HSA AI-SaMD Sandbox: What the 2026 Exemption Pathway Means for Singapore Hospital AI Teams

HSA AI-SaMD Sandbox: What the 2026 Exemption Pathway Means for Singapore Hospital AI Teams

Singapore's Health Sciences Authority has finalized an exemption pathway for AI-enabled Software as a Medical Device (AI-SaMD) developed by public healthcare institutions [4]. For hospital CIOs, clinical informatics teams, and AI engineers shipping clinical decision support tools, this changes the regulatory calculus: certain hospital-developed AI systems can now enter clinical use without full manufacturer licensing and product registration, provided they meet sandbox criteria. We walk through what the exemption covers, what it doesn't, and how to decide whether your project qualifies.

Audience: Hospital CIOs, clinical informatics leads, AI product managers, and healthtech founders building clinical AI in Singapore.

Key takeaways

• HSA's AI-SaMD exemption pathway allows selected public healthcare institutions to deploy internally developed AI-SaMD without manufacturer licensing or product registration, under defined conditions [4].
• The exemption is not a free pass: institutions must demonstrate governance capability, post-market surveillance, and incident reporting; the pathway is designed for lower-risk, institution-specific tools, not commercial products.
• Singapore's Model AI Governance Framework [1] and HSA's existing SaMD guidance [3] remain the foundation; the exemption adds a sandbox lane, not a replacement regulatory regime.
• Hospital teams must still address PDPA compliance, clinical validation, bias monitoring, and integration with existing clinical AI services governance infrastructure.
• The exemption does not cover high-risk devices or tools intended for commercial distribution; misclassifying your product can trigger retrospective compliance obligations.

What does the HSA AI-SaMD exemption actually cover?

The exemption applies to AI-SaMD developed by public healthcare institutions for use within their own facilities [4]. Key eligibility criteria include:

1. Developer status: The institution must be a public healthcare entity recognized by HSA (e.g., restructured hospitals, national specialty centers).
2. Intended use: The AI-SaMD is deployed only within the developing institution's clinical environment, not distributed commercially or to other institutions.
3. Risk classification: The device falls within defined risk tiers; high-risk Class C or D devices (e.g., autonomous diagnostic systems, life-critical interventions) are excluded from the exemption.
4. Governance capability: The institution must demonstrate robust internal governance, including clinical validation protocols, post-market surveillance, incident reporting, and version control.

The exemption does not waive the need for clinical evidence, safety monitoring, or adverse event reporting. It shifts the regulatory burden from pre-market product registration to post-market institutional accountability [4].

Why HSA introduced the sandbox: regulatory friction vs. innovation velocity

Singapore's existing SaMD regulatory framework [3] was designed for commercial medical device manufacturers, not hospital AI labs. The result: hospital-developed clinical decision support tools—risk stratification models, imaging triage algorithms, operational forecasting systems—faced the same registration pathway as vendor-supplied products, even when used only within the developing institution.

This created two problems:

1. Regulatory overhead: Small-scale, institution-specific AI tools (e.g., a sepsis alert model trained on local EHR data) required manufacturer licensing and product registration, delaying deployment by 6–12 months.
2. Misaligned incentives: Hospitals building AI for internal quality improvement had no commercial distribution intent, yet faced the same compliance burden as startups seeking market authorization.

The exemption pathway addresses this by creating a sandbox for public healthcare AI innovation, provided institutions can demonstrate governance maturity [4]. The trade-off: hospitals gain deployment velocity but assume full accountability for post-market safety and performance monitoring.

What the exemption does NOT cover: commercial distribution, high-risk devices, and cross-institutional use

Three critical exclusions:

### Commercial distribution
If your hospital develops an AI-SaMD and later decides to license it to other institutions or commercialize it, the exemption no longer applies. You must retrospectively complete manufacturer licensing and product registration [4]. This has implications for hospital-startup partnerships: if a hospital co-develops a tool with a vendor, the commercial intent may disqualify the exemption from the start.

### High-risk devices
Autonomous diagnostic systems (e.g., an AI that independently reports critical findings without clinician review), life-critical interventions (e.g., closed-loop insulin dosing), and Class C/D devices are excluded. The exemption targets lower-risk clinical decision support tools—triage alerts, risk scores, workflow optimization—not replacement-level autonomy [4].

