Navigating regulatory challenges across the life cycle of a SaMD

Objective: Software as medical devices (SaMDs) have become part of clinical practice and the management of the development and control processes of the documentation associated with them are an integral part of many medical realities. The European Regulation, MDR (EU) 2017/745, introduces a classification rule (rule 11, Annex VIII) specifically for software, which provides more explicit requirements than in the past, leading to classification of many software to higher risk and therefore to more complex certification processes. In this context, planning and awareness of possible regulatory strategies and related standards are fundamental for the key stakeholders, but this complex landscape can be perceived as fragmented. The aim of this work is to provide an amalgamated overview of how the current EU normative framework integrates into the various phases of the life-cycle of a medical device software, trying to ensure its safe and effective development. Methods: In addition to the MDR, the main normative references relevant to the medical device software sector were taken into consideration. Specifically, the IEC 62304 standard clarifies the main processes of the software life-cycle, including the analysis of problems and changes, and the IEC 82304 standard completes its management by addressing activities relating to post-market phases and requirements. In addition, the various steps include also key points such as risk identification and control (ISO 14971), design, implementation and validation of usability requirements (IEC 62366) and in general the quality of the context in which the software is developed and maintained (ISO 13485). The application of these standards can support the activities of the various stakeholders and facilitate evidence of compliance with the regulatory requirements by MDR. Results: Based on the software life cycle, a mapping of the requirements from the entire normative framework analyzed over the various phases was implemented. Conclusions: A detailed and integrated picture of the regulatory context behind the life cycle of a SaMD has been provided: this can facilitate the implementation of a balanced and effective approach, including key aspects, such as risk management and usability processes, and ensuring safety for the end user.