IVD Software Development: 8 Steps from Intended Purpose to CE Marking

Written by Carlos Galamba
Published on 04.04.2023 Last updated on 10.08.2026

IVD medical device software can process or analyse data obtained from specimens derived from the human body and provide information for diagnosis, monitoring, prediction, prognosis or treatment decisions. In the European Union, software falls under the IVDR only when its intended purpose meets the definition of an in vitro diagnostic medical device in Article 2(2) of Regulation (EU) 2017/746.

Not every laboratory or healthcare software application is an IVD. Software used only to store, transfer, archive or display information may fall outside the definition, while software that interprets results or generates clinically relevant information may qualify as IVD medical device software. Qualification must be based on the intended purpose, input data, output and clinical context.

Bringing IVD software to the EU market requires regulatory, quality, software lifecycle and performance evidence activities to be planned together. The following eight steps provide a practical roadmap from intended purpose and classification to CE marking, launch and post-market change control.

Projected size of the IVD market worldwide from 2018 to 2027 (in million U.S. dollars)

Source: Statista

The above graph shows the In-Vitro Diagnostics (IVD) market globally was estimated at 72.4 billion U.S. dollars in 2020, with a projected growth of 108 billion U.S. Dollars by 2027, showing its increased relevance in the healthcare industry today.

1. Define the Intended Purpose, Users and Target Markets

Define the intended purpose before software architecture and clinical claims become difficult to change. Document:

  • the specimens and input data used by the software;
  • the calculation, analysis or interpretation performed;
  • the output and the clinical decision it supports;
  • the intended users, patient population and use environment;
  • indications, limitations and contraindications;
  • each target jurisdiction and applicable regulatory framework.

Regulatory expertise should be involved during this stage, not added only when the product is ready for submission. Intended purpose decisions affect qualification, classification, software requirements, performance evidence, labelling and the conformity assessment route.

2. IVD Software Classification

Determine whether the software has an IVD medical purpose in its own right, drives or influences another device, acts as an accessory, or falls outside the medical device regulations. Under MDCG 2019-11 Rev.1, qualification is based on intended purpose and functionality, regardless of whether the software operates in the cloud, on a mobile device, on a desktop platform or as part of hardware.

Software that qualifies as IVD medical device software must be classified under Annex VIII of the IVDR, including the applicable implementing rules. The manufacturer should document the qualification and classification rationale and assess separately any software modules with different intended purposes.

Fig. 1 – MDCG 2019-11 flowchart on qualification of Medical Device Software (MDSW)

Familiarize yourself with relevant regulatory frameworks, guidances and standards such as ISO 13485, IEC 62304, but also specific guidance documents published by regulators, which provide specifications and guidelines for developing, validating, and maintaining IVD software.

3. Plan and Design the Software

The next crucial step of a successful IVD software development is design and planning.

  • A well-documented and robust planning process can help provide a more detailed roadmap for development.
  • During this phase, design reviews, testing, and verification will ensure that the final version meets user requirements.
  • It is essential to incorporate user feedback at every stage of the design process to develop an intuitive interface that works effectively according to their needs.
  • Obtaining feedback from customers and stakeholders offers the development team opportunities to recognize potential concerns and areas for enhancement.
  • Developers can devise software solutions that fulfill customer needs and address their grievances by integrating feedback.
  • The importance of accurate documentation should not be underestimated as it helps trace back issues later on in the lifecycle of the software.
  • The development team must consider scalability and flexibility during the initial planning and design stages when creating the software.

4. Develop and Test the Software

Developing and testing the software is crucial in creating a working prototype.

  • The development phase is necessary to ensure the accuracy of the design, coding, and algorithms used in creating the software solutions.
  • Testing and quality assurance also play an essential role in ensuring the products meet all requirements before launch.
  • It is essential for companies to thoroughly assess each component of their software as part of this process. This includes ensuring they meet performance objectives concerning speed, responsiveness, scalability, security, reliability, and ease of use for their users.
  • Quality assurance checks help identify bugs or errors to release a defect-free product that meets all standards from regulatory bodies such as FDA or CE Marking.
  • When deploying IVD systems, manufacturers need to consider if their applications can be flexible enough to support new technological advances; future-proofing their products becomes increasingly necessary where customers demand longevity across upgrades or iterations over time.