### Cross-institutional deployment
The exemption applies only within the developing institution. If Hospital A builds a readmission prediction model and Hospital B wants to deploy it, Hospital B cannot rely on Hospital A's exemption. Each institution must independently qualify, or the tool must enter the full SaMD registration pathway [4].

How to decide if your hospital AI project qualifies

Use this decision framework:

| Question | Exemption likely applies | Full SaMD pathway required |
|--------------|------------------------------|--------------------------------|
| Who developed the AI? | Public healthcare institution (restructured hospital, national center) | Commercial vendor, startup, or private hospital |
| Where will it be used? | Only within the developing institution | Multiple institutions, commercial distribution, or export |
| What is the risk classification? | Class A/B (lower-risk CDS, triage, workflow support) | Class C/D (autonomous diagnosis, life-critical intervention) |
| What governance is in place? | Documented validation, post-market surveillance, incident reporting, version control | Ad hoc development, no monitoring plan |
| Is there commercial intent? | No (internal quality improvement only) | Yes (licensing, sale, or partnership with vendor) |

If your project sits in the right-hand column for any row, assume you need the full SaMD pathway. If you're unsure, HSA offers pre-submission consultations [3].

Governance requirements: what "sandbox" really means

The exemption is not a regulatory holiday. HSA expects institutions to maintain governance standards comparable to commercial manufacturers [4]. Minimum requirements include:

1. Clinical validation: Prospective or retrospective validation on the target population, with documented performance metrics (sensitivity, specificity, calibration, fairness across subgroups).
2. Post-market surveillance: Continuous monitoring of model performance, drift detection, and adverse event tracking. See our guide on post-deployment fragility monitoring for implementation patterns.
3. Incident reporting: Adverse events, near-misses, and safety signals must be reported to HSA within defined timelines, even under the exemption.
4. Version control and change management: Model updates, retraining, and feature changes must be logged and assessed for safety impact. Major changes may require re-validation.
5. Transparency and explainability: Clinicians must understand how the AI informs decisions. Recent work on transparency in healthcare AI [5] highlights that regulatory explainability requirements often undershoot clinician needs; design for clinical usability, not just compliance.

Institutions should align their governance framework with Singapore's Model AI Governance Framework [1], which emphasizes accountability, transparency, and human oversight. The exemption pathway assumes you've already built this infrastructure; if you haven't, start there before deploying AI-SaMD.

How this fits with FDA and international SaMD pathways

Singapore's approach mirrors the FDA's adaptive AI/ML-enabled SaMD framework [2], which distinguishes between "locked" algorithms (fixed after deployment) and "adaptive" algorithms (continuously learning). Key parallels:

• Predetermined change control plans: Both HSA and FDA expect developers to define acceptable model update boundaries in advance. If your AI retrains monthly, you must specify what changes trigger re-validation.
• Real-world performance monitoring: Post-market surveillance is mandatory, not optional. The FDA's 2021 action plan for AI/ML-based SaMD [2] emphasizes continuous monitoring; HSA's exemption pathway embeds the same expectation [4].
• Risk-based tiering: Both regulators exempt lower-risk CDS tools from the most stringent pre-market requirements, provided governance is robust.

For Singapore hospitals with international deployment ambitions, the exemption pathway offers a domestic sandbox to prove governance maturity before pursuing FDA 510(k) or CE marking. But remember: the exemption does not substitute for international regulatory approval if you plan to export the tool.

Why this matters in Singapore

Singapore's public healthcare system is highly integrated, with national EHR infrastructure (NEHR), centralized procurement, and strong clinical informatics capability across restructured hospitals. The AI-SaMD exemption pathway leverages this integration: it assumes institutions have the governance maturity, clinical validation capacity, and post-market surveillance infrastructure to self-regulate lower-risk AI tools.

This creates a two-tier ecosystem:

1. Public healthcare institutions can iterate faster on internal AI tools, using the exemption pathway to deploy and refine models in production before (if ever) seeking commercial registration.
2. Healthtech startups and private hospitals must navigate the full SaMD pathway, which remains unchanged [3].

