HSA AI-SaMD Exemption Pathway: Singapore Public Healthcare Deployment Guide

HSA AI-SaMD Exemption Pathway: Singapore Public Healthcare Deployment Guide

Singapore's Health Sciences Authority published its response to public consultation on a proposed exemption pathway for AI-enabled Software as a Medical Device (AI-SaMD) developed by public healthcare entities [4]. For hospital AI teams navigating the gap between research validation and clinical deployment, this regulatory shift changes the timeline calculus—but introduces new governance obligations that many institutions are not yet equipped to handle.

This post is for clinical informatics leads, hospital CIOs, AI engineers in public healthcare institutions, and healthtech founders building for Singapore health systems who need to understand when the exemption applies, what it demands in return, and how it intersects with existing institutional governance.

Key takeaways

• HSA's proposed exemption pathway allows selected AI-SaMD developed by public healthcare entities to bypass manufacturer licensing and product registration requirements under specific conditions [4]
• The exemption is not a free pass: it requires institutional oversight frameworks, post-market surveillance, and adherence to safety and performance standards equivalent to registered devices [4]
• Scope is deliberately narrow: the pathway targets lower-risk AI-SaMD used within the developing institution, not commercial distribution or high-risk diagnostic/therapeutic applications [4]
• Governance infrastructure matters more than model performance: institutions must demonstrate robust clinical governance, incident reporting, and continuous monitoring capabilities before deploying under the exemption [4]
• This aligns with Singapore's Model AI Governance Framework [1], emphasizing accountability, transparency, and human oversight—principles that extend beyond regulatory compliance into operational practice

Why did HSA introduce this exemption pathway?

The traditional medical device regulatory pathway—designed for commercial manufacturers distributing products across multiple sites—creates friction for hospital-developed AI tools intended for internal use. A sepsis prediction model built and validated within a single institution, for example, faces the same registration requirements as a commercial diagnostic platform sold globally.

HSA's consultation response acknowledges this mismatch [4]. Public healthcare institutions in Singapore have clinical governance structures, ethics review processes, and quality management systems already in place. The exemption pathway recognizes that these institutional safeguards can substitute for certain manufacturer licensing requirements—if the AI-SaMD remains within the developing institution and meets specific risk and oversight criteria.

This mirrors regulatory experiments elsewhere. The FDA's adaptive AI/ML framework [2] contemplates predetermined change control plans that allow model updates without new premarket submissions. Utah's recent AI sandbox [15] attempts to accelerate clinical pilots, though it faces unresolved questions about federal regulatory authority. Singapore's approach is more conservative: it leverages existing institutional governance rather than creating a separate sandbox with unclear boundaries.

What qualifies for the exemption—and what doesn't?

The exemption pathway is deliberately narrow [4]:

Eligible:
- AI-SaMD developed by public healthcare institutions (restructured hospitals, national specialty centers, polyclinics under clusters)
- Lower-risk applications (HSA risk classification Class A or B)
- Internal use only—deployed within the developing institution, not distributed commercially or to other sites
- Applications where the institution can demonstrate appropriate clinical oversight, incident reporting, and post-market surveillance

Not eligible:
- High-risk AI-SaMD (Class C or D)—devices that directly inform critical diagnostic or therapeutic decisions without clinician review
- AI-SaMD intended for commercial distribution or multi-site deployment
- Applications where the institution lacks the governance infrastructure to monitor performance and safety continuously
- AI tools that fall outside the SaMD definition (e.g., administrative analytics, operational dashboards that don't inform clinical decisions)

The risk classification matters. A clinical deterioration early warning score that alerts nurses to review a patient is likely Class B. An AI system that autonomously adjusts ventilator settings or interprets radiology images for final diagnosis without radiologist review is Class C or D—and remains subject to full registration.

What governance obligations does the exemption impose?

The exemption is not a regulatory holiday. HSA's response makes clear that institutions must implement oversight mechanisms equivalent to what a registered manufacturer would provide [4]:

Required institutional governance:

1. Clinical oversight committee: A multidisciplinary group (clinicians, data scientists, quality assurance, legal/ethics) that reviews AI-SaMD proposals, approves deployment, and monitors ongoing performance
2. Incident reporting and adverse event tracking: Mechanisms to capture near-misses, user complaints, and safety signals—with escalation pathways to HSA when thresholds are met
3. Post-market surveillance: Continuous monitoring of model performance (discrimination, calibration, fairness), user behavior, and clinical outcomes—not just one-time validation
4. Change control procedures: Documented processes for model updates, retraining, and version control—including criteria that trigger re-validation or HSA notification
5. User training and documentation: Clinicians must understand the AI tool's intended use, limitations, and failure modes—generic "AI literacy" is insufficient

These requirements align with Singapore's Model AI Governance Framework [1], which emphasizes internal governance, explainability, and human oversight. For hospital AI teams, this means the bottleneck shifts from HSA registration timelines to internal governance maturity.

