Software in Medical Devices, by MD101 Consulting

When the draft guidance had been released in 2021, we discussed the it in a previous article.
Compared to the draft version, the final version isn't a game changer: it still contains the Basic Documentation Level and Enhanced Documentation Level. But compared to the previous guidance of 2005, it is a game changer: exit the three levels of concern, and exit IEC 62304 class A.

Changes compared to the draft version

The final guidance wording updated throughout the document, with some remarkable changes:

• Reference to the guidance on content of premarket submissions for cybersecurity,
• A discussion on software verification and validation, and the risk of having the adequate control on the design process if the documentation is written after development,
• The declaration of conformity to IEC 62304 is made more specific by quoting the clauses expected to be implemented,
• Additional documentation items in the software description section, especially if the software contains AI/ML models,

• The section on risk management file has been refactored. It is more in line with ISO 14971 and the reference to IMDRF documents has been removed, it is interesting to see the interpretation of order of priority of mitigation actions for software. I quote the body text of the guidance, due to peculiar interest of this section:
  • Design (e.g., eliminating or reducing unnecessary features, modifying the software architecture to prevent hazardous situations, modifying the user interface to prevent usability errors)
  • Protective measures (e.g., defensive programming checks that detect unexpected faults followed by automatic intervention to halt the delivery of results or therapy, alarms allowing user intervention to prevent a hazardous situation)
  • Information for safety (e.g., written warnings, on-screen warnings, training

Remark: determining whether alarms are information for safety or not is a recurrent debate. This extract of the guidance gives the FDA's thinking on that situation.

• For software design specification in basic documentation level, the FDA now recommends to document it in the DHF (that wasn't present in the draft guidance),
• Additional items should be documented on unresolved anomalies
• And the section on Off-The-Shelf (OTS) Software Use in Medical Devices has been removed. This is not surprising, the draft guidance just quoted the changes that would be done to the guidance on OTS use in medical devices. Just expect to see a new version of the OTS guidance, aligned with the guidance on content of premarket submission for device software functions.
• In appendix, we find a long list of examples of devices placed in Basic or Enhanced Documentation level.

These are the most prominent changes. Other little changes have been made throughout the document.

To make it short

The game has changed. Prepare yourself to apply this guidance if you have MD software. Now.