Research & Development
Software as a Medical Device.
From classification and IEC 62304-compliant development to FDA submission: We support your SaMD projects from architecture through to market approval.
Why do SaMD projects fail to gain approval?
Software classified as a medical device is subject to the same regulatory requirements as hardware—but is often treated like an IT project:
- Failure to classify: MDR Rule 11 and FDA 21 CFR Part 820 are considered too late in the development cycle. The risk class determines the entire regulatory pathway—and thus the effort, timeline, and costs.
- IEC 62304 not integrated: The software lifecycle is not structured in accordance with IEC 62304 from the outset. Software architecture, modularization, and change management are missing from the documentation.
- AI/ML Special Cases: Adaptive algorithms require Predetermined Change Control Plans (PCCP) in accordance with the FDA AI/ML Framework. Without such a plan, market authorization for learning systems is not possible.
- Cybersecurity as an afterthought: The FDA’s Premarket Cybersecurity Guidance (2023) and EU MDCG 2019-16 require threat modeling and SBOMs from day one—not as a final step in the review process.
Is your software architecture documented in such a way that an FDA reviewer can understand the safety classification level of each software unit?
Our SaMD services.
We bring regulatory precision to agile software development—without slowing down your development process.
SaMD Classification & Regulatory Strategy
Classification according to MDR Rule 11, the IMDRF SaMD Framework, and the FDA De Novo / 510(k) / PMA processes. We identify the most efficient regulatory pathway and develop a regulatory strategy, including a predicate device analysis.
IEC 62304 Software Life Cycle
Establishment of an IEC 62304-compliant development process: Software Development Plan, Architecture Design, Unit/Integration/System Testing. Seamless integration into agile frameworks (Scrum, SAFe) with full traceability.
AI/ML Regulatory Framework
Development of Predetermined Change Control Plans (PCCP) in accordance with the FDA AI/ML Action Plan. Documentation of algorithm training and validation, bias analysis, and continuous learning protocols for adaptive algorithms.
Cybersecurity & SBOM
Threat modeling (STRIDE/DREAD), Software Bill of Materials (SBOM), and vulnerability disclosure in accordance with the FDA’s Premarket Cybersecurity Guidance and MDCG 2019-16. Penetration testing and security risk assessment.
Frequently Asked Questions About Software as a Medical Device.
When is software considered a medical device?
Software is considered a medical device (SaMD) if it independently serves a medical purpose—such as diagnostic support, treatment recommendations, or patient monitoring. The decisive factor is the intended use, not the platform. A smartphone app can be a Class IIb medical device.
What is the difference between SaMD and SiMD?
SaMD (Software as a Medical Device) is standalone software intended for medical use. SiMD (Software in a Medical Device) is software embedded in a physical medical device. Both are subject to IEC 62304, but SaMD has its own classification rules (MDR Rule 11, IMDRF).
Can we use agile development and still comply with IEC 62304?
Yes. IEC 62304 does not require the use of the waterfall methodology. Agile development is fully compatible provided that sprint artifacts are correctly mapped to the required lifecycle documents: user stories → software requirements, sprint reviews → design reviews, definition of done → verification.
What are the FDA's requirements for AI/ML-based medical devices?
The FDA requires a Predetermined Change Control Plan (PCCP) that describes how the algorithm may be modified after market launch. Additionally: Good Machine Learning Practice (GMLP), documentation of training data, bias mitigation, and real-world performance monitoring.
Related engineering topics.
Expertise
Cybersecurity for Medical Devices
FDA Premarket Guidance, Threat Modeling, and SBOM Requirements.
ExpertiseDesign Controls
DHF, traceability, and V&V in accordance with ISO 13485 and 21 CFR 820.
ExpertiseVerification & Validation
Formal verification and validation methodology for software and hardware.
Software that wins over government agencies.
Describe your SaMD project—our experts will show you the most efficient approval pathway.