MDx to Present ESMO 2025 Poster on IVDR CE Marking for Large Germline NGS Panels

Announcement

MDx will present a peer-reviewed poster at the ESMO Congress 2025 in Berlin detailing how our team helped secure IVDR CE marking for a large, service-based germline NGS solution that integrates wet-lab workflows with a validated bioinformatics pipeline. The poster distills a practical, audit-proven pathway that labs and IVD developers can apply when scaling evidence, validating software, and navigating notified-body reviews for complex NGS offerings.

What the poster covers

  • Regulatory strategy and intended use: How to right-size scope for very large panels while planning for future expansion.
  • Technical documentation: Building Annex II/III files that stand up to Stage I/II audits, including labeling/IFU for service-based models.
  • Software validation: Applying IEC 62304/82304 rigor to a bioinformatics pipeline (architecture, V&V, cybersecurity, change control).
  • Evidence at scale: A tiered approach to scientific validity and clinical performance, plus a pragmatic PMPF plan to mature low-prevalence evidence.
  • Operationalization: Supplier controls, change management, and QMS integration to sustain post-market scalability.

Why this matters

Large NGS panels pose unique IVDR hurdles: non-uniform clinical evidence across thousands of genes, evolving variant knowledge, third-party components without CE marking, and the need to validate bioinformatics as SaMD. By sharing a repeatable pathway and the pitfalls we overcame, this poster offers concrete guidance to shorten timelines without compromising quality or compliance.

When and where to find us

ESMO Congress 2025 takes place 17–21 October in Berlin, Germany. We will publish our poster board number and presentation time here as soon as the session logistics are confirmed by the organizers. If you’re attending, we’d love to meet to discuss your IVDR roadmap.

Read the background

For context on the underlying program and its market impact, explore the public write-ups:

Plan a meeting

Ready to talk IVDR CE marking for your NGS product?

Use our contact form to request a 30-minute slot with our regulatory and bioinformatics leads during ESMO 2025, or schedule a virtual follow-up the week after the congress.

Industry Insights & Regulatory Updates

IVDR CE marking NGS: MDx Case Study with Fulgent

At a glance

  • Outcome: CE mark granted by TÜV SÜD for an end-to-end Class C germline NGS solution (wet lab + bioinformatics).
  • Scope: Furthermore, panel covering 4,600+ clinically relevant genes with a validated PLM (Pipeline Manager) software component; later expanded to >7,000 genes using a new probe set.
  • What we did: Specifically, we built an ISO 13485 QMS from the ground up, prepared full Annex II + III technical documentation, validated bioinformatics under IEC 62304/82304, split documentation into two Basic UDI-DIs (wet lab vs. software), and guided Stage I/II audits.
  • Why it matters: Ultimately, this demonstrates a repeatable pathway to IVDR certification for large NGS services and software—something that had no clear precedent.

Read the announcements: For details, read the Fulgent press release and Citeline case study.

The challenge: certifying a service-based, large-scale NGS system under IVDR

To begin with, FulgentExome is a service-based NGS solution that integrates wet-lab workflows with the Fulgent PLM bioinformatics pipeline. As a result, pursuing IVDR certification meant converting a mature CLIA/CAP testing service into a CE-marked IVD system with robust evidence across scientific validity, analytical performance, and clinical performance—for thousands of genes. In particular, key hurdles included: defining intended use at scale; validating third-party components; proving scientific validity across 4,600+ genes; above all fully validating the bioinformatics pipeline under medical device software standards.

MDx approach: a playbook for complex NGS + software

1) Build the right QMS, fast

First, we performed an IVDR GAP assessment. Next, we designed and implemented an ISO 13485-compliant QMS with risk management, supplier control, document control, internal audits, and management review—migrating from a CLIA/CAP model to IVDR-ready operations.

2) Engineer a defensible intended use

Meanwhile, the intended-use statement evolved iteratively—from an initial ~300-gene scope to whole-exome, finally landing on 4,600+ genes aligned to available clinical and analytical evidence. In the end, the final language was future-proofed to support rapid updates as evidence expands.

3) Split wet lab and software into two regulated products

Afterward, following round 1 review feedback, we separated the documentation into two Basic UDI-DIs—FulgentExome (wet lab) and Fulgent PLM (software)—to align with IVDR expectations for traceability and lifecycle control. Consequently, this restructuring sharpened conformity assessment and accelerated subsequent approvals.