5. Prepare a Regulatory Submission

Preparing a regulatory submission package is critical in bringing IVD software development to market. This step involves compiling documents to demonstrate that the software meets regulatory requirements and is safe and effective.

Here are some critical considerations for preparing a regulatory submission:

  • Gather relevant documents for the package

Understand regulations, standards, and risk classification of IVD software and the manufacturing role. Key documents to include are the device description, technical documentation, risk management file (ISO 14971), software lifecycle documentation (IEC 62304), and quality management system documentation (ISO 13485). Risk management must be applied and monitored during the IVD software development life cycle.

  • Prepare a performance evaluation report (PER)

This will require a comprehensive analysis of scientific evidence showing that the product meets user needs safely and effectively. IVD software performance evaluation should be prepared in accordance with relevant guidance documents, such as MDCG 2020-1 for the EU. Other guidance such as MedTech Europe Clinical Evidence Requirements for IVD can also be a good source of  additional information.

Clinical performance studies are aimed at providing evidence of the safety and effectiveness of a product’s intended purpose to ensure that it’s able to diagnose, monitor and predict diseases and conditions accurately.

As described in MDCG 2020-1 “Validation of the clinical performance should be considered at each change of the software to a new release. If no validation is performed, a justification should be stated in the technical documentation. With a validation of clinical performance, it is demonstrated that users can achieve clinically relevant outputs through predictable and reliable use of the MDSW”.

Adherence to relevant standards and guidelines, such as ISO 20916 (Clinical Performance Studies for In vitro diagnostics) and Good Clinical Practice (CGP), are crucial for the successful execution of clinical studies.

  • Ensure data accuracy

Ensure that that any data collected from testing is presented accurately to prove safety and efficacy before submitting your application. This includes validation and verification data, performance evaluations, and, if applicable, results from clinical studies. Carefully review all information for accuracy and completeness before submitting it.

6. Complete Conformity Assessment and CE Marking

The EU pathway is a conformity assessment process rather than an application for regulatory approval. The manufacturer must confirm the applicable IVDR class, select the conformity assessment route and, where required, engage an IVDR-designated notified body.

The submission package should align the intended purpose, classification rationale, quality management system, risk management, software lifecycle documentation, usability, cybersecurity, performance evaluation and post-market plans. Class A non-sterile devices may generally be self-declared, while other classes normally require notified body involvement.

Once conformity has been demonstrated, the manufacturer issues the EU Declaration of Conformity and affixes the CE marking. Registration, UDI, labelling and economic-operator obligations must also be completed before placing the software on the EU market.

7. Developing Marketing and Sales Strategies

Creating a successful marketing and sales strategy is essential for bringing IVD software to the market, it allows for faster positioning and gaining a competitive advantage. Make sure to develop a strong brand identity with messaging that resonates with your audience.

In addition, researching customer needs and understanding key industry trends can create a more targeted approach when it comes to the marketing of IVD software solutions, increasing your likelihood for success.

Make sure to use multiple channels such as paid advertising, email campaigns, social media and webinars to reach out to potential customers from diverse segments.

And last but not least, creating effective communication strategies to engage with customers throughout the sales cycle will also be key to promoting IVD products successfully.

8. Launch and Support the Software

Launching and supporting software is a crucial element to its success. The product can be improved over time by providing regular updates and customer service, and users can get the best experience.

Here are some points to consider when launching your IVD software development:

  • Create a comprehensive support plan that puts customer needs first. Ensure you have an efficient process for handling inquiries and technical issues as they arise.
  • Ensure that all necessary software updates are completed on schedule, so users don’t experience any delay in accessing the product’s full features or bug fixes.
  • Apply documented change control to every software release, including bug fixes, cybersecurity patches, algorithm changes and modifications to input data, intended purpose or performance claims. Assess whether verification, validation, performance evaluation, technical documentation, labelling or notified body notification must be updated before release. MDCG 2022-6 should only be used when assessing significant changes to eligible legacy IVDs placed on the market under the IVDR transitional provisions.
  • Set up user feedback forms or surveys so customers can share their thoughts on the product’s performance and what improvements they want to see. This will help drive further development of the software over time.
  • Offer ongoing training opportunities for new features, so users feel confident using them once released. This will also ensure that customers know how to use their investment in your IVD software development solution fully.

