Risk prediction models hold great promise to reduce the impact of cancer in society through advanced warning of risk and improved preventative modalities. These models are evolving and becoming more complex, increasingly integrating genetic screening data and polygenic risk scores as well as calculating risk for multiple types of a disease. However, unclear regulatory compliance requirements applicable to these models raise significant legal uncertainty and new questions about the regulation of medical devices. This paper aims to address these novel regulatory questions by presenting an initial assessment of the legal status likely applicable to risk prediction models in Canada, using the CanRisk tool for breast and ovarian cancer as an exemplar. Legal analysis is supplemented with qualitative perspectives from expert stakeholders regarding the accessibility and compliance challenges of the Canadian regulatory framework. While the paper focuses on the Canadian context, it also refers to European and U.S. regulations in this domain to contrast them. Legal analysis and stakeholder perspectives highlight the need to clarify and update the Canadian regulatory framework for Software as a Medical Device as it applies to risk prediction models. Findings demonstrate how normative guidance perceived as convoluted, contradictory or overly burdensome can discourage innovation, compliance, and ultimately, implementation. This contribution aims to initiate discussion about a more optimal legal framework for risk prediction models as they continue to evolve and are increasingly integrated into landscape for public health.