4) Validate the informatics stack like a medical device

In parallel, we validated PLM under IEC 62304/82304, including architecture, version control, cybersecurity, verification/validation, and integration with external databases. Therefore, the result was a fully evidence-backed bioinformatics pipeline capable of reproducible, high-confidence variant calling and reporting.

5) Make “evidence at scale” practical

  • First, Scientific validity: Three-tier strategy combining validation of exome sequencing as an approach, reliance on curated public databases, and deep exemplars for a large subset of genes.
  • Second, Clinical performance: Leveraged routine testing experience (thousands of positives) to focus clinical evidence on high-prevalence genes, and instituted a robust PMPF strategy to continuously strengthen low-prevalence areas.

6) Orchestrate TÜV SÜD audits to success

  • Initially, Stage I confirmed documentation readiness, scope, Basic UDI-DIs and integration of IVDR processes into daily practice.
  • Subsequently, Stage II verified on-the-floor implementation of SOPs, training, competence, CAPA and change control—closing findings on short cycles to hit NB timelines.

Results that move the market

  • CE mark granted for FulgentExome & Fulgent PLM—among the first end-to-end Class C germline NGS solutions under IVDR.
  • Certified scope covers 4,600+ genes, positioning Fulgent as a reference lab for comprehensive hereditary disease testing serving European patients.
  • Post-certification, the platform scaled to >7,000 genes using a new probe set—demonstrating the inherent scalability built into the certified system (process, documentation, and change control).
  • Strengthened competitive standing in the EU diagnostics market; public communications highlight the magnitude of this achievement for large NGS panels.

Read more in the Fulgent press release and Citeline’s in-depth article.

What this means for labs and IVD developers planning large NGS submissions

If you operate an LDT today: you’ll need to translate CLIA/15189 practices into an ISO 13485 framework, document design controls, and produce a full PER (PEP/PER), APR, SVR, PMS/PMPF, SSP, and labeling/IFU aligned to GSPR. Expect to validate any bioinformatics pipeline as SaMD with IEC 62304/82304 and cybersecurity controls.

If your panel is “large”: you likely won’t have uniform clinical data across every gene. A structured tiered evidence model + PMPF can satisfy Notified Bodies while keeping your roadmap scalable.

If you combine wet lab + software: plan for separate Basic UDI-DIs and documentation sets. Treat the pipeline as a product with its own requirements, verification, and risk controls.

Why MDx

  • End-to-end IVDR expertise: From regulatory strategy & classification to Annex II/III technical files, PER/SVR/APR, training, and mock NB reviews.
  • Clinical performance studies: We design, run, and report ISO 20916 studies (protocols, eTMF, monitoring, biostats, PER alignment), and we can act as delegated sponsor for multi-country submissions—100% submission success rate to date.
  • Operational scale: ISO 9001 clinical QMS, EU/US partner network, multilingual CRAs, and a repeatable process honed on 60+ performance study submissions for top IVD and pharma clients.

Project timeline

Our joint project with Fulgent spanned July 2023–July 2025, with overlapping tracks for QMS creation, technical documentation, NB review, and Stage I/II audits—a coordinated plan that allowed rapid closure of findings and post-certification scaling.

Client perspective

The program demanded evening/weekend execution across regulatory, documentation, and project management to meet Notified Body timelines—effort that, in the client’s words, made all the difference in achieving what initially “seemed almost impossible.

Planning IVDR for your NGS panel? Here’s a quick readiness checklist

  • Intended use aligned to evidence (and future updates)
  • ISO 13485 QMS with software lifecycle integration
  • PER (PEP/PER), SVR, APR mapped to gene-level strategy
  • PLM/DR pipeline validated per IEC 62304/82304 (+cybersecurity)
  • Separate documentation/UDI for wet lab vs. software (if applicable)
  • PMS/PMPF plan to mature low-prevalence evidence post-market
  • Mock NB review + Stage I/II audit readiness

(Our team can lead or co-author each artifact above.)

Talk to us

Whether you’re certifying a focused oncology panel or pushing the limits with exome-scale content, MDx brings the cross-functional regulatory, clinical, quality, and software depth to make it possible—on a timeline that keeps your business competitive.

