Selling Medical Device Software Apps on EU Online Platforms: What Manufacturers Must Consider

Selling a medical device software app through an online platform in the EU does not remove it from medical device regulation. Companies should first determine whether the software qualifies as Medical Device Software (MDSW), then confirm applicability of the MDR or IVDR, the CE marking status, economic operator responsibilities, the compliance of online product listings, download and distribution channels, software version updates, cybersecurity and post-market surveillance requirements. Online distribution cannot be used to bypass medical device oversight, particularly for software with diagnostic, monitoring, treatment-recommendation or clinical decision support functions.

Compiled by the AIMEILI Regulatory Editorial Team based on public regulatory sources, registration practice and international medical device registration reference materials. Published: 8 July 2026. Last updated: 8 July 2026.

Key Summary

Medical device software apps offered on EU online platforms remain subject to the full regulatory framework. The first step is qualification: does the software meet the definition of MDSW? If it does, the manufacturer must establish whether the MDR or IVDR applies, secure and maintain CE marking, fulfil the obligations attached to its role as an economic operator, and ensure that the information presented on the sales platform, the download channel, the update mechanism, the cybersecurity posture and the post-market surveillance system all comply with the applicable legislation. Software with diagnostic, monitoring, treatment-recommendation or clinical decision support functionality carries the greatest regulatory exposure.

Who Should Read This

This article is intended for manufacturers, regulatory affairs professionals, international business leads and CRO teams that are planning overseas registration of medical devices, preparing to enter GHWP member states and other priority markets, or assessing documentation gaps and registration pathways. It is also relevant to software and digital health companies evaluating whether their app can be marketed directly to EU users.

Assessment Logic

Companies should first define the target country or market, the risk class of the product, the intended purpose, the existing registration status and the commercial launch plan. Only then should they determine the applicable regulatory pathway, the required depth of documentation, the need for a local authorised representative and the scope of post-market maintenance obligations. The same product may be classified differently and require different evidence in different jurisdictions, so conclusions drawn from a domestic registration cannot simply be transferred to the EU.

For EU online sales specifically, the qualification question is decisive. Software intended by the manufacturer for a medical purpose — including diagnosis, prevention, monitoring, prediction, prognosis, treatment or alleviation of disease — will generally be treated as a medical device, and software that drives clinical decisions or therapeutic recommendations should be assessed with particular care.

Priority Documentation Points

• Determine whether the app pursues a medical purpose and whether it influences clinical decision-making, and document that qualification rationale.
• Confirm CE marking status, the identity of the legal manufacturer and the compliance of all information displayed on the online platform, including claims, intended purpose wording, instructions for use and language requirements.
• Manage software versions, update notices and release history so that each distributed version matches the certified scope.
• Address cybersecurity throughout the lifecycle, including risk assessment, secure design, vulnerability handling and incident response.
• Establish mechanisms for capturing online user feedback and complaints, and integrate them into the post-market surveillance and vigilance system.
• Clarify the roles of the manufacturer, importer, distributor, authorised representative and platform operator, and confirm responsibilities for each.

Common Pitfalls

Typical errors include mechanically preparing documents against a checklist without first performing product classification, ignoring local authorised representative and labelling requirements, underestimating the volume of additional testing and translation work, and treating the certificate as a one-off achievement rather than the starting point for continuous post-market maintenance. A further risk is marketing language published on the platform that expands the intended purpose beyond the certified scope, which can trigger a reassessment of the product's classification and conformity.

AIMEILI's View

AIMEILI recommends that software and AI-enabled medical device companies carry out a regulatory qualification assessment and a claims review before the product goes live on any platform. Commercial pages that inflate functionality can raise the regulatory burden, extend timelines and, in the worst case, invalidate the existing conformity assessment. Aligning marketing content with the certified intended purpose from the outset is a cost-effective compliance measure, not a marketing constraint.

Content Review and Scope of Application

Author: AIMEILI Regulatory Editorial Team
Technical review: AIMEILI International Medical Device Registration Project Team
Source principle: Priority is given to official regulatory authorities, international organisations, standards bodies and publicly available legislative materials; industry media and project experience are used only as supporting references.
Scope of application: This article supports preliminary understanding, documentation preparation and project planning. It does not replace the formal requirements of the target country's regulatory authority, test conclusions or legal advice.