Software in Medical Devices, by MD101 Consulting

What doesn't change

Let's begin with the occurrences of the "software" word in the standard, which don't change:

• 7.5.2 Validation of processes for production and service provision: software shall be validated
• 7.6 Control of monitoring and measuring equipment: software used in monitoring and measuring equipment shall be controlled.

Changes in device technical files and design records

The new version of the standard clarifies what medical devices technical files shall contain:

• New sub-clause 4.2.1.2 in Documentation requirements: For each type or model of medical device, the organization shall establish and maintain a file (...) b) product specifications including drawings, composition, formulation, component specifications and medical device software specifications

The new version clarifies also which records should be found in software design:

• New clause 7.3.9: Design and development records: Records resulting from the design and development activities shall be clearly identified and maintained in the design and development file

And the Note below this new clause :

• This(ese) file(s) can include, but is(are) not limited to: (...) f) software verification and validation describing the software design and development process and evidence of the validation of the software (...)

More generally, the new version of the standard adds a reference to IEC 62304:

• In the clause 7.1 Planning of product realization, a fourth paragraph is added in notes:
  • 3) See ISO 14971 for guidance related to risk management
  • 4) See IEC 62304 for guidance related to software life cycle processes

This is probably the biggest change of ISO 13485 for software as a medical device or medical device containing software.
IEC 62304 becomes almost mandatory in this version of the standard, by being quoted like ISO 14971.

Would you dare miss ISO 14971?
No?
So, guess what about IEC 62304!

Changes have a larger spectrum

In this post, I focussed only on the changes related to software. But the new version of the standard clarifies and strengthens requirements about all processes involved in the lifecycle of all types medical devices.
For example:

• The clause 7.3.9 clarifies what is needed in Design and development records,
• The sub-clause 4.2.1.2 clarifies what is needed in the technical file of a medical device
• A new clause 7.3.7 Design and Development Transfer was added before Control of design and development changes, perhaps to make ISO 13485 more compliant with 21 CFR 820.

Likewise, chapters 4 (for example documentation requirements), 5, 6 (for example human resources) and 8 (for example complaints handling) are deeply modified.

Coming back to software related requirements in the new version of ISO 13485: if you already apply IEC 62304, the gap between the software processes in your existing QMS and the new version of the standard shouldn't be so important.

However, there is a new clause, which is more problematic:

• 4.1.6 The organization shall document procedures for the validation of the application of computer software used in the quality management system (...).

I truncated the clause, it is longer. We'll see the consequences of this clause in the next article.