FDA updates off-the-shelf software guidance to reflect least burdensome approach

The US Food and Drug Administration (FDA) has reissued a final guidance on off-the-shelf (OTS) software used by medical devices, which aims to reduce administrative burdens for medical device sponsors. It aligns more directly with the agency’s broader approach to medical device software as well as international consensus standards.

The guidance supersedes an earlier version that was released in 2019 that focused on using hazard analysis to determine whether the software was fit for use. The previous version of the guidance relied on the agency’s then-current understanding of how OTS software was being incorporated into products. The agency said it has since learned much more about how OTS products function and has updated the guidance in line with its recent learnings.

“The least burdensome approach was applied to identify the minimum amount of information that, based on our experience, would generally be needed to support a premarket submission for a device that uses OTS software,” said FDA.

“The documentation recommended in this guidance is based on FDA’s experience evaluating the safety and effectiveness for a device that uses OTS software,” the agency added. “However, sponsors may use alternative approaches and provide different documentation so long as their approach and documentation satisfy premarket submission requirements in applicable statutory provisions and regulations.”

While both guidances took a risk management approach to OTS software, the 2019 guidance focused on conducting a hazard analysis of the software that tries to identify various levels of concern that reviewers can use to understand the risk they potentially pose and include a decision tree to evaluate the risk. It also contained a list of definitions tied to conducting hazard analyses.

The updated guidance does away with the hazard analysis approach, including the decision tree and glossary that were found in the previous version. Instead, FDA asks sponsors to conduct an OTS software risk assessment and provide different levels of documentation based on their potential risk. It relies on a previous premarket submission guidance on medical device software and asks sponsors to submit a risk management file and plan.

“It should be clear in the risk management plan how the sponsor plans to evaluate the overall residual risk,” said FDA. “In addition, the risk management file should include a risk assessment demonstrating that risks have been appropriately mitigated and a risk management report.

“For OTS software, the risks associated with the functions of the OTS software used in the device should be documented in the risk management file,” the agency added.

In the previous guidance, when addressing issues of maintenance and obsolescence in the appendix, FDA said it assumes sponsors have Manufacturer Good Software Development Practices (GSDP) and Good Corrective Action Practices (GCAP) in place. However, the agency does not include GSDP or GCAP requirements in the updated guidance and instead jumps straight into requirements on ensuring the OTS software works during the lifecycle of the device.

“In particular, this section identifies general safety and effectiveness, design, software testing as a part of verification/validation, change, installation, and decommissioning concerns,” said FDA. “These concerns may be applied to all regulated medical device software and stand-alone medical software devices. The appropriate evaluation will depend on the probable risk of death or serious injury, either to a patient, user of the device, or others in the environment of use.”

Updated OTS software guidance

FDA updates off-the-shelf software guidance to reflect least burdensome approach

Related topics

Recommended content

Welcome to the new RAPS Digital Experience