The risk: if public institutions misuse the exemption—deploying under-validated models, skipping post-market surveillance, or failing to report adverse events—HSA may tighten the pathway, reducing innovation velocity for everyone. The exemption is a trust-based regulatory experiment; institutions must earn that trust through rigorous governance.

What to do next

1. Audit your current hospital AI portfolio: Identify which tools meet exemption criteria (internal use, lower-risk, public institution developer) and which require full SaMD registration. Document the rationale for each classification.
2. Build or strengthen governance infrastructure: If you lack documented clinical validation protocols, post-market surveillance plans, or incident reporting workflows, implement them before deploying under the exemption. Use Singapore's Model AI Governance Framework [1] as a template.
3. Engage HSA early: For borderline cases (e.g., Class B/C boundary, unclear commercial intent), request a pre-submission consultation [3]. Misclassification can trigger retrospective compliance obligations.
4. Design for transparency and usability: Regulatory explainability is a floor, not a ceiling. Clinicians need to understand not just what the AI predicts, but why it matters for this patient, in this context. See our work on readmission prediction transparency for deployment patterns.
5. Plan for scale: If your tool succeeds internally and other institutions want it, you'll need to transition from the exemption pathway to full SaMD registration. Build with that transition in mind—document validation rigorously, maintain version control, and design for multi-site deployment from day one.

If you're building clinical AI in Singapore and need help navigating the HSA exemption pathway, governance infrastructure, or post-market surveillance design, start a project with our team.

FAQ

Can a private hospital use the AI-SaMD exemption pathway?

No. The exemption applies only to public healthcare institutions recognized by HSA (restructured hospitals, national specialty centers) [4]. Private hospitals must follow the full SaMD registration pathway [3], regardless of whether the AI is developed in-house or procured from a vendor.

Does the exemption cover AI tools that assist clinicians but don't directly diagnose?

It depends on the risk classification. Lower-risk clinical decision support tools (e.g., triage alerts, risk scores, workflow optimization) are eligible if they meet other exemption criteria [4]. However, if the tool's output directly informs high-stakes clinical decisions without clinician review, it may be classified as higher-risk and excluded from the exemption. When in doubt, consult HSA [3].

What happens if my hospital AI tool causes an adverse event under the exemption pathway?

You must report the incident to HSA within defined timelines, just as a commercial manufacturer would [4]. The exemption does not waive adverse event reporting obligations. Failure to report can result in loss of exemption status and retrospective enforcement action. Institutions should implement robust incident detection and reporting workflows before deploying AI-SaMD under the exemption.

Can I transition a tool from the exemption pathway to commercial registration later?

Yes, but you must complete full manufacturer licensing and product registration before commercial distribution [4]. The exemption does not grandfather your tool into a simplified commercial pathway. Plan for this transition from the start: maintain rigorous validation documentation, version control, and post-market surveillance data, so you can demonstrate safety and effectiveness when you apply for commercial registration.

Sources

[1] Singapore Model AI Governance Framework, PDPC Singapore, https://www.pdpc.gov.sg/help-and-resources/2020/01/model-ai-governance-framework

[2] Artificial Intelligence and Machine Learning in Software as a Medical Device, FDA, https://www.fda.gov/medical-devices/software-medical-device-samd/artificial-intelligence-software-medical-device

[3] HSA Guidance Documents for Medical Devices and Software Medical Devices, HSA Singapore, https://www.hsa.gov.sg/medical-devices/guidance-documents

[4] HSA Response to Public Consultation on Proposed Exemption from Manufacturer's Licensing and Product Registration Requirements for AI-SaMD, HSA Singapore, https://www.hsa.gov.sg/announcements/response-to-feedback-from-public-consultation-on-the-proposed-exemption-from-manufacturer-s-licensing-and-product-registration-requirements-for-artificial-intelligence/

[5] Transparency in healthcare AI: Testing EU regulatory provisions against users' transparency needs, PLOS Digital Health, July 24, 2026, https://journals.plos.org/digitalhealth/article?id=10.1371/journal.pdig.0001594