Software in Medical Devices – Update for Q1/Q2 2026

The past year, as in previous years, life has not been easy for many reasons, especially that investments have been hard to come by and, the regulatory bodies are not making it easier to get approval.

In the past 4 – 5 years, the FDA has been moving forward with new standards. The MDR/IVDR is still happening but is moving slowly. There is a major backup in getting to the notified body.

This is a continuation of the software updates I have been sending out for numerous years. Please check out all the references for download and/or purchase. If you have any questions, please contact us.

Software is everywhere in medical devices and IVDs. The FDA and CE are becoming more pedantic in how they review and relate to software. The number of companies getting into the field is growing and the amount of software being developed for medical devices is exceptionally large (especially the number of companies involved with AI/ML).

The FDA has been very critical of the software documentation and the cybersecurity documentation when reviewing a submission. The better the documentation, the less deficiencies are received. Even though the documentation may be good, this is not a reason that the software should not be good. The number of recalls due to software is growing each year and this reflects the quality of the software and not the documentation. There are thousands of devices in the field that are directly affected by these recalls.

 

Software Recalls Q1-Q2/2026

We have been following the recalls and there are a growing number of recalls listed where software played a role in the recall. It is interesting to note that software has been the leading cause of recalls in the FDA for the past 15 years. This trend does not look like it will change.

The following are additional examples of recalls involving software directly as listed on the FDA website, including Israeli developed software. There may be more but classified not under software. There are a large number of class I recalls after patients were severely injured. The descriptions given for the recall are taken from the FDA database. For further details on the recalls, you can check them out on the FDA’s recall database.

Please note that the content for each recall is taken from the FDA database and is not our content.

• Abiomed, Automated Impella Controller (AIC), Class I – Potential that the “Purge System Blocked” alarm display on the Automated Impella Controller (AIC) could be delayed when using first generation Impella 5.5 (0550-0008*) pumps.
• Philips Respironics, Philips Respironics Trilogy Evo O2, Class I – In some situations, the Obstruction Alarm does not trigger within the timeframe dictated by the relevant standards and may take up to four breaths.
• Trividia Health, TRUE METRIX GO Self-Monitoring Blood Glucose System, Class I – The system labeling (user manual and online labeling) did not provide adequate directions for lay users to act on the E-5 error code. The error code description and recommended actions for the E-5 error code in the labeling do not: (a) clearly emphasize that an E-5 error code could represent a very high blood glucose level, and (b) prominently convey the appropriate immediate actions, such as contacting a healthcare professional. This could lead to a delay in treatment if the user does not seek medical attention immediately when receiving an E-5 error code and experiencing symptoms of high glucose.
• Olympus Corporation of the Americas, Olympus High Flow Insufflation Unit, Class I – Issue with software algorithm which may lead to overpressure events.
• Fresenius Kabi, LVP software of the Ivenix Infusion System (IIS), Class I – Potential software anomaly that can cause the pump to report a false battery-health value (typically 69%) and trigger a battery-depletion alarm that will shut down the pump unless it is reconnected to AC mains power.
• Abiomed, Automated Impella Controller (AIC) for use with left heart support blood pump, Class I – Potential software error in the Automated Impella Controller (“AIC” ) when used in conjunction with left ventricular Impella devices.

 

