Software Development for Medical Devices

An AI model that "kind of" works isn’t good enough. Here’s 10 principle form the last IMDRF : 1) Define a clear intended use & involve experts Outline a precise intended use that meets clinical needs. Engage experts across disciplines to refine it and assess risks at every stage. 2) Strong engineering, design & security practices Ensure traceability, reproducibility, and data integrity. Apply robust security and risk management to protect patient safety. 3) Representative datasets for clinical evaluation Use datasets that reflect the real patient population. Diversity and sufficient size help ensure unbiased performance. 4) Independent training & test datasets Keep training and test datasets completely separate. Perform external validation based on risk levels. 5) Fit-for-purpose reference standards Use clinically relevant standards aligned with the intended use. If no standard exists, document the rationale for selection. 6) Model choice aligned with data & intended use Ensure model design fits the data and mitigates risks. Set clear performance goals and account for variability. 7) Human-AI interaction in device assessment Evaluate performance within clinical workflows. Consider human factors like skill level, autonomy, and misuse risks. 8) Clinically relevant performance testing Assess real-world performance independently from training data. Test across patient subgroups and factor in human-AI interactions. 9) Clear & essential user information Communicate intended use, limitations, and updates transparently. Ensure users understand model function, risks, and feedback mechanisms. 10) Ongoing monitoring & retraining risk management Continuously monitor models to ensure safety and performance. Use risk-based safeguards to manage bias, overfitting, and dataset drift. Developing AI/ML medical devices? These principles should be your foundation. Source: Good machine learning practice for medical device development: Guiding principles / IMDRF/AIML WG/N88 FINAL:2025

Just validate the software!  Sounds simple but at a medical device company there are many types of software that need to be validated and the rules and requirements are different for each type. I put together this diagram of the “software landscape” to help people understand what type of software they’re working with. The diagram shows all the categories and sub-categories of software at a medical device company with examples of each type. First, we divide the landscape into product software and “non-product software.” Product software, if it’s regulated, falls under FDA design control regulations and international standards for medical device development such as IEC 62304. Product software includes all the software you develop plus any third party software included in your product. Within the regulated product software category there are three sub-categories based on the safety risk of the software (classes A / B / C per the IEC 62304 medical software standard). The fourth category “Enforcement Discretion” refers to low risk applications that are technically regulated by FDA but for which FDA has decided not to enforce regulations. On the non-product software side different regulations and standards apply and therefore different requirements for validation and documentation. There are three main sub-categories of non-product software: software used in manufacturing, software used in product development, and software used in the quality system. These can vary considerably in complexity and risk profile, including everything from an Excel spreadsheet to a software test script to a very complex PLM system. The testing and documentation required for validation of non-product software depends very much on the risks associated with them and their complexity (i.e. a one-size-fits-all approach to validation will either over-validate or under-validate the wide variety of non-product software). My recommendation is to follow the FDA guidance for “Computer Software Assurance for Production and Quality System Software” and the international guidance ISO/TR 80002-2:2017 “Validation of software for medical device quality systems.” See links in the comments below. Do you have any tips for managing the variety of regulated software at a medical device company? What has worked well (or badly) at your company? #medicaldevices #medicalsoftware #samd

