The final version does not deviate substantially from the draft published in 2021 and is a significant improvement/update to the expectations in the 2005 version. Below are important points to keep in mind:
- The definition of what types of software are subject to “enhanced documentation” requirements has been clarified. The final guidance states that this level of documentation applies “where a failure or flaw . . . could present a hazardous situation with a probable risk of death or serious injury, either to a patient, user of the device, or others in the environment of use.” Keep in mind that not meeting this definition does not mean you have reduced documentation requirements; it merely means that you have less documentation that you have to submit for premarket review by the Agency. Also, keep in mind that you have to have a robust Risk Management File to determine what documentation level is applicable.
- The guidance clarifies that any software development lifecycle model is acceptable but indicates that, the creation of documentation “retrospectively or following a prolonged period of time after actual software development, verification, and validation . . . could raise concerns regarding whether a developer has adequate control of the design process.” This is an important point that digital health and Digital Therapeutics companies need to understand. The expectation is that a) you have a Quality System in place *before* you develop your software and b) the documentation demonstrating compliance with your QS is generated contemporaneously to the development activities.
- The level of sophistication of the documentation (particularly the System & Software Architecture Diagram) has increased significantly. Don’t forget the importance of strong Risk Management and cybersecurity documentation. The documentation (for all Medical Devices) must “demonstrate that planning, requirements, risk assessment, design reviews, traceability, change management, testing plans and results, and other aspects of good software engineering . . . were employed, to support a conclusion that the device software function was appropriately designed, verified, and validated.
- The FDA is giving industry 60 days (i.e., until August 14, 2023) to “operationalize the recommendations discussed” in the guidance. That means that a) you should immediately update your QMS procedures to be consistent with the guidance (and, of course, train your teams about the expectations going forward), and b) either get your submission in before the transition period ends or plan to re-work any submission currently under development.