• Abbott Medical, Merlin Patient Care System (PCS) software, Class II – Software malfunction may occur during pacing capture threshold test of pacemaker resulting in programmer not successfully communicating the command to terminate the test.
• Intuitive Surgical, Da Vinci 5, Class II – An error event following the release of a software version for the surgical system that can result in loss of user interface content on an external monitor or tower monitor.
• ICU Medical, Plum Duo Infusion Pump, Class II – Under certain conditions, the pump may not display a soft limit alert and will not notify the clinician of a soft limit violation before confirming and starting delivery. This may potentially lead to under- or over-delivery.
• Micromed, SD LTM 64 PLUS EEG Amplifier/recorder, Class II – Natus has become aware of two complaints related to the SD LTM 64 PLUS where the EEG traces acquired from two or four different amplifiers used in a multiple amplifier configuration (128 or 256 channels) running firmware version 2022.02 were displayed with a shift of 1 second between the 64channels blocks. In rare circumstances, a fixed 1-second temporal delay may appear between two 64-channel modules with firmware 2021.02, 2022.01 or 2022.02 in a multi-module SEEG configuration, potentially leading to misinterpretation of results.
• Philips North America, Patient Information Center iX, Class II – A recent software (SW) patch modifies Mobile Event Notification filter settings without providing any indication to the user when upgrading the system.
• GE Medical Systems China Co., MAC 5 A4 Resting ECG Analysis System, Class II – Software in development inadvertently made available for customer use. Use of this software can result in clinical information being associated with the incorrect patient. This could impact clinical decision-making.
• BD Kiestra Lab Automation, BD Kiestra ReadA, Class II – In certain situations, following a system reboot, one or more modules may have become unreachable via the remote connectivity interface. When this occurred, there was potential for delays in plate retrieval from the incubator while connectivity was restored. This issue was intermittent and did not affect test results, performance of the assay, or sample integrity.
• Beta Bionics, iLet Bionic Pancreas, Class II – insulin pump software versions 1.4.2, and 1.4.3 issue with Dexcom Continuous Glucose Monitoring (CGM) G7 sensor may result in delayed CGM reading then switch to non-CGM dosing, leading to only basal/requested meal doses provided, no correction doses/insulin reductions/suspensions for high/low glucose unless blood glucose entered for sensor life or replacement. Potential health risks to users include severe hyperglycemia with and without DKA and severe hypoglycemia.
• Foundation Medicine, Protocol Configuration Tool (PCT) software for Hamilton AutoLys STAR, Class II – Potential for spontaneous closures of Hamilton HxRunControl software during execution of Autolys protocols after deployment of the PCT software for AutoLys Hamilton STAR.
• Civco Medical Instruments, eTRAX Needle System Starter Kit, Class II – There was an error in inspection and programming of the eTRAX needle sensor for Aurora trackers. The result is a potential for the needle tip position to be incorrectly identified on the user interface.
• RefleXion Medical, RefleXion X1 Radiotherapy System Model RXM1000, Class II – Due to a radiotherapy medical system software defect, when performing angular roll corrections followed by a repeat localization, the roll corrections applied in the initial localization scan are not carried through to treatment delivery leading to the treatment plan dose being delivered to the incorrect location, potentially a displacement of 5mm or higher, with a 10% to 20% underdose.
• Medtronic MiniMed, MiniMed 780G, Class II – Three software defects (Pump Error 53, BG check, and Critical Pump Error (Open Book Image)) that occurred as a result of software updates (versions 6.60, 6.61, and 6.62), which could result in a risk of hypoglycemia or hyperglycemia due to inaccuracies in insulin delivery (either under-delivery, over-delivery, or cessation of delivery).
• Focalyx Technologies, Focalyx Fusion, Class II – Software device that is an accessory for image-guided interventional and diagnostic procedures involving prostate has accessories that may not function properly with Windows 10, which may cause patient harm during biopsy or cause treatment/therapy delays, so firm is recommending stop use until device is verified/validated with Windows 11.
• Beckman Coulter, CellMek SPS Sample Preparation System, Class II – Sample preparation system designed to automate staining, lysing, cell washing has a software error that causes samples to be dispensed close to or touching tube bottoms, which could dislodge fluid line, result in sample loss, spillage, make instrument inoperable and will lead to unintentional removal of 60-100 microliters from final sample, may lead to incorrect diagnosis or patient management.
