Standards, Guidance & Notices
Showing 111–120 of 134
ISO
ISO 14971:2019
Medical devices — Application of risk management to medical devices
Specifies terminology, principles and a process for risk management of medical devices, including software-only medical devices. Confirmed as current in the 2025 systematic review.
Published: 2019-12-01
AAMI
TIR
TIR
AAMI TIR102:2019
U.S. FDA 21 CFR mapping to the applicable regulatory requirement references in ISO 13485:2016 Quality Management Systems
Technical information report providing a mapping of US FDA 21 CFR 820 requirements to the regulatory requirement references in ISO 13485:2016. Developed by AAMI QM/WG 01 to help US industry identify applicable regulatory requirements through an ISO 13485 quality management system.
Published: 2019-08-30
NIST
FIPS
FIPS
FIPS 140-3
Security Requirements for Cryptographic Modules
The selective application of technological and related procedural safeguards is an important responsibility of every federal organization in providing adequate security in its computer and telecommunication systems. This standard is applicable to all federal agencies that use cryptographic-based security systems to protect sensitive information in computer and telecommunication systems (including voice systems) as defined in Section 5131 of the Information Technology Management Reform Act of 1996, Public Law 104-106 and the Federal Information Security Management Act of 2002, Public Law 107-347.
This standard shall be used in designing and implementing cryptographic modules that federal departments and agencies operate or are operated for them under contract. The standard provides four increasing, qualitative levels of security intended to cover a wide range of potential applications and environments. The security requirements cover areas related to the s
Published: 2019-03-22
NIST
SP
SP
SP 800-37 Rev. 2
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
This publication describes the Risk Management Framework (RMF) and provides guidelines for applying the RMF to information systems and organizations. The RMF provides a disciplined, structured, and flexible process for managing security and privacy risk that includes information security categorization; control selection, implementation, and assessment; system and common control authorizations; and continuous monitoring. The RMF includes activities to prepare organizations to execute the framework at appropriate risk management levels. The RMF also promotes near real-time risk management and ongoing information system and common control authorization through the implementation of continuous monitoring processes; provides senior leaders and executives with the necessary information to make efficient, cost-effective, risk management decisions about the systems supporting their missions and business functions; and incorporates security and privacy into the system development life cycle. E
Published: 2018-12-20
AAMI
TIR
TIR
AAMI SW91 ED1:2018
AAMI SW91 ED1:2018
This AAMI technical information report establishes a standardized
classification system for defects identified in health software,
including software embedded in medical devices and Software as a
Medical Device (SaMD). The document defines defect categories based
on type, severity, and origin within the software development
lifecycle, enabling consistent defect tracking, root cause analysis,
and process improvement. The classification scheme supports
compliance with IEC 62304 software lifecycle requirements and FDA
quality system expectations, and is referenced in the context of
cybersecurity vulnerability management and postmarket surveillance
activities. Currently under reaffirmation review by the AAMI SM-WG08
Software Defect Classification Working Group (as of April 2025).
Published: 2018-11-02
EU
MDCG
MDCG
MDCG 2018-5
UDI assignment to medical device software
Clarifies, for software that is placed on the market either as a standalone medical device or as a component of another medical device, when manufacturers must assign a new Basic UDI-DI as opposed to simply updating the UDI-PI (production identifier) for a minor version change. A new Basic UDI-DI is required when a change affects the software's original performance, safety, or interpretation of data -- for example, new or modified algorithms, database structures, operating platforms, architecture, user interfaces, or new interoperability channels -- or when the Basic UDI-DI itself, the name/trade name, version/model number, critical warnings or contraindications, or the user-interface language changes. By contrast, minor revisions such as bug fixes, non-safety-related usability improvements, security patches, or operating-efficiency changes do not require a new Basic UDI-DI; these are tracked instead through the manufacturer's own version/release identification scheme reflected in the UDI-PI. The guidance notes that UDI placement (labelling/display) criteria are addressed in a separate, later guide, and should be read together with MDCG 2018-1 on UDI assignment.
Published: 2018-10-01
JIS
Std
Std
JIS Q 13485:2018
JIS Q 13485:2018 Medical devices - Quality management systems - Requirements for regulatory purposes (equivalent to ISO 13485:2016)
This JIS standard specifies quality management system (QMS) requirements for medical devices across their entire lifecycle, from design and development through manufacturing, storage, distribution, installation, servicing, and disposal, corresponding to ISO 13485:2016. The document establishes the foundational QMS framework required for medical device manufacturers to obtain manufacturing and sales licenses and manufacturing registration under Japan's Pharmaceutical Affairs Law (Yakuhin Kikai Hou). Manufacturers must establish documented procedures for design control, risk management, supplier management, production and process controls, verification and validation, nonconforming product management, corrective and preventive actions, and post-market surveillance. The standard emphasizes management responsibility, resource provision, competence and training, and management review to ensure consistent product quality and safety. Organizations must maintain traceability, manage changes, and implement effective management of product recalls. This QMS standard serves as the regulatory foundation integrating all other technical standards (IEC 62304, ISO 14971, IEC 62366-1) into a coordinated governance structure.
Published: 2018-04-20
IMDRF
IMDRF/SaMD WG/N41 FINAL:2017
Software as a Medical Device (SaMD): Clinical Evaluation
IMDRF final document on the clinical evaluation of SaMD. It defines clinical evaluation as a set of ongoing activities to assess and analyze a SaMD's clinical safety, effectiveness, and performance, consisting of three components: valid clinical association (is there a valid clinical association between the SaMD output and the targeted clinical condition?), analytical validation (does the SaMD correctly process input data to generate accurate, reliable, and precise output data?), and clinical validation (does use of that output achieve the intended purpose in the target population in the context of clinical care?). All SaMD should demonstrate these components, using existing evidence or generating new evidence. Depending on the N12 risk category and subject to each jurisdiction's laws, manufacturers of certain low-risk SaMD may self-declare the appropriateness of the evidence, while independent review of clinical evidence becomes more important for higher-risk SaMD. Manufacturers continue to collect real-world performance data after market entry.
Published: 2017-09-21
FDA
CDRH
CDRH
FDA-Interoperability-2017
Design Considerations and Pre-market Submission Recommendations for Interoperable Medical Devices
This FDA final guidance addresses the safe and effective interoperability of medical devices that connect and exchange information electronically (e.g., devices integrated with EHRs or connected to networks). It covers design considerations (risk management, error management, and data integrity), the technical documentation to include in premarket submissions, and labeling. It shows the correspondence with ISO 14971 (risk management). Essential reading for submissions of network-connected SaMD and medical IoT devices.
Published: 2017-09-06
EU
Law
Law
Regulation (EU) 2017/746
Regulation (EU) 2017/746 of the European Parliament and of the Council of 5 April 2017 on in vitro diagnostic medical devices and repealing Directive 98/79/EC and Commission Decision 2010/227/EU
EU regulation on in vitro diagnostic medical devices, dated 5 April 2017, published in the Official Journal on 5 May 2017 and applicable since 26 May 2022. It repeals Directive 98/79/EC and Commission Decision 2010/227/EU and governs placing on the market, conformity assessment and post-market obligations for devices, including software. The classification rules are set out in Annex VIII, with MDCG 2020-16 providing guidance on their interpretation, and the general safety and performance requirements, including those relevant to cybersecurity, are set out in Annex I. The transitional periods were extended by Regulations (EU) 2022/112 and (EU) 2023/607. To be read together with MDCG 2019-11 on qualification and classification of software, which covers both the MDR and the IVDR.
Published: 2017-05-05