The FDA has recently published a number of software related guidance documents, covering topics such as off-the-shelf software, cybersecurity, closed-loop-control, and predetermined change control plans for artificial intelligence (AI)/machine learning (ML)-enabled software. This article, which is the first in a series related to medical device software, discusses FDA's most cross-cutting software guidance.
Background of FDA's Software Guidance
On June 14, 2023, the FDA released its final guidance on the "Content of Premarket Submissions for Device Software Functions", which serves as an update to the 2005 guidance on software contained in medical devices.
The guidance applies to premarket submissions that contain software functions that meet the definition of a medical device. Thus, the guidance is applicable to software functions intended for use in the diagnosis, cure, mitigation, treatment, or prevention of disease or other conditions, or intended to affect the structure or function of the human body. This also includes instances when the device constituent part of a combination product contains a software function.
Examples of software functions include device firmware, software accessories to medical devices, and standalone software as a medical device.
Purpose of FDA's Software Guidance Update
The guidance outlines the information FDA expects to see for software verification and validation procedures and activities. While the previous version of the guidance outlined documentation expectations based on the device software's level of concern (Major, Moderate, or Minor), the updated guidance recommends a risk-based approach that accounts for the device's intended use in determining the level of documentation to be submitted. Additionally, instead of three software levels of concern, there are now only two software document levels – Basic and Enhanced.
Furthermore, the updated guidance also references more recent FDA-recognized consensus standards and other guidance documents related to software released since 2005. For example, as cybersecurity and interoperability being recent focal points of the Agency. it is noted that sponsors should review the referenced documents on these topics.
The updated guidance also reflects updates to the FD&C Act since 2005. For example, in December 2016 the 21st Century Cures Act redefined a medical device to exclude specific software functions. These exclusions encompass software intended for administrative support of a health care facility, for maintaining or encouraging a healthy lifestyle, to serve as electronic patient records, and for handling results and findings by a health care professional. Another change to the FD&C Act, implemented in December 2022, is the addition of "Predetermined Change Control Plans for Devices". This update allows FDA to approve or clear a predetermined change control plan (PCCP) for a device, eliminating the need for another premarket submission for included changes.
Recommended Software Documentation
The FDA notes that they intend to take a risk-based approach when determining if a device software function(s) Documentation Level should be Basic or Enhanced. Should a failure or flaw of any device software function(s) present a hazardous situation with a probable risk of death or serious injury to anyone in the environment of use, then FDA expects the submission of Enhanced Documentation.
Enhanced Documentation is expected for devices associated with blood transfusions, as well as for devices that are a constituent part of a combination product and Class III devices unless a sponsor can provide adequate rationale otherwise.
Both Basic and Enhanced Documentation Levels require the following information:
- Documentation Level Evaluation
- Software Description
- Risk Management File
- Software Requirements Specification
- System and Software Architecture Design
- Software Version History
- Unresolved Software Anomalies
Enhanced Documentation requires the following additional documents:
- Software Design Specification
- Software Development, Configuration, Management, and Maintenance Practices
- Software Testing as Part of Verification and Validation
How ProPharma Can Help
Navigating the rapidly evolving recommendations and requirements for devices with software functions can be daunting without expert support. ProPharma brings 40 years of regulatory expertise to assist clients with changing regulatory landscapes. We can assist you in determining the type of software documentation needed for your device, review software packages to be included in premarket submissions, and guide you through FDA interactions. Contact us to speak with one of our regulatory experts for more information.