Lifecycle Regulatory Requirements for SaMD in Europe This analysis examines how the EU regulatory framework—MDR 2017/745 and associated standards—maps onto every phase of the Software as a Medical Device (SaMD) lifecycle. It identifies how lifecycle-based oversight shapes development predictability, certification complexity, and long-term maintenance obligations for software-driven medical technologies. Key Takeaways: 1️⃣ Lifecycle compliance relies on a multi-standard architecture. The paper shows that MDR, ISO 14971, ISO 13485, IEC 62304, IEC 62366 and IEC 82304 must be applied together across development, maintenance and post-market phases, forming an integrated compliance stack rather than isolated requirements. 2️⃣ Rule 11 drives higher-risk classification for software. Under MDR Annex VIII Rule 11, many software products transition to higher risk classes, triggering more complex conformity assessment processes and third-party notified-body involvement. 3️⃣ Maintenance and change control are major regulatory burdens. The authors highlight that adaptive, corrective and preventive updates require structured change-control, re-validation when needed, and risk reassessment—making post-market phases as resource-intensive as development. 4️⃣ Post-market surveillance is continuous and multi-layered. PMS requirements include incident reporting, usability monitoring, cybersecurity management, UDI traceability and updates to technical documentation, embedding ongoing regulatory obligations throughout the product lifecycle. Synthesis: The authors conclude that SaMD regulation is fragmented across standards, but becomes coherent when mapped onto lifecycle stages. They identify key risks stemming from unaligned processes, insufficient early planning, and the growing regulatory impact of iterative software modifications. They recommend lifecycle-integrated planning using MDR-aligned standards, structured risk and usability processes, and rigorous post-market surveillance to maintain safety, performance and compliance. ➡️ How should investors factor lifecycle-wide compliance and change-control obligations into valuation models for SaMD companies? 🔗 Source(s): Navigating Regulatory Challenges Across the Life Cycle of a SaMD. Francesconi M., et al. Journal of Biomedical Informatics, 2025. #digitalhealth #healthinvesting #venturecapital #healthcareinnovation #governance

🧠 I recently reviewed the FDA 510(k) summary for Nurea's PRAEVAorta®2, a newly cleared machine learning device for automated vascular measurements. For anyone building a Software as a Medical Device (SaMD), these summaries are a goldmine of strategic insights. Here are my key takeaways 💡 Strategic "Indications for Use": The clearance letter includes the phrase "to be run on its own or as part of another medical device." This is a brilliant move that keeps options open for future integrations, APIs, or inclusion in a larger clinical marketplace. It's about planning for future growth from day one. 🔒 Non-Adaptive is the Standard (For Now): The device uses a "non-adaptive" machine learning algorithm, meaning the model is locked and doesn't change after deployment. This is the current standard for streamlined FDA clearance. 🖥️ The Power of a CLI: The device uses a Command Line Interface (CLI) for data input. This is a huge advantage. It simplifies the device's scope, clarifies inputs/outputs, and makes integration significantly easier—a key lesson in elegant and efficient design. 📊 Performance Data is Everything: This is the most critical section of any submission. The summary clearly defines the "ground truth" (reference standard) and the acceptance criteria. They used multiple metrics (MAE, Bland-Altman, etc.) not just for validation, but to build confidence and create marketable performance claims. 👍 Real-World Data is Okay: The summary notes that their dataset wasn't perfect (e.g., some missing metadata). This is a crucial reminder: don't panic if your data isn't flawless. The FDA understands the complexities of real-world data. Focus on robust validation of the data you have. Full disclosure: The predicate device used in this submission, CT Cardiomegaly, is one that our team helped get FDA cleared, so it’s fantastic to see it paving the way for further innovation in this space. #MedTech #SaMD #AIinHealthcare #FDA #510k #RegulatoryAffairs #MachineLearning #DigitalHealth #MedicalDevice

🔍 The FDA doesn't care if an LLM wrote your code. They care if you can prove it's safe. When building AI-assisted Software as a Medical Device (SaMD), the instinct is to rewrite the "messy" AI code from scratch. That's a mistake. It destroys your iteration speed and reintroduces human error. The solution? Wrap, don't rewrite. 1️⃣ The Compliant Wrapper — treat the AI-generated core as a black box and build a rigorous, human-verified wrapper around it. 2️⃣ Input Validation — the wrapper strictly controls what goes in (schema, ranges, DICOM tags). 3️⃣ Output Verification — the wrapper strictly controls what comes out (bounds, sanity checks, fail-safe). 4️⃣ Treat It Like SOUP — apply the exact same IEC 62304 discipline you already use for third-party Software of Unknown Provenance. 5️⃣ Cybersecurity Stack — SAST, DAST, SBOM, vulnerability management, threat modeling. The LLM wrote the code. You own the security. 6️⃣ Exhaustive Verification — the code stays. The evidence is added. 👉 See how the wrapper architecture turns AI-generated code into a clearable medical device: https://hubs.li/Q04d-Kk60 #MedicalDevice #SaMD #FDA #MedTech #RegulatoryAffairs #DigitalHealth #FDAClearance #MedicalDeviceCybersecurity

