Indonesia Issues Marketing Authorization Requirements for Software-Based Medical Devices

On September 7, 2026, Indonesia’s Ministry of Health issued Minister of Health Decree No. HK.01.07/MENKES/951/2026 on Guidelines for Marketing Authorization of Software-Based Medical Devices. The decree took effect immediately.

The guidelines cover Software as a Medical Device (SaMD), Software in a Medical Device (SiMD) and AI-enabled medical devices. They introduce requirements for software validation, clinical evidence, cybersecurity, labeling, software changes and post-market monitoring.

For overseas manufacturers, this new framework may affect how a product is classified, what evidence belongs in the dossier and whether local validation is required.

Which Software-Based Medical Devices Are Covered?

The guidelines establish clear definitions across three primary software categories:

• SaMD: Standalone software intended for one or more medical purposes
• SiMD: Software embedded in a medical device to control its operation or provide specific functions
• AI-enabled medical devices: Devices using AI to analyze health data or generate clinically relevant information, predictions or recommendations

Key Distinction: AI functionality alone does not classify software as a medical device. Classification depends strictly on its intended medical purpose and clinical impact. Software used solely for administrative data management, storage, or operational workflows falls outside the scope of these guidelines.

Technical Documentation and Software Validation

Manufacturers and distributors must hold the applicable business licenses and comply with the relevant manufacturing or distribution requirements. They must also maintain a quality management system supporting product safety, performance and quality.

The guidelines reference international standards covering quality management, risk management, software lifecycle processes, usability, cybersecurity and AI performance evaluation. However, not every standard necessarily applies to every product. Manufacturers must determine which requirements are relevant to the device and its intended use.

Applicants must demonstrate that the software meets its design requirements, user needs and intended purpose. Verification and validation documentation should address:

• Software version identification and traceability
• Change control and Interoperability
• Cybersecurity and risk management

If the tested version differs from the version submitted for authorization, the applicant must compare the versions and justify the differences. Further validation may be required when changes affect safety, performance or intended use. The marketed version must remain controlled throughout the product lifecycle and be identifiable on the label or software interface.

Special Requirements for AI-Enabled Medical Devices

AI-enabled medical devices require documentation covering the design, development, validation and control of the AI system.

The dossier should address:

• Datasetinput data, sources, size, characteristics, composition and division between training, validation and testing
• Model selection, suitability, limitations and risk controls
• Performance results, including relevant accuracy, sensitivity and specificity measures
• Clinical relevance of the software’s outputs
• Deployment, monitoring and version management

Continuous-learning systems require additional documentation covering ongoing learning, anomaly detection, dataset integrity, traceability, and continuous validation.

For generative AI or large language models, manufacturers must explain how outputs are controlled, how hallucination risks are reduced and how the accuracy and consistency of generated medical information are evaluated.

Clinical Evidence & Local Validation Requirements

Clinical evidence must reflect the product’s intended purpose, risk and clinical impact. Depending on the device, it may include scientific literature, clinical guidelines, comparisons with similar software and clinical study results.

The guidelines establish a clear distinction between two evaluation phases:

• Analytical validation, which assesses whether the software processes data correctly and produces reliable outputs.
• Clinical validation, which determines whether those outputs are clinically meaningful for the intended purpose and population.

Evidence requirements depend on the product’s novelty, risk, and influence on clinical decision-making. Higher-risk products may require independent clinical review.

When Is Local Clinical Validation Mandatory?

Certain imported products require local clinical validation if they:

• Have been further developed or retrained using data representative of the Indonesian population; or
• Use medium-to-high-risk AI for diagnosis, screening or clinical decision-making

Validation may be conducted through hospitals, universities, accredited laboratories or relevant Ministry of Health technical units.

Local validation may proceed alongside the marketing authorization application. Applicants must submit existing clinical and performance evidence with the application and provide local validation results no later than one year after authorization.

Manufacturers should determine early whether their products meet these criteria to plan any required studies and timelines.

Labeling & Software Change Management

Labels and accompanying information must identify the product name, software version, product owner, intended purpose, instructions for use, performance information, and relevant safety information.

