Guidance on Qualification and Classification of Software as a Medical Device in Regulation (EU) 2017/745

Cutting-edge technology has created paradigm shift in all facets of healthcare. Software has become a deeply rooted component of all products and is widely integrated into digital platforms that serve both medical and non-medical purposes. The introduction of EU MDR has placed stringent restrictions and heightened requirements on medical device manufacturers to improve device safety and performance. Interestingly, the MDR guidelines have also extended to digital health technologies and medical applications considering them as Medical Device Software (MDSW). Medical software manufacturers must now carefully consider the new regulatory requirements adopted by the European Parliament and Council in May 2017.

The European Commission’s Medical Device Coordination Group (MDCG) unveiled a Guidance on Qualification and Classification of Software in Regulation (EU) 2017/745 – MDR and Regulation (EU) 2017/746 – IVDR in October 2019. With the regulatory status of medical devices being obscure, the MDCG provide insights to manufacturers as to when software is regulated under the new EU MDR and Invitro Diagnostic Regulation (IVDR).

MDCG defines an active medical device as

“any device, the operation of which depends on a source of energy other than that generated by the human body for that purpose, or by gravity, and which acts by changing the density of, or converting that energy.”

The term Software as a medical device is defined by the MDCG as a set of instructions that processes input data (data provided through the use of a human data-input device) and creates output data (data produced by software) and are therefore deemed to be an active device as per the MDR guidelines. Medical device software is intended to drive/influence the use of a (hardware) medical device, used alone, or in combination, for a purpose as specified in the guidance document.

Your organization may benefit from the EU MDR consulting services offered by Celegence for a seamless transition to the new requirements with effective business outcomes.

The guideline lays out qualification criteria to clarify what type of software may subject to the regulations. The guideline states that the “Software must have a medical purpose on its own to be qualified as an MDSW.” 

Firstly, the manufacturer’s product must fulfill the definition of a “medical device”, “software”, or in vitro diagnostic medical device according to Article 2(1) of Regulation (EU) 2017/745 – MDR and/or Article 2(2) of Regulation (EU) 2017/746 – IVDR. The intended purpose of the software described by the manufacturer is relevant to qualifying the software as a device and further addressing its classification.

Implementation rules 3.3 and 3.5 described in the Regulation (EU) 2017/745 – MDR or Regulation (EU) 2017/746 – IVDR also respectively apply when the software is intended as an accessory to a medical device and does not meet the definition of a medical device or an in vitro diagnostic medical device.

The qualifying factors of software as a medical device is independent of the risk of harm to users (both patients and professionals) within a healthcare setup.

• Software that directly controls a medical device (hardware), providing immediate decision-triggering information intended to be used by healthcare professionals or patients (e.g. blood glucose meter software).
• Software that provides support for healthcare professionals (e.g. ECG interpretation software).
• Software intended to process, analyze, create, or modify medical information when the software is governed by a medical intended purpose (e.g. searching image for findings that support a clinical hypothesis as to the diagnosis or evolution of therapy)
• Independent software, by having its intended medical purpose

Software may be qualified as MDSW regardless of its location (e.g. operating in the cloud, on a computer, on a mobile phone, or as an additional functionality on a hardware medical device). With the transformational impact of technology shaping the medical device sector, Celegence’s expert team can provide regulatory guidance and supplement information on whether your device qualifies as a MDSW.

With regards to software medical devices, changes to classification have been a leading cause for concern. In classifying software as a medical device, Rules 9, 10, 11, 12, 13, 15, and 22 of Annex VIII EU-MDR 2017/745 are to be applied. Nearly all software medical devices are likely to be class IIa, or even class III (the highest risk category), where previously the majority have been class I. This potential up-classification can be attributed to the wide-phrasing of Rule 11 which was newly added to Annex VIII of the EU MDR.

This rule was issued with guidance from the International Medical Device Regulators Forum (IMDRF). The drafting of Rule 11 assigns a significant proportion of software medical devices to the higher classes and manufacturers have taken a cautionary approach to this rule. The implication of such strict wording has led to increase in class contingent irrespective of the probable innocuous function of the device itself. For e.g., in cases were the software performs a relatively simple function, but if the resulting decision of the device itself could impact the well-being of the patient, the device is awarded the highest risk category. This may place additional strain on the manufacturer to place the device on market.

The Medical Device Coordination Group (MDCG) Guidance on Qualification and Classification of Software, appears to soften the impact of Rule 11, providing greater clarity with regards to classification of software medical devices. It particularly describes and categorizes the significance of the information provided by an active device to the patient management in combination with patient condition by dividing them into three sub-rules.

For further details on classification rules, please refer to:
Guidance on Qualification and Classification of Software in Regulation (EU) 2017/745 – MDR and Regulation (EU) 2017/746 – IVDR

Rapidly improving technology has made Software medical devices increasingly prevalent in the healthcare sector. Securing data being stored or processed by MDSW’s has become a valid concern for manufacturers not only in the development phase but also during the product maintenance.

Susceptibility to malware is a scaling concern as the software component in several MSDW’s becomes more complex. Manufacturers must be prepared to assess security risks, detect compromise, and recover from any data breach incidents.

Designing patent protection and copyright registrations are some of the primary measures that can be taken to protect MDSW’s. Additionally, cybersecurity measures based on cryptography, digital signatures, and frequent integrity checks, may help protect system programs and data against unauthorized manipulation.

In conclusion, increased use of software as medical devices has undeniably improved several aspects of patient care and management. However, security breach of MSDW’s has presented itself as a justifiable risk and this may present as a challenge to the manufacturer and regulatory agencies to ensure adherence to conformity assessments.

The qualification criteria and classification rules detailed in the EU regulation – 2017/745 – MDR and 2017/746 – IVDR addresses gaps between standalone and incorporated software devices. The requirements help manufacturers and agencies navigate through a well laid out system while the stringent guidelines also drive manufacturers to adopt continued data protection measures.

Ensuring precise classification, adequate clinical evidence, and appropriate risk mitigation procedures play key roles in addressing and improving patient safety and device performance to successfully place a device on the market.

• Software must adhere to the definition of a medical device under the MDR
• To classify a software, key questions pertaining to the devices intended use and purpose must be answered
• Implementation rules of Annex VIII help address the applicability of software:
  • Implementation Rule 3.3, states that ‘Software, which drives or influences the use of a device, shall fall within the same class as the device’ and ‘If software is independent of any other device, it shall be classified in its own right’
  • Implementing rule 3.5 states ‘If several rules, or if, within the same rule, several sub-rules, apply to the same device based on the device’s intended purpose, the strictest rule and sub-rule resulting in higher classification will apply’
• Up-classification of MSDW’s will require approval from notified body prior to marketing in the EU

While you integrate modern product development methodology to compete with fast-paced innovation, partner with Celegence to ensure regulatory compliance of your MDSW to successfully place the device on the market.