We've seen institutions struggle here. A major Singapore hospital cluster developed a readmission prediction model with strong validation metrics, but deployment stalled for months because the institution lacked a formal AI oversight committee and post-market surveillance plan. The exemption pathway doesn't eliminate that work—it makes it a prerequisite.

How does this interact with existing hospital AI governance?

Most Singapore public healthcare institutions already have:
- Domain-Specific Review Boards (DSRBs) for research ethics
- Clinical governance committees for new clinical protocols
- IT steering committees for system deployments
- Quality improvement frameworks for monitoring clinical outcomes

The AI-SaMD exemption pathway requires these structures to explicitly cover AI tools with medical device characteristics. Many institutions have governance gaps:

• Ethics review is not the same as device oversight: DSRB approval confirms research ethics (informed consent, data privacy, scientific validity). It does not assess post-market surveillance, incident reporting, or continuous performance monitoring.
• IT governance focuses on system availability, not clinical safety: IT steering committees evaluate cybersecurity, uptime, and integration—not whether a model's calibration has drifted or whether clinicians are overriding alerts appropriately.
• Quality improvement is retrospective, not real-time: Traditional clinical audit cycles (quarterly or annual reviews) are too slow for AI systems that can degrade silently due to data drift.

Institutions need to bridge these gaps. One practical model:

AI-SaMD Oversight Committee (example structure):
- Chair: Chief Medical Informatics Officer or equivalent
- Members: Clinical lead for the application domain, data scientist/ML engineer, quality assurance representative, legal/regulatory counsel, patient safety officer
- Cadence: Monthly review of deployed AI-SaMD performance dashboards; ad-hoc meetings for incident escalation
- Responsibilities: Pre-deployment approval, ongoing performance monitoring, incident investigation, change control approval, annual re-validation, HSA liaison

This committee sits above individual project teams and below the hospital executive leadership. It has authority to pause or withdraw AI-SaMD deployments if safety thresholds are breached.

What should hospital AI teams do differently under this pathway?

The exemption pathway changes the deployment checklist:

Before the exemption (traditional registration path):
1. Develop and validate model
2. Prepare technical documentation for HSA submission
3. Wait 6–12 months for HSA review and approval
4. Deploy with institutional IT and clinical governance
5. Monitor performance as part of general quality improvement

Under the exemption pathway:
1. Develop and validate model
2. Confirm eligibility: Is this Class A/B? Internal use only? Does the institution have the required governance infrastructure?
3. Prepare institutional governance documentation: Oversight committee charter, post-market surveillance plan, incident reporting procedures, change control protocol
4. Obtain institutional oversight committee approval—this is now the primary gate, not HSA registration
5. Deploy with real-time performance monitoring dashboards
6. Continuous surveillance: Monthly performance reviews, quarterly governance reports, annual re-validation
7. Notify HSA of incidents per defined thresholds (e.g., safety signals, significant performance degradation)

The timeline advantage is real—institutions can deploy in weeks rather than months—but the governance burden is higher and ongoing.

For clinical AI services teams, this means:
- Governance infrastructure is now a deployment prerequisite, not a post-launch afterthought
- Performance monitoring must be real-time and automated—manual quarterly audits are insufficient
- Documentation standards remain high—the exemption does not reduce the need for technical files, validation reports, and risk assessments; it shifts the reviewer from HSA to the institutional oversight committee

Why this matters in Singapore and Asia

Singapore's approach—leveraging institutional governance rather than creating a separate regulatory sandbox—offers a model for other jurisdictions grappling with hospital-developed AI.

Regional context:
- Singapore's public healthcare system is highly integrated: The three major clusters (SingHealth, NUHS, NHG) have centralized data platforms, shared IT infrastructure, and mature clinical governance. This makes institutional oversight feasible.
- Contrast with fragmented systems: In markets with hundreds of independent hospitals (e.g., India, Indonesia), institutional governance is harder to standardize. Regulatory pathways may need to rely more on external certification.
- Alignment with ASEAN harmonization efforts: Singapore often serves as a regulatory reference for the region. If the exemption pathway succeeds, other ASEAN countries may adopt similar frameworks.

