New Guidelines on Marketing Authorization for Software-Based Medical Devices in Indonesia

Indonesia has introduced a specific framework for the marketing authorization of software-based medical devices through Minister of Health Decree No. HK.01.07/MENKES/951/2026 on Guidelines for Marketing Authorization of Software-Based Medical Devices (“MOH Decree 951/2026”).

Effective as of 7 September 2026, the regulation provides specific guidance for software used for medical purposes, including software incorporating artificial intelligence (“AI”). It establishes requirements covering product classification, business licensing, quality management, clinical validation, digital integration, and post-market surveillance.

The regulation is particularly relevant to developers, manufacturers, distributors, and healthcare technology companies whose products perform medical functions through software.

1. Scope of Software-Based Medical Devices

MOH Decree 951/2026 provides a specific framework for software-based medical devices and distinguishes between several types of products.

The first is Software as a Medical Device (SaMD), referring generally to standalone software that performs one or more medical functions without being an integral part of a physical medical device. Examples may include software installed on computers, tablets, or smartphones to analyze medical information or monitor physiological conditions.

The second is Software in a Medical Device (SiMD), where software forms an integral part of a medical device and controls or operates the functions of the underlying equipment. Software used to process signals in medical imaging equipment may fall within this category.

The framework also covers medical devices incorporating artificial intelligence or machine learning, including software that analyzes health data and provides diagnostic or other clinical recommendations.

The classification of the software and its medical function remains important because the risk classification determines the applicable regulatory requirements.

2. Business Licensing and Production Requirements

Companies involved in the manufacture or distribution of software-based medical devices are required to hold the relevant business licensing applicable to the medical device sector.

The regulatory framework also applies quality and distribution requirements to software-based medical devices. This means that companies cannot treat medical software solely as an ordinary digital product where the software performs a regulated medical function.

Manufacturers and distributors must establish appropriate processes for production, quality control, and distribution in accordance with the requirements applicable to medical devices.

The risk-based licensing framework is also relevant. Depending on the risk classification of the product, different levels of authorization and regulatory oversight may apply.

3. Quality Management Throughout the Software Life Cycle

One of the key features of the new framework is its focus on the software life cycle.

Quality management is expected to cover the product from planning and design through development, verification, validation, release, maintenance, and eventual discontinuation.

Companies are also expected to establish appropriate governance, product planning, life-cycle risk management, configuration control, and oversight of outsourced activities.

The framework refers to international standards commonly used in medical device and software development, including ISO 13485, IEC 62304, and relevant medical electrical equipment safety standards, as references for quality and development processes.

For AI-based medical software, this approach also places greater emphasis on the management of the model and its underlying data throughout the product life cycle.

4. Local Clinical Validation for Imported AI Medical Devices

A significant requirement concerns local clinical validation for certain imported AI-based medical devices.

Imported software-based medical devices using AI technology and falling within medium- to high-risk categories are required to undergo clinical validation in Indonesia to demonstrate their clinical performance in the Indonesian population.

The framework allows the marketing authorization process to proceed subject to a subsequent validation obligation in certain circumstances. However, the results of the local clinical validation must be submitted to the Ministry of Health within the prescribed period following the issuance of the marketing authorization.

This requirement is particularly relevant to foreign companies seeking to introduce AI-based medical software into the Indonesian market. Obtaining marketing authorization may therefore need to be considered together with the company’s ability to conduct and document clinical validation in Indonesia.

5. Regulatory Sandbox for Digital Health Innovation

MOH Decree 951/2026 also provides a regulatory sandbox mechanism for certain digital health innovations that do not yet have comprehensive clinical evidence.

The sandbox is intended to allow qualifying technologies to be tested within a limited and controlled environment while maintaining requirements relating to safety and usefulness.

For innovative digital health products, this mechanism provides a regulatory pathway for testing technology under controlled conditions before the product is fully introduced into the healthcare market.

6. AI Governance and Digital Health Integration

For AI-based medical software, the framework places importance on good machine learning practices (GMLP).

This includes appropriate management of data, documentation of the model, performance monitoring, and measures to address potential bias and other risks associated with the development and operation of AI systems.

The framework also places software-based medical devices within the broader digital health architecture.

Certain software is expected to integrate with the National Health Information System (SIKN). This reflects the government’s broader approach toward integrating healthcare information systems and supporting the digital transformation of the healthcare sector.

As a result, companies developing medical software may need to consider not only whether their products meet medical device requirements, but also whether their systems can operate within the relevant national digital health infrastructure.

7. Post-Market Surveillance

Regulatory obligations do not end once marketing authorization has been obtained.

