported to BASG by manufacturers, healthcare professionals, and distributors
• Patients/relatives may report voluntarily via BASG
• Manufacturer must conduct investigation; BASG evaluates and may mandate recalls or field safety corrective actions (FSCA)
• BASG publishes safety information publicly; FSCAs will move to EUDAMED once operational
• Austria participates in annual global #MedSafetyWeek campaign
• For SaMD: cybersecurity incidents and software failures that could cause patient harm are reportable events

Source: BASG Reporting · EU MDR Art. 87–92

14. EUDAMED (European Database for Medical Devices)

✅ Covered (but rapidly evolving — needs monitoring)

• EUDAMED is the central EU medical device database
• Mandatory UDI/Device registration for new devices: May 28, 2026
• Existing devices on market before that date: November 27, 2026
• PMS reporting via EUDAMED mandatory from May 2026
• Replaces most national registration obligations for manufacturers

Source: BASG · European Commission EUDAMED

15. Fees & Annual Declarations

⚠️ Partial — Fee Schedule Detail Needed

Annual Fee Structure

• Exemptions: Companies with total medical device sales < €35,000 may be exempt
• Companies where fee > 1% of annual MD turnover: exempt with BASG justification
• Retail chains: first branch pays full fee; subsequent branches pay 50% (max total: €10,000)
• Fee declaration submitted electronically by June 30 of each year (for prior fee year)
• BASG sends access credentials in late December / early January
• Registry registration itself: free

Gap

Full fee schedule (all classes + 2025 tariffs) should be extracted from BASG fee page and added to backend tile with exact amounts.

Source: BASG Medical Devices Fee · Preslmayr Law 2024

16. Renewal / Certificate Lifecycle

❌ Gap — Not in Backend

What Applies

• There is no marketing authorization renewal for medical devices in Austria (unlike pharma)
• Notified Body certificates are valid for a defined period (typically 5 years) and must be renewed via the NB before expiry
• Certificates issued under MDD/AIMDD became invalid by May 27, 2024
• For SaMD: significant software changes (per MDCG 2020-3 SaMD guidance) may require NB re-assessment and new/updated certificate
• Manufacturers must maintain a "change log" — BASG may request documentation of significant changes

Gap

No tile exists for certificate lifecycle management, NB certificate renewal timelines, or the MDR significant change assessment process for SaMD. This is particularly important for SaMD given frequent software updates.

Source: BASG · MDCG 2020-3 · EU MDR Art. 120

17. SaMD-Specific Requirements

⚠️ Partial — Lacks SaMD-Specific Tile

Key SaMD Requirements Under EU MDR (Austria)

• IEC 62304: Software lifecycle process standard — mandatory for all SaMD
• IEC 62366-1: Usability engineering — human factors testing required
• ISO 14971: Risk management — includes software-specific risk analysis
• Cybersecurity: MDCG 2019-16 guidance on cybersecurity applies; manufacturers must define security update policy, vulnerability management, and minimum IT requirements
• SOUP (Software of Unknown Provenance): All third-party components must be identified and assessed per IEC 62304
• Software versioning: Each major version may require re-assessment — MDCG 2020-3 defines "significant change" threshold
• eIFU: Electronic Instructions for Use permitted for professional-use SaMD under EU Regulation 207/2012
• Intended purpose document: Must clearly delineate medical vs. non-medical claims (critical for SaMD bordering wellness apps)

Gap

Backend currently lacks a dedicated SaMD tile. Recommend creating a "Software as a Medical Device" section under Austria with the above requirements and MDCG guideline references.

Source: MDX CRO SaMD Guide · Maven Prof Serv · MDCG 2019-16 · MDCG 2020-3

18. EU AI Act — AI-Enabled SaMD

❌ Gap — Critical Missing Tile

Regulatory Requirements

• EU AI Act (Regulation 2024/1689) introduces dual compliance for AI-powered SaMD
• SaMD requiring Notified Body involvement under MDR/IVDR automatically qualifies as "high-risk AI system"
• MDCG 2025-6 (June 2025): defines "Medical Device Artificial Intelligence (MDAI)" products subject to dual regulation

Key Timelines

High-Risk AI Requirements (for AI-enabled SaMD)

• Data governance & dataset management
• Technical documentation (beyond MDR technical file)
• Transparency and provision of information to users
• Human oversight mechanisms
• Accuracy, robustness, and cybersecurity (continuous monitoring)
• Record-keeping and logging obligations
• Conformity assessment (coordinated with MDR NB assessment)

Gap

No tile exists in Austria backend for EU AI Act obligations on SaMD. This is a critical gap given the August 2026 deadline is imminent.

Source: MDX CRO EU AI Act · EU AI Act 2024/1689 · MDCG 2025-6

19. eSubmission / EUDAMED Module Compliance

❌ Gap — Evolving Requirements Not Captured

• EUDAMED is becoming mandatory across modules in 2025–2026
• Key mandatory milestones not yet in backend:
  • UDI/Device registration: mandatory from May 28, 2026 (new devices)
  • PMS/Vigilance reporting via EUDAMED: mandatory from May 2026
  • Clinical investigations registration via EU portal: already mandatory
• BASG uses EUDAMED as primary interface — Austria-specific submission process is EU-harmonized
• For SaMD manufacturers: EUDAMED registration replaces national Austrian registry for most entities

Gap

Backend tile should document EUDAMED module rollout schedule, Austria-specific implications, and the transition from national to EU-level registration.

Source: BASG · European Commission EUDAMED roadmap

20. Custom-Made Device Rules

❌ Gap — Specific Tile Missing

• Custom-made devices follow a different MDR pathway (Annex XIII)
• Austrian manufacturers of custom-made devices must still register nationally in the Medizinprodukteregister
• No CE marking required for custom-made devices, but a Statement of Conformity is required
• Implantable custom-made devices: manufacturer must make documentation available to patient and healthcare institution
• For SaMD: a "custom-made" SaMD configured specifically for one patient/institution may fall under this pathway

Gap

No tile distinguishing custom-made device obligations from standard MDR pathway — particularly relevant given custom-made SaMD use cases in Austria's healthcare system.

Source: Medizinprodukteregister · EU MDR Annex XIII

21. Timeline & Key Dates Summary

✅ Covered (partial — should be expanded)

Priority Action Items for Backend Team

Key Sources & References