Need Regulatory Help? Try Our Platform
Post your regulatory questions or request quotations from verified pharmaceutical consultants worldwide. Get matched with experts who specialize in your market.
February 10, 2026
Approximately 5 minutes
Brazil ANVISA RDC 657/2022: Regulatory Framework for Software as a Medical Device (SaMD)
Brazil ANVISA RDC 657/2022: Regulatory Framework for Software as a Medical Device (SaMD)
1. Purpose and Scope
RDC No. 657/2022, effective July 1, 2022, provides specific provisions for the regularization of Software as a Medical Device (SaMD). It complements general medical device regulations (e.g., RDC No. 185/2001). Excludes welfare software, administrative tools, embedded software in hardware devices, and certain non-medical software. Source: ANVISA RDC No. 657/2022 (English translation) (https://www.gov.br/anvisa/pt-br/assuntos/produtosparasaude/temas-em-destaque/arquivos/2024/rdc-657-2022-en.pdf)
2. Key Definitions
- SaMD: Software meeting the medical device definition, intended for medical purposes without being part of hardware; includes mobile apps, subscription models, and hosted services.
- Embedded software: Incorporated in specific hardware, not usable on general devices.
- Cybersecurity: Protection against unauthorized activities, maintaining confidentiality, integrity, and availability.
- Interoperability/Compatibility: Ability to exchange/use information without conflicts.
Source: ANVISA RDC No. 657/2022 (English translation) (https://www.gov.br/anvisa/pt-br/assuntos/produtosparasaude/temas-em-destaque/arquivos/2024/rdc-657-2022-en.pdf)
3. Classification
SaMD classification follows general rules in RDC No. 751/2022 (or successors), considering intended purpose and risks. Standalone SaMD classified independently. Source: ANVISA RDC No. 657/2022 (English translation) (https://www.gov.br/anvisa/pt-br/assuntos/produtosparasaude/temas-em-destaque/arquivos/2024/rdc-657-2022-en.pdf)
4. In-House Developed SaMD
Low-risk (Class I/II) in-house SaMD used exclusively within health services exempt from regularization, but validation records must be maintained for 10 years. Commercialization/donation prohibited without regularization. Two-year adaptation period. Source: ANVISA RDC No. 657/2022 (English translation) (https://www.gov.br/anvisa/pt-br/assuntos/produtosparasaude/temas-em-destaque/arquivos/2024/rdc-657-2022-en.pdf)
5. Regularization Pathways
- Classes I/II: Notification with simplified form.
- Classes III/IV: Full marketing authorization.
Follow general procedures; technical dossier held by holder (submitted for higher classes). Source: ANVISA RDC No. 657/2022 (English translation) (https://www.gov.br/anvisa/pt-br/assuntos/produtosparasaude/temas-em-destaque/arquivos/2024/rdc-657-2022-en.pdf)
6. Labeling and Instructions for Use
In Portuguese (menus primarily); include update procedures, hardware/software requirements, operating principles, interoperability/compatibility, cybersecurity info. Electronic distribution allowed; traceability via product/version ID (no batch/serial for virtual). Source: ANVISA RDC No. 657/2022 (English translation) (https://www.gov.br/anvisa/pt-br/assuntos/produtosparasaude/temas-em-destaque/arquivos/2024/rdc-657-2022-en.pdf)
7. Technical Dossier Requirements
Structured chapters with increasing detail by class:
- Description, intended purpose, risk management.
- Architecture, algorithms, cybersecurity (higher classes).
- Verification/validation, usability (IEC 62366), lifecycle (IEC 62304).
- Conformity declaration referencing key standards (IEC 62304, ISO 14971).
Clinical evidence via literature or studies for innovations. Source: ANVISA RDC No. 657/2022 (English translation) (https://www.gov.br/anvisa/pt-br/assuntos/produtosparasaude/temas-em-destaque/arquivos/2024/rdc-657-2022-en.pdf)
8. Alterations and Post-Market
Certain alterations (new functions, significant impacts, visual identity changes) require prior approval. Maintenance updates exempt. Post-market monitoring mandatory; adverse events reported. Source: ANVISA RDC No. 657/2022 (English translation) (https://www.gov.br/anvisa/pt-br/assuntos/produtosparasaude/temas-em-destaque/arquivos/2024/rdc-657-2022-en.pdf)
9. Safety, Effectiveness, and Cybersecurity
SaMD must address IT interaction risks, ensure reliability/repeatability, follow lifecycle processes, and mitigate cybersecurity threats throughout lifecycle. Source: ANVISA RDC No. 657/2022 (English translation) (https://www.gov.br/anvisa/pt-br/assuntos/produtosparasaude/temas-em-destaque/arquivos/2024/rdc-657-2022-en.pdf)
10. Practical Notes for RA Managers
Focus on rigorous documentation of lifecycle, cybersecurity, and usability. In-house exemptions limited—ensure records. Transitional processes for pre-existing SaMD. Align with IMDRF principles. Source: ANVISA RDC No. 657/2022 (English translation) (https://www.gov.br/anvisa/pt-br/assuntos/produtosparasaude/temas-em-destaque/arquivos/2024/rdc-657-2022-en.pdf)
Ask Anything
We'll follow up with you personally.
Related Articles
Approximately 5 minutes
Brazil ANVISA RDC 751/2022: Medical Device Risk Classification Rules and Regulatory Requirements
RDC 751/2022 establishes Brazil's risk-based framework for medical devices, defining four classes (I-IV), 22 classification rules, notification for lower-risk, registration for higher-risk, labeling, technical dossier, and transitional provisions effective March 2023.
Approximately 5 minutes
Brazil ANVISA RDC 830/2023: In Vitro Diagnostic Device Risk Classification and Regulatory Requirements
RDC 830/2023 establishes Brazil's risk-based regulation for IVDs, defining Classes A-D with 8 classification rules, notification for lower-risk (A/B), full registration for higher-risk (C/D), mandatory performance evaluation for C/D, specific labeling, and transitional provisions effective October 2023.
Approximately 5 minutes
Medical Device Regulation in Brazil: ANVISA Risk Classification, Registration, and Certification Requirements
In Brazil, ANVISA regulates medical devices with risk-based classification (Classes I-IV), notification for lower-risk devices, full registration for higher-risk, mandatory GMP for Classes III/IV, and specific rules for imports, IVDs, SaMD, and used devices.
Approximately 5 minutes
Brazil ANVISA RDC 591/2021: Unique Device Identification (UDI) System for Medical Devices
RDC 591/2021 implements Brazil's UDI system aligned with IMDRF, requiring manufacturers to assign UDI (DI + PI) using accredited issuers, apply AIDC/HRI on labels/packaging, submit data to ANVISA database, with phased timelines by risk class starting 2022.
Approximately 5 minutes
Brazil ANVISA RDC 848/2024: Essential Safety and Performance Requirements for Medical Devices and IVDs
RDC 848/2024 updates Brazil's essential safety and performance requirements for medical devices and IVDs, emphasizing risk management throughout lifecycle, clinical evaluation, cybersecurity for software, radiation protection, and alignment with state-of-the-art, effective September 2024.
Approximately 5 minutes
Brazil ANVISA RDC 925/2024: Regulatory Requirements for Custom-Made and Patient-Matched Medical Devices
RDC 925/2024 establishes specific requirements in Brazil for custom-made and patient-matched medical devices, including justification documentation, manufacturer declaration, post-market surveillance, high-risk device restrictions, and transitional provisions effective from 2024.