Written by:
Carlos Galamba

Carlos Galamba

CEO

Senior regulatory leader and former BSI IVDR reviewer with deep experience in CE marking high-risk IVDs, companion diagnostics, and IVDR implementation.
Industry Insights & Regulatory Updates

How many MedTech companies are there in Europe?

Europe’s MedTech Landscape in 2025: 38,000+ Companies Driving Innovation

Europe is home to one of the world’s most dynamic and diverse medical technology ecosystems, with more than 38,000 MedTech companies operating across the continent. The vast majority—over 90%—are small and medium-sized enterprises (SMEs), playing a critical role in driving innovation, improving healthcare outcomes, and fueling economic growth .

What Defines Europe’s MedTech Industry?

According to MedTech Europe, the sector includes manufacturers of medical devices, in vitro diagnostics (IVDs), and digital health solutions, spanning everything from surgical tools to AI-powered diagnostic platforms. In total, the industry employs over 930,000 people directly, making it one of the largest employers in Europe’s life sciences space .

Why It Matters for Clinical and Regulatory Success

With the growing complexity of EU MDR and IVDR regulations, these companies—especially SMEs—face increasing pressure to:

  • Prove clinical evidence and safety of their technologies
  • Navigate Notified Body reviews and CE Marking
  • Manage post-market surveillance (PMS) and performance evaluations

That’s where MDx CRO steps in.

Supporting Europe’s MedTech Growth

At MDx CRO, we specialize in helping MedTech innovators—from start-ups to established manufacturers—successfully plan, execute, and submit their clinical and regulatory strategies across the EU and global markets. With proven expertise in:

We partner with both large diagnostic leaders and agile SMEs to deliver compliant, high-quality, and market-ready solutions.

A Pan-European Presence

With offices in Barcelona, Madrid, Lisbon, and London, and a network of CRAs and regulatory experts across Europe, MDx provides localized insight with global reach—helping MedTech companies meet requirements faster and smarter.

The Bottom Line

The European MedTech sector is growing—but so are its regulatory challenges. Whether you’re launching a new diagnostic product or preparing for a Notified Body audit, MDx CRO is here to support your success every step of the way.

Let’s talk about your next clinical or regulatory challenge.

Industry Insights & Regulatory Updates

ISO 13485 Implementation Guide: How to Stand Up a World-Class QMS (and Win Faster Market Access)

For MedTech and diagnostics companies, ISO 13485:2016 is the operating system for quality. It’s the globally recognized standard that regulators and notified bodies expect you to use to design, manufacture, and maintain safe, effective devices across the full lifecycle. Implement it well and you accelerate technical documentation, reduce rework, and shorten time-to-market. Implement it poorly and every audit, change, and submission becomes harder than it should be.

There’s an additional strategic reason to act now: the U.S. FDA’s Quality Management System Regulation (QMSR) formally converges 21 CFR 820 with ISO 13485:2016. The QMSR’s effective date is February 2, 2026, with a two-year transition from the legacy QS Reg—so a robust ISO 13485 QMS positions you for both EU and U.S. expectations. (QMSR overview PDF).

What ISO 13485 actually requires (and how to build it right)

At its core, ISO 13485 demands a documented, controlled set of interrelated processes that meet regulatory requirements for medical devices—from design and production to post-market activities. Success is not about templates; it’s about process architecture, risk-based decision-making, and evidence you can defend. (ISO 13485 handbook preview).

1) Map your process architecture

Start with a top-level map that shows how design & development, purchasing/supplier control, production & service provision, software validation (for QMS and process software), vigilance, and post-market processes interact. Keep ownership clear; keep inputs/outputs traceable.

2) Make risk management the backbone

ISO 13485 expects risk-based controls throughout realization and post-market feedback. Operationalize ISO 14971:2019 (and ISO/TR 24971 guidance) so hazards, risk controls, and residual risk tie directly into design inputs, verification/validation, and change control.

3) Design controls that satisfy NB and FDA reviewers

Build a single D&D framework that covers planning, inputs/outputs, reviews, verification, validation (including clinical/performance where applicable), transfer, and DHF/Design History File traceability. Link your design plans to intended purpose/indications so your technical documentation aligns with MDR/IVDR and (when applicable) FDA submissions.

