SaMD Explained: How is Software Becoming the Medical Device?

With chronic illnesses on the rise, SaMD is becoming standard care, whether it’s predictive analytics, AI diagnostics, sepsis prediction, or cardiac monitoring tools. Regulatory growth illustrates this, with the FDA authorizing over 1,350 AI-enabled devices in early 2026 (double the number cleared in 2022). Each type of SaMD comes with different regulatory pathways and potential cybersecurity risks, particularly as integration accelerates, making specialist hiring a critical business priority.

Key Takeaways:

Remote patient monitoring is expected to quadruple in value by 2033, from $26bn to $110.7bn.
Predictive analytics, AI diagnostics, and remote monitoring are seeing significant strides in critical and everyday care in areas such as chronic disease management, sepsis and cardiac event prediction, and non-invasive remote monitoring in heart failure patients.
Security risks are becoming a key issue in the SaMD industry, with 53% of networked medical devices containing at least one known critical vulnerability and 1 in 4 healthcare organizations experiencing a device attack in the past year that disrupted patient care.
The FDA’s Section 524B has made cybersecurity documentation a formal submission requirement, making the specialist hiring of regulatory, cyber and product security professionals critical for SaMD businesses looking to stay ahead of the curve.

What is SaMD in Healthcare?

Software as a Medical Device (SaMD) is defined by the FDA under the IMDRF definition as “software intended to be used for one or more medical purposes that perform these purposes without being part of a hardware medical device”.

The primary difference between traditional medical devices and Software as a Medical Device is that traditional medical devices are physical hardware products that use mechanical or electrical parts to treat, diagnose, or monitor patients. SaMD is standalone software that fulfils these medical tasks on standard devices like smartphones, laptops, and cloud servers.

Whilst you might see traditional medical devices such as an ECG machine with physical wires and patches used for cardiac monitoring, the SaMD alternative could be an AI algorithm app that analyzes heart-rate data from a smartwatch to detect atrial fibrillation. Similarly, a continuous glucose monitor with a physical needle sensor for a patient’s arm would have the alternative SaMD option of a dose-calculator app for patients to manually log sugar levels to receive custom insulin recommendations.

How is Software Becoming the Medical Device?

In early 2026 alone, the FDA had authorized over 1,350 AI-enabled devices (double the number cleared in 2022). With the rise in chronic illnesses, SaMD is undoubtedly being treated as a potential solution. Healthentia, a certified medical application acting as a SaMD, conducted controlled studies on several chronic diseases: type II diabetes, COPD, cancer, and heart diseases. They found that:

HbA1c levels decreased in several of the studies
Physical activity, performance, and body fat had significant improvements
Self-reporting improved self-monitoring and patient knowledge
The 30-day hospital readmission rate was much lower

This shift is playing out in critical and everyday care as well, with developments across areas such as predictive analytics, AI diagnostics, and remote monitoring:

Predictive analytics: SaMD utilizes predictive analytics for chronic disease management, as outlined above, alongside early diagnosis and screening, and patient monitoring and alerts through artificial intelligence and wearable data.
AI diagnostics: In imaging, deep learning models achieved a pooled sensitivity of 89% for detecting cancer spread, compared with 65% for unassisted radiology.
Sepsis prediction: One model, COMPOSER, provided early warning up to 12 hours before the first antibiotics order, tested across six patient cohorts totaling over 500,000 patients.
Cardiac event prediction: Wearable-based deep learning models can predict coronary, structural, and infiltrative heart disease with near-clinical accuracy.
Remote monitoring: Non-invasive remote monitoring reduces hospitalizations and mortality in heart failure patients by catching early signs of deterioration before they escalate.

As SaMD becomes more integrated as a standard of care, the industry undoubtedly will encounter issues relating to regulatory alignment. This will have a knock-on impact on the hiring landscape for software as a medical device that pushes for more cybersecurity and product security professionals to spearhead these changes and overcome potential barriers proactively.