Last month, a founder called us with a surprise: their AI-based diagnostic tool had just been classified as an In Vitro Diagnostic (IVD) under the IVDR. Their first reaction: “But it’s just software!” It’s a moment we’ve seen often. The line between software and diagnostics is disappearing fast, and for many innovators, this means their app, algorithm, or data platform is now subject to one of Europe’s most stringent regulations. IVDR doesn’t just redefine compliance; it redefines accountability. Software that interprets biological or diagnostic data must now show clinical performance, cybersecurity robustness, and traceability, just like traditional test kits or analyzers. This shift is catching companies off guard, not because the rules are unclear, but because they assume “code” operates outside the lab. In our reviews, three mistakes keep showing up: ❌ Treating software validation like IT testing and not clinical evidence. ❌ Weak traceability between code logic, intended use, and risk controls. ❌ Missing cybersecurity and PMS plans for continuous updates. Here’s how we guide teams stepping into this “Software as IVD” frontier: ✅ Clearly define the intended purpose and diagnostic claim. ✅ Map algorithm outputs to clinical relevance. ✅ Validate analytical + clinical performance, not just functionality. ✅ Align lifecycle with IEC 62304 and IVDR Annex XIII. ✅ Set up PMS to capture real-world software performance. As the IVDR era unfolds, every diagnostic startup must ask: Is our software just functioning, or is it clinically proven to perform? #IVDR #SaMD #DigitalHealth #IVDSoftware #RegulatoryStrategy #MedTechLeadership #Elexes #AI #SAMD #IVD #Regulatory #Medicaldevice

If your medical device has software, FDA demands cybersecurity. And if you architect your system incorrectly, trying to secure it later will be painful. So… Before choosing components or writing code, think through the whole system architecture. This diagram is part of a book we’re writing on MedTech Cybersecurity. Let me know if you’re open to reviewing an advanced electronic copy. The figure is imperfect because there are nuances that are hard to capture, but here’s the headline: Start cybersecurity early and consider each subsystem. There are many moving parts in cybersecurity, and architecting the overall system and each subsystem is iterative. Here are some key steps: ↳ Understand user needs and the role security plays ↳ Consider other systems your device will talk to ↳ Capture security requirements early ↳ Architect with a defense-in-depth approach ↳ Choose hardware components that are likely to meet security requirements ↳ Propose a software architecture and then evaluate it against the constraints of the system and hardware ↳ If necessary, adjust device-level requirements that drive changes to the system or hardware architecture ↳ Generate architecture security views ↳ Perform threat modeling ↳ Estimate and evaluate risk (security, safety, etc.) ↳ Determine necessary controls ↳ Evaluate whether the system, hardware, and architecture are adequate for the controls ↳ Adjust the relevant requirements and architecture as needed ↳ Rinse and repeat until your entire architecture is amenable to cybersecurity At that point, you’re ready to design and implement. But don’t be surprised if you have to revisit requirements or architecture later. PS. Fellow system architects and cybersecurity experts: what did I miss? Keep in mind that the focus here is on architecture. PPS. If you’re open to reviewing the book pre-release, let me know in the Comments. ♻️ And please repost if you think this is helpful!

