FDA revamps device software premarket submissions guidance

Editor's Note: A previous version of this article incorrectly stated the guidance did not apply to device constituent parts of a combination product.

The US Food and Drug Administration (FDA) this week finalized guidance on the content of premarket submission for software functions in medical devices. The guidance emphasizes a risk-based approach to regulating such products, new legislative mandates and to acknowledge other guidances that have been published since an earlier version of the guidance was issued in 2005.

The final guidance supersedes the 2005 document and includes several revisions from a draft version released for comment in 2021. While the 2005 guidance explained what documentation sponsors should consider providing in their application based on the agency’s definition of “levels of concern,” the new guidance does away with that and instead focuses on a risk-based approach that urges sponsors to think about the total product lifecycle (TPLC) of the device and how software plays into that. (RELATED: FDA issues draft guidance for device software in premarket submissions, Regulatory Focus 4 November 2021)

The guidance also takes into consideration legislation that has been passed since 2005, such as the 21^st Century Cures Act, which removed certain software functions from the definition of a medical device, and more recently the FY 2023 omnibus spending bill, which gave the agency explicit authority to authorize devices that include Predetermined Change Control Plans (PCCPs). (RELATED: FDA draft guidance allows AI/ML devices to evolve without requiring new submissions, Regulatory Focus 31 March 2023)

FDA said the guidance “also considers the rapidly evolving nature of digital health and recent FDA-recognized consensus standards related to software.”

In the guidance, the agency lists seven digital health premarket guidances sponsors should refer to when putting together their premarket submission for medical devices that have a software component, though it notes that the list is not exhaustive. The agency also lists several internationally recognized standards that sponsors may want to reference in their submissions.

“The emergence of consensus standards related to software has helped to improve the consistency and quality of software development and documentation, particularly with respect to activities such as risk assessment and management,” said FDA. “When possible, FDA harmonized the terminology and recommendations in this guidance with software-related consensus standards.”

FDA has also made significant updates to its Quality System Regulation (QSR) in the years since the previous final guidance, and the agency said it may request additional information from sponsors in their premarket submissions related to QSR documentation requirements. Specifically, the guidances states that as part of QSR design controls, sponsors need to establish procedures to validate their products that include software validation and risk analysis.

FDA wants sponsors to provide a basic or advanced level of documentation for various aspects of their software and provide a rationale for the level of documentation they used.

“The rationale should account for the device’s intended use, and include references, where appropriate, from the submission documentation (such as Risk Management File, Software Description, etc.) to support the indicated Documentation Level,” the agency said.

The clarify the issue, FDA provides a table in the guidance that walks sponsors through the different types of information about software that sponsors can submit and the level of documentation that may be necessary.

FDA notes that the guidance does no not apply to automated manufacturing and Quality System software, or software that is not a device, and urges sponsors to contact the responsible FDA review division to clarify any documentation expectations. The agency also notes that the guidance generally applies to device constituent parts of a combination product when the device constituent part includes a device software function, including combination products assigned to its drug or biologics centers.

“Other FDA guidance documents may recommend additional software-related documentation for inclusion in a premarket submission,” said FDA. “For example, recommendations regarding cybersecurity information to include in a device premarket submission can be found in the guidances ‘Content of Premarket Submissions for Management of Cybersecurity in Medical Devices’ and ‘Cybersecurity for Networked Medical Devices Containing Off-The-Shelf (OTS) Software.’”

Software Guidance

FDA revamps device software premarket submissions guidance

Related topics

Recommended content

Welcome to the new RAPS Digital Experience