HSA AI-SaMD Exemption Pathway: What Singapore Public Hospitals Need to Know in 2026

HSA AI-SaMD Exemption Pathway: What Singapore Public Hospitals Need to Know in 2026

Singapore's Health Sciences Authority (HSA) has finalized an exemption pathway that allows selected AI-enabled Software as a Medical Device (AI-SaMD) developed by public healthcare institutions to bypass manufacturer licensing and product registration requirements under specific conditions [4]. For hospital CIOs, clinical informatics teams, and AI engineers building in-house clinical decision support tools, this changes the regulatory calculus—but not in the way most assume.

This post unpacks what the exemption covers, what it doesn't, and how to build a governance posture that survives both the exemption criteria and eventual scale-out.

Key takeaways

• HSA's AI-SaMD exemption applies only to public healthcare entities developing tools for internal use within Singapore's public health system, not commercial deployment or private hospitals [4]
• Exempted products must still meet safety and performance standards; the exemption removes licensing bureaucracy, not clinical accountability
• The pathway aligns with Singapore's Model AI Governance Framework [1] and mirrors FDA's adaptive AI/ML-SaMD thinking [2], but implementation details matter more than policy alignment
• Hospitals building under the exemption should design governance as if full registration were imminent—because it often becomes necessary when tools prove clinically useful
• The exemption does not replace institutional review boards, data protection obligations under PDPA, or clinical validation requirements

What the HSA exemption actually covers

The exemption pathway targets AI-SaMD developed by public healthcare institutions (think restructured hospitals, polyclinics, national specialty centers) for use within Singapore's public healthcare system [4]. It removes two regulatory friction points:

1. Manufacturer licensing requirements — public institutions don't need to register as medical device manufacturers for internally developed AI-SaMD
2. Product registration requirements — exempted AI-SaMD doesn't require HSA product registration before clinical deployment

What it does not exempt:

• Safety and performance standards — exempted products must still demonstrate clinical safety, effectiveness, and quality management
• Post-market surveillance — hospitals remain responsible for monitoring performance, adverse events, and model drift
• Data protection obligations — PDPA compliance, consent management, and data governance remain mandatory
• Institutional ethics review — IRB or domain review board approval is still required for clinical deployment
• Commercial use — the exemption does not extend to products sold to private hospitals, exported, or commercialized

The exemption is a deployment accelerator for public health innovation, not a regulatory holiday.

Why HSA introduced this pathway

Singapore's public hospitals have been building clinical AI for years—readmission prediction models, ICU early warning systems, imaging triage tools. Many sat in regulatory limbo: clinically validated, operationally useful, but administratively expensive to register as SaMD.

The exemption acknowledges two realities:

1. Public healthcare entities already operate under clinical governance — they have medical boards, clinical audit committees, and institutional accountability structures that approximate manufacturer quality management systems
2. Regulatory friction was delaying clinically beneficial tools — the cost and timeline of full SaMD registration discouraged hospitals from deploying internally developed AI that could improve patient outcomes

This mirrors the FDA's approach to adaptive AI/ML-SaMD, where the agency is exploring predetermined change control plans that allow model updates without new premarket submissions [2]. Both regulators recognize that traditional medical device frameworks—designed for static, externally manufactured products—don't fit the iterative, institution-specific nature of hospital-built AI.

What governance posture survives the exemption

We've worked with Singapore health systems building AI under various regulatory assumptions. The teams that succeed long-term design governance as if the exemption didn't exist. Here's why:

Exempted tools often become candidates for wider deployment. A readmission model built for one cluster proves useful; another cluster wants it; suddenly you're exporting or commercializing, and the exemption no longer applies. If your governance was designed around the exemption, you're rebuilding from scratch.

Clinical accountability doesn't scale down with regulatory relief. When a model contributes to an adverse outcome, the question isn't "Did HSA approve this?" but "Did you validate it properly, monitor it continuously, and document decision provenance?" Exemption from registration doesn't exempt you from clinical negligence.

Institutional review boards expect SaMD-grade documentation. Even if HSA doesn't require a technical file, your IRB will want to see validation data, performance monitoring plans, and risk mitigation strategies that look suspiciously like a SaMD submission.

A practical governance posture:

• Maintain a technical file — even if not submitted to HSA, document intended use, clinical validation, risk analysis, and performance specifications as if you were registering
• Implement post-market surveillance — track model performance, adverse events, and distributional drift with the same rigor as a registered device; see our readmission prediction calibration guide for monitoring frameworks
• Design for portability — assume your tool will eventually need full registration; build quality management, version control, and audit trails that survive regulatory scrutiny
• Align with the Model AI Governance Framework — Singapore's PDPC framework [1] provides a governance scaffold that satisfies both HSA expectations and institutional risk committees

For LLM-based clinical tools (diagnostic support, clinical documentation, patient communication), the governance bar is higher. We've covered rubric-based evaluation and human-in-the-loop validation frameworks that apply regardless of exemption status.

How this fits Singapore's broader AI governance landscape

The AI-SaMD exemption doesn't exist in isolation. It's one piece of Singapore's multi-layer AI governance architecture:

• Model AI Governance Framework (PDPC/IMDA) [1] — principles-based guidance on transparency, fairness, accountability, and human oversight for AI systems across sectors
• Personal Data Protection Act (PDPA) — data protection obligations that apply to all AI systems processing personal data, including health data
• HSA medical device regulations — risk-based framework for SaMD, with the new exemption as a carve-out for public healthcare innovation
• Institutional governance — hospital medical boards, clinical audit committees, IRBs, and data governance committees that oversee clinical AI deployment

For teams building clinical AI, the practical implication: governance is multi-stakeholder, not single-regulator. Even if HSA exempts your tool, you still answer to PDPC on data protection, your IRB on clinical ethics, your medical board on clinical safety, and your patients on outcomes.

