Market Access Germany – International DTx Guide to DiGA

By Christoph Eberhardt · CEO, DUX Healthcare · Stand 15 April 2026, revised 27 April 2026

Germany operates the most developed statutory reimbursement pathway for digital therapeutics (DTx) in the world. Through a regulatory category called DiGA (Digitale Gesundheitsanwendung – digital health application), prescription-grade software is reimbursed by statutory health insurance for roughly 73 million insured citizens. No other single market offers reimbursement for pure software at this scale today.

For international DTx companies – in the United States, United Kingdom, France, Israel, the Netherlands, the Nordics, and APAC – this creates both an opportunity and a puzzle. The opportunity is obvious: one listing, one price, one reimbursement decision, and the product is payable across the entire German statutory health insurance system. The puzzle is that the DiGA pathway was designed by German regulators for the German market. It assumes a European CE-marked medical device, German-language product and support, data processing bound to the EU or an adequacy-decision jurisdiction, and a legal manufacturer accountable under European law. None of these are impossible for a foreign company – but each requires deliberate planning.

This guide is written for the international team evaluating whether and how to enter Germany via DiGA. It covers the market opportunity, the legal architecture, the prerequisites, the application process, the evidence requirements, pricing, post-listing obligations, and an honest comparison against the regulatory pathways the team may already know – FDA SaMD, NHS DTAC, PECAN in France, mHealthBelgium. It is not a substitute for legal advice.

TL;DR

DiGA is the single most tractable European DTx entry. One BfArM decision reimburses the product across ~73 million statutory-insurance lives under § 33a SGB V and § 139e SGB V. As of end-2025 the directory holds 58 reimbursable DiGAs; 2025 alone saw nearly 700,000 prescriptions at about €171M in spending.
CE marking under MDR is the hard gate. A DiGA must be a CE-marked medical device under MDR (Regulation (EU) 2017/745). Eligible classes are I, IIa, and – since DigiG came into force on 26 March 2024 – IIb. Class III is excluded.
Legal manufacturer is the non-obvious gate. Non-EU teams hit the constraint of MDR Art. 11 – an EU-established legal manufacturer or an EU authorised representative with joint-and-several liability is required. This is the single most common reason foreign DTx teams stall at month eight.
BSI TR-03161 is certified per DiGA, not per company. Accredited-lab testing, ~€50k–€150k per DiGA, 4–6 months on the critical path; binding for filing completeness since 1 July 2025 per DiGA Guide v3.6 Sec. 3.4.
Pricing works in two phases. Manufacturer sets the price for the first 12 months; from month 13, the GKV-Spitzenverband negotiates. Across the 40 DiGAs with completed negotiations as of end-2025, the mean negotiated price was €227 per 90 days – roughly a 59 % reduction from the €544 mean manufacturer price.
Budget for a portfolio, not a file. A realistic zero-base path (no CE mark, no EU operations) is 18–30 months and €1.2M–€3M; an existing CE-marked product migrating to DiGA is 8–14 months and €400k–€1.2M; a platform-based path with a partnered legal manufacturer compresses to 6–10 months.

Why Germany – the scale of the DiGA opportunity

Germany runs a dual-payer health system. The statutory insurance system (Gesetzliche Krankenversicherung, GKV) covers approximately 73 million people – roughly 87 % of the population. The remainder are privately insured through supplementary carriers that, in practice, tend to mirror GKV reimbursement decisions. When a DiGA is listed in the DiGA-Verzeichnis (the official directory maintained by the BfArM – Bundesinstitut für Arzneimittel und Medizinprodukte, the Federal Institute for Drugs and Medical Devices), statutorily insured patients can either obtain a prescription from a physician or psychotherapist and have the app dispensed through their insurer, or – with documentation of a matching indication – receive it directly from their health insurance without a prescription. Either way, the insurer pays the listed price directly to the manufacturer under § 33a SGB V.

There is no equivalent pathway at this scale anywhere else. The United States has coverage decisions, but coverage for digital therapeutics is fragmented across Medicare, Medicaid, commercial payers, and PBMs. The NHS in the UK funds digital therapeutics through regional Integrated Care Systems, not a unified national listing, and runs NHS DTAC as an assurance framework alongside – not in place of – reimbursement routes. France’s PECAN (prise en charge anticipée numérique) is closer in spirit but smaller and early-access in character. Belgium’s mHealthBelgium framework works but covers a fraction of the German population.