Plan the Regulatory Pathway Before Development Decisions Become Difficult to Reverse

Qualification, classification and performance evidence decisions made early in development can prevent major changes to software architecture, claims and technical documentation later.

If you need support with IVDR qualification, performance evaluation, technical documentation or change control, explore MDx CRO’s Software, Digital Health & AI regulatory services or request a regulatory assessment.

FAQs

What are the key considerations when designing IVD software?

There are several key considerations that companies should keep in mind when designing IVD software: user requirements, regulatory requirements depending on the target geographic location, data accuracy and effective data management, the software’s ability to integrate with other systems, as well as performance and usability.

What are the regulatory requirements for IVD software development in Europe?

The regulatory requirements for IVD software development in Europe are determined by the In Vitro Diagnostic Regulation (IVDR), which became applicable on May 26, 2022. They include, but are not limited to design and development, risk management, validation and verification, as well as compliance with GDPR.

What are the most common challenges in IVD software development?

The most common challenges in IVD software development include regulatory compliance (which can be complex and challenging to navigate through), ensuring integration compatibility with other systems, effective data management, and great user experience, among others.

How do you ensure the quality and reliability of IVD software?

To ensure the quality and reliability of IVD software, it’s important that companies follow all regulatory guidelines applicable to their geographical location, and use a quality management system to ensure that the development process is well-documented. Conducting testing, validation and verification processes is another essential element of software development for in vitro diagnostics.

Written by:

Carlos Galamba

IVD Precision Medicine CDx

With more than 18 years of experience in the IVD sector, including hands-on work as a scientist in transfusion medicine and infectious disease diagnostics, and regulatory review experience at BSI, one of the EU's largest Notified Bodies, Carlos Galamba brings a uniquely integrated perspective to IVD regulatory strategy. Their work spans Class C/D IVDs, companion… Read more…

View the Author Profile
Industry Insights & Regulatory Updates

Draft of Principles and Practices for Software Bill of Material for Medical Device Cybersecurity

Written by Diego Rodriguez Muñoz
Published on 23.08.2022 Last updated on 16.06.2026

Connected medical devices increasingly share third-party and open-source components. A single vulnerability in a widely used library can ripple across vendors and product lines—making Software Bills of Materials (SBOMs) essential for transparency, risk assessment, and incident response across the total product lifecycle. The International Medical Device Regulators Forum (IMDRF) formalized this with its final guidance, Principles and Practices for Software Bill of Materials for Medical Device Cybersecurity (N73), which describes what an SBOM is, how to generate and maintain it, and how healthcare delivery organizations should consume it.

What an SBOM is—and why devices need one

The U.S. National Telecommunications and Information Administration (NTIA) defines an SBOM as a structured inventory of software components and their metadata—the “ingredients list” of a product. This transparency helps manufacturers and operators quickly identify exposure when new vulnerabilities (e.g., in a dependency) are disclosed, and it enables repeatable vulnerability and patch management processes.

IMDRF’s SBOM guidance (N73) dovetails with earlier IMDRF N60 lifecycle cybersecurity practices, positioning SBOMs as part of customer security documentation and post-market risk management. For device makers, that means SBOMs aren’t a one-time deliverable but a maintained asset that evolves with software updates, configurations, and component end-of-support.

Where regulators are today (and what they expect)

In the U.S., the FDA’s final cybersecurity guidance (2025 update) integrates SBOM expectations into quality system and premarket documentation, alongside processes for vulnerability handling, threat modeling, and update mechanisms. The FDA’s public Cybersecurity FAQs also explain how statutory changes (section 524B) affect submissions and postmarket obligations. Manufacturers should expect reviewers to look for SBOM content that’s actionable (e.g., component versions, known vulnerabilities, support status) and kept current throughout the device lifecycle.