• Physical media: Provide physical labels and instructions for use in hard copy or electronically through a link.
• Downloadable / Web-Based Software: Include interface screenshots identifying the product and software version, along with instructions for access, installation, and use.

Evaluating Software Updates

Software updates must be assessed before implementation. Changes affecting the intended indication, primary function, or clinical performance may require a new marketing authorization.

Examples requiring new authorization:

• Algorithm changes affecting diagnostic or therapeutic functions
• New clinical features influencing medical decisions
• Alarm changes affecting patient management
• Platform or infrastructure changes affecting safety or performance

Note on Minor Changes: Updates that do not affect safety, performance, or quality can typically be handled via a standard amendment. If the appropriate regulatory pathway is unclear, the business operator must submit the proposed change and supporting evidence to the Ministry of Health for formal evaluation. All changes must be fully documented within your Quality Management System (QMS).

Post-Market Vigilance & Compliance

Marketing authorization holders must:

• Investigate complaints, adverse events, and product defects
• Monitor software performance and cybersecurity vulnerabilities
• Evaluate post-market clinical performance using relevant evidence, including real-world data
• Implement safety notices, corrective actions, and recalls where required

The guidelines also provide for annual routine field inspections and additional inspections where necessary. Manufacturers and their Indonesian partners should therefore establish clear procedures for exchanging safety information, investigating problems and implementing corrective measures.

Action Plan for Foreign Manufacturers

Foreign manufacturers should immediately audit current and planned Indonesian submissions against the new guidelines by taking the following steps:

1. Categorize the Device: Confirm whether the product qualifies as SaMD, SiMD, or an AI-enabled medical device.
2. Audit Core Documentation: Review software validation, risk management, cybersecurity protocols, and version-control records.
3. Assemble AI Dossiers: Gather the required datasets, model training documentation, and performance evidence for AI-enabled features.
4. Determine Clinical Requirements: Assess whether local clinical validation is mandatory for your product class.
5. Verify Labeling: Ensure all user interfaces, labeling, and documentation accurately reflect the correct version number and intended use.
6. Formalize Post-Market Workflows: Establish clear workflows for managing software updates and continuous post-market surveillance.

Final Thoughts

By establishing clear distinctions for SaMD, SiMD, and AI-enabled software, the Ministry of Health has aligned its regulatory oversight with international standards while introducing strict localized requirements for clinical validation and continuous lifecycle monitoring.

For foreign manufacturers, compliance is no longer a one-time hurdle at initial registration — it requires an active strategy encompassing software version management, robust AI model governance, and tight integration with local partners. Proactively auditing software dossiers and setting up local post-market protocols now will be critical to ensuring uninterrupted market access and long-term commercial success in Indonesia’s rapidly growing digital health market.

To navigate these evolving compliance standards efficiently, international medical device companies can rely on Cisema’s regulatory expertise to compile required technical evidence, manage local validation requirements, and coordinate the marketing authorization process in Indonesia.

For companies looking to expand into Indonesia or update their existing medical device portfolio, contact Cisema today.

About the Author: Elysabeth Septiani

Elysabeth Septiani is a Regulatory Affairs Manager at Cisema, Indonesia, overseeing regulatory strategy and compliance for medical devices, supplements, and cosmetic products. With eight years of experience in Regulatory Affairs and Quality Assurance, she specializes in regulatory submissions and intelligence, supporting efficient and compliant market access while ensuring alignment with evolving regulatory requirements.

Further Information

• Explore Cisema’s medical device registration services in Indonesia.
• Read more about medical devices in Indonesia:
  
  • A Practical Guide to Medical Device Registration in Indonesia
  • Guide to Indonesia Medical Device Post-Registration Changes: Notification, Variation, or New Registration
  • A Guide to Dossier Preparation for Indonesia Medical Device Registration
  • Key Requirements for Indonesia Halal Medical Devices: What Manufacturers & Importers Need to Know

References

• Ministry of Health of the Republic of Indonesia, Minister of Health Decree No. HK.01.07/MENKES/951/2026 on Guidelines for Marketing Authorization of Software-Based Medical Devices, established September 7, 2026: JDIH Kementerian Kesehatan RI

‍