• Elekta, MOSAIQ Oncology Information System with Particle Therapy License, Class II – Using oncology information system that manages workflow may result in overtreatment if: Plan delivered with Particle Therapy IHE-RO TDW-II interface; With one field per fraction or last field partial treatment; Partial treatment occurs followed by treatment field interruptions with manually recorded partial treatment; Then treatment unit doesn’t check meter set value so partial treatment delivered twice.
• Philips North America, Philips Telemetry Monitor 5500 1.4 GHz, Class II – Potential for device reset to default “NEW_DEVICE” state, which may lead to a to loss of device configuration and the equipment label, resulting in a failure to reconnect to the PIC iX central monitoring system.
• GE Medical Systems, GE Healthcare AW Server, Class II – GE HealthCare has become aware of a context synchronization issue in AW Server 3.2 ext. 6.5. When a user selects a patient or exam in the AW Server Web Client worklist and launches an interactive application (e.g. Volume Viewer), the application may open the previous patient’s exam instead of the intended one. When this issue occurs, there is no system warning or error notification. If the error is not recognized, a clinical user could review, interpret, or report images for the wrong patient which could lead to misdiagnosis, incorrect clinical decisions, resulting in delayed or incorrect treatment.
• Staar Surgical, STAAR ICL Calculation Software, Class II – Due to a software coding issues for calculating the implant orientation diagram printout for the implantation for toric implantable collamer lenses.
• Philips Medical Systems Nederland, Philips Azurion 3M12, Class II – During the device phase of Roadmap Pro, a user may experience a dark image that is not clinically usable. The dark image may result after the user performs a pedal tap (shortly touching the footswitch pedal without generating an Xray image). The pedal tap may cause a dark image with the next fluoroscopy run.
• GE HealthCare, GE HealthCare Carescape Telemetry Server, Class II – GE HealthCare has become aware of an unlikely situation where potential loss of ECG and SpO2 monitoring involving ApexPro CARESCAPE Telemetry Server (CTS) v5.0 and v6.0, can result from a persistent NO COMM or OFF NETWORK condition at the CARESCAPE Central Station or CIC Pro Clinical Information Center (Central Station).
• Dexcom, Dexcom ONE+ Continuous Glucose Monitoring System, Class II – A software defect in which a low-priority file I/O check blocks the higher-priority thread responsible for processing estimated glucose values (EGVs) and trend arrows. When the app is running in the background, EGV notifications may queue up and then “replay” sequentially when the user brings the app to the foreground, causing the Glucose Compass to flicker through previous EGVs. In more severe instances, the app may perceive signal loss and deploy signal loss mitigations. This delay in EGV and alert processing creates a risk that users may miss detection of a hypoglycemic or hyperglycemic event or make treatment decisions based on outdated glucose information.
• GE Medical Systems, Revolution Ascend computed tomography, Class II – GE HealthCare has become aware of a potential security vulnerability impacting AW Server deployed via Edison Health Link (EHL) based CT Smart Subscription used in conjunction with certain Revolution Apex, Revolution Ascend, and Revolution CT systems.
• Hologic, Genius Review Station, Class II – It was identified that certain devices were being operated outside the validated and FDA-cleared display configuration due to user modification of the manufacturer-installed settings. Modifications included disabling Barco Application Appearance Manager (AAM), altering calibration and compliance parameters, and adjusting additional display-related settings. This field correction is being conducted to restore affected system to the validated configuration and reinforce proper use in accordance with the Operator’s Manual.
• Beta Bionics, iLet Dosing Decision Software, Class II – It was found that in versions 1.3.7, 1.4.2, and 1.4.3, the Lock Screen and Limited Access Passcode Screen on the iLet graphical user interface (GUI) include certain icons displayed in the status bar that are active, thereby allowing the user to bypass those screens when those icons on the status bar are pressed, allowing unauthorized access while the device is in Limited Access Mode. A Health Risk associated with Limited access mode includes severe hypoglycemia due to unauthorized access to the iLet if someone were to make unauthorized meal announcements or stopped insulin delivery.
• Philips Medical Systems Nederland, Vue Motion V12, Class II – Potential that mis-ordered frames in Vue Motion during dynamic cine runs may cause images frames to display out of sequence.
• GE Medical Systems, Centricity Universal Viewer 6.0, Class II – There is a potential cybersecurity vulnerability affecting certain versions of Centricity Universal Viewer. User login credentials may be exposed on the local client workstation, which could allow an unauthorized individual to potentially impact system availability and/or manipulate data.