Beyond healthcare, CISA’s 2024 framing for software component transparency shows how SBOM data is converging toward interoperable formats and exchange models—useful for scaling supplier management and incident response across complex portfolios and hospital networks.

Practical SBOM essentials for medical-device teams

Per IMDRF N73, an effective medical-device SBOM should clearly identify each component (and transitive dependency), the supplier, version, and unique identifiers, along with relationships and license data. It must also be consumable by customers: documentation should explain how the SBOM is accessed, how frequently it is updated, and how customers can map vulnerabilities to affected configurations. Manufacturers should align SBOM scope and format with their post-market cybersecurity processes so that vulnerability intake (e.g., from CISA/NVD) triggers internal triage, risk evaluation, and—when needed—field actions.

SBOMs for AI/ML and ML-enabled devices (MLMD)

AI-driven devices and machine learning-enabled medical devices (MLMD) depend on extensive software stacks plus data pipelines. While model artifacts aren’t “software components” in the classic sense, the IMDRF MLMD terminology (N67) and broader cybersecurity guidance support the same principle: maintain transparent, version-controlled inventories of the components your safety depends on—frameworks, libraries, runtimes, and security-relevant configs—so you can evaluate and communicate risk when dependencies change. Pair your SBOM with rigorous change control for models and data to preserve safety and performance.

How SBOMs reduce time to action

When a widely used component is found vulnerable, organizations that maintain current, machine-parsable SBOMs can immediately answer: Where do we run this? Which devices are impacted? What versions are affected? That shortens the path from disclosure to containment, patching, or compensating controls—reducing patient and business risk. FDA reviewers, hospital security teams, and incident-response coordinators increasingly expect this level of traceability.

Bottom line for digital-health manufacturers

Treat the SBOM as a first-class safety artifact: build it as you build your software, keep it up to date, make it accessible to customers, and wire it into vulnerability management and field-action playbooks. Align content and exchange formats with IMDRF N73 and be prepared to show how SBOMs underpin your premarket claims and postmarket responsiveness.

If you’re planning or executing a submission, MDx CRO can map your current secure-development and post-market processes to the latest expectations, align SBOM tooling and content to IMDRF/FDA, and integrate SBOM handling into your PMS and incident-response procedures.

Written by:

Diego Rodriguez Muñoz

In Vitro Diagnostics (IVD) Regulatory Affairs Clinical Research

Diego Rodríguez Muñoz is a Clinical Research and Regulatory Associate specializing in medical device software, artificial intelligence, and biocompatibility. He holds a PhD in Molecular Bioscience and brings multidisciplinary experience across clinical research, regulatory affairs, and biomedical science. At MDx CRO, Diego supports clinical and regulatory projects for medical devices and in vitro diagnostics (IVDs),… Read more…

View the Author Profile
Industry Insights & Regulatory Updates

IMDRF N67 and N88: ML Medical Device Terms and GMLP Principles

Written by David Tome
Published on 03.06.2022 Last updated on 28.07.2026

The International Medical Device Regulators Forum (IMDRF) has published Machine Learning-enabled Medical Devices: Key Terms and Definitions (IMDRF/AIMD WG/N67, Edition 1). This foundational guidance establishes a common vocabulary for artificial intelligence (AI) and machine learning (ML) in the medical device sector. Its purpose is to create uniform expectations and understanding, improve patient safety, inspire innovation, and encourage access to breakthroughs in healthcare technology.

Artificial intelligence is broadly defined as the use of algorithms or models to perform tasks, make decisions, or generate predictions. Within AI, machine learning is a subset where models are trained on data, enabling them to learn patterns without explicit rule-based programming. The IMDRF document situates these concepts within a regulatory and clinical context, ensuring clarity when applied to medical devices.

One of the key goals of the guidance is to reduce confusion across jurisdictions. Manufacturers, regulators, and clinicians may use different terms for the same concepts, such as “model,” “training,” or “retraining.” This lack of alignment can complicate regulatory submissions and reviews. The IMDRF’s definitions create a standard set of terms that can be consistently referenced across regulatory frameworks and development programs.

In February 2025, IMDRF released Good Machine Learning Practice (GMLP), which builds on the definitions in N67 by providing ten guiding principles for the development, validation, and monitoring of ML-enabled devices. The link between the two documents is crucial: N67 defines the language, while GMLP sets expectations for practice across the product lifecycle.

