The FDA released new guidance for the Content of Premarket Submissions for Device Software Functions [1] in June 2023. This guidance replaces the preexisting guidance from May of 2005. Since then, technological advances have caused software to become an important part of medical devices.
The final guidance moved to a simplified risk-based approach to determine the Documentation Level which is either Basic or Enhanced. Enhanced documentation should be provided for any premarket submission that includes device software function(s) where a failure or flaw of any device software function(s) could present a hazardous situation with a probable risk of death or serious injury, either to a patient, user of the device, or others in the environment of use. These risks should be assessed prior to implementation of risk control measures. Sponsors should consider the risks in the context of the device’s intended use, and other relevant considerations. Basic documentation should be provided for any premarket submission that includes devices software function(s) where enhanced documentation does not apply. Previously this was referred to as the Level of Concern which was Major, Moderate, or Minor.
The section on risk management contained within this updated Guidance Document is in alignment with ISO 14971:2019. Now, the full Risk Management file for the system is required instead of just the Device Hazard analysis. The priority of mitigation actions for software are more explicitly stated and align with ISO 14971:2019:
- Design (e.g. eliminating or reducing unnecessary features, modifying the software architecture to prevent hazardous situations, modifying the user interface to prevent usability errors)
- Protective measures (e.g., defensive programming checks that detect unexpected faults followed by automatic intervention to halt the delivery of results or therapy, alarms allowing user intervention to prevent a hazardous situation)
- Information for safety (e.g., written warnings, on-screen warnings, training)
The final guidance discloses the FDA’s approach on software verification and validation. The definition given in the latest Guidance Document draws the link with Design Controls as specified with 21 CFR 820 and prompts how to perform software validation. While IEC 62304 has assumed to be the prevailing governing standard for software development, it remains to exclude a definition for software validation, as it maintains focus on software verification only.
While the Guidance Document makes reference to module and unit, IEC 62304 references software item and software unit in related discussions on Software Systems and Software Architecture Diagrams. These are similar concepts, however the FDA’s Guidance Document includes hardware components in these terms, taking into account the critical input of software as a portion of a functional system.
For Software Requirements Specifications (SRS), the Guidance Document recommends similar to IEC 62304 clause 5.2 which states software requirements should be specified from system requirements. However, FDA additionally suggested the use of well-elaborated stories, use cases, textual descriptions, screen mockups and control flows as part of the submission.
The FDA Guidance Document notes that Software Design Specifications (SDSs) are required for premarket submissions for devices that fall under the Enhanced Documentation Level only, similar to IEC 62304 clause 5.4. For the Basic Documentation Level, the FDA is recommending the SDS be included in the DHF, and not required as part of the premarket submission package. In both cases, the FDA recommends documenting the SDS prospectively.
The guidance document allows a declaration of conformity to IEC 62304 for software development and maintenance practices. Alternatively, it offers an option for the Basic level to summarize the life cycle development plan and configuration management and maintenance activities. The alternative option for the Enhanced level requires the Basic level PLUS complete configuration management and maintenance plan documents.
The final guidance document has brought the requirements for Device Software a long way from 2005. Let us know if AlvaMed can assist in navigating these changes.
[1] Content of Premarket Submissions for Device Software Functions – Guidance for Industry and Food and Drug Administration Staff (June 14, 2023)