4) Supplier & software rigor

Qualify and monitor critical suppliers with risk-based controls; embed incoming inspection and performance metrics. Validate QMS/production software proportional to risk and document configuration management so you can pass objective evidence reviews.

5) Document control that scales

Use a lean document hierarchy (policy → process → work instruction → form) and number it so auditors can navigate quickly. Automate change control and training effectiveness checks; link each controlled record to the process requirement it satisfies.

6) Post-market surveillance that drives improvement

Your PMS loop should systematically capture complaints, feedback, vigilance, field actions, and real-world performance. Close the loop with CAPA and management review using trend analysis and risk re-evaluation.

7) Internal audits and management review that add value

Audit for process performance (not just procedural conformance). Track effectiveness KPIs and feed them into management review alongside regulatory metrics (e.g., NB queries, submission outcomes, vigilance timelines).

EU alignment matters: harmonized EN ISO 13485 and MDR/IVDR

In Europe, EN ISO 13485:2016 (including A11:2021 and AC:2018) is recognized as a harmonized standard supporting MDR/IVDR requirements—useful for presumption of conformity where applicable. Aligning your QMS to the harmonized edition reduces friction in notified body assessments and surveillance.

Implementation roadmap (what works in the real world)

  • Phase 1 — Gap Assessment & Plan: Benchmark current practices against ISO 13485 clauses, ISO 14971 integration points, and your market strategy (EU MDR/IVDR, FDA QMSR). Produce a prioritized remediation plan with owners and dates.
  • Phase 2 — Process Build & Evidence: Draft/revise procedures; pilot them with one product line to generate real records (design plan, risk files, supplier files, software validation, training, internal audit).
  • Phase 3 — System Activation: Roll out across programs; execute internal audit cycle and management review with measurable outcomes.
  • Phase 4 — NB/FDA Readiness: Run a mock audit; fix systemic findings; align technical documentation index to QMS records; confirm personnel qualification and training effectiveness.

Avoid the top 5 pitfalls we see

  • Building dozens of procedures without a process map (auditors get lost; so do teams).
  • Treating risk management as a document, not a process that drives design and post-market decisions.
  • Weak supplier controls for critical components and software.
  • Software validation that stops at IQ/OQ and misses real-world configurations.
  • “One-and-done” internal audits that don’t test effectiveness or feed CAPA.

How MDx CRO makes ISO 13485 implementation faster (and audit-proof)

MDx CRO designs right-sized 13485 systems for MedTech and diagnostics teams—from first-time implementations to remediation before NB or FDA inspections. We build the process architecture, author and train on lean SOPs, integrate ISO 14971 risk into day-to-day decision-making, and generate submission-ready evidence. Then we run mock audits that mirror NB/FDA styles so you walk into the real thing prepared.

Explore Regulatory & Quality Services and Clinical & Post-Market Support, or contact MDx CRO to scope your ISO 13485 program.

Industry Insights & Regulatory Updates

A Step-by-Step Guide to IEC 62366 and Usability Engineering

The usability of medical devices is not just a matter of convenience. It is a matter of safety, effectiveness, and regulatory compliance. Poor design that confuses or frustrates users can lead to use errors, adverse events, and even patient harm. To address this, the international standard IEC 62366-1:2015/Amd 1:2020 establishes a structured framework for usability engineering in medical device development.

For medical device manufacturers, understanding and applying IEC 62366 is essential. Compliance demonstrates that usability risks have been identified, reduced, and documented, which is essential for all medical devices including IVDs and Software as a Medical Device (SaMD).

What Is IEC 62366?

IEC 62366 is the internationally recognised standard that defines how to integrate usability into the design and development process.

It has two main parts:

  • IEC 62366-1:2015/Amd 1:2020 Medical devices – Application of usability engineering to medical devices: The core standard describing the usability engineering process.
  • IEC/TR 62366-2:2016 Medical devices – Guidance on the application of usability engineering to medical devices: A technical report providing guidance and examples to support implementation.

The goal is to ensure that usability engineering is applied consistently so that devices can be used safely and effectively by intended users, in intended use environments, while ensuring that use errors that could lead to harm are identified, reduced, and controlled through structured usability activities.