IMDRF N67 and N88 at a glance

DocumentPurposePractical relevance
IMDRF N67, published in 2022Establishes common terms and definitions for machine learning-enabled medical devices.Helps manufacturers and regulators use consistent terminology across development, evaluation and regulatory documentation.
IMDRF N88, published in 2025Sets out ten Good Machine Learning Practice guiding principles.Applies the terminology across the total product lifecycle, including dataset design, testing, human interaction, user information and post-deployment monitoring.

N67 provides the common vocabulary. N88 builds on that foundation by describing how good machine learning practices should be applied throughout the medical device lifecycle.

The 10 IMDRF Good Machine Learning Practice principles

IMDRF N88 identifies ten principles for the development and lifecycle management of AI and machine learning-enabled medical devices:

  • Define the intended purpose clearly and use multidisciplinary expertise throughout the product lifecycle.
  • Apply sound software engineering, medical device design, security and quality practices.
  • Use datasets that represent the intended patient population and use environment.
  • Keep training datasets appropriately independent from test datasets.
  • Select reference standards that are fit for the device’s intended purpose.
  • Match the model design to the available data, intended purpose and identified risks.
  • Evaluate the human-AI team in the intended clinical environment, not only the model in isolation.
  • Test performance under clinically relevant conditions.
  • Give users clear information about performance, limitations, data and appropriate use.
  • Monitor deployed models and control the risks associated with retraining, bias and dataset drift.

Key Terms and Their Impact

N67 formally defines a machine learning-enabled medical device, or MLMD, and establishes terminology for bias, continuous learning, reference standards, reliability, training and test datasets, and supervised, semi-supervised and unsupervised learning. It also discusses locked states, retraining and changes to the device or its data environment. Dataset drift is addressed later in N88 as part of post-deployment monitoring and retraining risk management, rather than as a formal N67 definition.

Why Uniform Definitions Matter

A harmonized vocabulary enhances regulatory predictability and cross-border alignment. With common definitions, manufacturers can prepare more consistent submissions, and regulators can apply more transparent and standardized review processes. It also helps notified bodies, standards committees, and audit organizations maintain consistent evaluation criteria.

Clear definitions are equally important for clinicians and patients. When a device is described as “continuously learning,” stakeholders need to understand the precise boundaries of its adaptation. This clarity reduces risks of misinterpretation that could compromise patient safety or compliance.

Integration with Regulatory Practice

The IMDRF’s N67 definitions are now referenced in the GMLP principles adopted by multiple regulators, including those in the U.S., UK, EU, and Canada. This reinforces the importance of shared terminology as the basis for regulatory policy. Together, N67 and GMLP create a roadmap for the development and oversight of AI/ML-enabled devices, from design and testing to monitoring and lifecycle management.

For the EU-specific requirements that apply alongside these international principles, see our guide to the EU AI Act for medical devices and SaMD.

Implications for Developers

Manufacturers must integrate IMDRF definitions into their development practices from the outset. Risk management plans, validation strategies, and change-control procedures should explicitly reflect terms such as drift, retraining, and continuous learning. Clinical performance evaluation must be designed using clearly defined training and test sets, while monitoring strategies must track performance shifts aligned with N67 definitions.

Failure to align with this common vocabulary can lead to misinterpretation, regulatory delays, or gaps in safety oversight. By embedding these terms into development and documentation, companies can demonstrate compliance and strengthen the credibility of their devices.

Manufacturers preparing an EU submission should also consider software classification, IEC 62304, clinical evidence and lifecycle documentation. These requirements are covered in our SaMD compliance guide.

FAQ

What is IMDRF N67?

IMDRF/AIMD WG/N67 is a 2022 document that establishes common terminology for machine learning-enabled medical devices across the total product lifecycle. It defines MLMD and terms related to bias, continuous learning, reference standards, reliability, training and testing datasets, and different machine learning methods. It does not provide detailed development or risk-management requirements.

What is a machine learning-enabled medical device according to IMDRF?