For healthtech founders, the implications are nuanced:
- The exemption does not apply to commercial products—startups selling AI-SaMD to Singapore hospitals still need full HSA registration [4]
- But hospital-developed tools under the exemption may become internal competitors to commercial solutions, especially for lower-risk applications like early warning scores or operational forecasting
- Partnerships with public institutions (co-development, licensing) may offer a path to initial deployment under the exemption, followed by commercial registration for broader distribution

What to do next

For hospital AI teams in Singapore public healthcare:
1. Audit your current AI tools: Which ones meet the SaMD definition? Which are Class A/B and used only internally? These are exemption candidates.
2. Assess governance readiness: Do you have an AI oversight committee with the required membership and authority? A post-market surveillance plan? Incident reporting procedures? If not, establish them before attempting to deploy under the exemption.
3. Engage HSA early: The exemption pathway is new. HSA has indicated willingness to provide guidance on borderline cases [4]. Schedule a pre-submission consultation to confirm eligibility and governance expectations.
4. Build real-time monitoring infrastructure: Manual performance audits are insufficient. Invest in automated dashboards that track discrimination, calibration, alert override rates, and clinical outcomes—reviewed monthly by the oversight committee.
5. Document everything: Even under the exemption, you need technical files, validation reports, risk assessments, and user training materials equivalent to a registered device. The reviewer is your oversight committee, not HSA—but the standards are the same.

For healthtech founders:
1. Understand the exemption does not apply to you—if you're selling a product, you need full HSA registration [4].
2. Consider co-development partnerships with public institutions: initial deployment under the exemption, followed by commercial registration for broader distribution.
3. Differentiate on governance tooling: Hospitals need post-market surveillance platforms, incident reporting systems, and performance dashboards. If your product includes these, you reduce the institution's governance burden.

For clinical informatics leaders:
1. Establish the AI oversight committee now, even if you're not yet deploying under the exemption. Governance maturity takes time to build.
2. Integrate AI-SaMD oversight into existing clinical governance—don't create a parallel structure. Extend your quality improvement and patient safety frameworks to cover AI tools explicitly.
3. Pilot the exemption pathway with a low-risk application (e.g., a Class A clinical decision support tool) to stress-test your governance processes before tackling higher-risk deployments.

If you're navigating HSA pathways for hospital AI deployment, start a project conversation with our team. We've supported Singapore health systems through SaMD classification, governance framework design, and post-market surveillance planning.

FAQ

Does the exemption apply to AI tools developed by private hospitals in Singapore?

No. HSA's proposed exemption is limited to public healthcare institutions—restructured hospitals, national specialty centers, and polyclinics under the three major clusters [4]. Private hospitals developing AI-SaMD must follow the standard manufacturer licensing and product registration pathway, even for internal use. The rationale is that public institutions have established clinical governance and oversight structures that HSA can rely on as a regulatory substitute; private hospitals have more variable governance maturity.

Can a hospital deploy an AI-SaMD under the exemption and later commercialize it?

Yes, but the commercial distribution requires full HSA registration. The exemption covers internal use only [4]. If the institution later decides to license the AI-SaMD to other hospitals or spin it out as a commercial product, it must submit a manufacturer license application and product registration dossier. The validation work done under the exemption (technical files, performance data, risk assessments) can support the registration submission, but HSA will conduct its own review for commercial distribution.

What happens if an AI-SaMD deployed under the exemption causes patient harm?

The institution is liable, and HSA retains enforcement authority [4]. The exemption does not shield institutions from regulatory action if safety standards are breached. Institutions must report serious adverse events to HSA per existing medical device incident reporting requirements. If HSA determines that the institution's governance oversight was inadequate, it can revoke the exemption and require full registration—or prohibit deployment entirely. This is why robust post-market surveillance and incident reporting are non-negotiable under the exemption pathway.

How does this exemption interact with PDPA and data privacy requirements?

The exemption addresses medical device regulation (HSA), not data privacy (PDPC). AI-SaMD deployed under the exemption must still comply with Singapore's Personal Data Protection Act [1]. For clinical AI tools, this typically means: obtaining patient consent (or relying on legitimate interest exceptions for care delivery), implementing data security safeguards, and ensuring transparency about how AI informs clinical decisions. The Model AI Governance Framework [1] provides guidance on privacy-preserving practices (data minimization, de-identification, federated learning where appropriate). Institutions should conduct a Data Protection Impact Assessment (DPIA) for AI-SaMD deployments, regardless of whether they use the HSA exemption pathway.

Sources

[1] Singapore Model AI Governance Framework — PDPC Singapore
https://www.pdpc.gov.sg/help-and-resources/2020/01/model-ai-governance-framework

[2] FDA artificial intelligence and machine learning in software as a medical device — FDA
https://www.fda.gov/medical-devices/software-medical-device-samd/artificial-intelligence-software-medical-device

[3] HSA guidance documents for medical devices and software medical devices — HSA Singapore
https://www.hsa.gov.sg/medical-devices/guidance-documents

[4] HSA response on proposed AI-SaMD sandbox — HSA Singapore
https://www.hsa.gov.sg/announcements/response-to-feedback-from-public-consultation-on-the-proposed-exemption-from-manufacturer-s-licensing-and-product-registration-requirements-for-artificial-intelligence/

[5] STAT+: Why health AI pilots in Utah may be on a collision course with the FDA — STAT News Health Tech
https://www.statnews.com/2026/10/07/utah-sandbox-health-ai-pilots-and-fda-regulations-ai-prognosis/?utm_campaign=rss