FDA CDRH’s “Quality System Regulation ” issued October 7, 1996 under the GMP regulation 21 CFR Part 820. This regulation specifically requires software validation as a part of design validation (820.30g) for medical device software. Note that this is required even for Class 1 devices (820.30a) if they contain software which means that the device might be exempt from a 510(k) Submission requirement but that does not exempt the manufacturer from validating the software and implementing design controls for that device. Section 820.70i Automated Processes requires software validation when computers or automated data-processing systems are used as part of production or the quality system. Section 820.181 Device master record states that software specifications are to be part of the DMR. The preamble of the regulation responds to a number of comments on the earlier draft of the regulation in relation to design control and software. It is important to note (especially for companies where software is the product) that all sections of this regulation need to be considered even if they don’t explicity mention software (for example, preventive and corrective action, auditing, document control, purchasing controls, management review, etc.).
While this regulation established requirements for design control and for software validation explicity in a regulation FDA submission and enforcement practices had essentially required software validation for medical devices since the late 1980s as evidenced by the 1991 software submission guidance and the frequent software validation citations in warning letters.