A machine learning-enabled medical device, or MLMD, is a medical device that uses machine learning, either partly or entirely, to achieve its intended medical purpose. The product must first meet the applicable definition of a medical device before it can be considered an MLMD.

What is the difference between IMDRF N67 and N88?

N67 establishes the vocabulary used to describe machine learning-enabled medical devices. N88 builds on that terminology by presenting ten Good Machine Learning Practice principles covering design, datasets, testing, human-AI interaction, user information and post-deployment monitoring.

What are the IMDRF Good Machine Learning Practice principles?

The ten principles address intended purpose, multidisciplinary expertise, software and security practices, representative datasets, independence between training and test data, reference standards, model design, human-AI interaction, clinically relevant testing, user information and ongoing model monitoring.

Where can I find the official IMDRF documents?

The official documents are available directly from IMDRF: Machine Learning-enabled Medical Devices: Key Terms and Definitions, N67 and Good Machine Learning Practice for Medical Device Development: Guiding Principles, N88.

Conclusion

The IMDRF’s Machine Learning-enabled Medical Devices: Key Terms and Definitions guidance represents a milestone in harmonizing global understanding of AI/ML in healthcare. By defining key terms such as model, drift, and retraining, it lays the foundation for safe innovation and regulatory clarity. Together with the GMLP framework, it provides a roadmap for developers and regulators alike as AI-enabled healthcare technologies continue to evolve.

MDx CRO supports manufacturers with AI and machine learning regulatory strategy, software validation, clinical evidence and lifecycle documentation. Explore our Software, Digital Health and AI regulatory services or contact our team to discuss your development programme.

Written by:

David Tome

Medical Device Regulation (MDR) Clinical Research IVDR

David is a recognized expert in clinical research and medical device regulation (MDR/IVDR). He is currently President and former Head of Clinical Operations at MDx CRO, a strategic consulting firm that helps MedTech and IVD companies bring their technologies from patent to market in the EU and the U.S. With over 15 years of experience… Read more…

View the Author Profile
Industry Insights & Regulatory Updates

AI & SaMD: Driving a New Era in Medical Innovation

Written by Diego Rodriguez Muñoz
Published on 27.11.2021 Last updated on 15.07.2026

In the rapidly evolving world of MedTech, the convergence of Artificial Intelligence (AI) and Software as a Medical Device (SaMD) is revolutionizing how healthcare solutions are designed, delivered, and regulated. At MDx CRO, we help developers of AI-powered SaMD navigate complex clinical and regulatory pathways with confidence and precision.

Why It Matters:

AI-based diagnostic tools, decision support systems, and therapeutic algorithms promise faster, more accurate patient care. But these innovative technologies bring unique regulatory, clinical, and usability challenges—especially under evolving standards like EU MDR and IVDR.

Our Expertise in Action:

At MDx, we support companies from prototype to post-market, offering:

Post-Market Surveillance (PMS) & PMCF/PMPF Plans for ongoing risk-benefit monitoring

Expertise that Makes a Difference:

Our team has guided software developers through the toughest regulatory transitions and supported numerous Class IIa and Class III SaMD products in gaining CE marking and UKCA certification. With MDx, you don’t just check the regulatory boxes—you build a credible, compliant path to market success.

The Future is Software-Defined

Whether you’re developing AI-based diagnostic tools, clinical decision support systems, or digital therapeutics, MDx CRO is your trusted partner in SaMD innovation. We combine deep technical insight with real-world regulatory experience to help you bring safe, effective, and compliant digital solutions to market—faster.

Let’s talk about your next SaMD project.

Contact us today for a free consultation.

Written by:

Diego Rodriguez Muñoz

In Vitro Diagnostics (IVD) Regulatory Affairs Clinical Research

Diego Rodríguez Muñoz is a Clinical Research and Regulatory Associate specializing in medical device software, artificial intelligence, and biocompatibility. He holds a PhD in Molecular Bioscience and brings multidisciplinary experience across clinical research, regulatory affairs, and biomedical science. At MDx CRO, Diego supports clinical and regulatory projects for medical devices and in vitro diagnostics (IVDs),… Read more…

View the Author Profile
Industry Insights & Regulatory Updates