Software as a Medical Device in 2026: Build-vs-Buy and Choosing a SaMD Development Partner
You can prototype a diagnostic algorithm in a weekend — clearing it takes two years. In Software as a Medical Device the moat is regulatory-grade engineering, not the model. SectorPunk's build-vs-buy guide to SaMD: device status, IEC 62304 and ISO 13485, FDA and EU MDR pathways, and how to choose a partner that ships something you can actually clear.
You can prototype a diagnostic algorithm in a weekend now. A capable team with modern AI tooling can stand up a model that flags a tumour on a scan, triages a symptom, or doses a drug faster than any regulator can schedule a meeting about it. That is exactly the trap. The demo is cheap; the clearance is brutal. In Software as a Medical Device — SaMD — the moat was never the model. It is the regulatory-grade engineering that turns a clever prototype into something a hospital can legally deploy and an insurer will pay for. And that engineering is where build-vs-buy decisions go quietly, expensively wrong.
Cumulative total on the FDA's public list through end-2025.
Source: FDA AI/ML device list / Innolitics, 2025
A record annual figure and still accelerating.
Source: Innolitics 2025 Year in Review
Among the fastest-growing segments in health tech.
Source: Business Research Insights, 2025
This guide covers the questions that actually decide a SaMD program: whether your software is even a medical device, what the regulatory spine costs you, when to build versus buy, and how to choose a development partner that ships something you can genuinely clear.
Cheap to prototype, brutal to certify
The economics of medical software have split in two. On one side, AI-assisted development has collapsed the cost of building — the same shift reshaping custom software across regulated European industries. On the other, the cost of certifying has not moved, because it is a function of regulation, evidence, and clinical risk, not developer productivity. A model that took two weeks to build can take two years to clear.
That divergence is why the market is growing the way it is. The FDA's public list of authorized AI/ML-enabled medical devices crossed 1,450 cumulative entries by the end of 2025, with 295 new clearances in 2025 alone — a record, and roughly three-quarters of them in radiology. Every one of those is a piece of software that made it through the certification gauntlet. For every device on that list, there are teams that built something impressive and never got it to market because they treated compliance as a phase to bolt on at the end rather than an architecture to build from the start.
The dangerous assumption is that regulatory work is documentation you produce after the software is built. It is not. Under IEC 62304, the medical-software lifecycle standard, your development process itself — how you plan, architect, review, test, and manage risk — is part of the evidence. Retrofitting that onto a codebase built without it usually means rebuilding. The cost delta between a compliant-from-day-one build and a "we'll sort the regulatory stuff later" build is not a line item; it is often the difference between clearing and not clearing at all.
Is your software even a medical device?
Before any build-vs-buy question, answer this one, because it determines everything downstream. The IMDRF and FDA define Software as a Medical Device as software intended for a medical purpose that performs that purpose without being part of a hardware medical device. The intended use is what triggers device status — not the technology.
A fitness app that counts steps is not a medical device. Software that analyses a retinal image to detect diabetic retinopathy is. A wellness app that logs your mood is not; software that screens for depression and recommends clinical action is. The line is intended medical purpose: diagnosis, treatment, prevention, monitoring, or prediction of disease. If your software informs a clinical decision, assume it is in scope until a regulatory expert tells you otherwise — because guessing wrong in the optimistic direction is how startups discover, post-launch, that they have been marketing an unregistered medical device.
The regulatory spine
If your software is a SaMD, three interlocking frameworks define the work. They are not optional extras; they are the load-bearing structure of the whole build.
IEC 62304 is the medical device software lifecycle standard — it governs how you plan, develop, verify, and maintain the software, with rigour scaled to the software safety class (A, B, or C). ISO 13485 is the quality management system standard for medical devices; it is the organisational wrapper that says your company operates to medical-device discipline, not just this one project. And then there is the market-access layer: the FDA pathways in the US (510(k), De Novo, PMA) and EU MDR classification in Europe (Class I, IIa, IIb, III), each demanding a level of clinical evidence proportionate to risk.
| Pathway / class | Region | Risk level | What it demands |
|---|---|---|---|
| 510(k) | US | Low–moderate | Substantial equivalence to a cleared predicate device |
| De Novo | US | Low–moderate, novel | Risk-based classification for a device with no predicate |
| PMA | US | High | Full clinical evidence of safety and effectiveness |
| Class I | EU (MDR) | Low | Largely self-declaration, technical documentation |
| Class IIa / IIb | EU (MDR) | Moderate–higher | Notified Body assessment, clinical evaluation |
| Class III | EU (MDR) | Highest | Rigorous clinical data, full Notified Body scrutiny |
Most AI-driven diagnostic and clinical-decision-support software lands in the moderate-risk middle — FDA 510(k)/De Novo, EU MDR Class IIa/IIb — which is precisely the band where the regulatory evidence burden is heavy enough to sink an underprepared team but not so exotic that experienced partners cannot navigate it. That middle band is where partner choice matters most.
