Opportunities and challenges for DiGA manufacturers
Since 2020, individuals with public health insurance have been entitled to digital health applications, known as “apps on prescription.” Since then, the regulatory framework has been refined several times: through the Digital Healthcare and Care Modernization Act (DVPMG), the Digital Act (DigiG), and most recently with the amended Digital Health Applications Regulation (DiGAV), which takes effect on February 1, 2026. Anyone looking to bring a DiGA or DTx to the German market today must consider not only clinical trials and conformity assessment but also performance measurement, price negotiations, and market realities. Here are the six most important facts, updated to reflect the current situation.
The legal framework for DiGA: Three levels
DiGA is established as a separate service category in the GKV service catalog. The regulations are organized into three levels:
- Law: SGB V governs entitlement to benefits (Section 33a SGB V), the BfArM approval process, the DiGA directory (Section 139e SGB V), and reimbursement (Section 134 SGB V).
- Regulation: The Federal Ministry of Health’s DiGAV specifies the requirements for security, quality, data protection, interoperability, and evidence of positive healthcare outcomes. The changes effective as of February 1, 2026, primarily concern the measurement of outcomes during application, an expanded definition of benefit, and simplified change notifications.
- Guidance: The BfArM’s DiGA Guidance explains the fast-track procedure in practice and serves as the most important working document for manufacturers.
What types of products can be considered DiGA?
A DiGA is a medical device whose primary function relies substantially on digital technologies. The medical purpose must be achieved primarily through this primary digital function. Simply reading data from or controlling a device is not sufficient. An overview of the most important requirements:
- Risk class: Since the enactment of the DigiG, Class IIb products have been eligible in addition to Class I and IIa medical devices. However, Class IIb products are not eligible for clinical trials.
- Intended use: The DiGA supports the detection, monitoring, treatment, or alleviation of diseases, or the detection, treatment, alleviation, or compensation for injuries or disabilities. Applications intended solely for primary prevention are excluded.
- Indications: In the application, you must specify the patient groups using ICD-10-GM codes. Reimbursement is provided only for these indications.
- Access: The DiGA is prescribed by a physician or psychotherapist, or approved by the health insurance provider upon demonstration of a valid medical indication.
The process: How to get your DiGA listed in the directory
The application for inclusion in the DiGA directory is submitted electronically to the BfArM. The manufacturer, as defined by medical device law, is eligible to submit the application. You should allow three months for the evaluation once the application is complete; in justified individual cases, up to three additional months may be required.
- Permanent inclusion: a prerequisite is the completion of a comparative study demonstrating a positive effect on care.
- Provisional approval for testing: If verification isnot yet possible, the DiGA may be approved for testing for up to twelve months (risk classes I and IIa only). The testing period may be extended by up to twelve months. All requirements regarding safety, quality, data protection, and data security must be met at the time of application, and you must have a scientific evaluation plan prepared by a manufacturer-independent institution.
- After a rejection: If permanent admission isdenied following a trial period, a new application may be submitted no sooner than twelve months later and only with new supporting documentation.
- Changes: You must report significant changes to the BfArM. Starting in February 2026, minor and editorial changes may be reported in batches up to four times a year. Changes affecting pricing and reimbursement must still be reported immediately.
Safety, quality, privacy, and data security
Safety and functionality are generally considered to be demonstrated by the CE marking. In addition, the DiGAV requires quality characteristics such as interoperability, robustness, consumer protection, accessibility, and user-friendly operation. The most significant changes have occurred in the areas of data protection and data security:
- Certificates instead of self-declarations:The previous manufacturer’s declaration is no longer sufficient. As of August 1, 2024, a certificate is required for data protection (Section 139e(11) of Book V of the Social Code), and, for data security, a certificate from the BSI in accordance with Technical Guideline BSI TR-03161 has been required since January 1, 2025 (Section 139e(10) of the German Social Code, Book V).
- Cloud: The processing of health data in the cloud is also subject to the requirements for a C5 certification from the BSI.
- Artificial Intelligence: Applicants must indicate whether their digital health application (DiGA) falls under the EU AI Regulation. If so, the regulation’s requirements regarding data quality, transparency, and risk management also apply.
Our recommendation: Plan for security and privacy by design from the very beginning. Obtaining certifications after the fact takes significantly more time and money.
The Legal Framework for DiGA: Three Levels
DiGA is established as a separate service category in the GKV service catalog. The regulations are organized into three levels:
- Law: SGB V governs entitlement to benefits (Section 33a SGB V), the BfArM approval process, the DiGA directory (Section 139e SGB V), and reimbursement (Section 134 SGB V).
