U.S. Food and Drug Administration – FDA Software Documentation: A Risk-Based Shift
The FDA has recently updated its guidelines for software documentation in premarket submissions, replacing the old 2005 Level of Concern system with a more detailed, risk-based approach. The new framework of 2023 divides documentation into two categories: Basic and Enhanced linked to the risk associated with the intended use of the software. This change is part of the FDA's effort to modernize its regulations and keep up with the rapid advances in medical device software technology.
From Levels of Concern to Risk-Based Documentation Level
Under the old guidelines, software documentation was categorized into three levels — Minor, Moderate, and Major — depending on the potential impact of software failures. The new framework simplifies this by using just two categories, based on a broader, risk-based approach.
-
Basic Documentation Level
Applicability: Required for all device software submissions, regardless of risk.
Key Requirements:
-
- Software description and architecture.
- Software requirements specifications (SRS).
- Summaries of risk management, verification, and validation (V&V) testing.
- Maintenance and revision-level history.
Simplifications:
-
- No need to provide detailed software design specifications (SDS).
- A declaration of conformity to IEC 62304 can substitute for full configuration management documentation.
-
Enhanced Documentation Level
Applicability: Reserved for higher-risk devices, such as:
-
- Class III devices.
- Combination products or devices with probable risks of serious injury.
- Devices facing cybersecurity vulnerabilities or blood establishment software.
Key Requirements:
-
- Comprehensive risk management files and testing protocols.
- Detailed SDS
- Unit and Integration Test details.
- Full configuration management and maintenance plans.
This updated approach aligns with modern regulatory practices, emphasizing proportionality in documentation based on the risk posed by the device software.
A Comparison Of The Minimum Documentation Required By The New Guidance
The table below compares the documentation for Minor LOC (2005 guidance) against the new Basic Documentation Level (2023 guidance)
Document Section
|
2005 Guidance (Minor LOC)
|
2023 Guidance (Basic Documentation)
|
|
Documentation Level Analysis
|
Required
|
Required
|
|
Software Description
|
Summary overview required
|
Detailed description of features, inputs, outputs, and hardware.
|
|
Risk Management
|
Required (called Device Hazard Analysis)
|
Required (now the Risk Management File with a plan, assessment, and report).
|
|
Software Requirements Specification (SRS)
|
Summary of functional requirements
|
Detailed individual requirements, tracing to risk management, architecture, and testing.
|
|
Architecture Design Chart
|
Not required
|
Required; must outline the system and software architecture.
|
|
Software Design Specification (SDS)
|
Not required
|
Not required
|
|
Traceability Analysis
|
Required
|
Required as part of the SRS.
|
|
Software Development Environment Description
|
Not required
|
Summary of lifecycle activities OR IEC 62304 certification accepted
|
|
Verification and Validation (V&V) Documentation
|
Functional test plan, pass/fail results
|
Summary of unit, integration, and system-level testing with system-level reports
|
|
Revision Level History
|
Required
|
Required
|
|
Unresolved Anomalies
|
Not required
|
Required; must document any anomalies and their impacts.
|
Why The Fda's New Guidance Is Important
- Clearer Risk Definitions
The FDA now focuses on real-world risks, not just theoretical ones, making it easier to evaluate potential problems, especially for cybersecurity threats.
- Easier Submissions for Low-Risk Devices
Low-risk devices have more flexible requirements under the Basic Documentation Level, though some new details, like a more complete SRS, are now expected.
- Stricter Rules for High-Risk Devices
High-risk devices need more thorough evidence of safety, functionality, and risk management, ensuring they meet the highest safety standards.
This new approach balances simplicity for low-risk devices with robust checks for high-risk ones.
Implications For Manufacturers
The updated guidance introduces significant changes, offering both benefits and challenges:
- Re-evaluation of Processes
Manufacturers need to review and update their development and documentation practices to meet the updated risk-based categories, ensuring compliance without straining resources.
- Increased Documentation for Low-Risk Devices
Software once classified as low-risk now requires more comprehensive documentation, including detailed test plans and results.
- Cybersecurity Emphasis
Addressing potential cybersecurity risks is now a priority, requiring proactive assessments and mitigations of vulnerabilities to ensure product safety.
The FDA's revised guidance reflects a thoughtful approach to modernizing regulatory oversight for medical device software. By transitioning from a rigid, concern-based framework to a flexible, risk-driven model, the FDA ensures that documentation requirements are both proportionate to risk and aligned with contemporary technological realities.
For manufacturers, understanding and adapting to these changes is critical. A strategic approach to software development and documentation can streamline regulatory approvals and bring innovative, safe medical devices to market efficiently.