2021 FDA Draft Software Premarket Submission Guidance

Today, the U.S. Food and Drug Administration (FDA) issued the draft guidance: Content of Premarket Submissions for Device Software Functions. The draft guidance is intended to reflect FDA’s most current thinking on the recommended documentation sponsors should include in premarket submissions for FDA’s evaluation of the safety and effectiveness of device software functions, including both software in a medical device (SiMD) and software as a medical device (SaMD).

When final, it will replace the FDA’s Guidance for the Content of Premarket Submissions for Software Contained in Medical Devices issued on May 11, 2005.

Nice work Team FDA, evolution in thought and practice is a really good thing.

Quick observations from my first read through:

  • The language “Software Contained in Medical Devices” moves to “Device Software Functions”
  • The new guidance allows for declaration of conformance to IEC 62304 in some cases. IEC 62304 was not mentioned in the previous guidance
  • The “level of concern” model has been replaced with Documentation Levels “Basic” and “Enhanced.”

It also updates the recommended documentation list as follows:

2005 GuidanceNew DRAFT Guidance
Level of ConcernDocumentation Level Evaluation
Software DescriptionSoftware Description
Device Hazard AnalysisRisk Management File
Software Requirements SpecificationSoftware Requirements Specification
Architectural Design ChartSystem and Software Architecture Design Chart
Software Design SpecificationSoftware Design Specification
Traceability Analysis(see below)
Software Development EnvironmentSoftware Development and Maintenance Practices
Verification and Validation DocumentationSoftware Testing as Part of Verification and Validation
Revision Level HistoryRevision Level History
Unresolved Anomalies (bugs or defects)Unresolved Anomalies (Bugs, Defects or Errors)

While there is no specific recommendation for a separate “Traceability Analysis”, the following language appears in the guidance

This recommended information should demonstrate that practices were employed resulting in traceability for device software functions and demonstrate planning, requirements, risk assessment, design reviews, change management, testing plans and results, and other aspects of good software engineering for device software functions, to help inform a regulatory decision on whether the software is appropriately designed, verified, and validated.

In addition, the need for traceability and trace needs is included in other parts of the guidance.

About the author

John is a 25 year FDA veteran. John served as a regulatory and compliance expert for FDA regulated computers and software. Practice (focus) areas include FDA software related guidances, software device classification determination, pre-market software review, post market software inspectional 483’s, additional information software requests, Digital Health Pre-certification, AAMI Software related TIRs and related medical device software standards.

SoftwareCPR Training Courses:

Being Agile & Yet Compliant (Public)

Our SoftwareCPR unique approach to incorporating agile and lean engineering to your medical device software process training course is now open for registration!

  • Agile principles that align well with medical
  • Backlog management
  • Agile risk management
  • Incremental and iterative software development lifecycle management
  •  Frequent release management
  • And more!

3 days virtual (Zoom) with group exercises, quizzes, examples, Q&A.

Lead Instructor: Mike Russell

Next public offering: Dec 3, 4, & 5, 2024 – 12:00 pm to 5:00 pm CET

Register Now


 

IEC 62304 and other emerging standards for Medical Device and HealthIT Software

Our flagship course for preparing regulatory, quality, engineering, operations, and others for the activities and documentation expected for IEC 62304 conformance and for FDA expectations. The goal is to educate on the intent and purpose so that the participants are able to make informed decisions in the future.  Focus is not simply what the standard says, but what is meant and discuss examples and approaches one might implement to comply.  Special deep discount pricing available to FDA attendees and other regulators.

3-days onsite with group exercises, quizzes, examples, Q&A.

Instructor: Brian Pate

Next public offering:  TBD

Call or email now to schedule a private, in-house class. The fall schedule is filling up!

Email training@softwarecpr.com to request a special pre-registration discount.  Limited number of pre-registration coupons.

Registration Link:

TBD

 


 

Medical Device Cybersecurity (Public or Private)

This course takes a deep dive into the US FDA expectations for cybersecurity activities in the product development process with central focus on the cybersecurity risk analysis process. Overall approach will be tied to relevant standards and FDA guidance documentation. The course will follow the ISO 14971:2019 framework for overall structure but utilize IEC 62304, IEC 81001-5-1, and AAMI TIR57 for specific details regarding cybersecurity planning, risk characterization, threat modeling, and control strategies.

2-days onsite with group exercises, quizzes, examples, Q&A.

Instructor: Dr Peter Rech, 2nd instructor (optional)

Next public offering:  TBD

Corporate Office

15148 Springview St.
Tampa, FL 33624
USA
+1-781-721-2921
Partners located in the US (CA, FL, MA, MN, TX) and Canada.