Software in Medical Devices, by MD101 Consulting

The FDA issued in April a new draft guidance on Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions. This guidance will supersede the guidance on Content of Premarket Submissions for Management of Cybersecurity in Medical Devices of 2014, when it is finalized. There’s no word about the draft guidance of 2018. We can suppose that one is obsolete.

Post-Market Surveillance (PMS) is one of the strengthened requirements of the Medical Device Regulation (MDR). Performing an effective PMS can be a time consuming task, shared by several departments of MD manufacturers. This is also true for SaMD.

Medical device regulations require the manufacturers to define lifetime for their devices. In the case of SaMD, this requirement needs some interpretation.

That is the question.
MD manufacturers are pressed by end-users to implement changes. Especially SaMD, where the users are used to receiving new versions weekly or monthly. Thus, Class I MDD SaMD manufacturers are pressed to find a way to qualify their software changes as non-substantial according to the MDCG 2020-3. Otherwise, they can't deliver new versions to their end-users, blocked by the deadly MDR rule 11 and its class IIa trap.

The Australian Regulatory changes for software based medical devices took effect from 25th February 2021.

After the MDCG guide 2019-11 for the MDR, the MDCG 2020-16 gives the regulatory oversight on In-Vitro Diagnostic medical devices (IVD MD) classification; including software qualified as IVD MD. Let's see the consequences for software.

While the winds of Covid are blowing a bad air on Europe, the UK MHRA published in September 2020 the guidance on regulatory status of medical devices, IVD and AIMD from 1 January 2021.

So we have a new guidance on cybersecurity for medical devices: the MDCG 2019-16. This is not the one we expected so quickly, but we're not going to complain about the existence of this guidance! It was published in December 2019. At last I found time to write a review.
This guidance covers a broad range of topics applicable to all stakeholders in the medical device supply chains, and to end-users. It explains a bit why it is 46 pages long.

Here we are! White smoke over the European Parliament! The MDCG 2019-11 guidance on qualification and classification of medical device software (MDSW) was published the 11th of October 2019.