Viviana Cervieri
Cervieri Monsuárez, Montevideo, Uruguay
vivianacervieri@cmlawyers.com.uy

Jesús Urbina
Cervieri Monsuárez, Montevideo, Uruguay
jurbina@cmlawyers.com.uy

Katherin Pérez
Cervieri Monsuárez, La Paz, Bolivia
kperez@cmlawyers.com.bo

Lucía Arimón
Cervieri Monsuarez, Asunción, Paraguay
larimon@cmlawyers.com.py

Introduction

The digital transformation of the healthcare sector has generated a structural shift in the way medical devices are conceived, developed, and regulated. In this context, software with a medical purpose has acquired a central role, establishing itself as an independent regulatory category when it performs diagnostic, therapeutic, or monitoring functions without relying on a specific physical medium.

This evolution has required health authorities to adapt their traditional regulatory frameworks, originally designed for tangible devices, toward schemes capable of evaluating intangible, dynamic products subject to continuous updates. In countries such as Uruguay, Paraguay, and Bolivia, this process is developing within a scenario of progressive convergence, in which national regulations, regional frameworks, and international technical references coexist. This article aims to comparatively analyse the regulatory treatment of software as a medical device in these countries, identifying similarities, differences, and emerging trends in the region.

Conceptual framework and international technical standards

The concept of software as a medical device has been widely developed at the international level, particularly by technical organisations that have established definitions and guiding principles for its regulation. In general terms, software is considered a medical device when it has been designed with a specific medical purpose and performs that function independently, without being part of dedicated hardware.

This approach has made it possible to clearly differentiate between software that is integrated into a medical device and software that, by itself, performs clinically relevant functions. The adoption of this distinction has been key to structuring differentiated regulatory criteria, especially regarding risk classification and validation requirements.

In recent years, the development of tools based on artificial intelligence and machine learning has introduced new regulatory challenges related to performance variability, change management, and the need for continuous post-market controls. In response, technical guidelines have been established to promote good practices in the development, validation, and maintenance of medical software, serving as references for regulatory authorities and developers.

Regional regulatory convergence

The harmonisation process in Latin American countries has progressed significantly, establishing common criteria for the registration of medical devices and their essential safety and performance requirements. This process has made it possible to consolidate a risk-based approach, in which regulatory requirements increase according to the potential impact of the product on patient health.

However, the level of implementation of these criteria is not uniform among the countries reviewed in this paper. While some have fully incorporated these standards into their internal legislation, others are in intermediate stages or transition processes, creating a heterogeneous environment for companies seeking to position themselves in the region.

In this context, reference to international standards becomes particularly relevant, as it allows for technical consistency in product evaluation, even in the absence of full regulatory harmonisation.

Uruguay: a consolidated implementation model

Uruguay, although cautious in its approach to the registration of these products, presents a regulatory system that reflects a certain degree of maturity in the incorporation of regional and international criteria. Software as a medical device is evaluated under a comprehensive approach that considers its risk classification, intended purpose, and available evidence regarding its safety and performance.

During the fully digitalised registration process, technical evaluation focuses on software validation, risk management throughout its lifecycle, and the implementation of appropriate controls to ensure safe operation.

Additionally, there is a strong emphasis on aspects such as cybersecurity, version traceability, and design quality, evidencing alignment with international best practices in the regulation of medical software.

Paraguay: regulatory update and progressive adaptation

In Paraguay, the regulatory framework has undergone significant evolution in recent years. However, regarding SaMD, no substantial advances have been achieved, maintaining standards based on MERCOSUR regulations.

On the other hand, the registration mechanism distinguishes between different levels of risk, introducing simplified schemes for lower-complexity products while maintaining more robust requirements for those with greater clinical impact. This differentiation allows optimisation of evaluation timelines and encourages innovation, while preserving health control.

Regarding regulatory requirements, a case-by-case review standard is applied depending on the impact of the product in question. In this sense, although some aspects remain pending, the Paraguayan system shows a trend toward the adoption of international standards.

It is important to note that in Paraguay, software with a medical purpose is already registered for applications related to the processing and visualisation of diagnostic images, clinical decision support, and patient monitoring.

Bolivia: a system in regulatory transition

Bolivia is in a stage of regulatory transition characterised by the coexistence of a national framework and a progressive alignment process toward regional standards. In this context, software with a medical purpose does not yet have a specific regime that allows its sanitary registration.

The current system prioritises the submission of technical documentation to support the safety and performance of products, including aspects related to their operation, associated risks, and conditions of use. However, the absence of specific guidelines for SaMD creates a case-by-case evaluation scenario by the health authority.

Consequently, this does not imply a lack of control, but rather a stage of regulatory development. It is expected that, as Bolivia deepens its harmonisation with MERCOSUR, specific provisions for the registration and control of software as medical devices will be incorporated. Until then, operators are advised to anticipate these future requirements and structure their dossiers in accordance with internationally recognised standards.

Common technical and regulatory challenges

Despite differences in the level of development of regulatory systems, the three countries analysed face, each at its own pace, similar challenges in the evaluation of software as a medical device.

One of the most relevant challenges for regulators and companies can be considered to be software validation, as this aspect represents a characteristic that technically diverges from what is traditionally handled in the field of medical devices, and which must objectively demonstrate the software’s ability to fulfill its intended purpose. Accordingly, validation requires robust methodologies, including functional testing, requirements verification, and, in some cases, clinical evidence supporting its usefulness in medical practice.

Another critical aspect is risk management, particularly in an environment where software may be frequently updated. This requires the implementation of processes that allow risks to be identified, assessed, and mitigated throughout the entire product lifecycle.

Cybersecurity also constitutes a central element, given that digital systems are exposed to threats that may compromise data integrity and patient safety. In this regard, developers are expected to incorporate protection measures from the design stage, as well as monitoring and incident response mechanisms.

Finally, the advancement of technologies based on artificial intelligence introduces additional challenges related to variability in software behaviour and the need to establish continuous controls that ensure its performance over time.

Conclusions

The comparative analysis of the regulatory regime for software as a medical device in Uruguay, Paraguay, and Bolivia shows a trend toward regulatory convergence, driven both by regional harmonisation processes and the adoption of international standards.

Uruguay is well positioned in the implementation of these criteria, while Paraguay is advancing in the modernisation of its regulatory system through the incorporation of mechanisms aimed at risk-based differentiation and optimisation of registration processes.

For its part, Bolivia is undergoing a transition process which, far from representing a limitation, offers an opportunity to align its practices with global standards from early stages. In this context, the progressive alignment with MERCOSUR guidelines is particularly relevant, as it will allow, in the medium term, progress toward more harmonised schemes, potentially including the incorporation of specific frameworks for emerging technologies such as software with a medical purpose.

In this scenario, the key point is that the registration of software as a medical device can be carried out in Uruguay and Paraguay. In the case of Bolivia, it is assessed on a case-by-case basis. The main challenge for operators in the sector lies in understanding and anticipating the current regulatory requirements of the target market, adopting comprehensive approaches that include technical validation, risk management, and cybersecurity.