Software in Medical Devices, by MD101 Consulting

The IMDFR organization published in January 2024 a new document on Medical Device Software: Considerations for Device and Risk Characterization
Say briefly, this document is a gem!

The final version of the FDA guidance titled "Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions was published the 27th September 2023.

The FDA added late December 2022 IEC 81001-5-1 to the list of recognized consensus standards.
That's it. After beating around the bush on this blog on whether UL 2900-x or IEC 81001-5-1 would be applicable to 510(k) submissions and other regulatory clearances, we now have the answer.

We can use IEC 81001-5-1 as:

• A Secure Product Development Framework according to the latest draft FDA guidance on cybersecurity,
• A method of answer to GSPR on cybersecurity of EU MDR and IVDR.

A good way to make thing (a bit) more simple.

Remark: UL 2900-x can still be applied in the US!

The Manual on borderline and classification under Regulations (EU) 2017/745 and 2017/746 - Version2 - December 2022 has been published yesterday.

The MDCG published in August 2022 the MDCG 2022-14 position paper on Notified body capacity and availability of medical devices and IVDs.

The FDA issued in April a new draft guidance on Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions. This guidance will supersede the guidance on Content of Premarket Submissions for Management of Cybersecurity in Medical Devices of 2014, when it is finalized. There’s no word about the draft guidance of 2018. We can suppose that one is obsolete.

Post-Market Surveillance (PMS) is one of the strengthened requirements of the Medical Device Regulation (MDR). Performing an effective PMS can be a time consuming task, shared by several departments of MD manufacturers. This is also true for SaMD.

Medical device regulations require the manufacturers to define lifetime for their devices. In the case of SaMD, this requirement needs some interpretation.

That is the question.
MD manufacturers are pressed by end-users to implement changes. Especially SaMD, where the users are used to receiving new versions weekly or monthly. Thus, Class I MDD SaMD manufacturers are pressed to find a way to qualify their software changes as non-substantial according to the MDCG 2020-3. Otherwise, they can't deliver new versions to their end-users, blocked by the deadly MDR rule 11 and its class IIa trap.