What SAHPRA requires before AI reads a scan in South Africa

Most write-ups of the South African position stop at "SAHPRA recognises FDA and CE", which is true and is not the whole answer. Recognising a foreign decision is what makes a local application possible. It is not a substitute for making one.

There are two separate permissions, and they are commonly confused because both get called "approval" in conversation.

The establishment licence licenses the company, not the product

A Section 22C medical device establishment licence, issued under the Medicines and Related Substances Act, permits an organisation to manufacture, distribute or wholesale medical devices. Every device the company handles has to be listed on it.

It requires an Authorised Representative who is a natural person resident in South Africa, one per site. From Phase 3 in April 2026, every licence holder must have an ISO 13485 certificate available for verification during audits, complaint investigations and vigilance activity.

Holding an establishment licence does not mean any particular device is authorised. It means the company is licensed to trade in devices at all.

The device authorisation is separate, and AI has its own communication

SAHPRA communication MD08-2025/2026 sets out the position for AI and machine learning enabled devices. Standalone software and software embedded in hardware both require SAHPRA authorisation before use, and the manufacturer or importer must hold the establishment licence.

Devices are classified A to D on a rule-based system. Tools that directly influence a clinical decision generally land in Class C or D. A detector that reorders a worklist on a suspected haemorrhage is squarely in that territory, though the classification is a determination somebody has to make and defend against the sixteen rules in the classification guideline rather than a fact anybody can assert.

The part that surprises people: reliance runs the wrong way

For Class C and D, SAHPRA operates a reliance model. Applications are expected to carry evidence of approval by one of six reference regulators: the TGA, ANVISA, Health Canada, the EU under MDR or IVDR, the PMDA, or the FDA. WHO prequalification also serves.

Two consequences follow, and both matter for planning. The route into the South African market runs through a foreign regulator first, which is unusual for a home market. And the MHRA is not on that list, so a UKCA mark is not reliance evidence here however good it is elsewhere.

If your vendor tells you they are "CE marked and therefore fine in South Africa", the CE mark is the evidence for an application that still has to be made and granted.

What to ask a vendor

That last question is the one nobody asks. A CE certificate has an expiry date, and an authorisation granted on reliance is only as good as the decision it relied on.

• Do you hold a Section 22C establishment licence, and what is the number?
• Is this specific device authorised by SAHPRA, or is the CE or FDA decision all you have?
• Which findings are covered by the authorisation, and how does that list differ from the findings the product reports?
• What class was it determined to be, and who made that determination?
• When does the underlying foreign certificate expire?

General product registration has not been called up

Worth knowing so you do not go looking for a certificate that does not exist: general product registration for devices under Regulation 8 has not been initiated. A SAHPRA authorisation for an AI device is not a registration certificate and should not be recorded as one.

Confirm all of this against SAHPRA current guidance before acting on it. The classification determination in particular is worth putting to a South African regulatory consultant, because everything downstream hangs on it.