The market is well past pilot stage. As of December 2025, the DiGA directory lists 58 reimbursable digital therapeutics. Since the pathway opened in late 2020, statutory insurers have dispensed approximately 1.6 million DiGA prescriptions at a cumulative cost of roughly €400 million. Volumes accelerated sharply in 2025: nearly 700,000 prescriptions that year alone, at a cost of €171 million – a 62 % year-over-year increase in spending (GKV-Spitzenverband DiGA-Bericht 2025; cross-checked against SVDGV DiGA-Report 2025). Whether this pace continues or contracts depends substantially on policy debates currently underway, but the direction so far has been steady expansion.

What a DiGA is, legally speaking

DiGA is a legal category, not a marketing label. It was created by the Digitale-Versorgung-Gesetz (Digital Health Care Act, DVG), which came into force on 19 December 2019, and is now codified primarily in § 33a SGB V and § 139e SGB V. The implementation details live in the Digitale Gesundheitsanwendungen-Verordnung (DiGAV), the ordinance issued by the Federal Ministry of Health (BMG). BfArM publishes a detailed procedural guide – the DiGA-Leitfaden v3.6 (10 December 2025) – that interprets how the ordinance will be applied in practice.

Three defining features matter for international applicants:

A DiGA must be a CE-marked medical device. The DiGA category sits on top of European medical device regulation. A product cannot enter the DiGA pathway without first qualifying as a medical device under the MDR and carrying a CE mark under MDR. Eligible risk classes are I, IIa, and – since the DigiG came into force on 26 March 2024 – IIb. Class III is excluded. Class IIb DiGAs face two additional constraints: they must demonstrate at least one medical benefit under DiGAV § 8, and the provisional listing (“fast-track”) is not available – Class IIb can only enter via a full permanent listing with a completed comparative study. The MDCG-endorsed interpretation of MDR for software qualification is set out in MDCG 2019-11 Rev.1, and MDR Annex VIII Rule 11 is the classification driver for nearly every DiGA.

A DiGA must be a “digital” health application with the product’s medical purpose realised essentially through its digital functions. Accessories to non-digital medical devices do not qualify. Nor do purely administrative, lifestyle, or prevention products that lack a regulated medical purpose.

A DiGA serves a specific set of users. The law defines the user as either the patient alone or the patient together with their treating professional. Products designed purely for professional use (clinician workflow tools, decision support that the patient never touches) do not fit.

The DiGA category is distinct from three adjacent reimbursement paths – DiPA (digital care applications under SGB XI), the Hilfsmittelverzeichnis (HMV), and the ZPP certification (digital prevention courses). The reimbursement paths cluster treats this decision in detail.

Who can apply – the legal manufacturer question

The DiGA applicant must be the legal manufacturer of the medical device, as that term is defined in MDR. This is the single requirement that most often derails international companies. The full treatment lives in Who Qualifies as a DiGA Applicant; the summary here is deliberately compact.

Under MDR Art. 2(30) and MDR Art. 10, the legal manufacturer is the entity that takes responsibility for placing the medical device on the European market. The legal manufacturer must maintain an ISO 13485-conformant Quality Management System, hold the technical documentation, conduct post-market surveillance, and accept liability for the product’s safety and performance. For manufacturers established outside the European Union, MDR Art. 11 additionally requires an Authorised Representative inside the EU – with joint-and-several liability under Art. 11(5) for defective devices where the manufacturer has not complied with Art. 10.

Two practical consequences for DiGA applicants:

Personal health data processing must reside in permitted jurisdictions. Under DiGAV § 4 para. 3, processing is allowed in Germany, EU member states, EEA-equivalent countries (including Switzerland), and third countries covered by a European Commission adequacy decision under GDPR Art. 45. The latter includes the United States under the EU–US Data Privacy Framework, subject to specific contractual and technical controls. In practice, most DiGA applicants choose EU-region hosting (AWS Frankfurt, Azure Germany, or comparable services with C5 attestation) because it materially simplifies the BfArM review and avoids re-litigating data residency every time Schrems or successor case law evolves.

