Standards, Guidance & Notices
Showing 121–130 of 134
EU
Law
Law
Regulation (EU) 2017/745
Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices, amending Directive 2001/83/EC, Regulation (EC) No 178/2002 and Regulation (EC) No 1223/2009 and repealing Council Directives 90/385/EEC and 93/42/EEC
EU regulation on medical devices, dated 5 April 2017, published in the Official Journal on 5 May 2017, in force since 25 May 2017 and applicable since 26 May 2021. It repeals Council Directives 90/385/EEC and 93/42/EEC and governs placing on the market, conformity assessment and post-market obligations for devices, including software. Software is classified under Rule 11 of Annex VIII, and the general safety and performance requirements, including those relevant to cybersecurity, are set out in Annex I. The transitional period was extended by Regulation (EU) 2023/607, and Regulation (EU) 2024/1860 provided among other things for the gradual roll-out of Eudamed. To be read together with guidance such as MDCG 2019-11 on qualification and classification of software and MDCG 2019-16 rev.1 on cybersecurity.
Published: 2017-05-05
JIS
Std
Std
JIS T 2304:2017
JIS T 2304:2017 Medical device software - Software lifecycle processes (equivalent to IEC 62304:2006+Amd.1:2015)
This JIS standard specifies software lifecycle processes for embedded software in medical devices and Software as a Medical Device (SaMD), corresponding to IEC 62304:2006+Amendment 1:2015. The document defines development and maintenance requirements according to safety classes A, B, and C, establishing a comprehensive framework for software development activities. Originally enacted in 2006, the standard was revised in 2017 to align with the 2015 amendment of the international standard. Manufacturers must comply with this standard when developing medical device software to ensure systematic control of design, development, verification, validation, and post-market activities. The lifecycle processes encompass requirements analysis, design specification, implementation, verification, and validation phases tailored to device risk classification. This standard serves as a foundational requirement under the Pharmaceutical Affairs Law (Yakuhin Kikai Hou) for medical device approval and registration in Japan.
Published: 2017-03-01
IEC
IEC 82304-1:2016
Health software — Part 1: General requirements for product safety
Applies to health software intended to be operated on general-purpose computing platforms. Covers product safety requirements for the complete life cycle.
Published: 2016-10-01
ISO
ISO 13485:2016
Medical devices — Quality management systems — Requirements for regulatory purposes
Specifies requirements for a quality management system where an organization needs to demonstrate its ability to provide medical devices and related services.
Published: 2016-03-01
IMDRF
IMDRF/SaMD WG/N23 FINAL:2015
Software as a Medical Device (SaMD): Application of Quality Management System
IMDRF final document on applying a quality management system (QMS) to SaMD. It is aimed mainly at software development organizations that apply good software quality and engineering practices but may not be familiar with medical device QMS principles, and explains those principles from a software perspective. An effective QMS for SaMD is described in terms of three principles: leadership and organizational support, providing leadership, accountability, governance, and adequate resources to assure the safety, effectiveness, and performance of SaMD; SaMD lifecycle support processes, which are scalable for the size of the organization and applied consistently across all realization and use processes; and SaMD realization and use processes, covering activities from requirements through design, development, and verification and validation. The three principles are not separate series of processes: leadership and organizational support provides the foundation for the lifecycle support processes, which apply across the realization and use processes. The concepts in each section are related to clauses of ISO 13485:2003.
Published: 2015-10-02
IMDRF
IMDRF/MC/N35 FINAL:2015
Statement regarding Use of IEC 62304:2006 "Medical device software - Software life cycle processes"
Information document of the IMDRF Management Committee listing how IEC 62304:2006 (Medical device software – Software life cycle processes) is used in each jurisdiction's regulatory system (as of 2015). In Australia, compliance is used as evidence of meeting the Essential Principles; in Canada and the US, it is a recognized standard that can be used as evidence of conformity or for a declaration of conformity. In Europe, the corresponding EN 62304:2006 is a harmonized standard providing a presumption of conformity. In China, it has been adopted as the recommended (not mandatory) standard YY/T 0664-2008, while in Brazil and Russia the use of standards is voluntary. For Japan (MHLW/PMDA), the standard was not yet referred to, but could be used in a premarket application to rationally explain conformity with the Essential Principles. The document does not set out a common position or an interpretation of the standard.
Published: 2015-10-02
IEC
IEC 62304:2006+AMD1:2015
Medical device software — Software life cycle processes
Defines life cycle requirements for software in medical devices and in vitro diagnostic medical devices. Applies to development and maintenance of medical device software.
Published: 2015-06-01
IMDRF
IMDRF/SaMD WG/N12 FINAL:2014
Software as a Medical Device: Possible Framework for Risk Categorization and Corresponding Considerations
IMDRF final document proposing a possible framework for risk categorization of SaMD and the corresponding considerations. The category is determined by combining two factors: the significance of the information provided by the SaMD to the healthcare decision (treat or diagnose, drive clinical management, or inform clinical management) and the state of the healthcare situation or condition (critical, serious, or non-serious), resulting in four categories, I to IV, with treating or diagnosing a critical condition in the highest category (IV). The categories are relative and reflect the level of impact on the patient or public health, where accurate information provided by the SaMD is vital to avoid death, long-term disability, or other serious deterioration of health. Categorization relies on an accurate and complete SaMD definition statement. Other aspects, such as the transparency of inputs or technological characteristics, do not influence the category but inform the identification of considerations specific to a given SaMD, such as clinical evaluation, quality management, and information security.
Published: 2014-09-18
IMDRF
IMDRF/SaMD WG/N10 FINAL:2013
Software as a Medical Device (SaMD): Key Definitions
IMDRF final document setting out a common definition of SaMD and a reminder of related key terms. SaMD is defined as software intended to be used for one or more medical purposes that perform these purposes without being part of a hardware medical device, and the document converges on the term SaMD in place of terms such as "standalone software." Notes to the definition state that SaMD is a medical device and includes IVD medical devices; that it is capable of running on general purpose (non-medical purpose) computing platforms; that "without being part of" means the software is not necessary for a hardware medical device to achieve its intended medical purpose; that software intended to drive a hardware medical device does not meet the definition; that SaMD may be used in combination with (e.g., as a module) or interfaced with other products, including medical devices; and that mobile apps meeting the definition are SaMD. Software used to make or maintain a device is not considered SaMD. Relevant key terms previously defined in GHTF documents are also restated.
Published: 2013-12-18
NIST
SP
SP
SP 800-30 Rev. 1
Guide for Conducting Risk Assessments
The purpose of Special Publication 800-30 is to provide guidance for conducting risk assessments of federal information systems and organizations, amplifying the guidance in Special Publication 800-39. Risk assessments, carried out at all three tiers in the risk management hierarchy, are part of an overall risk management process—providing senior leaders/executives with the information needed to determine appropriate courses of action in response to identified risks.
Published: 2012-09-17