Our clinical AI services help hospitals navigate this multi-layer governance landscape, designing systems that satisfy regulatory, institutional, and clinical accountability simultaneously.

Why this matters in Singapore and Asia

Singapore's AI-SaMD exemption is being watched across Asia. Several jurisdictions are considering similar pathways for hospital-developed AI, and Singapore's approach—balancing innovation acceleration with safety accountability—will inform regional policy.

For Singapore hospitals, the exemption creates a strategic opportunity: build and validate clinical AI internally, then commercialize or export once clinical value is proven. The exemption reduces the upfront regulatory cost of experimentation, allowing hospitals to iterate on real clinical workflows before committing to full SaMD registration.

For vendors selling AI-SaMD to Singapore hospitals, the exemption changes the competitive landscape. Public hospitals can now build internally what they previously had to buy. Vendors need to offer either:

1. Capabilities hospitals can't build — foundation models, multi-site federated learning, specialized imaging algorithms
2. Regulatory and operational support — full SaMD registration, multi-country deployment, enterprise integration
3. Clinical validation at scale — evidence from diverse populations and care settings that single institutions can't generate

The exemption doesn't eliminate the vendor market; it raises the bar for what vendors must deliver.

What to do next

If you're building AI-SaMD in a Singapore public healthcare institution:

• Confirm exemption eligibility — review HSA's response to public consultation [4] and confirm your tool, institution, and intended use meet exemption criteria
• Design governance for eventual registration — maintain technical files, validation documentation, and post-market surveillance as if full SaMD registration were required; this protects you clinically and prepares you for scale-out
• Align with the Model AI Governance Framework — use PDPC's framework [1] to structure transparency, accountability, and human oversight; this satisfies both HSA expectations and institutional risk committees
• Implement continuous monitoring — track model performance, distributional drift, and adverse events from day one; exemption from registration doesn't exempt you from clinical accountability
• Engage your IRB early — institutional review boards expect SaMD-grade documentation even for exempted tools; involve them in validation planning, not just final approval

If you're evaluating whether to build or buy:

• Calculate total cost of ownership — the exemption removes registration fees and licensing overhead, but not validation, monitoring, and maintenance costs; compare internal build costs (including governance and clinical validation) against vendor pricing
• Assess internal AI capability — building under the exemption requires ML engineering, clinical informatics, and regulatory expertise; if you lack these, the exemption doesn't help
• Consider scale and portability — if you plan to deploy across multiple institutions or commercialize eventually, design for full SaMD registration from the start

For strategic guidance on regulatory pathways, governance design, or build-vs-buy decisions for clinical AI in Singapore, start a conversation with our team.

FAQ

Does the HSA exemption apply to private hospitals in Singapore?

No. The exemption is limited to public healthcare institutions (restructured hospitals, polyclinics, national centers) developing AI-SaMD for internal use within Singapore's public health system [4]. Private hospitals deploying AI-SaMD—whether developed internally or purchased—must follow standard HSA registration and licensing requirements.

Can I commercialize an AI-SaMD developed under the exemption?

Not without full HSA registration. The exemption applies only to internal use within the public healthcare system. If you want to sell your tool to other institutions, export it, or deploy it in private hospitals, you must obtain manufacturer licensing and product registration [4]. Design your governance to support eventual registration if commercialization is a possibility.

Does the exemption replace IRB approval or PDPA compliance?

No. The exemption removes HSA manufacturer licensing and product registration requirements, but does not affect institutional ethics review (IRB), data protection obligations under PDPA, or clinical validation standards [4]. You still need IRB approval for clinical deployment and must comply with PDPA for any processing of personal health data.

How does this compare to FDA's approach to adaptive AI/ML-SaMD?

Both HSA and FDA recognize that traditional medical device frameworks don't fit iterative, adaptive AI systems. FDA is exploring predetermined change control plans that allow model updates without new premarket submissions [2], while HSA's exemption removes upfront registration for public healthcare innovation. Both approaches maintain safety and performance accountability while reducing regulatory friction. The key difference: FDA's framework applies to commercial manufacturers with approved predetermined change control plans; HSA's exemption applies to public healthcare entities for internal use.

Sources

[1] Personal Data Protection Commission Singapore. (2020). Model AI Governance Framework. https://www.pdpc.gov.sg/help-and-resources/2020/01/model-ai-governance-framework

[2] U.S. Food and Drug Administration. Artificial Intelligence and Machine Learning in Software as a Medical Device. https://www.fda.gov/medical-devices/software-medical-device-samd/artificial-intelligence-software-medical-device

[3] Health Sciences Authority Singapore. Guidance Documents for Medical Devices and Software Medical Devices. https://www.hsa.gov.sg/medical-devices/guidance-documents

[4] Health Sciences Authority Singapore. Response to Feedback from Public Consultation on the Proposed Exemption from Manufacturer's Licensing and Product Registration Requirements for Artificial Intelligence. https://www.hsa.gov.sg/announcements/response-to-feedback-from-public-consultation-on-the-proposed-exemption-from-manufacturer-s-licensing-and-product-registration-requirements-for-artificial-intelligence/