Medical devices are classified by risk, not by how clever they are, into four levels: Class I (lowest risk), Class IIa, Class IIb and Class III (highest risk). The class determines how much independent scrutiny is required before the device can be marketed. Class I is self-declared by the manufacturer, while Class IIa, IIb and III all require an independent body to assess and certify. This guide explains the classes in plain terms and shows where common AI tools sit.
Key takeaways
- Classification is driven by risk and intended purpose, not technical sophistication or price.
- Class I is self-declared; Class IIa, IIb and III require independent certification.
- The UK uses the UKCA regime; the EU uses MDR and CE marking, accepted in GB until 30 June 2028.
- Software often sits in grey areas because its risk depends on how its output is used.
- A small change in a tool's intended use can move it into a higher class.
What do the classes mean, and why does risk drive them?
The logic is proportionality: the more harm a device could cause if it failed, the more scrutiny it gets. In ascending order of risk and oversight:
- Class I: lowest risk. Many informational tools, and devices with limited potential for harm. Generally self-declared, though sterile or measuring devices need some Approved Body involvement.
- Class IIa: medium-low risk. Devices that provide information used in decisions, or perform functions with moderate risk. Requires independent certification. Diagnostic imaging software and scribes that summarise and code sit here.
- Class IIb: medium-high risk. Devices influencing significant treatment decisions, or monitoring vital parameters where a fault could cause immediate danger. Heavier assessment.
- Class III: highest risk. Devices where a failure could cause death or irreversible harm, and most implantables. The most rigorous assessment.
Sophistication does not set the class. A very advanced tool used purely for reference can be Class I, while a simpler tool that directly influences high-stakes decisions can be higher.
The UKCA route versus the EU MDR route
There are two regimes a clinician will encounter. The UK's own route is UKCA, under the UK Medical Devices Regulations 2002, with certification by a UK Approved Body for Class IIa and above. The EU route is the Medical Device Regulation, with CE marking and certification by an EU notified body. For clinical use in Great Britain, a UKCA mark is the native route, but a valid CE mark is accepted until 30 June 2028, provided the device is also MHRA registered. The UK framework is being reformed under the 10-Year Plan, with the aim of a faster, more predictable, risk-proportionate approach for software and AI, so expect this area to evolve.
Worked examples across informational tools, scribes and decision support
| Class | Certification | Typical examples |
|---|---|---|
| Class I | Self-declared (MHRA registered) | Informational and reference tools; basic transcription; low-end summarisation |
| Class IIa | Independent certification | Scribes that summarise and code; diagnostic imaging software; tools informing decisions |
| Class IIb | Independent certification | Software influencing significant treatment decisions; monitoring of vital parameters |
| Class III | Most rigorous certification | Software where error could cause death or irreversible harm; implantables |
Why does software keep landing in grey areas?
Because software risk depends on intended purpose, not on the code. The same underlying tool can be Class I or Class IIa depending on what it claims to do and how its output is used. Under EU MDR, standalone software is classified mainly under Rule 11, which pushes software that provides information for clinical decisions to at least Class IIa, and higher if a wrong output could cause serious harm. The UK's regime is being reformed toward similar risk-based clarity. The practical consequence is that a small feature change, such as a scribe moving from summarising to suggesting management, can shift the intended purpose and bump the class. This is why intended purpose, not marketing, is the thing to read.
What does self-certification tell a buyer?
Less than certification does. A self-declared Class I device reflects the manufacturer's own assessment that it meets the standard, with no external body reviewing the file. That is legitimate for genuinely low-risk tools, and the device must still be MHRA registered, but it is a lower level of external scrutiny than Class IIa certification, where an Approved Body has assessed the quality system and technical documentation. So "self-certified Class I" and "Class IIa certified" are not the same assurance, and a buyer should read the intended purpose and confirm registration in both cases.
Where do the AI tools you use sit today?
A snapshot, as of writing:
- Ask iatroX is a Class I, MHRA-registered device, intended as a clinical reference and educational tool.
- TORTUS reached UKCA Class IIa in June 2026, certified as a clinical decision-support device.
- Tandem, including via Accurx Scribe, holds EU MDR Class IIa for its scribe and coding assistant.
- Heidi is a self-declared Class I device for summarisation, with Class IIa reported to be in progress.
- Higher-risk clinical decision-support tools that influence significant treatment decisions sit at Class IIb or above.
For the detail behind these, see our regulatory status tracker, the TORTUS Class IIa analysis, and our explainer on what Class IIa means for procurement.
Frequently asked questions
How are medical devices classified? By risk and intended purpose, into Class I, IIa, IIb and III. The higher the potential for harm, the higher the class and the more independent scrutiny required before marketing.
What is the difference between Class I and Class IIa? Class I is self-declared by the manufacturer. Class IIa requires an independent Approved Body or notified body to certify the quality system and technical documentation. Class IIa applies to higher-risk intended purposes.
Why is software often hard to classify? Because its risk depends on how its output is used, not on the technology. Under EU MDR Rule 11, software informing clinical decisions is at least Class IIa, and a change in intended use can move a tool up a class.
Does a higher class mean a better product? No. The class reflects risk, not quality or sophistication. A Class I reference tool and a Class IIa scribe are simply certified for different levels of risk and intended purpose.
What should a clinician check before using a tool? The intended purpose, the class and regime, and that the device is MHRA registered. Confirm your use matches the certified intended purpose, and follow local governance.