Software as a Medical Device in Thailand: New Classification Guidelines Explained

Software as a Medical Device (SaMD) is one of the most rapidly evolving regulatory categories globally, and Thailand is no exception. The TFDA's updated classification guidelines for SaMD, released in late 2025, establish a framework that aligns more closely with the IMDRF SaMD framework while introducing Thailand-specific requirements that developers and manufacturers must understand before seeking registration or placing products on the Thai market.

What Qualifies as SaMD in Thailand

The TFDA follows the IMDRF definition: SaMD is software intended to be used for one or more medical purposes that performs these purposes without being part of a hardware medical device. This covers clinical decision support tools, diagnostic algorithms, patient monitoring software, image analysis software, and any standalone software that drives or informs a clinical decision. Software that is merely administrative (scheduling, billing) or that controls hardware (device drivers, embedded firmware) is generally not classified as SaMD. The boundary between SaMD and general wellness software is a common classification challenge: any software that makes claims related to disease diagnosis, treatment, or prevention falls within the medical device definition regardless of how it is marketed.

How Thailand Classifies SaMD

Under the updated Thai guidelines, SaMD classification maps onto the existing Class 1 through 4 medical device structure, following IMDRF risk-based principles. The classification depends on two factors: the significance of the information provided by the software to a clinical decision, and the healthcare situation or condition the software addresses. Software that drives diagnosis or treatment decisions in critical or serious healthcare situations falls in Class 3 or 4 and requires the most rigorous registration pathway, including full technical dossier, clinical evidence, and post-market surveillance commitments. The most common misclassification is underclassifying software that actively drives treatment decisions as Class 1 or 2 because the developer views it as "decision support" rather than a primary diagnostic tool. Under IMDRF principles, which the TFDA now applies, the consequence of the software's output on patient management determines classification, not the developer's framing of the product.

Cybersecurity Requirements

A significant addition in the 2025 guidelines is the formalization of cybersecurity documentation requirements for SaMD. Applicants must now submit a cybersecurity risk management file as part of the technical documentation package. This file must include threat modeling demonstrating identification of potential attack vectors, vulnerability assessment results, security testing evidence (penetration testing reports or equivalent), and a post-market security monitoring plan describing how the manufacturer will identify and respond to emerging vulnerabilities after market placement. These requirements reflect alignment with IMDRF cybersecurity guidance and IEC 81001-5-1, the international standard for health software cybersecurity. Manufacturers who have already built cybersecurity documentation for EU MDR, US FDA, or TGA submissions will find significant overlap with Thai requirements, though Thailand-specific formatting and submission requirements apply.

Electronic Labeling for SaMD

The December 2025 labeling regulation B.E. 2568, effective June 20, 2026, specifies that SaMD must provide electronic labeling in Thai or English, with mandatory content including version number, intended use, warnings, contraindications, and manufacturer details. For professional-use SaMD, a Thai-language summary with English IFU is acceptable. Developers should confirm current requirements with their Thai regulatory partner, as labeling requirements for SaMD have specific provisions that differ from physical device labeling.

Practical Implications for Market Entry

Developers of clinical AI tools, diagnostic decision support software, and health monitoring applications targeting the Thai market should conduct a formal classification analysis under the new guidelines before initiating registration. Misclassification — typically underclassifying to avoid a more demanding pathway — is a common and costly error. It results in either non-compliant market entry or the need to restart the registration process under the correct class, losing all timeline advantage of the initial submission. DeeMED Consulting provides SaMD regulatory strategy and classification analysis for the Thai market, including pathway assessment, technical dossier preparation, and TFDA submission management.