MDCG 2025-4: Medical device software apps on online platforms, explained

Who this applies to

This guidance applies to manufacturers offering medical device software (MDSW) through app stores, software marketplaces or other online platforms. It also applies to platform operators, including platforms established outside the EU, and to economic operators deciding who performs the importer or distributor role.

The guidance reads the MDR and IVDR together with the Digital Services Act (DSA). The two regimes do different jobs: the MDR/IVDR governs the device and its supply chain, while the DSA governs the platform's intermediary service, trader traceability, notices about illegal content and the way listings are presented.

Uploading an app is placing it on the market

When a manufacturer uploads an MDSW app to an online platform so EU users can obtain it, that is placing the device on the market. Making the app available through the platform is a supply of the device, even when it is free of charge.

The delivery mechanism does not dilute the manufacturer's obligations. The app still needs the correct conformity assessment, CE marking, UDI where applicable, registration, labelling and instructions. Updates also remain regulated device changes; calling them “app updates” does not create a separate, lighter pathway.

Is the platform an intermediary, distributor or importer?

The platform's role depends on what it actually does, not what its terms and conditions call it.

A platform that remains an intermediary still has DSA responsibilities. These can include verifying and displaying trader information, providing notice-and-action mechanisms, designing the interface so traders can supply required compliance information, and making reasonable efforts to check that information. Very large online platforms also have additional systemic-risk duties.

For a non-EU manufacturer, the usual authorised-representative requirement remains. The existence of an app store does not fill that role.

What the product page should show

The guidance expects users to receive essential device information before they decide to download the app. A medical-device listing should make the following readily accessible:

• the device name or trade name;
• the manufacturer's name, address and Single Registration Number (SRN), where applicable;
• whether it is a medical device or IVD, together with its indication and intended purpose;
• warnings, contraindications and other information needed for safe use;
• a link to the electronic instructions for use;
• the UDI-DI;
• where applicable, the authorised representative, notified-body identification number and certificate information; and
• operating-system, hardware and information-security requirements needed to run the software safely.

Platforms should distinguish medical device apps from generic health, wellness and lifestyle products. A dedicated medical-device category and filters make the regulatory status clearer and reduce the risk that users treat an unregulated wellness app as equivalent to CE-marked MDSW.

What this means for you, practically

1. Map the transaction, not just the interface. Record who contracts with the user, who grants the licence or access right, who receives payment, and who first supplies a third-country app in the EU. That determines the economic-operator roles.
2. Build a release gate for store listings. Do not let marketing upload screenshots and a short description without regulatory review. The listing is part of how the device is placed and presented on the market.
3. Create a minimum listing dataset. Store the intended purpose, manufacturer and authorised-representative details, UDI-DI, certificate data, eIFU link, warnings and technical requirements in a controlled source that can feed every platform.
4. Plan app updates through change control. Assess whether each release affects intended purpose, performance, cybersecurity, clinical evidence, UDI data or conformity assessment before it reaches the store.
5. Contract for platform cooperation. Your agreement should cover listing corrections, complaint and incident forwarding, recalls or access restriction, records, cybersecurity notices and the speed at which unsafe software can be removed.