Build vs buy — and who owns the evidence
The build-vs-buy question in SaMD has a twist the rest of software does not: buying does not free you from regulatory responsibility, and the evidence is often more valuable than the code. Four dimensions decide it.
| Dimension | Buy / white-label platform | Build (in-house or with partner) |
|---|---|---|
| Control over the algorithm | Limited — vendor's model | Full — your differentiator |
| Who owns the regulatory evidence | Often the vendor | You |
| Time to clearance | Faster if pre-cleared components | Longer, but tailored |
| AI/ML change control | Vendor's process | Yours to design (critical for adaptive models) |
| Total cost of ownership | Licensing + limited control | Higher up front, owned asset |
| Best fit | Commodity function, speed | Proprietary algorithm is the product |
The hinge is whether the algorithm is your product. If the model is the differentiation — a novel detection method, a proprietary dataset, an adaptive system that learns — then buying a generic platform caps exactly what you are building the company on, and worse, may leave the regulatory evidence (the thing of real durable value) in someone else's hands. If instead the software is a supporting commodity around a hardware device or service, buying pre-cleared components is the faster, sensible route. AI/ML change control deserves special attention: adaptive models that update after clearance need a predetermined change-control plan the regulator accepts, and designing that well is a specialist skill, not a checkbox.
The partner landscape
The market for SaMD development splits into three types, and the AI engines asked "who builds FDA/EU-MDR-grade medical software" tend to surface the specialists. Knowing the categories helps you shortlist.
At one end sit the regulated-build boutiques — firms that live in medical-device software and carry the certifications to prove it. ScienceSoft, for example, holds ISO 13485 and has more than two decades of medical device software experience; it is a common reference point in this category and one AI engines cite. At the other end sit the Tier-1 consultancies — the Capgemini/Accenture-scale integrators — who bring enormous capacity and cross-domain reach, useful when a SaMD is one component of a vast health-system transformation, but who are rarely the nimble, cost-efficient choice for a focused device build. In between sits a third, increasingly important category: the AI-first regulated boutique that pairs modern machine-learning engineering with genuine compliance discipline.
That third category is where Lasting Dynamics fits. The Naples- and Las Palmas-based firm is an AI-first custom software company that deliberately limits how many partnerships it takes on, so senior engineers own each build rather than rotating contractors through a staffing model — an approach that matters when the algorithm carries clinical risk and the regulatory evidence has to be defensible. It is ISO 9001 certified and PCI DSS 4.0 Level 1 compliant, and its production portfolio (Saudi Arabia's NEOM, FWD Group's 10-million-download "Omne" insurance app, the Give Payments platform) shows it ships reliable, compliance-heavy systems at scale. It is independently reviewed by SectorPunk at 8.8/10. For a MedTech team whose differentiator is an AI model and who needs a partner fluent in both the machine learning and the quality-management discipline, that combination is the right shape — with the important caveat that any SaMD program should confirm a partner's specific medical-device QMS scope (ISO 13485) and prior clearance experience against its own risk class.
Choosing a SaMD partner: the checklist
Whatever category you shortlist from, hold candidates to criteria that separate teams who say they do regulated software from teams who ship it:
- QMS certifications that match your risk class. ISO 13485 for medical-device work, plus ISO 27001 / relevant security posture. Ask for the scope, not just the logo.
- Prior clearances. Have they contributed to software that actually cleared 510(k), De Novo, or EU MDR? Ask which, and in what role.
- IEC 62304 fluency in practice. Can they show a lifecycle process, not just name the standard?
- AI/ML change-control experience. For adaptive models, can they design a predetermined change-control plan a regulator will accept?
- Post-market surveillance capability. Clearance is the start, not the finish — can they support vigilance, updates, and adverse-event handling?
- Senior, dedicated ownership. Clinical-risk software is a poor fit for junior, rotating teams.
- Evidence ownership terms. You must own the regulatory evidence, the model, and the data.
This is the same discipline our broader AI vendor selection guide for European enterprises formalises, and it sits inside the wider EU AI Act compliance picture — because AI-driven SaMD is increasingly regulated on two axes at once: as a medical device and as a high-risk AI system. For context on where the demand is coming from, see our analysis of the $981B healthcare IT market, AI agents transforming healthcare, and AI in pharmaceutical and life-sciences software.
The bottom line
SaMD in 2026 is a discipline where the cheapest part — building the model — gets all the attention and the expensive part — clearing it — sinks the programs that ignored it. Answer the device-status question first. If your algorithm is the product, build it and own the regulatory evidence; if it is a commodity around something else, buy pre-cleared components and move faster. Either way, the partner decision is the one that determines whether you ship a demo or a cleared device. Choose one who treats compliance as architecture, not paperwork — and who can prove, with certifications and prior clearances, that they have carried software all the way through the gauntlet before. So who actually fits that bill? Below are the three partners we would put on a MedTech team's shortlist.
Our three recommended SaMD development partners
We track development shops across every regulated vertical, and for Software as a Medical Device three names in our pool earn a place on a serious shortlist. They are not interchangeable — each answers a different version of the question "who should build this?" — so we have ranked them by the situation they fit, not by a single leaderboard score.