Why Usability Engineering Matters

Use-related errors are a leading cause of device-related adverse events. By embedding usability engineering into product development, manufacturers can:

  • Reduce use errors that could lead to harm
  • Improve patient safety and treatment outcomes
  • Satisfy regulatory requirements from the MDR, IVDR, and FDA
  • Increase user acceptance and market success
  • Lower long-term costs by avoiding redesigns or recalls

In short, usability is both a compliance requirement and a competitive advantage.

Step-by-Step Guide to Applying IEC 62366

The usability engineering process defined in IEC 62366 is systematic and iterative. It integrates into the overall product development lifecycle and risk management process in line with ISO 14971. Below is a step-by-step breakdown.

Step-by-step visual guide illustrating the IEC 62366 usability engineering process for medical devices, covering intended use definition, hazard identification, risk analysis, user interface requirements, formative evaluations, and summative usability validation, aligned with EU MDR and FDA human factors guidelines.

The UEF is the central documentation repository for all usability activities. It includes intended use, user profiles, use scenarios, hazard analysis, test results, and risk control measures. In practice, the records and other documents that form the UEF may also form part of the product design file (ISO 13485) or the risk management file (ISO 14971).

Think of the UEF as both a project management tool and evidence for regulators.

Prepare the Use Specification. This is where you define:

  • The intended medical purpose of the device
  • The user groups (e.g. clinicians, patients, laypersons, caregivers)
  • The use environments (hospitals, homes, ambulances, clinics)
  • Any training or expertise required

This forms the foundation of all subsequent usability activities.

Once you know who will use your device and where, the next step is to analyse how things could go wrong.

Activities include:

  • Identifying safety-related user interface characteristics (e.g. readability of displays, button layout, alarm visibility).
  • Reviewing post-production data and public databases for known usability issues with similar devices.
  • Identifying hazards and hazardous situations.
  • Identifying and describing hazard-related use scenarios, which describe exactly how use errors might occur and what consequences they could have.
  • Selecting hazard-related use scenarios for Summative Evaluation.

These scenarios are then prioritised to decide which will be evaluated in summative testing.

This is where design and usability testing happen in iterative cycles.

Key steps:

  1. Establish the User Interface Specification – the blueprint of all UI elements.
  2. Develop the User Interface Evaluation Plan – define how formative and summative testing will be performed.
  3. Iterative cycles of concept, prototype, and testing

The point of formative evaluation is to find usability issues early, before final validation, so changes are cheaper and less disruptive.

The final stage is a summative usability validation. This is a formal test that demonstrates to regulators that the device can be used safely and effectively by the intended users.

  • Test the hazard-related use scenarios identified earlier.
  • Use representative users in realistic environments.
  • Collect both objective performance data (task completion, error rates) and subjective feedback (ease of use, confidence).
  • Confirm that residual risks are acceptable in line with ISO 14971.

This stage provides the objective evidence regulators require to ensure compliance.

Usability engineering does not end at product launch. Post-market surveillance should collect feedback on usability issues, adverse events, and complaints. Updates or design changes may be required if new risks emerge.

Common Challenges in Applying IEC 62366

Many manufacturers encounter difficulties such as:

  • Underestimating resources needed for usability testing
  • Recruiting representative users for formative and validation studies
  • Defining realistic use scenarios that reflect actual clinical environments
  • Integrating usability with development timelines
  • Documenting evidence properly in the UEF

Failing to address these challenges can result in regulatory rejection, delays, or costly redesigns.

Best Practices for Success

  1. Start usability engineering early in the design process
  2. Involve multidisciplinary teams including engineers, clinicians, and usability experts
  3. Use a mix of qualitative and quantitative methods in evaluations
  4. Prioritise hazard-related use scenarios in validation testing
  5. Document everything thoroughly in the Usability Engineering File
  6. Where possible involve regulators early for alignment
  7. Leverage specialist expertise such as a Medical Device and IVD Consultancy with usability engineering experience

How MDx CRO Can Help

Implementing IEC 62366 in-house can strain resources. At MDx CRO we can provide:

  • Protocol development and study design for usability testing
  • Recruitment of representative users across geographies
  • Moderation of formative and validation studies
  • Integration of usability engineering with regulatory strategy
  • Preparation of all usability documentation required for submissions including FDA submissions

As a trusted Medical Device and IVD consultancy, we support manufacturers in implementing IEC 62366, running usability studies, and preparing documentation that satisfies both EU and US regulators. Whether you are starting a new project or updating an existing device, our team helps you achieve compliance and deliver safer devices to market.

