Getting classification right: Why remote monitoring safety depends on using the right level of medical device assurance

Chris Malone, commercial business lead at Luscii, argues that classification is often overlooked despite being the foundation of safe digital care.

“Classification isn’t an administrative detail; it’s the foundation of patient safety,” he says. “If a platform is being used to support clinical decision-making, issue alerts or guide escalation, then it should be regulated to the level that reflects those risks.

“When classification and real-world use don’t match, you create a dangerous gap between how safe the product actually is and how safe people assume it is. That’s where avoidable harm can occur.”

One of the most common problems is the deployment of a lower-classified device for higher-risk clinical activities. Mr Malone explains that this is rarely intentional, but risk creeps in when the regulatory foundation isn’t aligned with actual use.

The consequences can be significant. Clinicians may rely on information or alerts that have not been validated to medical-device standards. Delays or inaccuracies carry far more danger when the system hasn’t been assessed for its intended clinical role.

Organisationally, liability can shift towards the NHS provider if the technology is used outside its certified scope. Governance safeguards such as change control, incident reporting and post-market surveillance are also far stronger in Class IIa than in Class I.

Understanding classification, therefore, matters, and this starts with clarity about what Class IIa represents. Joris Janssen, Luscii’s co-founder and global lead, explains: “When a platform is certified as a Class IIa medical device, as Luscii is, it stops being a wellness tool and becomes part of the clinical workflow.

“That certification means the technology has demonstrated clinical benefit, that its risks are managed to an acceptable level, and that a notified body has independently assessed its safety, performance, cybersecurity and data integrity.

“A Class IIa device can support clinical decision-making, but it must stay within well-defined, lower-risk boundaries. It can’t make autonomous high-risk diagnoses. That’s the whole point of classification: it defines the responsibility, the safeguards and the limits.”

In Luscii’s case, the Class IIa certified medical device is Luscii vitals, which is the clinical engine responsible for analysing patient data, generating alerts and prioritising patients. The surrounding apps and dashboards are user interfaces, not medical devices in their own right.

One area where precision is essential is the use of terms like “continuous monitoring” or “real-time insights”. These phrases carry clear regulatory implications. In medical-device regulation, continuous monitoring refers to moment-to-moment physiological surveillance and is associated with Class IIb, not IIa.

NHS leaders can validate supplier claims by checking three elements:

• The device’s intended use statement;
• The clinical evaluation documentation; and
• Whether a notified body has assessed the system.

If a capability does not appear in the regulated documentation, it is not an approved feature of the device.

Staying aligned with the certified intended use is an ongoing responsibility. As Mr Janssen notes: “For a Class IIa device, staying aligned with the intended use is a continuous responsibility, not something you check once and forget. You must operate a full ISO 13485 quality system, run continuous risk analysis, maintain detailed technical documentation and monitor real-world performance. Even marketing must be regulated – you can only make claims backed by clinical evidence.”

As regulations evolve, from UK MDR 2002 to the UKCA transition, suppliers and NHS providers must work together to maintain safe, compliant services. Mr Malone highlights the importance of partnership.

He agrees that collaboration is essential: “Some of our smoothest deployments have occurred when our partner NHS organisations and the Luscii team create joint governance forums, reviewing safety information, planned updates and post-market data together. It keeps both sides aligned and ensures the service remains safe and resilient even as the regulatory landscape shifts.”

Scaling remote monitoring safely requires governance frameworks that expand alongside clinical adoption. Defined pathways, clear escalation protocols and regular review of alert activity and patient outcomes help keep services within safe, intended use. Higher-class devices also bring structured safeguards such as continuous risk management, vigilance reporting and regulated change control.

As remote monitoring continues to scale, the NHS needs technologies whose regulatory foundations match their clinical role. Using devices within their intended use is not a constraint; it’s what protects patients, gives clinicians confidence and supports safe, sustainable service models. Getting classification right creates the conditions for digital care that can be trusted, expanded and relied upon across the system.