- Regulation: The Federal Ministry of Health’s DiGAV specifies the requirements for security, quality, data protection, interoperability, and evidence of positive healthcare outcomes. The changes effective as of February 1, 2026, primarily concern the measurement of outcomes during application, an expanded definition of benefit, and simplified change notifications.
- Guidance: The BfArM’s DiGA Guidance explains the fast-track procedure in practice and serves as the most important working document for manufacturers.
What Types of Products Can Be Considered DiGA?
A DiGA is a medical device whose primary function relies substantially on digital technologies. The medical purpose must be achieved primarily through this primary digital function. Simply reading data from or controlling a device is not sufficient. An overview of the most important requirements:
- Risk class: Since the enactment of the DigiG, Class IIb products have been eligible in addition to Class I and IIa medical devices. However, Class IIb products are not eligible for clinical trials.
- Intended Use: The DiGA supports the detection, monitoring, treatment, or alleviation of diseases, or the detection, treatment, alleviation, or compensation for injuries or disabilities. Applications intended solely for primary prevention are excluded.
- Indications: In the application, you must specify the patient groups using ICD-10-GM codes. Reimbursement is provided only for these indications.
- Access: The DiGA is prescribed by a physician or psychotherapist, or approved by the health insurance provider upon demonstration of a valid medical indication.
The Process: How to Get Your DiGA Listed in the Directory
The application for inclusion in the DiGA directory is submitted electronically to the BfArM. The manufacturer, as defined by medical device law, is eligible to submit the application. You should allow three months for the evaluation once the application is complete; in justified individual cases, up to three additional months may be required.
- Permanent inclusion: a prerequisite is the completion of a comparative study demonstrating a positive effect on care.
- Provisional approval for testing: If verification isnot yet possible, the DiGA may be approved for testing for up to twelve months (risk classes I and IIa only). The testing period may be extended by up to twelve months. All requirements regarding safety, quality, data protection, and data security must be met at the time of application, and you must have a scientific evaluation plan prepared by a manufacturer-independent institution.
- After a rejection: If permanent admission isdenied following a trial period, a new application may be submitted no sooner than twelve months later and only with new supporting documentation.
- Changes: You must report significant changes to the BfArM. Starting in February 2026, minor and editorial changes may be reported in batches up to four times a year. Changes affecting pricing and reimbursement must still be reported immediately.
Safety, Quality, Privacy, and Data Security
Safety and functionality are generally considered to be demonstrated by the CE marking. In addition, the DiGAV requires quality characteristics such as interoperability, robustness, consumer protection, accessibility, and user-friendly operation. The most significant changes have occurred in the areas of data protection and data security:
- Certificates instead of self-declarations:The previous manufacturer’s declaration is no longer sufficient. As of August 1, 2024, a certificate is required for data protection (Section 139e(11) of Book V of the Social Code), and, for data security, a certificate from the BSI in accordance with Technical Guideline BSI TR-03161 has been required since January 1, 2025 (Section 139e(10) of the German Social Code, Book V).
- Cloud: The processing of health data in the cloud is also subject to the requirements for a C5 certification from the BSI.
- Artificial Intelligence: Applicants must indicate whether their digital health application (DiGA) falls under the EU AI Regulation. If so, the regulation’s requirements regarding data quality, transparency, and risk management also apply.
Our recommendation: Plan for security and privacy by design from the very beginning. Obtaining certifications after the fact takes significantly more time and money.
Positive effects on care and success measurement during treatment
Demonstrating positive effects on care remains the biggest hurdle. Possible benefits include medical benefits or patient-relevant improvements in structure and procedures (Section 8 of the DiGAV). Under the amended DiGAV, the contribution to maintaining the ability to work is also recognized as a separate benefit pathway.
What’s new is that the verification process no longer ends with approval. Under the in-use effectiveness measurement (AbEM) requirement, all permanently listed digital health applications (DiGA) must collect data in a structured manner; this requirement will be phased in starting in 2026:
- Data collected includes: duration of use and discontinuations, patient-reported changes in health status, and satisfaction. Starting in 2028, indication-specific, validated questionnaires will be added.
- When: At the beginning and end of use; for extended use, limited to 90 days.
- Where: The results are sent to the BfArM, which publishes them, and to the GKV-Spitzenverband. Participation in surveys is voluntary for patients.
