February 10, 2026
Approximately 5 minutes
Reviewed by Nate Lam, Founder & Director, ElendiLabs
Brazil ANVISA RDC 657/2022: Regulatory Framework for Software as a Medical Device (SaMD)
1. Purpose and Scope
RDC No. 657/2022, effective July 1, 2022, provides specific provisions for the regularization of Software as a Medical Device (SaMD). It complements general medical device regulations (e.g., RDC No. 185/2001). Excludes welfare software, administrative tools, embedded software in hardware devices, and certain non-medical software. Source: ANVISA RDC No. 657/2022 (English translation) (https://www.gov.br/anvisa/pt-br/assuntos/produtosparasaude/temas-em-destaque/arquivos/2024/rdc-657-2022-en.pdf)
2. Key Definitions
- SaMD: Software meeting the medical device definition, intended for medical purposes without being part of hardware; includes mobile apps, subscription models, and hosted services.
- Embedded software: Incorporated in specific hardware, not usable on general devices.
- Cybersecurity: Protection against unauthorized activities, maintaining confidentiality, integrity, and availability.
- Interoperability/Compatibility: Ability to exchange/use information without conflicts.
Source: ANVISA RDC No. 657/2022 (English translation) (https://www.gov.br/anvisa/pt-br/assuntos/produtosparasaude/temas-em-destaque/arquivos/2024/rdc-657-2022-en.pdf)
3. Classification
SaMD classification follows general rules in RDC No. 751/2022 (or successors), considering intended purpose and risks. Standalone SaMD classified independently. Source: ANVISA RDC No. 657/2022 (English translation) (https://www.gov.br/anvisa/pt-br/assuntos/produtosparasaude/temas-em-destaque/arquivos/2024/rdc-657-2022-en.pdf)
4. In-House Developed SaMD
Low-risk (Class I/II) in-house SaMD used exclusively within health services exempt from regularization, but validation records must be maintained for 10 years. Commercialization/donation prohibited without regularization. Two-year adaptation period. Source: ANVISA RDC No. 657/2022 (English translation) (https://www.gov.br/anvisa/pt-br/assuntos/produtosparasaude/temas-em-destaque/arquivos/2024/rdc-657-2022-en.pdf)
5. Regularization Pathways
- Classes I/II: Notification with simplified form.
- Classes III/IV: Full marketing authorization.
Follow general procedures; technical dossier held by holder (submitted for higher classes). Source: ANVISA RDC No. 657/2022 (English translation) (https://www.gov.br/anvisa/pt-br/assuntos/produtosparasaude/temas-em-destaque/arquivos/2024/rdc-657-2022-en.pdf)
6. Labeling and Instructions for Use
In Portuguese (menus primarily); include update procedures, hardware/software requirements, operating principles, interoperability/compatibility, cybersecurity info. Electronic distribution allowed; traceability via product/version ID (no batch/serial for virtual). Source: ANVISA RDC No. 657/2022 (English translation) (https://www.gov.br/anvisa/pt-br/assuntos/produtosparasaude/temas-em-destaque/arquivos/2024/rdc-657-2022-en.pdf)
7. Technical Dossier Requirements
Structured chapters with increasing detail by class:
- Description, intended purpose, risk management.
- Architecture, algorithms, cybersecurity (higher classes).
- Verification/validation, usability (IEC 62366), lifecycle (IEC 62304).
- Conformity declaration referencing key standards (IEC 62304, ISO 14971).