• Ion Beam Applications, ProteusONE, Class II – It was identified that eh Universal Beam Triggering Interface (UBTI) is disabled in the Therapy Safety System (TSS) configuration. In this condition, the TSS does not interrupt the beam delivery if the Healthy Signal  from an external gating device is lost. This may lead to a risk of mistreatment when external gating devices are used.
• Roche Diagnostics Operations, Cobas Pro Integrated Solutions, Class II – Software defect, which allows the system to accept erroneous, non-monotonous calibrations for Spline-type assays. Cobas pro integrated solutions is an automated analyzer, intended for running qualitative, semi-quantitative and quantitative clinical chemistry and immunochemistry assays, as well as ion-selective measurements. When an erroneous calibration is active, the instrument fails to calculate new values and instead repeats the last successfully calculated result from any Spline-type assay for all subsequent measurements, leading to identical and erroneous patient and QC results. The defect could lead to patients receiving erroneous lab results, which could result in a remote risk of serious adverse health consequences. The following assays use spline type calibration and are affected by this issue: Cystatin C Gen.2, Ferritin Gen.4, Lipoprotein (a) Gen. 2, Lipoprotein (a) molarity, Vancomycin Gen.3, Kappa Free Light Chains Partner Channel, Lambda Free Light Chains Partner Channel, and fCAL turbo Partner Channel.
• Agiliti Health – Ellis, Adapt Pump, Class II – Agiliti identified an issue where the Adapt Pump (61600200-Adapt Pump) supplied with all Adapt Line support surfaces does not re-engage the Microclimate Management function after using the Autofirm function for 10 minutes. This issue only occurs when the 10-minute timer is allowed to elapse after the Autofirm button is pressed after initial setup, and it only affects the Microclimate Management function.
• Hitachi Radiation Oncology Systems, Hitachi Proton Beam Therapy System, Class II – Software anomaly in the patient positioning system may result in positional discrepancy.
• Auris Health, Monarch Platform Bronchoscopy, Class II – Device for bronchoscopic visualization, patient airway access has software issue: if application restarts after patient-side selection, prior to bronchoscope loading, application will re-initialize to patient-left position; and if right position was previously selected, this may lead to unanticipated robotic arm positioning toward patient-left, may result in contact with patient/endotracheal tube.
• Philips North America, Ingenia/Evolution, Class II – The potential for stiffness value errors when viewing exported MR Elastography (MRE) stiffness maps to viewer Picture Archiving and Communication System (PACS).
• Siemens Medical Solutions USA, LUMINOS Q.namix T, Class II – Ortho images acquired with preset automatic horizontal flip are not flipped and when acquiring single images, there is the possibility that an image of a previous patient may be processed.
• Sysmex America, TS-10, Class II – Under specific conditions, the lift’s electromagnetic holding force may disengage unexpectedly, allowing unintended downward movement of the lift.
• ICU Medical, ICU Medical Plum Duo/Solo Precision IV Pump, Class II – Plum Solo and Duo Infusion pumps include a feature, that when selected, automatically flushes the downstream line after a piggyback therapy. The programmed flush volume is delivered from the primary line container at the piggyback therapy rate after the piggyback therapy is complete. In certain cases, as described below, the clinician may receive an Upper Hard Limit (UHL) or Lower Hard Limit (LHL) Violation message when programming a piggyback flush, which prevents the flush from being programmed.
• GE Medical Systems Israel, GE Healthcare Omni Legend, Class II – There is a potential intermittent issue on certain Omni Legend systems that can result in a streaking artifact in the PET clinical scan images. This streaking artifact is most easily identified in transaxial slices on the acquisition console (both corrected and non-corrected for attenuation).
• Philips Medical Systems Nederland, Philips Azurion system, Class II – Philips has identified two (2) software issues affecting device systems that may result in loss of imaging (X-ray) functionality and/or loss of motorized movement, and/or incorrect image content and/or loss of data. Issue 1 – System remains in continuous restart mode after the start-up. Issue 2 – Longitudinal Position Error Applicable only to systems with Poly-G3 frontal stand.
• Medtronic Neuromodulation, A71200 Vanta” Clinician Programmer Application (CP App), Class II – Complaints received that Vanta A71200 CP App does not function as intended during use. There is a potential for prolonged or postponed surgical procedure.
• Sophysa, Pressio 2 ICP Monitoring System, Class II – Customer complaints of Pressio monitor rebooting.
• Philips North America, Philips Smart-hopping 2.0 AP 1.4 GHz, Class II – It was found that the MX40 device could not reconnect to the PIC iX when moving between Radiohead and Trident 1.4 GHz access points if the signal strength changed quickly.