The product must be operable in German – not merely translated, but localised for the German healthcare context. This includes UI, patient education content, consent language that matches German medical law, clinical terminology aligned with German coding systems, and customer support available in German.

A foreign company can become the legal manufacturer itself if it meets MDR requirements and operates with a competent EU Authorised Representative. Alternatively, many international DTx companies enter Germany through a partnered legal manufacturer model: the foreign company retains ownership of the product and the clinical asset, while a German or EU-based partner assumes the legal manufacturer role, the ISO 13485 QMS, and regulatory liability. This is the model DUX Healthcare supports through a certified partner, and it materially shortens the path to a German listing.

The prerequisites – what must be in place before applying

Six prerequisites must be in place before a DiGA application is filed:

CE marking under MDR. With a Notified Body certificate for Class IIa and IIb. Conformity assessment under MDR Annex IX or Annex XI is the standard route.
ISO 13485-conformant QMS. The QMS that the Notified Body will audit as part of MDR conformity assessment. ISO 13485 certification is the harmonised path; “ISO 9001 compliant” does not pass.
ISO 27001 (or BSI IT-Grundschutz, or equivalent) ISMS at the organisation level, accredited. Required for DiGA listings since 1 April 2022.
BSI TR-03161 certificate per DiGA. Application-relevant since 1 July 2025 under § 139e Abs. 10 SGB V. Three parts: mobile (Part 1 v3.0), web (Part 2 v2.0), backend (Part 3 v2.0). Outcome can be ohne Auflagen (without conditions) or mit Auflagen (with conditions).
BfArM data-protection criteria (Annex 1 DiGAV), declared with the application. Roughly 150 testable criteria across 12 thematic blocks. Binding since 1 August 2024 through DiGAV § 4 Abs. 8; formal third-party certification by an accredited ISO/IEC 17065 body is not yet operational because no body has been DAkkS-accredited for this purpose. Once accreditation is in place, BfArM will require formal certificates with appropriate lead time.
GDPR DPIA, German localisation, ePA interface plan, evidence package in place.

The controller under GDPR Art. 4 No. 7 is the manufacturer of the DiGA – not a platform service provider. DUX implements the technical requirements (TOM_, AV_1.3 TOMs, ACC_, pseudonymisation, access control, logging, deletion) on the platform side and supports operationally; the process-side obligations (DSB appointment, EU representative under Art. 27 GDPR where the controller is not established in the EU, processor agreements with sub-processors, DSFA review cadence) remain with the manufacturer.

The application process

The BfArM process has three formal steps:

Filing. Twenty-six content blocks per DiGAV § 2 – the clinical evaluation, the CE certificate, the BSI TR-03161 data-security certificate, the penetration test report, the GDPR DPIA, the study or evaluation concept, the ePA interface specification, the AbEM integration, the price declaration, and the rest.
Formal completeness check. BfArM verifies that the 26 blocks are present and structurally complete. Incomplete filings receive a deadline of up to three months to remedy under DiGAV § 16 Abs. 2.
Substantive review and decision. Three months from the point of administrative completeness (§ 139e Abs. 3 SGB V); extendable by up to three further months in justified cases. Outcome is permanent listing, provisional listing for Class I/IIa (the Erprobung trial track), or rejection.

For Class IIa preliminary listing, the trial period is typically 12 months (extendable to 24); the comparative study runs in parallel and must demonstrate the claimed positive care effect by the end of the trial. Class IIb has no preliminary route – the comparative study must be complete pre-filing.

Evidence – positive care effects and AbEM

The substantive evidence requirement is positive care effects (PVE) under DiGAV § 8. Two PVE categories: medical benefits (improvements in clinical outcomes) and patient-relevant structural and procedural improvements. At least one PVE must be demonstrated; Class IIb requires a medical benefit specifically.

The standard evidence vehicle is a prospective comparative study under DiGAV § 10 – typically a randomised controlled trial against usual care, registered in advance with a pre-specified statistical analysis plan, designed to detect a clinically meaningful minimum difference at adequate power. Studies conducted in the US or UK can be cited but their generalisability to the German healthcare context must be argued explicitly per DiGA-Leitfaden v3.6 Sec. 4.3.9; many applicants run an additional German study during the trial period to strengthen the case for the subsequent price negotiation.

