EVERBIZ · Compiled from the official text published by the Indonesian Ministry of Health
On 7 September 2026, Indonesia’s Minister of Health signed KMK HK.01.07/MENKES/951/2026, issuing the Guidelines for Marketing Authorisation of Software as a Medical Device. The decree took effect on the day it was signed, with no transition period. It applies to standalone software (SaMD), software in a medical device (SiMD) and AI medical devices — products that are already registered or under review also need attention.
1. Key dates
Key dates at a glance
| Date | What it means | Note |
|---|---|---|
| 7 Sep 2026 | Signed (Ditetapkan) = effective date | Article KEEMPAT: in force from the date of signing |
| No transition period | Registered products and products under review | The decree contains no transitional provision; check proactively |
| Within 1 year of approval | Deadline for submitting local clinical validation results | Applies only to certain imported software (see below) |
| Once a year | Routine on-site inspection | Additional unscheduled inspections are possible |
EVERBIZ note: 7 September is the date of signing and also the date of entry into force — it is not the publication date.
2. Scope
Which three types of software does KMK 951/2026 cover?
SaMD
Software as a Medical Device
- Not part of any device hardware
- Runs on computers, tablets or phones
- Includes IVD software
- e.g. blood glucose monitoring apps, ECG-based heart attack risk algorithms
SiMD
Software in a Medical Device
- Embedded as part of a device
- Not used on its own; quality system follows the host device
- e.g. MRI/CT signal processing, ventilator auto-control, pacemaker/defibrillator software
AI medical devices
incl. ML / NLP / LLM / generative AI
- Covered only if it has a medical purpose
- AI used only for administration or data storage is not covered
- e.g. medical image analysis, clinical decision support
Whether AI is regulated depends only on whether it has a medical purpose: AI whose output is used for diagnosis, monitoring or treatment decisions is a medical device; AI used only for administration or data storage is not.
3. Four core requirements
① AI/ML registration documentation
Manufacturers must describe the dataset (source, partitioning, annotation, bias), the model architecture and performance on an independent test set, the clinical evidence, and deployment and version management. Continuously learning devices must also describe update controls and rollback mechanisms; generative AI/LLM products must describe the measures used to control the risk of “hallucinations”. The software version number must be shown on the label or the user interface.
② Local clinical validation for imported software
How does “local clinical validation” work for imported software?
Triggers (either one)
- ① Data from a representative Indonesian population is used for further development and/or retraining
- ② Medium- to high-risk AI, especially for diagnosis, screening or clinical decisions
Where it can be done
- Hospitals, universities or accredited laboratories
- Ministry of Health medical device safety technical units
- Ministry of Health biomedical and genome service units
| Step | Action |
|---|---|
| 1 | Submit the marketing authorisation application |
| 2 | Run local clinical validation in parallel |
| 3 | Izin Edar (marketing authorisation) is granted |
| 4 | Submit the validation results within 1 year |
- The manufacturer’s clinical and performance evidence must be submitted; validation may run in parallel with the application
- During validation, the product may be used to a limited extent in specific situations under evaluation, provided patient safety is not put at risk
- If the results differ significantly from the original clinical evidence, administrative measures may be taken
Validation can run alongside the registration application, but the results must be submitted within 1 year of approval. If the results are clearly inconsistent with the original clinical evidence, administrative measures may follow.
③ Filing routes for software updates
After a software update: new authorisation, change approval or notification?
New marketing authorisation
Affects the indication, main function or clinical performance
- Algorithm changes affecting diagnostic or treatment functions
- Adding or removing alarms that affect patient management
- Operating system or infrastructure changes that may affect performance or safety
Change approval
Does not affect safety, effectiveness or quality
- User interface display, formatting, etc.
- Minor bug fixes
- Report format, printing, etc.
- Non-clinical functions
Notification to the Ministry of Health
Falls into neither category
- Submit the necessary data and information for further assessment by the Ministry of Health
All changes must be recorded in the quality management system.
Note: changes to the operating system or infrastructure also require a new marketing authorisation if they may affect performance or safety.
④ Licence holder obligations and post-market surveillance
- AI/ML devices must follow the 10 principles of Good Machine Learning Practice (GMLP);
- Licence holders must commit that software output data can be connected to SATUSEHAT, Indonesia’s national health data platform;
- After market entry, complaints, adverse events and cybersecurity vulnerabilities must be reported, and products are subject to a routine on-site inspection once a year.
4. EVERBIZ recommendations
- Qualify first: determine whether your product is SaMD, SiMD or not a medical device, and whether it contains AI.
- Review existing products: as there is no transition period, confirm with the authority as soon as possible how the rules apply to registered products and those under review, and complete any missing documentation.
- Plan local validation early: for imported medium- and high-risk AI products, secure a validation site before submitting the registration.
- Assess before each release: build the Indonesian change-route assessment into your software release process.
EVERBIZ · Medical device market access in Southeast Asia
To assess what KMK 951/2026 requires for your product, please contact EVERBIZ.