Software can now diagnose illness and guide treatment, but it does not fit the rules written for physical medical devices. Singapore's health regulator built a system that matches oversight to the risk each tool carries.

The dilemma

A new kind of medical product was emerging: software that diagnoses illness, supports clinical decisions, or reads medical scans using AI. This kind of software, known as software as a medical device, did not fit the rules written for physical medical devices like pacemakers or syringes. Singapore's health regulator faced a choice. It could apply the strict, slow approval process used for physical devices, which would hold back useful software. Or it could treat the software like ordinary technology with light-touch rules, which would risk leaving tools that make real clinical decisions without proper oversight.

The regulatory gap

What was needed was a system that matched the level of regulation to the level of risk. Software that helps diagnose a serious illness should face strict controls. A low-risk wellness app should face far fewer. The system also needed to follow international standards, so that companies selling medical software around the world would not face a set of rules unique to Singapore.

The approach

Singapore's Health Sciences Authority, known as the HSA, built a system that sorts medical software into four risk classes, from A to D, based on principles set by the International Medical Device Regulators Forum, the main global body for coordinating medical device rules. The level of regulation rises with the risk. The lowest-risk software only needs to be listed. The highest-risk software needs full registration before it can be sold, must meet international quality management standards, and is monitored after it reaches the market. The HSA has updated the rules over time to cover AI-powered software and cybersecurity. The thinking was that matching the rules to the risk, while following international standards, would attract digital health companies to Singapore while keeping patients safe.

Results achieved

The framework underpins Singapore's wider strategy to become a hub for digital health. It has also supported international cooperation. In December 2025, Singapore and the UK launched the UK-Singapore Regulatory Innovation Corridor, a joint fast-track pathway between the two countries' health regulators for breakthrough health technologies.

Two limits are worth noting. The system is well-developed when it comes to classifying software and setting controls. But the harder-to-see results, such as how many products get approved, whether approval times have improved, and what safety problems show up after products launch, are not published in a way that lets outsiders judge how well the system is actually working. The framework is widely praised as best practice, but the data that would prove that label is only partly available.

The transferable lesson

Following international standards gives a smaller regulator more power than it might seem. It lowers the cost for global companies to enter the market, builds the regulator's credibility, and makes cooperation with other countries easier to set up, as the UK-Singapore corridor shows. The lesson is that a small country's regulatory influence is partly a network effect. Countries that align with international standards early tend to gain more than they give up.