Software regulatory compliance

It depends on the software’s intended use, target market, and regulatory context. There is no single set of requirements that applies to all life sciences software.

For medical device and IVD software, relevant frameworks may include the EU MDR or IVDR and FDA requirements in the US. IEC 62304 addresses medical device software lifecycle processes, ISO 14971 covers medical device risk management, and ISO 13485 applies to the manufacturer’s quality management system. Other requirements may include IEC 62366-1 for usability engineering, GDPR for personal data, or the EU AI Act for certain AI systems.

Software used in pharmaceutical or other GxP-regulated processes may instead require Computer System Validation (CSV) or Computer Software Assurance (CSA) approaches and controls related to 21 CFR Part 11 or EU GMP Annex 11.

At BioSistemika, we help you determine which requirements are relevant to your specific software and translate them into practical software development, testing, and documentation activities.

Whether software qualifies as medical device software (MDSW) depends primarily on its intended purpose and what the software does.

Software intended for a medical purpose, such as providing information used for diagnosis, monitoring, prediction, prognosis, or treatment, may qualify as a medical device. Software that only stores, transfers, or displays information may be treated differently.

In the EU, qualification and classification are assessed under the MDR or IVDR. The European Commission also publishes specific guidance on the qualification and classification of medical device software.

IEC 62304 defines lifecycle processes for the development and maintenance of medical device software. It applies when software is itself a medical device or is embedded in or forms an integral part of a medical device.

IEC 62304 uses three software safety classes based on the possible consequences of software failure: Class A, B, and C, with increasingly rigorous lifecycle activities required as software safety risk increases.

Determining the appropriate safety class early is important because it influences the development, documentation, verification, and maintenance activities required for the software.

Yes. We can review your software, architecture, requirements, documentation, testing, and development processes against the requirements relevant to your product.

We identify software-related gaps and provide practical recommendations to address them. This can be useful when preparing for certification or a regulatory submission, taking over legacy software, or making significant changes to an existing product.

If software qualifies as a medical device or IVD under the EU MDR or IVDR, the applicable conformity assessment requirements must be met before the device can be placed on the EU market with a CE mark.

The requirements depend on the software’s intended purpose and classification. Software development, risk management, usability engineering, cybersecurity, verification and validation, and technical documentation may all contribute evidence needed for conformity assessment.

BioSistemika can support the software-related development and documentation activities, while responsibility for regulatory compliance and CE marking remains with the legal manufacturer.

Yes. We develop software for medical devices and IVDs intended for regulated markets, including the EU and US.

We incorporate applicable software requirements into the development process, such as IEC 62304 software lifecycle activities, verification and validation, traceability, risk controls, cybersecurity, and technical documentation.

The manufacturer remains responsible for the regulatory strategy, product conformity, and market authorization, while we provide the software engineering expertise and evidence needed to support that process.

No. Well-developed and properly documented software is an important part of regulatory compliance, but software alone does not guarantee regulatory clearance, approval, certification, or CE marking.

For medical devices and IVDs, the regulatory outcome depends on the product as a whole, including its intended purpose, classification, risk management, clinical or performance evidence where applicable, technical documentation, quality management system, and the applicable regulatory pathway.

For example, in the US, medical devices may follow 510(k), De Novo, or Premarket Approval (PMA) pathways, depending on the device. In the EU, medical devices and IVDs must meet the applicable MDR or IVDR requirements for CE marking.

For laboratory, R&D, or pharmaceutical software that is not a medical device or IVD, different requirements may apply depending on its intended use—for example, GxP, Computer System Validation (CSV), Computer Software Assurance (CSA), 21 CFR Part 11, EU GMP Annex 11, or GDPR.

Yes. We help organizations identify and address compliance gaps before audits or regulatory submissions.

Our support may include reviewing software documentation, traceability, risk management, validation evidence, and development processes to help ensure your software is well prepared for regulatory review.