MOH Decree 951/2026 establishes post-market surveillance requirements for software-based medical devices. Marketing authorization holders are expected to conduct ongoing monitoring, including complaint handling and technical monitoring, to identify malfunctions, software problems, or algorithmic errors.

Manufacturers and distributors must also document and address technical incidents and cybersecurity vulnerabilities where these may create risks to patient safety.

The framework further requires ongoing evaluation of clinical performance using real-world data. This is intended to ensure that the safety, accuracy, and effectiveness of the software remain consistent with its intended use after the product has entered the market.

Government supervision may also include routine and incidental inspections.

This means that compliance for medical software is not limited to obtaining an initial marketing authorization. Companies must maintain appropriate monitoring, documentation, and risk management throughout the product’s commercial life.

8. Interaction with Electronic Medical Records and Telemedicine

The new framework also has implications for digital healthcare platforms that interact with electronic medical records.

Indonesia’s electronic medical record framework requires healthcare facilities to maintain electronic medical records and establishes requirements for electronic systems used for this purpose.

Accordingly, software that functions as an electronic medical record system, or that integrates with such a system, may be subject to overlapping requirements concerning medical software and electronic medical records.

A similar issue may arise for telemedicine platforms.

Not every telemedicine application will necessarily constitute a software-based medical device. However, where a platform provides functions such as diagnosis, clinical recommendations, or clinical decision-making that fall within the scope of a software-based medical device, those particular functions may be subject to the medical device marketing authorization framework.

The regulatory classification therefore depends significantly on the actual medical function performed by the software.

9. Position Within Indonesia’s Medical Device Regulatory Framework

MOH Decree 951/2026 does not establish software-based medical devices as a completely separate regulatory category from the broader medical device framework.

Instead, it provides more specific guidance for the software component of medical devices, including AI-based products.

The framework also forms part of Indonesia’s broader digital health transformation. Software used in healthcare is increasingly regulated not only according to its function as a digital product, but also according to its impact on patient safety, clinical decision-making, data management, and healthcare system integration.

For companies developing or distributing medical software, this means that regulatory assessment should begin with the actual function of the product, rather than simply whether the product is marketed as software, an application, or an AI platform.

10. Practical Implications for Medical Software Companies

The introduction of MOH Decree 951/2026 creates a more specific compliance framework for companies developing and distributing software-based medical devices in Indonesia.

Companies may need to assess:

• whether their software qualifies as a medical device;
• whether the product falls within SaMD, SiMD, or an AI-based medical device category;
• the applicable risk classification;
• the business licensing and marketing authorization requirements;
• the quality management system applicable throughout the software life cycle;
• clinical validation requirements for relevant imported AI products;
• data, model, and performance management for AI-based systems;
• integration requirements with the national health information infrastructure; and
• post-market monitoring, incident reporting, cybersecurity, and real-world performance evaluation.

For foreign companies, these requirements are particularly relevant when entering the Indonesian market with AI-based diagnostic, monitoring, or clinical decision-support software.

The regulatory framework therefore places medical software within a continuing compliance cycle, beginning with product classification and marketing authorization and continuing through development, validation, commercialization, monitoring, and post-market oversight.

Conclusion

MOH Decree 951/2026 establishes a specific regulatory framework for software-based medical devices in Indonesia, including products incorporating artificial intelligence and machine learning.

The framework goes beyond the initial issuance of a marketing authorization. It addresses the entire software life cycle, including quality management, clinical validation, digital integration, AI governance, and post-market surveillance.

For companies developing or supplying medical software in Indonesia, particularly foreign companies introducing AI-based products, understanding whether the software performs a regulated medical function and determining the applicable risk classification will be an important first step in assessing the regulatory requirements applicable to the product.

This alert is part of a series examining legal and regulatory developments affecting Indonesia’s healthcare and digital technology sectors. As the use of software and artificial intelligence in healthcare continues to develop, further regulatory developments should be monitored for their potential implications for medical device manufacturers, technology companies, healthcare providers, and digital health platforms.

Disclaimer: Here

For additional insights on Indonesian immigration compliance and global mobility matters, explore our related publications:

Can a Foreign Executor Act in Indonesia Over Estate Assets?

When Is a Foreign Technology Company Considered to Be Doing Business in Indonesia?

Expansion of the Securities Valuation Framework: Sukuk, Asset-Backed Securities, and Money Market Instruments in Indonesia

Cross-Border Succession in Indonesia: Foreign Wills, Foreign Executors, and Indonesian Heirs

Can a Foreign Company Directly Sell Goods or Services to the Indonesian Government?

Can a Foreign Software Company Contract with an Indonesian Company Without a Local Entity?