What Is Medical Device Software?

Indonesia's government has established official guidelines for managing digital health product registration. The Ministry of Health Regulation Number HK.01.07/MENKES/ 951/2026, enacted on September 7, 2026, governs how medical software, artificial intelligence applications, and health software must be developed, tested, and distributed.

Why does this matter? Digital technology has become integral to healthcare delivery. From glucose monitoring apps to AI-driven diagnostic systems, health software influences medical decisions daily. This regulation ensures products are safe, effective, and high-quality before reaching doctors and patients.

Three Main Categories of Digital Health Devices

1. Software as a Medical Device (SaMD)

SaMD is standalone software that operates independently without requiring specialized hardware. Examples include :

• Mobile apps for diabetic patients to monitor glucose levels;
• Medical image analysis software that doctors use to interpret X-ray images;
• Systems that predict heart attack risk based on digital ECG data.

Key characteristics: Does not require specialized medical hardware to operate and can run on standard computers, tablets, or smartphones.

2. Software in Medical Device (SiMD)

SiMD is embedded within medical hardware and controls how that device functions. Examples include:

• Software that operates MRI or CT scan machines;
• Automated systems in ventilators for respiratory support;
• Software in pacemakers that regulates patient heartbeat

Key characteristics: Cannot be used separately from the hardware and functions to control medical device operations.

3. Artificial Intelligence and Machine Learning Medical Devices (AI/ML-MD)

This rapidly growing category includes products using machine learning or AI to analyze health data and provide recommendations. Examples include:

• Systems that automatically analyze radiological images
• Applications that identify patterns in patient health data
• AI chatbots or assistants helping medical professionals make clinical decisions

The government emphasizes: AI in medical devices is only considered a "medical device" if its output is truly used for medical purposes (diagnosis, monitoring, therapy), not merely administrative functions.

Registration Requirements: What Must Be Fulfilled

Who Needs Registration?

Manufacturers selling digital health products in Indonesia must obtain market authorization from the Ministry of Health. Distributors must also register and comply with good distribution standards.

Required Documentation

1. Quality Management System Documentation

Every manufacturer must demonstrate a system for quality control. International standards that can serve as reference include:

• ISO 13485 (quality management for medical devices)
• ISO 62304 (software lifecycle process for medical devices)
• IEC 62366 (usability engineering for medical devices)

Essentially: manufacturers must prove they have rigorous processes to ensure product safety and functionality.

2. Verification and Validation Documentation

This is evidence that the product has been properly tested. Must include:

• Information about the software version tested;
• How data moves between systems (if connected with other systems);
• Cybersecurity evidence (protection from attacks);
• Complete test results

3. Clinical Evidence Documentation

For certain products, manufacturers must submit evidence that the product truly functions as claimed. Evidence may include:

• Scientific literature supporting the product;
• Comparison with similar products already on the market;
• Clinical trial results (especially for new claims or critical features).

The government recognizes not all products require expensive clinical trials. For lowrisk products, scientific literature is sufficient.

4. Labels and Instructions for Use

Products must include:

• Product name and version number;
• Manufacturer identity;
• Clear intended use statements;
• Easy-to-understand instructions for use;
• Safety information and warnings.

AI and Machine Learning: Special Requirements

For products using AI or machine learning, the government adds extra requirements:

Dataset Documentation

Manufacturers must explain:

• What data was used to train the system (medical images? patient data? physiological signals?)
• How much data (dataset size);
• How data was cleaned and processed;
• Whether bias is possible (for example, did data come from only one hospital or specific population?).

Model Documentation

Manufacturers must explain:

• What type of AI/machine learning was used
• How the model was trained and validated
• Accuracy results and other performance parameters
• Model limitations (when might the model fail?)

Continuous Learning

If the product can learn from new data during use (continuous learning), manufacturers must demonstrate:

• How the system detects unexpected events;
• How new data is safely integrated;
• Mechanisms to revert to previous versions if problems occur.

Regulatory Sandbox: Space for Innovation

Indonesia's government understands that innovative products may not have all ideal clinical evidence. For this, there is a "regulatory sandbox" mechanism.

This is a controlled trial in hospitals or certain health facilities before broad launch. Requirements include:

• Product must have reached technology readiness level 9 (system proven to work in real conditions)
• Trials conducted at qualifying health facilities
• Trial data used to complete clinical evidence
• Local clinical validation results must be submitted within 1 year of authorization

This mechanism creates opportunities for local innovators to test their products while ensuring patient safety.