From 1 January 2026 the AbEM (Anwendungsbegleitende Erfolgsmessung – application-accompanying success measurement) layers on top of the PVE study. AbEM phases in across three stages – usage data from 1 July 2026, PGI-C and patient satisfaction from 1 July 2027, indication-specific PROMs from 1 July 2028 – with the first BfArM submission due 15 April 2027. The same data feed the 20 % outcomes-linked price share under § 134 SGB V.

Pricing

Year-1 manufacturer-set prices currently range from €119 to €2,077 per 90-day prescription, with an average around €544 per GKV-Spitzenverband 2025 data. From month 13, prices are negotiated with the GKV-Spitzenverband; the mean negotiated price across the 40 DiGAs with completed negotiations at end-2025 was €227 per 90 days – roughly a 59 % reduction from the manufacturer-set mean. From 1 January 2026, at least 20 % of the negotiated price must be tied to outcome parameters per § 134 SGB V – the AbEM data above will feed that calculation.

This single month-13 repricing event is the biggest commercial-model discontinuity in the DiGA lifecycle. A business case modelled on first-year manufacturer-set pricing is modelling 12 months of revenue, not a steady state. Listings with strong RCT evidence tend to hold their prices better in negotiation; weaker-evidence listings typically face material reductions.

Honest comparison – DiGA vs. FDA SaMD vs. NHS DTAC vs. PECAN

Each pathway answers a different question:

Dimension	DiGA (DE)	FDA SaMD (US)	NHS DTAC (UK)	PECAN (FR)
Decision type	Combined regulatory + reimbursement	Marketing authorisation only	Assurance framework	Early-access reimbursement
Reimbursement	Statutory, ~73M lives	Fragmented (Medicare/Medicaid/private/PBM)	Local (ICS-led)	Statutory, time-limited
Hard prerequisite	CE under MDR	FDA clearance/De Novo/PMA	DTAC self-assessment	CE under MDR + HAS dossier
Cybersecurity	BSI TR-03161 per DiGA	§ 524B FD&C Act submission item	Part of DTAC criteria	National + EU rules
Evidence bar	Comparative RCT (DiGAV § 10)	Pathway-dependent	NICE ESF tiered	CNEDiMTS principles
Local data residency	EU/EEA + adequacy	None	Information-governance	EU/EEA
Realistic timeline (zero-base)	18–30 months	12–24 months	6–12 months	12–24 months

What transfers well across pathways: ISO 13485 QMS maturity, IEC 62304 lifecycle discipline, ISO 14971 risk management, software architecture and verification/validation documentation, and – with care – clinical evidence. What does not transfer: the CE mark itself (must be done under MDR), BSI TR-03161 (no equivalent outside Germany), the BfArM data-protection criteria (no equivalent), and German localisation. The DiGA vs. FDA SaMD cluster article walks the translation exercise in detail.

Frequently asked questions

Can a company based outside the EU apply for a DiGA listing?

Yes, but not directly. The applicant must be the legal manufacturer of the medical device under MDR and – under MDR Art. 11 – a non-EU manufacturer must designate an EU-based authorised representative with joint-and-several liability. The applicant does not need to be established in Germany, but the product must satisfy all German-specific requirements (language, data residency, BSI TR-03161 per DiGA, BfArM Datenschutzkriterien). Many foreign applicants enter through a partnered legal manufacturer model to simplify the EU regulatory footprint.

Does FDA clearance shorten the path to DiGA listing?

Partially. FDA clearance does not substitute for CE marking under MDR, which is a hard prerequisite for DiGA. However, the clinical evidence, risk management file (ISO 14971), software lifecycle artefacts (IEC 62304), and intended-use framing developed for FDA can often be adapted into the CE-MDR clinical evaluation and the DiGA evidence package, reducing duplication. Plan to still generate German-specific evidence where generalisability questions arise.

What is the minimum realistic timeline from decision to DiGA listing?

For a company with an existing CE-marked product, 8–14 months. For a company starting from scratch, 18–30 months. Using a platform-based approach with pre-validated modules and a partnered legal manufacturer, 6–10 months is achievable. These are production-ready ranges, not best-case theoreticals.

Can we host a DiGA on AWS US or other non-EU infrastructure?

