Software Validation for Medical Device Production, Quality Systems, and Device Components
This guidance outlines general validation principles applicable to software used in medical device production, quality systems, and as components of medical devices. It covers software validation requirements for: - Software used as a component/part/accessory of medical devices - Software that is itself a medical device - Software used in production of devices - Software used in quality systems implementation
Recommended Actions
- Establish software validation plan early in development process
- Document software requirements and specifications
- Conduct risk analysis to determine validation effort needed
- Implement verification and validation activities throughout development lifecycle
- Perform appropriate levels of testing based on risk assessment
- Conduct independent reviews where appropriate
- Document all validation activities and results
- Establish change control procedures for software modifications
- Validate off-the-shelf software for intended use
- Maintain validation documentation throughout software lifecycle
- Implement configuration management procedures
- Ensure human factors are considered in software design and testing
- Verify safety requirements are implemented and validated
- Establish procedures for problem reporting and resolution
Key Considerations
Non-clinical testing
- Testing must be conducted according to a documented protocol
- Test cases should exercise system performance, error handling, startup/shutdown, security features
- Test results must be documented and evaluated against predetermined criteria
- Testing should cover normal and stress conditions
Human Factors
- Software design needs to address human factors and usability
- Human factors engineering should be integrated throughout development process
- Device safety and usability should be considered in flowcharts, prototypes, and test plans
- Task and function analyses, risk analyses, and usability tests should be performed
- User population should be involved in testing
Software
- Software validation activities should occur throughout development lifecycle
- Software requirements must be documented
- Design reviews should be conducted
- Code reviews and testing are required
- Change control procedures must be followed
- Validation coverage should be based on risk and complexity
- Independent review is recommended
Safety
- Safety requirements must be identified and implemented in software
- Risk analysis must be performed
- Safety features must be verified and validated
- Software changes must be evaluated for safety impact
Other considerations
- Configuration management procedures required
- Documentation must be maintained
- Off-the-shelf software requires validation for intended use
- Validation effort should be commensurate with risk
- Device manufacturer retains ultimate responsibility for validation
Relevant Guidances
- Content of Premarket Submissions for Device Software Functions
- Off-The-Shelf Software in Medical Devices: Documentation Requirements for Premarket Submissions
- Applying Human Factors Engineering and Usability Engineering to Medical Devices
- Design Considerations and Recommendations for Interoperable Medical Devices
- Cybersecurity in Medical Devices: Design, Implementation, and Premarket Submissions
- Computer Software Assurance for Production and Quality System Software (Draft)
Related references and norms
- ISO 8402:1994: Quality management and quality assurance - Vocabulary
- ISO 9000-3:1997: Guidelines for application of ISO 9001 to software
- ISO 9001:1994: Quality systems model
- IEC 60601-1-4:1996: Medical electrical equipment safety requirements for programmable systems
- ISO/IEC 14971-1: Medical Devices - Risk Management
- ANSI/UL 1998:1998: Safety of programmable components
- IEEE 1012-1986: Software Verification and Validation Plans
Original guidance
- Software Validation for Medical Device Production, Quality Systems, and Device Components
- HTML / PDF
- Issue date: 2002-01-11
- Last changed date: 2020-02-28
- Status: FINAL
- Official FDA topics: Medical Devices, Good Clinical Practice (GCP), Digital Health, Premarket, Biologics
- ReguVirta summary file ID: e456e394ff5b93417d6befdc18e61319
This post is licensed under CC BY 4.0 by the author.