• Elekta, Radionuclide RT Treatment planning system, Class II – Due to an error when defining a new stereotactic reference that users fail to first change an already defined obsolete reference to a pre-plan reference. This may result in a treatment plan that potentially irradiates the incorrect patient location if the error is not detected by users.
• Fresenius Kabi USA, Ivenix Infusion System (IIS), Class II – Emphasizing instructions for LVP duration programming located in the IFU.
• Mint Medical, Mint Lesion, Class II – If the connection between a mint Lesion workstation and the mint Lesion server is interrupted while performing a read, in rare cases some information may be lost or incorrectly linked to other patients.
• BioFire Diagnostics, Biofire Spotfire Respiratory/Sore Throat Panel, Class II – Respiratory/sore throat panel test may result in false negative results and control failures.
• The Binding Site Group, EXENT Analyser, Class II – It was reported that plates 2 and 3 were marked as passed , although it appeared that QC had not been performed on these plates, despite samples being measured. The potential clinical hazards include false or missed detection of M-protein (false positive); and falsely elevated or decreased M-protein concentration.
• Raysearch Laboratories, RayCare 2024A SP1 Oncology Information Systems, Class II – Beam set delivery note issues in which there is potential data loss if the beam set delivery note is modified simultaneously and/or if a note is updated during a treatment session, the user is not notified of the change.
• Medtronic Navigation, Medtronic O-arm O2 Imaging System, Class II – Potential for image artifacts caused by an anomaly in the O-arm O2 Imaging System s detector panel firmware.
• Philips Medical Systems Nederland, Azurion system, Class II – It was identified that HDDs used in the PCs of Azurion and Allura systems may show a decrease in performance as they age, particularly beyond six years of service. Issues with an HDD may, depending on the specific system PC in which the affected HDD is installed, result in loss of imaging functionality. Additionally, in Allura systems, this may lead to loss of motorized movement, or loss of data. In some cases, a system restart may temporarily restore functionality.
• Medtronic Neuromodulation, SynchroMed Flex Infusion Mode – A810 Clinician Programmer Software Application, Class II – Software issue: When programming the SynchroMed Pump with the A810 CP App in Flex Infusion Mode, the infusion steps should automatically be arranged in consecutive order, from earliest to latest. However, in rare cases, the steps may be displayed out of order. If this occurs, the programmed Flex Infusion schedule will not be delivered at the intended time, if at all.
• Technological Medical Advancements, Diowave Laser System, Class II – Software update is needed for laser systems, for topical infrared heating to provide temporary relief of minor muscle and joint pain, spasms, stiffness associated with minor arthritis, and to temporarily increase local blood circulation, operating at a maximum average power output of 70W, which is beyond the FDA cleared 60W.
• Boston Scientific Corporation, LUX-DX II Arrythmia detector and alarm, Class II – For some patients upgraded from a LUX-Dx M301 device to a new Model M302 or M312, the new ICM device is not collecting PVC Burden data (both M302/M312) or monitoring for Bradyarrhythmia and Pause (M312 only). In addition, for these devices that are not being monitored, the LATITUDE Clarity programming screens have discrepant information, indicating that the monitoring is enabled for these features in one location and not enabled in another location.
• Integra LifeSciences, CUSA Clarity C7000 Console, Class II – Software issue that renders the touch screen unresponsive.
• Philips Customer Care Solutions Center, Philips Spectral CT on Rails, Class II – Philips has identified three software issues: 1. During a continuous CT (CCT) scan, there is the potential that the Gantry could remain at the current scan position after pressing Go. 2. Potential where the message of Previous Surview Exists Select Previous Surview? or should display but does not appear. 3. After performing Surview and planning the Brain Helical acquisition by setting Brain Area DoseRight Index to increase the dose, there is the potential that the Define Head Area option in the context menu is grayed out.
• Abbott Diagnostics Scarborough, D NOW” Influenza A & B 2, Class II – It was confirmed that the impacted lot has a higher occurrence of invalid rates when compared to the product Instructions for Use.
• Covidien, HealthCast “Vital Sync” Remote Patient Monitoring System, Class II – Due to complaints and investigations stating that alarms from the primary patient bedside monitor was not alarming/being transmitted and received on the remote patient monitoring system.
• Elekta, Radionuclide RT Treatment planning system, Class II – Due to an error when defining a new stereotactic reference that users fail to first change an already defined obsolete reference to a pre-plan reference. This may result in a treatment plan that potentially irradiates the incorrect patient location if the error is not detected by users.
• Fresenius Kabi USA, Ivenix Infusion System (IIS), Class II – Emphasizing instructions for LVP duration programming located in the IFU.