Does the FDA also recognise IEC 62366?

Yes. The latest versions of the IEC 62366 standards are recognised by the FDA as consensus standards. However, the FDA has also published specific human factors engineering guidances with minor differences to IEC 62366 so it is recommended that these are also considered for FDA submissions.

When should usability testing be performed?

Throughout development. Formative evaluations identify and correct issues early, while summative validation confirms safe and effective use before market approval.

Can simulated environments be accepted in usability validation?

Yes, provided they are representative of real-world conditions and cover all critical tasks and hazard-related use scenarios.

Written by:
Floella Otudeko

Floella Otudeko

Senior QARA Specialist

Senior QA/RA consultant with MDR, IVDR, Usability/Human Factors and MDSW expertise, supporting MedTech and IVD innovation globally.
Industry Insights & Regulatory Updates

SaMD Compliance Guide: Navigating Regulations for Software as a Medical Device

In an era where digital health, telemedicine, and AI-driven diagnostics are becoming mainstream, Software as a Medical Device (SaMD) is no longer a niche concept; it stands as a core pillar of modern healthcare innovation. Yet, delivering a safe, effective, and compliant SaMD product in Europe requires careful navigation of complex regulatory regimes.

For companies and regulatory affairs teams, successful market access in the European Union means meeting the demands of the EU Medical Device Regulation (MDR, Regulation (EU) 2017/745) and, increasingly, the EU Artificial Intelligence Act (AI Act, Regulation (EU) 2024/1689). Together, this combined regime shapes how developers design, validate, monitor, and maintain software with medical functionality.

This SaMD Compliance Guide presents a concise, European-focused overview. You’ll find:

  • How to determine if your software qualifies as SaMD
  • Key requirements under the MDR (classification, conformity, clinical evaluation, post-market)
  • Best practices, pitfalls, and strategic recommendations

1. Defining SaMD: What Qualifies?

What is SaMD?

The International Medical Device Regulators Forum (IMDRF) defines SaMD as:
“Software intended to be used for one or more medical purposes that perform these purposes without being part of a hardware medical device.”

In the EU context, and based on MDCG 2019-11, software qualifies as a medical device when the manufacturer’s intended purpose includes diagnosis, prevention, monitoring, prediction, prognosis, treatment, or alleviation of disease.

Key determinants

  • Intended medical function (not administrative, not purely wellness)
  • Standalone operation; the software does not need to embed in medical hardware
  • Potentially autonomous action (e.g., cloud-based analysis)

Examples (and non-examples)

Typical SaMD examples

  • An AI-based image analysis tool that assists radiologists in detecting tumors
  • A mobile app that predicts hypoglycemic events for diabetic patients
  • A cloud algorithm that classifies ECG signals to detect arrhythmias

Non-SaMD (or out-of-scope) software

  • A healthcare facility’s scheduling or billing software
  • A fitness tracker app for general wellness (unless marketed for disease diagnosis)
  • A general-purpose image viewer used in the clinic but not intended for diagnosis

Because the line can be subtle, regulatory teams should document a short justification for whether software is—or is not—a medical device, supported by functional claims, labeling, and architecture.

2. The EU MDR Framework for SaMD

Classification: Rule 11 for Software

Annex VIII of MDR includes Rule 11, which addresses software risk classification. Under Rule 11:

  • If the software informs decisions for diagnostic or therapeutic purposes, it often lands in Class IIa, IIb, or even Class III, depending on risk and the consequences of error.
  • If the software monitors physiological processes, it may fall in Class IIa or IIb.
  • Software intended for administrative or non-medical functions typically falls in Class I.

Because many advanced SaMD tools now trigger Notified Body oversight, developers should plan conformity assessments, clinical evaluation, and documentation accordingly.