Registration Holder Obligations

After obtaining authorization, manufacturers cannot simply let products run themselves. They have ongoing responsibilities:

1. Data Security and Privacy

• Protect patient health data from unauthorized access;
• Encrypt data in transit and at rest;
• Maintain strict cybersecurity protocols;
• Report any data breaches.

2. Transparency and Accountability

• Inform users how the product works
• Be clear about system limitations and constraints
• Do not hide information about how AI makes decisions

3. Ethics in AI Development

For AI products, manufacturers must:

• Avoid discrimination and bias that harms patients;
• Ensure systems are inclusive for all patient groups;
• Respect user humanity and privacy;
• Maintain patient safety as the top priority.

4. Integration with National Systems

Manufacturers commit that data output from their products can integrate with the National Health Information System (SIKN/SATUSEHAT). This supports:

• Patient care continuity;
• National health research;
• Public health monitoring;
• Data-driven health policy.

Changes to Market Authorization: When to Report

Digital health products evolve. New features, bug fixes, security updates emerge. The question: when must manufacturers report changes to the Ministry of Health?

Changes Requiring New Authorization

Changes affecting indicated use or clinical performance:

• Algorithm modifications that change diagnostic accuracy
• New clinical features affecting medical decisions
• Changes that increase or decrease system sensitivity
• Integration with new devices or systems affecting services

Example: If a diagnostic app initially detected Disease A with 85% accuracy, then the manufacturer changes the algorithm to 92% accuracy, this is significant and requires new authorization

Changes Reportable as Authorization Updates

Changes not affecting safety or clinical performance:

• Improved interface appearance;
• Enhanced report quality;
• New administrative (non-clinical) features;
• System performance improvements without changing clinical results.

Example: Improving dashboard appearance or adding better report printing functions.

Gray Area Changes

If changes don't clearly fit either category, manufacturers must report to the Ministry of Health with complete data for further evaluation.

Post-Launch Oversight

Market authorization is not the end. The Ministry of Health conducts ongoing oversight:

Routine Report Reviews

Manufacturers must report:

• User complaintsHow the system handles complaints from doctors, hospitals, or patients
• Technical monitoringWhether the system continues to work well, cybersecurity vulnerabilities, or other technical issues
• Post-market clinical validation Whether system performance matches promises based on real-world usage data

Local Clinical Validation for Imported Products

For foreign products, the government may require local clinical validation to ensure product effectiveness in Indonesian populations. This is important because:

• Genetic or epidemiological patient characteristics may differ
• Clinical practices in Indonesia may differ from the country of origin
• Local data helps verify the product is truly useful here

Field Inspections

Inspections occur at least once per year to verify manufacturers and distributors maintain compliance.

Practical Guide for Industry

If you are a developer, startup, or health company wanting to develop digital products in Indonesia, here are initial steps:

1. Understand your product category: Is it SaMD, SiMD, or AIMD? This determines applicable requirements;
2. Build quality management systems from the start: Do not wait until near completion. Good processes from the beginning make everything easier.
3. Document everything: From input data, development processes, to test results. Complete documentation saves time during approval.
4. For AI products: Pay special attention to datasets (are they representative?), bias mitigation, and continuous monitoring. These are the regulator's primary focus.
5. Consult with regulatory experts: The regulatory landscape changes. Local experts help you navigate more efficiently.
6. Consider regulatory sandbox: If your product is innovative but lacks complete clinical evidence, the sandbox can be a bridge to full authorization.

Conclusion

Ministry of Health Regulation 951/2026 is the new foundation for digital health device regulation in Indonesia. This regulation balances two important things: encouraging innovation in health technology while ensuring safety and quality for patients.

Clear standards build trust. When doctors and patients know that apps or AI systems they use have passed strict verification, they can focus on better healthcare.

For manufacturers and developers, this is opportunity. Indonesia is a large healthcare market with growing digital needs. By following this regulation well, your product can make real impact for millions of people.

Source: Keputusan Menteri Kesehatan Republik Indonesia Nomor HK.01.07/MENKES/951/2026 Tentang Pedoman Izin Edar Alat Kesehatan Berbasis Perangkat Lunak