 

Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions

The FDA issued the newest update to the Cybersecurity guidance on 3 February 2026, which replaced the previous guidance from 2025 (and the previous one from 2023). The purpose of this update is to align device cybersecurity expectations with the new Quality Management System Regulation (QMSR) and to clarify how FDA expects manufacturers to show compliance with section 524B (FDORA) in premarket submissions.

https://www.fda.gov/media/119933/download

 

Computer Software Assurance for Production and Quality Management System Software

FDA has issued this guidance on 3 February to provide  recommendations on computer software assurance for computers and automated data processing systems used as part of medical device production or the quality management system. This guidance supersedes “Computer Software Assurance for Production and Quality System Software,” issued 24 September 2025.

This guidance describes “computer software assurance” as a risk-based approach to establish confidence in the automation used for production or quality management systems and identifies where additional rigor may be appropriate; and describes the  various methods and testing activities that may be applied to establish computer software assurance and provide objective evidence to fulfill regulatory requirements.

https://www.fda.gov/media/188844/download

 

Clinical Decision Support Software

The FDA released this guidance on 29 January 2026 to provide insight on which CDS (clinical decision support) software meets the definition of a medical device and which doesn’t. This document replaces the previous version from 6 January 2026. As many companies claim their software is CDS, this should help decide whether the CDS is a medical device or not.

https://www.fda.gov/media/109618/download

 

Decisions by the IMDRF Management Committee

The IMDRF met on 12 and 13 March 2026 and decided to publish the draft document ‘Technical Framework for Artificial Intelligence Life Cycle Management’ from Artificial Intelligence/Machine Learning WG for a 90-day public consultation.