The MDR Compliance Roadmap

To achieve CE marking under MDR, follow these essential steps:

  • Intended Purpose & Use Context – Define the intended medical purpose, user groups, environment, contraindications, and usage scenarios with precision.
  • Risk Management (ISO 14971) – Identify hazards and mitigate risks, including software bugs, algorithm drift, cybersecurity intrusion, and data errors. Manage risk across the full lifecycle (design, validation, deployment, maintenance).
  • Quality Management (ISO 13485) – Operate under a QMS that addresses design control, configuration management, change control, CAPA, and supplier management.
  • Software Lifecycle (IEC 62304 / 82304-1) – Use recognized lifecycle standards to structure architecture, module-level design, verification and validation, maintenance, and configuration.
  • Clinical Evaluation (MDCG 2020-1) – Demonstrate clinical benefit and performance with fit-for-purpose evidence.
  • Technical Documentation (Annex II/III) – Include architecture, risk analysis, verification, usability, labeling, and performance claims.
  • Conformity Assessment – For Class I(s/m/r), IIa and above, a Notified Body reviews your QMS and technical documentation and performs audits.
  • CE Marking & Declaration of Conformity – Once you demonstrate conformity, apply the CE mark and sign the DoC to enter the EU market.
  • Post-Market Surveillance – Maintain PMS and PSUR, and integrate performance data and AI monitoring logs.
  • Software Updates and Change Control – Analyze each change—functional, algorithmic, or data-driven—to decide whether it represents a significant change that requires re-assessment.

3. Cybersecurity and Lifecycle Protection

Cybersecurity should start at design and continue through maintenance. The main requirements include:

  • Ensure confidentiality, integrity, and availability (CIA) throughout the lifecycle
  • Define minimum IT requirements and secure configurations
  • Implement verification and validation of security controls
  • Provide clear IFU instructions on data protection, updates, and secure disposal (GSPR 13.6)
  • Maintain a post-market security plan to track vulnerabilities and manage patches

4. Challenges, Risks & Strategic Recommendations

ChallengeMitigation / Best Practice
Unclear intended purpose or software classificationDefine the medical purpose at project initiation. Align IFU, labeling, marketing, and technical files with intended use and Rule 11 logic.
Insufficient clinical/performance evidenceUse prospective studies or robust real-world performance evaluations aligned with MDR Annex XIV and, where applicable, AI Act testing provisions.
Data quality and representativenessImplement data governance for acquisition, preprocessing, and validation. Ensure datasets represent the intended patient population and use context.
Transparency and user comprehensionProvide clinically interpretable outputs. Explain functionality, limitations, and user responsibilities in the IFU and training materials.
Traceability gaps between requirements, risks, and testsMaintain a requirements-to-verification traceability matrix that links requirements, risk controls, verification results, and clinical claims.
Software updates and regulatory impactEstablish change management to evaluate whether updates are significant and require re-assessment. Integrate these controls into the QMS.
Regulatory and Notified Body capacity constraintsEngage early with a qualified Notified Body. Provide clear, harmonized documentation to streamline assessments.
Evolving standards and regulatory guidanceMonitor new EU and MDCG guidance and standards (ISO 14971, ISO 13485, IEC 62304, IEC 81001-5-1) and the EU AI Act. Review QMS procedures periodically to stay aligned.

5. Conclusion

Delivering safe and compliant Software as a Medical Device (SaMD) requires a structured approach that integrates regulatory, technical, and quality considerations across the lifecycle. Compliance with the EU MDR ensures that safety, performance, and clinical benefit remain clear and consistently supported.

Advanced technologies, including AI, can enhance SaMD functionality; however, they should not overshadow the core principles of safety, effectiveness, and human oversight. The same regulatory rigor and lifecycle management practices apply to all SaMD, regardless of the underlying technology.

Manufacturers should:

  • Define a clear intended purpose aligned with clinical benefit
  • Maintain a QMS that addresses MDR and, where relevant, AI Act obligations
  • Engage early with Notified Bodies and keep documentation, risk, and cybersecurity controls consistent
  • Treat post-market surveillance and maintenance as continuous improvement

By embedding these principles, manufacturers can reach compliance efficiently and deliver trustworthy, clinically valuable SaMD solutions.

Written by:
Diego Rodrigues

Diego Rodrigues

RA Specialist

Regulatory affairs specialist with expertise in EU MDR/IVDR, CE marking, SaMD & AI for MDs & IVDs.
Industry Insights & Regulatory Updates