Clinical evidence via literature or studies for innovations. Source: ANVISA RDC No. 657/2022 (English translation) (https://www.gov.br/anvisa/pt-br/assuntos/produtosparasaude/temas-em-destaque/arquivos/2024/rdc-657-2022-en.pdf)
8. Alterations and Post-Market
Certain alterations (new functions, significant impacts, visual identity changes) require prior approval. Maintenance updates exempt. Post-market monitoring mandatory; adverse events reported. Source: ANVISA RDC No. 657/2022 (English translation) (https://www.gov.br/anvisa/pt-br/assuntos/produtosparasaude/temas-em-destaque/arquivos/2024/rdc-657-2022-en.pdf)
9. Safety, Effectiveness, and Cybersecurity
SaMD must address IT interaction risks, ensure reliability/repeatability, follow lifecycle processes, and mitigate cybersecurity threats throughout lifecycle. Source: ANVISA RDC No. 657/2022 (English translation) (https://www.gov.br/anvisa/pt-br/assuntos/produtosparasaude/temas-em-destaque/arquivos/2024/rdc-657-2022-en.pdf)
10. Practical Notes for RA Managers
Focus on rigorous documentation of lifecycle, cybersecurity, and usability. In-house exemptions limited—ensure records. Transitional processes for pre-existing SaMD. Align with IMDRF principles. Source: ANVISA RDC No. 657/2022 (English translation) (https://www.gov.br/anvisa/pt-br/assuntos/produtosparasaude/temas-em-destaque/arquivos/2024/rdc-657-2022-en.pdf)
Need Regulatory Help? Try Our Platform
Post your regulatory questions or request quotations from verified pharmaceutical consultants worldwide. Get matched with experts who specialize in your market.
Registered Pharmacist · AI Engineer · Director, ElendiLabs
Registered pharmacist, AI engineer, HKHAIS founder, and pharmaceutical & medical device SEO/GEO specialist.
Ask Anything
We'll follow up with you personally.
100% response rate • Reply within 7 business days
Related Articles
Approximately 5 minutes
Brazil ANVISA RDC 751/2022: Medical Device Risk Classification Rules and Regulatory Requirements
RDC 751/2022 establishes Brazil's risk-based framework for medical devices, defining four classes (I-IV), 22 classification rules, notification for lower-risk, registration for higher-risk, labeling, technical dossier, and transitional provisions effective March 2023.
Approximately 5 minutes
ANVISA RDC 830/2023: Brazil IVD Risk Classes A–D
RDC 830/2023 sets Brazil's ANVISA risk-based framework for in vitro diagnostic devices, defining Classes A–D, notification vs registration, and dossier requirements.
Approximately 5 minutes
Medical Device Regulation in Brazil: ANVISA Risk Classification, Registration, and Certification Requirements
In Brazil, ANVISA regulates medical devices with risk-based classification (Classes I-IV), notification for lower-risk devices, full registration for higher-risk, mandatory GMP for Classes III/IV, and specific rules for imports, IVDs, SaMD, and used devices.
Approximately 5 minutes
Brazil ANVISA UDI Requirements: RDC 591/2021 and SIUD Database
Understand Brazil ANVISA UDI requirements under RDC 591/2021, SIUD database submission, class-based deadlines, and linkage to RDC 830/2023 IVD rules.
Approximately 5 minutes
Brazil ANVISA RDC 848/2024: Essential Safety and Performance Requirements for Medical Devices and IVDs
RDC 848/2024 updates Brazil's essential safety and performance requirements for medical devices and IVDs, emphasizing risk management throughout lifecycle, clinical evaluation, cybersecurity for software, radiation protection, and alignment with state-of-the-art, effective September 2024.
Approximately 5 minutes
Brazil ANVISA RDC 925/2024: Regulatory Requirements for Custom-Made and Patient-Matched Medical Devices
RDC 925/2024 establishes specific requirements in Brazil for custom-made and patient-matched medical devices, including justification documentation, manufacturer declaration, post-market surveillance, high-risk device restrictions, and transitional provisions effective from 2024.
Approximately 5 minutes
Navigating Emerging and Major MedTech Corridors: A Comparative Technical Analysis of Brazil (ANVISA), China (NMPA), and Kenya (PPB)
A comprehensive technical comparison evaluating the regulatory architectures, quality system compliance routes, and market access pathways in Brazil, China, and Kenya.