International Regulatory Frameworks: EU MDR, Health Canada, and Beyond

A comparative overview of regulatory requirements across jurisdictions. CE marking under the EU Medical Device Regulation, Health Canada's SaMD framework, and the emerging impact of the EU AI Act.

When your AI model is ready for clinical deployment, you have to choose which market you tackle first. This is obviously more a business question than a regulatory one, it depends mostly on where your customers are. But also at play is where the regulatory clarity is sharpest, since it might make more sense to have any regulatory clearance if it can happen faster. Which jurisdiction that is might not be where you’d expect.

The United States and Canada have published the clearest guidance on software as a medical device (SaMD) and, more recently, machine learning. The EU, meanwhile, is writing new rules as we speak (well, as I write, but I hope to speak to you soon!). The UK is charting its own post-Brexit course. Meanwhile, Japan, Australia, and Brazil have their own frameworks, though they increasingly look to FDA and Health Canada for signals.

This article is not a country-by-country legal manual (get some experts!). Instead, it’s a map of how these systems differ on the fundamentals, and why those differences might influence your development strategy.

The EU Medical Device Regulation (MDR): More than CE Marking

The EU MDR took full effect in May 2021, replacing the older Medical Devices Directive. If you’re selling in Europe, you have to comply. Good news and bad news: the good news is that CE marking is not a government approval, it’s a vendor declaration backed by a Notified Body assessment. The bad news is the Notified Body is not like FDA reviewers. They audit your entire quality system, not just your clinical data.

For software, the EU uses a classification system based on risk and reversibility. Rule 11 is the part you want to read the most carefully: software that processes biological signals or delivers therapies is typically Class IIa at minimum (moderate-risk), and often Class IIb or Class III (high-risk). A diagnostic AI reading imaging scans might land in Class III, which means you need a Notified Body sign-off before you can slap on the CE mark.

The EU does not require pre-market clinical trials the way FDA does, but you will need to demonstrate clinical validity through literature, published evidence, or your own smaller study. You’ll also need to prove your algorithm performs consistently across populations, though the EU’s expectations here have been vague until recently.

Then there’s the EU AI Act, which is overlaying a new layer of regulation on medical devices. The sections on high-risk AI applications (which includes medical diagnosis and treatment) go into effect in August 2027. The EU defines “high-risk” very broadly: any AI making binding decisions affecting health is in scope. This will require documentation of training data provenance, bias testing across demographic groups, and human oversight protocols. It’s not a parallel pathway; it’s an additional requirement on top of MDR.

One practical note: CE marking is mutual recognition across the EU, UK, and some neighboring countries. But the UK, post-Brexit, now operates its own framework under the MHRA, and it’s still developing its AI-specific guidance. So you may find yourself needing separate strategies for continental Europe versus the UK.

Health Canada: MDSAP and the 2025 MLMD Guidance

Canada’s approach is clearer and in some ways more prescriptive than the FDA’s. Health Canada expects you to submit a medical device licence application for any AI/ML-based device before market entry. For Class II-IV devices (which includes most ML-based diagnostics), you need to undergo MDSAP certification.

MDSAP stands for Medical Device Single Audit Program. It’s a single ISO 13485 quality management system audit that satisfies regulatory requirements in five jurisdictions: the United States (FDA), Canada (Health Canada), Japan (PMDA), Australia (TGA), and Brazil (ANVISA). If you’re planning multi-market distribution, MDSAP is your most efficient path. A single audit-organization conducts the ISO 13485 assessment, and all five countries accept that certification.

But Canada stands out a bit. It published the MLMD (Machine Learning/Modification Deployment) guidance in 2025, which is now part of their standard review criteria. Health Canada explicitly asks you to document:

Intended use in plain terms. This should be written by scientists, not marketers.
Performance characteristics against external validation data
Risk classification based on reversibility and clinical impact
Deployment pathways including the Predetermined Change Control Plan (PCCP) if you plan to modify the model post-market

The MLMD guidance also mandates SGBA Plus analysis, which is Sex- and Gender-Based Analysis Plus. SGBA Plus requires you to evaluate whether your model’s performance varies across demographic subgroups: sex, gender identity, age, ethnicity, socioeconomic status, and others relevant to your indication. This isnt Health Canada wants to see how performance breaks down and what you’ll do if it’s unequal.

