At Long Last: FDA Updates Software Guidance (Part I of II)

On November 4, 2021, the FDA released a long-awaited updated guidance document regarding the Content of Premarket Submissions for Device Software Functions. This guidance, the first update in over 16 years, is intended to provide clarity regarding the required documentation of Software in a Medical Device (SiMD) or Software as a Medical Device (SaMD). This document replaces the previous FDA guidance document of May 11, 2005.

The updated guidance further defines a “software function” as a device software function that may control a hardware device or be part of a hardware device (i.e., Software in a Medical Device, or SiMD) or a device without being part of a hardware device (i.e., Software as a Medical Device, or SaMD).

So, what do you need to know? The major updates to this guidance document relate to the determination of Documentation Level. While previously we estimated the Documentation Level based of Level of Concern, a series of questions established by the FDA, we are now focused on a series of questions that will prescribe the documents required for premarket FDA submission.

This guidance is intended to cover:

• firmware and other means for software-based control of medical devices;

• stand-alone software applications;

• software intended to be operated on general-purpose computing platforms;

• dedicated hardware/software medical devices; and

• accessories to medical devices when those accessories contain or are composed of software.

This guidance applies to all types of premarket submissions that include one or more device software function(s). Premarket submissions include:

• Premarket Notification (510(k));

• De Novo Classification Request;

• Premarket Approval Application (PMA);

• Investigational Device Exemption (IDE);

• Humanitarian Device Exemption (HDE); and

• Biologics License Application (BLA).

The latest guidance recommends that we consider four risk-based concerns to determine whether the Documentation Level falls under Basic Documentation or Enhanced Documentation categories. These four considerations are:

1. The device is a constituent part of a combination product.

2. The device (a) is intended to test blood donations for transfusion-transmitted infections; or (b) is used to determine donor and recipient compatibility; or (c) is a Blood Establishment Computer Software.

3. The device is classified as class III.

4. A failure or latent flaw of the device software function(s) could present a probable risk of death or serious injury, either to a patient, user of the device, or others in the environment of use. These risk(s) should be assessed prior to implementation of risk control measures. You should consider the risk(s) in the context of the device’s intended use; the direct and indirect impacts to safety, treatment, and/or diagnosis; and other relevant considerations.

Many of the recommendations carry over from the previous guidance document. In the updated document, however, the required software documents are clearly and concisely spelled out.

Does this updated guidance change our submission practices, you ask? No, it does not. Developing and submitting a quality device that includes software always includes a firm software development life cycle process and risk management process. Our best advice: The earlier you can begin to implement these processes in your organization, the better your documentation will ultimately be. And if you need help understanding the nuances of these regulations or creating efficient and effective documentation, look to Rook Quality Systems; we’ve been partnering with medical device companies for nearly a decade, and we’re here when you need us.