 

FDA Recognized Consensus Standards

The following are the consensus standards recognized by the FDA in the first half of 2026 for STG #13 (software/informatics) :

• CVSS v4.0, Common Vulnerability Scoring System version 4.0
• IEEE  Std 11073-10207-2017 [Including Cor 1-2025], Health informatics – Point-of-care medical device communication Part 10207: Domain Information and Service Model for Service-Oriented Point-of-Care Medical Device Communication
• IEEE  Std 1752.1-2021, Open Mobile Health Data: Representation of Metadata, Sleep, and Physical Activity Measures

 

Content of Human Factors Information in Medical Device Marketing Submissions

The FDA released this guidance on 29 May 2026 to provide help submitters determine what human factors information should be included in marketing submissions for medical devices. The guidance is intended to be used to complement the FDA guidance “Applying Human Factors and Usability Engineering to Medical Devices”.

https://www.fda.gov/media/163694/download

 

General Wellness: Policy for Low Risk Devices

The FDA released this guidance on 6 January 2026 to provide understanding of what is a general wellness product and what is expected from the company.

https://www.fda.gov/media/90652/download

 

Validate Medical Device Cybersecurity with Industry-Leading Penetration Testing Best Practices

This white paper from the Medical Device Innovation Consortium (MDIC) was released 29 June 2026. The purpose of this paper is to help manufacturers implement effective penetration testing, strengthen security controls, and meet evolving regulatory expectations. This paper includes the following:

• Scoping Penetration Tests
• Resourcing and Supplier Selection
• Execution Best Practices
• Findings and Risk Disposition
• Reporting and Communication

To receive this paper, access MDIC at: https://mdic.org/resources/validating-medical-device-cybersecurity-through-penetration-testing/

 

Cybersecurity Risk Analysis for Medical Devices in the Era of Evolving Technologies

MITRE released this white paper in April 2026. MITRE identified the key cybersecurity challenges for these technologies facing the Medical Device Manufacturers and mitigations and consensus practices.

https://www.mitre.org/sites/default/files/2026-04/PR-26-0682-Cybersecurity-Risk-Analysis.pdf

 

Considerations for Managing Challenges in Software Bill of Materials (SBOM) Data Normalization

MITRE released this white paper in April 2026. MITRE issued this paper to discuss a range of options used in managing and generating SBOMs, including manual approaches (with the aid of spreadsheets and ad hoc scripts¹), open-source tooling, and commercial SBOM management tools.

https://www.mitre.org/sites/default/files/2026-04/PR-26-0685-Considerations-for-Managing-Challenges-in-Software-Bill-of-Materials.pdf

 

FDA QSMR

On 2 February 2024, the FDA published the final rule to amend the Quality System  regulation in 21 CFR part 820 (89 FR 7496, effective February 2, 2026). The revised 21 CFR part 820 is now titled the Quality Management System Regulation (QMSR). The QMSR harmonizes quality management system requirements by incorporating by reference the international standard specific for medical device quality management systems, ISO 13485:2016. The FDA has determined that the requirements in ISO 13485 are, when taken in totality, substantially similar to the requirements of the quality system regulation, providing a similar level of assurance in a firm’s quality management system and ability to consistently manufacture devices that are safe and effective.

Proposed changes to IEC 62304 Edition 2

So far there are no new updates to the proposed changes in IEC 62304.  If you need more info on this, please contact us.

 

Health software and health IT systems safety, effectiveness and security — Part 5-1: Security — Activities in the product life cycle

IEC 81001-5-1 is the standard used by the Notified Bodies for cybersecurity in medical devices. It is still not yet harmonized but is considered state-of-the-art and the NB expects you to meet these requirements.

 

Summary

There are many ways to screw up your software in the medical device whether it is embedded in dedicated hardware (also known as SiMD – Software in a Medical Device) or stand-alone health software (also known as SaMD – Software as a Medical Device).

Many companies are getting heavily into AI for code development, various technical analysis’, marketing and user documentation, etc. Can AI be used and how do we control and validate it?  Many questions, few answers.

It doesn’t take too much talent to do this (as we all know) and companies are doing it daily. Many companies mess up royally and don’t know how to get out of the mess. In many cases, they don’t even know that they are in deep trouble until the recall is issued.

You can work properly without breaking the bank. There are many ways to handle the software development/maintenance life cycle and the software validation.

If there are any questions or requests, please feel free to contact us.

 

Mike