DiGAV § 4 para. 3 permits processing in Germany, other EU member states, EEA countries, Switzerland, and third countries covered by an EU adequacy decision under Article 45 GDPR – which currently includes the United States under the EU-US Data Privacy Framework, subject to appropriate safeguards. In practice, most DiGA applicants choose EU-region hosting (AWS Frankfurt, Azure Germany, or comparable services) with C5 attestation because it materially simplifies the BfArM review and avoids re-litigating data residency every time Schrems or successor case law evolves.

What is BSI TR-03161 and how does it compare to SOC 2 or ISO 27001?

BSI TR-03161 is a DiGA-specific security guideline certified per DiGA by accredited test labs on behalf of the German Federal Office for Information Security. It defines technical security requirements for mobile apps (TR-03161-1), web applications (TR-03161-2), and backends (TR-03161-3). SOC 2 and ISO 27001 focus on organisational controls and overlap partially with BSI TR-03161 preparation work, but neither substitutes for it. A DiGA without a BSI TR-03161 certificate cannot complete the BfArM filing.

Do we need to support integration with the German electronic patient record (ePA)?

Yes – with statutory deadlines. DiGAs must be capable of transmitting relevant data to the ePA on patient request, using the standardised interface. The specific obligations are codified in DiGAV § 6a and § 355 SGB V, with the GesundheitsID framework in § 291 SGB V and § 327 SGB V. Products that miss the applicable deadlines risk delisting.

Can we use a study conducted in the US or UK to support a DiGA application?

It can be included and cited. Whether it is sufficient depends on the strength of the evidence and how convincingly generalisability to the German healthcare context is argued per DiGA-Leitfaden v3.6 Sec. 4.3.9. Many applicants plan an additional German study – often as part of the provisional listing trial period – to strengthen the case and support the subsequent GKV price negotiation.

What are typical DiGA prices?

Year-1 manufacturer-set prices currently range from €119 to €2,077 per 90-day prescription, with an average around €544 per GKV-Spitzenverband 2025 data. From month 13, prices are negotiated with the GKV-Spitzenverband; the mean negotiated price across the 40 DiGAs with completed negotiations at end-2025 was €227 per 90 days – roughly a 59 % reduction from the manufacturer-set mean. Listings with strong RCT evidence tend to hold their prices better in negotiation; weaker-evidence listings typically face material reductions.

What happens if the study fails at the end of the provisional listing period?

If the comparative study does not demonstrate the claimed positive care effect by the end of the trial period (typically 12 months, up to 24 in justified cases), BfArM removes the DiGA from the directory. The manufacturer may reapply with revised evidence. As of end-2025, 16 of the 74 DiGAs ever listed (22 %) had been delisted – all of them originally provisional listings. Framed as a pass rate across completed trials, roughly 70 % of provisionally listed DiGAs that have finished their trial period successfully transitioned to permanent listing – a figure SVDGV (industry) emphasises and GKV-Spitzenverband (payer) contests.

Can DUX act as our legal manufacturer in Germany?

Yes, through a certified regulatory partner. This model allows international DTx companies to enter Germany without building their own German legal entity and MDR-compliant ISO 13485 QMS. The team retains ownership of the clinical asset and the brand; the partner assumes the MDR legal manufacturer role and the associated regulatory responsibilities under Art. 10 and 11.

This guide is the overview. The deeper treatments live in the international-markets cluster and the DiGA knowledge area:

Who qualifies as a DiGA applicant – legal manufacturer under MDR Art. 11, EU authorised representative, three realistic entry routes.
DiGA vs. FDA SaMD – what translates from a US SaMD mindset, what does not.
EU DTx Market Map 2026 – Germany, France, Belgium, Netherlands, Austria, Italy, Switzerland, UK, Nordics, Spain compared.
International Market Access overview – the practitioner overview for cross-border DTx.
DiGA knowledge area – the German-market DiGA reference, in depth.

Practitioner take

Thirty minutes. Your DiGA path. An honest assessment.

Not a sales funnel. A conversation about the product already in hand, the regulatory position already carried, the evidence already on hand or needed, and whether a DiGA entry – platform-based or custom – fits the timing. If DiGA is the right first move, that is what is said. If not, that is said too.

Book a 30-min call with Christoph