For you, this means that AbEM must be factored into product design, data architecture, and data protection strategies. Weak usage and performance data will become publicly visible in the future and will affect your position in price negotiations.
Compensation for DiGA Manufacturers and Market Realities
For DiGA, the health insurance provider reimburses the manufacturer; prices apply per prescription. In the first year following inclusion, the manufacturers’ actual prices apply, subject to any group-specific maximum amounts, which take effect only if a DiGA has been dispensed at least 2,000 times in the first year (reported every 90 days). Thereafter, a reimbursement amount agreed upon with the GKV-Spitzenverband or set by the arbitration board applies.
The difference is significant. According to the 2025 GKV report, the average manufacturer’s price for the 40 DiGA that had already been negotiated or set by the arbitration board was 552 euros, while the negotiated amount was 227 euros—about 59 percent less. Across all DiGA devices since 2020, manufacturer prices range from 119 to 2,077 euros. In the calendar year 2025, health insurance funds spent 171.3 million euros on 695,000 redeemed codes.
In addition, there are statutory deductions and performance-based components:
- Performance-based price components: As of January 1, 2026, they must account for at least 20 percent of the total compensation amount. This applies to the total compensation amount starting in the second year, not to the manufacturer’s price in the first year.
- Volume-based discounts: Effective January 1, 2027, the compensation agreement must provide for a discount of at least 2 percent for more than 3,000 transactions per year and at least 30 percent for more than 100,000.
Positive effects on care and success measurement during treatment
Demonstrating positive effects on care remains the biggest hurdle. Possible benefits include medical benefits or patient-relevant improvements in structure and procedures (Section 8 of the DiGAV). Under the amended DiGAV, the contribution to maintaining the ability to work is also recognized as a separate benefit pathway.
What’s new is that the verification process no longer ends with approval. Under the in-use effectiveness measurement (AbEM) requirement, all permanently listed digital health applications (DiGA) must collect data in a structured manner; this requirement will be phased in starting in 2026:
- Data collected includes: duration of use and discontinuations, patient-reported changes in health status, and satisfaction. Starting in 2028, indication-specific, validated questionnaires will be added.
- When: At the beginning and end of use; for extended use, limited to 90 days.
- Where: The results are sent to the BfArM, which publishes them, and to the GKV-Spitzenverband. Participation in surveys is voluntary for patients.
For you, this means that AbEM must be factored into product design, data architecture, and data protection strategies. Weak usage and performance data will become publicly visible in the future and will affect your position in price negotiations.
Compensation for DiGA Manufacturers and Market Realities
For DiGA, the health insurance provider reimburses the manufacturer; prices apply per prescription. In the first year following inclusion, the manufacturers’ actual prices apply, subject to any group-specific maximum amounts, which take effect only if a DiGA has been dispensed at least 2,000 times in the first year (reported every 90 days). Thereafter, a reimbursement amount agreed upon with the GKV-Spitzenverband or set by the arbitration board applies.
The difference is significant. According to the 2025 GKV report, the average manufacturer’s price for the 40 DiGA that had already been negotiated or set by the arbitration board was 552 euros, while the negotiated amount was 227 euros—about 59 percent less. Across all DiGA devices since 2020, manufacturer prices range from 119 to 2,077 euros. In the calendar year 2025, health insurance funds spent 171.3 million euros on 695,000 redeemed codes.
In addition, there are statutory deductions and performance-based components:
- Performance-based price components: As of January 1, 2026, they must account for at least 20 percent of the total compensation amount. This applies to the total compensation amount starting in the second year, not to the manufacturer’s price in the first year.
- Volume-Based Discounts: Effective January 1, 2027, the compensation agreement must provide for a discount of at least 2 percent for more than 3,000 transactions per year and at least 30 percent for more than 100,000.
Conclusion
DiGA remains the only way to integrate digital therapy into standard care nationwide for all individuals insured under statutory health insurance. However, the requirements have become significantly more stringent: certifications for data protection and data security, ongoing effectiveness monitoring, and reimbursement that decreases noticeably starting in the second year and is partly contingent on success. Successful providers are those who integrate regulatory compliance, evidence, data strategy, and the business case from the very beginning.
How BAYOOMED supports you
BAYOOMED has already supported numerous DiGA and DTx projects from concept to market entry: from defining the intended use, through MDR- and IEC 62304-compliant development, security in accordance with BSI TR-03161, and preparation of the AbEM, all the way to the BfArM application. Together with our partner HEPICC, we also support you with market access, pricing strategy, and negotiations with the GKV-Spitzenverband.