Types of Medical Device Software

Not all medical software is under the same umbrella. Each type functions differently for compliance, procurement, and hiring. The main categories are:

Software in a Medical Device (SiMD)/embedded software: Embedded within physical hardware and can’t function independently (e.g., software controlling an insulin pump).
Software as a Medical Device (SaMD): Standalone software that performs medical functions on its own, covering diagnosis, monitoring, analysis, or treatment decisions and run on general-purpose platforms like smartphones or the cloud.
AI/ML-enabled software: A growing subset of SaMD/SiMD using machine learning for image recognition, predictive analytics, and diagnostic or treatment recommendations. The FDA has already authorized over 1,016 ML-enabled devices across 17 medical disciplines, showing the growth in the area.
Mobile health (mHealth) applications: Apps supporting remote patient monitoring and digital therapeutics, usually overlapping with SaMD when they perform diagnostic or therapeutic functions rather than general wellness tracking.

Each category carries different and complex regulatory pathways, which makes specialist hiring critical for businesses looking to stay ahead of the curve.

What Are the Latest Trends in Medical Device Software Integration?

The medical device industry has undoubtedly been experiencing a rapid development phase in software innovation. AI and ML are at the forefront of these changes, with AI algorithms that can process complicated medical data helping facilitate early identification of disease, risk stratification, and patient-specific therapy planning.

The interoperability of medical device software is another key trend for medical software integration. Medical device software needs to be integrated with electronic health records, telehealth systems, and population health systems, with shared data standards rather than records existing in silos.

In 2020, the ONC finalized its Cures Act rule, requiring EHR systems to use the FHIR data standard for certified APIs and becoming a compliance requirement in 2026. In essence, it’s a common format so that any app or device can plug into any certified EHR and expect the same data, structured in the same way.

ML-enabled devices are now easily interfaced with third-party software, cloud platforms, and IoT systems to be as interconnected as possible, with additional emphasis on remote and real-time monitoring due to the rise of chronic disease rates and wider telehealth adoption.

How Do Medical Devices Software & Healthcare Apps Ensure Patient Data Security?

Cybersecurity is now embedded into every stage of development with SaMD:

Security embedded into the design: Updated FDA guidance now aligns with multiple regulatory bodies, global markets, and the IMDRF framework, recommending that device manufacturers adopt and implement a Secure Product Development Framework. This makes security central to the design and development process rather than an add-on.
Continuous threat modelling: Manufacturers are expected to identify potential threats to devices, analyze the attack surface, and evaluate the impact of successful attacks on patient safety and device functionality early in the development process and as the design evolves, not as a final step.
DevSecOps as standard practice: The software development lifecycle is embedded with security throughout, with DevSecOps automating security checks, encryption standards, and risk management into every phase.
Rising regulatory expectations: The FDA’s February 2026 guidance has tied cybersecurity into the Quality Management System, making a documented threat model, SBOM, vulnerability management plan, and individual penetration testing a requirement that is scoped into the devices real-world interfaces.

For organizations, this makes hiring a critical component in avoiding falling behind compliance requirements. Teams need development lifecycle and FDA cybersecurity- fluent talent to drive their organization.

The Importance of Cybersecurity and Product Security Professionals for SaMD Companies

The expansion of SaMD means increased exposure, putting cybersecurity and product security at the forefront. 53% of networked medical devices contain at least one critical known vulnerability, and RunSafe Security’s 2026 index found one in four healthcare organizations experienced a medical device attack in the past year, which directly disrupted patient care.

These risks are also applicable, with an added layer, to AI-enabled devices, due to model manipulation, data poisoning, and adversarial inputs, all of which are categories that procurement checklists weren’t built to assess. If the industry fails to account for the speed of AI adoption with SaMD, the accumulated exposure could be significant.

These potential threats are changing the hiring landscape of SaMD companies to match the pace of changing security needs:

Threat modelers and secure development specialists: Embedded from the beginning stages proactively rather than at the end.
SBOM and supply-chain security specialists: As transparency becomes a baseline from a market and regulatory perspective, these professionals will be at the forefront of this change.
AI security specialists: Addressing the specific, unique challenges of ML models, which will require adaptability as the regulations continue to evolve.
Compliance professionals fluent in the FDA’s 524B requirements: Cybersecurity documentation is now a necessity for submissions, requiring professionals that can translate engineering work into regulatory language in the appropriate format.

Why Partner with Redbock?

Redbock is a leading life sciences consulting firm backed by a global framework, with over 600+ active consultants across the US and a highly specialized approach to resourcing solutions.

If you’re looking to keep pace with where the SaMD industry is heading, we can connect you with specialists, from software quality, engineering and validation to data scientists and clinical affairs consultants. Get in touch today to expand your team.