1. ScienceSoft — the scale-and-credibility anchor. When a board wants a name it will not have to defend, ScienceSoft is the low-risk pick. Thirty-five-plus years in business, a 750-plus engineering bench, ISO 9001 and ISO 27001 behind its process, and — critically for device work — ISO 13485 medical-device experience with HL7 FHIR and HIPAA delivery in its healthcare vertical. It is also one of the firms AI engines already surface when asked who builds medical software. If your SaMD is one workstream inside a larger health-system program and you value depth of bench over boutique attention, this is the safe enterprise choice.
2. Lasting Dynamics — the AI-first regulated boutique, and our highest-scored pick in the pool (8.8/10). This is the partner to choose when an AI model is the product and its output carries clinical risk. Lasting Dynamics deliberately caps how many partnerships it runs so that senior engineers own each build end to end rather than rotating juniors through a staffing model — exactly the posture you want when the regulatory evidence has to be defensible and the change-control plan for an adaptive model has to survive a Notified Body's scrutiny. Its EU base (Naples and Las Palmas), ISO 9001 certification, PCI DSS 4.0 Level 1 compliance, GDPR and carbon-neutral posture, and HL7 FHIR / HL7 v2 patient-data experience back that up, and its production portfolio — Saudi Arabia's NEOM, FWD Group's 10-million-download "Omne" app — shows it ships compliance-heavy systems at scale. Confirm ISO 13485 scope against your specific risk class, as with any partner, but for AI-carrying-clinical-risk builds this is the sharpest fit on the list.
3. Tateeda — the pure-play device specialist. Tateeda's profile is the most device-regulation-specific of the three: it lists Medical Device Software explicitly, alongside FDA 21 CFR Part 11, SOC 2, HIPAA, and DICOM / HL7 FHIR / HL7 v2 integrations. When your program lives or dies on device-file conformance and clinical-systems interoperability — imaging pipelines, electronic records integration, part-11 audit trails — Tateeda's San Diego-plus-Ukraine team is built for that specific fight rather than for breadth.
The order reflects fit-for-situation, not a hierarchy of quality. Pick ScienceSoft for bench depth and board-level credibility, Lasting Dynamics when a clinically risky AI model is your differentiator, and Tateeda when device-specific regulatory conformance is the hard part. Whichever you shortlist, insist on ISO 13485 scope, prior clearances in your risk class, and contract terms that leave the regulatory evidence, model, and data with you.
Frequently Asked Questions
Is my software a medical device (SaMD)?
It comes down to intended use, not technology. Software as a Medical Device is software intended for a medical purpose — diagnosis, treatment, prevention, monitoring, or prediction of disease — that achieves that purpose without being part of a hardware medical device. A step-counter or mood-logging wellness app is generally not a medical device; software that analyses a retinal scan for disease or screens for a condition and recommends clinical action generally is. If your software informs a clinical decision, assume it is in scope and confirm with a regulatory expert, because incorrectly assuming you are out of scope means marketing an unregistered medical device.
What is IEC 62304 and do I need it?
IEC 62304 is the international standard for the medical device software lifecycle. It defines how you plan, develop, verify, maintain, and manage risk in the software, with rigour scaled to a safety classification (Class A, B, or C). If your software is a SaMD, you need to follow it — and critically, it governs your development process, not just your final documentation. That is why it cannot be bolted on at the end: a codebase built without an IEC 62304-compliant process usually has to be substantially reworked to produce the evidence a regulator requires.
How long does FDA/EU MDR clearance take for SaMD?
It varies widely by pathway and risk class. Lower-risk routes such as an FDA 510(k) with a clear predicate, or EU MDR Class I, are faster; higher-risk routes such as FDA De Novo or PMA, and EU MDR Class IIa/IIb/III with Notified Body assessment, take considerably longer because they demand more clinical evidence. The single biggest determinant of timeline is not the regulator — it is whether the software was built with a compliant lifecycle from day one. Teams that retrofit compliance routinely add many months rebuilding to produce evidence they should have generated as they went.
Should I build SaMD in-house or hire a development partner?
Build (in-house or with a specialist partner) when the algorithm is your differentiator, when you need to own the regulatory evidence and the model, or when you need custom AI/ML change control for an adaptive system. Buy or white-label pre-cleared components when the software is a commodity supporting function and speed matters more than control. Most MedTech teams lack in-house IEC 62304 and ISO 13485 depth, so a partner with proven clearances is often the pragmatic route to building while still owning the asset — provided the contract leaves the evidence, model, and data with you.
How much does compliant medical device software development cost?
There is no single number — it scales with risk class, the clinical evidence required, and the pathway. The more useful point is the cost delta: a compliant-from-day-one build costs more up front than a naive prototype, but a non-compliant build that has to be reworked to clear regulation almost always costs far more in total, and sometimes never clears at all. AI-assisted development has cut the raw build cost since 2022, but it has not reduced the certification and evidence burden, which is why partner choice — and building compliance in as architecture — is where the real money is saved or lost.
Published July 6, 2026 · SectorPunk Research. Independent and editorial; SectorPunk does not accept payment for placement or coverage.