To enter the market in Canada you also need to get a Medical Device Establishment Licence. Before you can sell any device in Canada (including tongue depressors), you need an MDEL. It’s a licensing requirement tied to your manufacturing facility or distribution entity.

The UK MHRA: Divergence and Emerging AI Guidance

The UK is still writing its own story. It kept the old Medical Devices Directive for a transition period post-Brexit, but it’s moving toward a new regulatory framework that will likely diverge from the EU MDR on timelines and on AI specifics.

The MHRA is developing AI-specific guidance that will apply to medical devices, but it’s still in consultation. What’s clear is that the MHRA values transparency and post-market monitoring. If you’re selling in the UK, expect scrutiny of your documentation on data sources, model training, and real-world performance tracking. The bar is not yet as prescriptive as Health Canada’s, but it’s heading in that direction.

For now, if you have a CE mark under MDR and your device isn’t changing behavior post-market, you can often distribute in the UK under transitional rules. But keep an eye on it and plan for a UK-specific assessment if you want to deploy updates via PCCP or other modification pathways.

Other Major Markets: Japan, Australia, and Brazil

Japan (PMDA), Australia (TGA), and Brazil (ANVISA) each have their own device pathways, and none of them have published AI-specific guidance as detailed as FDA or Health Canada. However, they all look to FDA and Health Canada as markers. A device cleared in the US or approved in Canada often signals lower risk to these regulators, and some expedited pathways exist.

MDSAP is your friend here. If you’re ISO 13485-certified under MDSAP, Australia and Japan will accept that as proof of quality system compliance. Brazil’s acceptance of MDSAP is newer but growing.

Which Market First? A Strategic Lens

Many developers default to “FDA first” because FDA guidance on SaMD and AI is clear and the approval bar is well-understood. But that’s not always the smartest move.

If your clinical evidence is limited, consider Canada first. Health Canada accepts smaller validation datasets and post-market performance monitoring more readily than FDA. Plus, once you’re MDSAP-certified for Canada, you’re most of the way to approval in Japan and Australia.

If you’re EU-focused, start with the EU. But budget for the Notified Body assessment, and plan for 2027 when the EU AI Act kicks in. It’s prudent to get ahead of SGBA Plus analysis now, because all the egulators are converging on it.

If you’re building for multiple regions, MDSAP can actuaally be a strategic moat, since it’s more demanding upfront (ISO 13485 is stricter than many companies’ existing quality systems), but you pay once and satisfy five jurisdictions. For companies with limited regulatory affairs capacity, that efficiency is worth the investment.

The Convergence Trend

Regulatory harmonization is slow, but it’s happening and it’s where the puck is going. SGBA Plus, post-market monitoring, PCCP, and transparency documentation will soon be table stakes across FDA, Health Canada, EU, and UK. The underlying concepts are the same everywhere: clear intended use, valid evidence, robust post-market data, and equity checks.

The details vary (EU wants Notified Body sign-offs, Canada wants SGBA Plus, FDA is still refining its AI guidance), but the skeleton of the skeleton is the same. This means that if you design your evidence generation and quality system with the highest bar in mind (right now, that’s either FDA or Canada), you’ll have a much easier time adapting to other jurisdictions.

Key Takeaways

EU MDR requires Notified Body assessment and CE marking, but no pre-market trials. The EU AI Act adds bias and transparency requirements for high-risk medical AI starting August 2027.
Health Canada expects an MDSAP audit, device licence application, MDEL registration, and SGBA Plus demographic analysis. The 2025 MLMD guidance is clear and prescriptive.
MDSAP certification (single ISO 13485 audit) satisfies FDA, Health Canada, PMDA (Japan), TGA (Australia), and ANVISA (Brazil) in one go.
UK MHRA is still developing AI-specific guidance but expects transparency and post-market monitoring. Current transitional rules allow CE-marked devices to distribute pending new UK regulations.
Strategic choice: Start in the market where your evidence and quality system are strongest. If evidence is moderate, Canada may be easier than FDA. If you plan multi-market, MDSAP is a single-audit solution.
Convergence is real. SGBA Plus, post-market data, and transparency requirements are becoming universal. Design for the highest bar, and other markets follow.