⚠️ Medical Device Software: Guidance That Can Actually Help!   Building compliant Medical Device Software (MDSW) today is not just about coding a safe product. It’s about understanding how software evolves, how risk is continuously managed, and how to demonstrate control across the entire lifecycle. There’s no single manual. And it can vary across jurisdictions. But there are key guidance documents that regulatory, clinical, and pms teams rely on when developing and maintaining medical device softwares. After bringing back this series, I am starting with some Medical Device Software guidance worth knowing 👇   🇪🇺 𝗘𝗨 / 𝗠𝗗𝗖𝗚 📄 MDCG 2019-11 Rev.1 Qualification and classification of software under MDR/IVDR 📄 MDCG 2020-1 Clinical Evaluation and Performance Evaluation of MDSW 📄 MDCG 2023-4 MDSW intended to work in combination with hardware or hardware components 📄 MDCG 2025-4 Safe making available of MDSW apps on online platforms 📄 MDCG 2025-6 / AIB 2025-1 FAQ on interplay between MDR/IVDR and the AI Act 📄 MDCG 2019-16 Rev.1 Guidance on Cybersecurity for medical devices 🌐 𝗜𝗠𝗗𝗥𝗙 𝗦𝗼𝗳𝘁𝘄𝗮𝗿𝗲 𝗮𝘀 𝗮 𝗠𝗲𝗱𝗶𝗰𝗮𝗹 𝗗𝗲𝘃𝗶𝗰𝗲 (𝗦𝗮𝗠𝗗) 𝗗𝗼𝗰𝘂𝗺𝗲𝗻𝘁𝘀 📄 IMDRF SaMD WG/N12 SaMD: Risk Categorization (+ N81 FINAL:2025 with a broader scope for Medical Device Software) 📄 IMDRF SaMD WG/N23 SaMD: Application of Quality Management System 📄 IMDRF SaMD WG/N41 SaMD: Clinical Evaluation 📄 IMDRF SaMD WG/N10 SaMD: Key Definitions 🇺🇸 𝗙𝗗𝗔  📄 Clinical Decision Support Software: Guidance for Industry and Food and Drug Administration Staff 📄 Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions 📌 Using the right guidance helps teams structure development, manage change, and align with what regulators actually expect. 🖥️ And with software, staying updated is not optional, regulations evolve almost as fast as the product itself, especially with the changing cross-legislations regulatory frameworks for Medical Devices (see MDR/IVDR proposed changes), Security, Privacy, and AI. This is why at MedBoard, our mission is to enable knowledge access to monitor real-time changes, manage evidence and intelligence, and automate compliance workflows in one platform, powered by global data and AI. 👉 Which guidance do you rely on most when building or maintaining your medical device software? 👉 How are you keeping up with the continuous changes? Feel free to reach out or DM me to see how MedBoard is already helping Regulatory, Clinical, Market and PMS teams! www.medboard.com #MedBoard #MDSW #SaMD #EU #FDA #IMDRF #MDR #MDCG #ClinicalAffairs #RegulatoryAffairs #RegulatoryIntelligence #software #medicaldevice #MedTech #IVD #AI #cybersecurity

🫸 Stop Scroll! Are your AI/ML Medical Devices safe, effective, and unbiased? As AI and Machine Learning (AI/ML) change healthcare, the core challenge remains to ensure Software as Medical Device (SaMD) meet the highest standards throughout their lifecycle. 🪧 The Good Machine Learning Practice (GMLP) Guiding Principles (attached in comments) is a key foundational resource issued by the FDA, Health Canada, and the MHRA. The document provides 10 simple guiding principles for responsible AI/ML development in medical devices. Why this document matters: 1️⃣ Combating Bias: There is a critical need to ensure datasets are truly representative of the intended patient population for the clinically relevant condition(s) in order to manage and mitigate unintended bias (generalizability). Generalizability also extends beyond patient characteristics to consider, for example, equipment manufacturer, image quality, etc. 2️⃣ The Human-AI Team: The guiding principle calls for a focus on the performance of the Human AI Team (keeping a human in the loop), recognizing that effective patient outcomes depend on the interpretability of the model's output and its safe integration into clinical workflows. 3️⃣ Continuous Quality: It is critical that developers make use of good software engineering practices, manage retraining risks, and continuously monitor devices in production to ensure performance and integrity long after deployment. Take this guideline as a simple blueprint or checklist to build AI trust. #GMLP #AIML #MedTech #DigitalHealth #FDA #MachineLearning #RegulatoryAffairs #Innovation