As the number of medical devices that include software continues to grow, so too does the use of off-the-shelf (OTS) software in regulated medical devices. Defined as “a generally available software component used by a device manufacturer for which the manufacturer cannot claim complete software life cycle control (e.g., operating system, printer/display libraries),” OTS software has its own regulatory/quality considerations and deliverables when incorporated into a medical device.
To ensure device manufacturers provide the appropriate documentation for any premarket submission, FDA updated the documentation recommendations with the release of the new guidance document Off-The-Shelf Software Use in Medical Devices (issued August 11, 2023). This update aligns with the understanding that the device manufacturer does not have the software life cycle control that they would have over their own in-house software, but the manufacturer still bears responsibility for the safe and effective performance of the medical device that incorporates the OTS.
On June 14, 2023, FDA revised the guidance Content of Premarket Submissions for Device Software Functions (see our blog post about this topic). Within this guidance, FDA proposed a new approach to software documentation based on the device’s risk to a patient, as well as the user of the device, and the intended use environment: basic and enhanced. The new OTS guidance aligns with this new classification, refining what documentation should be provided based on the documentation level (see Table 1).
| Software Documentation Elements | Basic Documentation Level | Enhanced Documentation Level |
| Description of OTS Software | An overview and description of the OTS software and actions taken for the continued safe and effective use of the medical device. | |
| Risk Assessment of OTS Software | Risk assessment demonstrating that risks related to the use of OTS software have been appropriately mitigated. | |
| Software Testing as Part of Verification and Validation | Test plans and results for the OTS software, commensurate with the Documentation Level (i.e., Basic or Enhanced) for the device. | |
| Assurance of Development Methodologies and Continued Maintenance of OTS Software | FDA is not recommending this documentation as part of the premarket submission. Sponsors should document this information via the DHF for the device. During premarket review, FDA may request additional information, if needed, to evaluate the safety and effectiveness of the device. | Information to provide an assurance that the product development methodologies used by the OTS software developer are appropriate and sufficient, and mechanisms exist for assuring the continued performance, maintenance, and support of the OTS software. |
Table 1. Software documentation elements based on documentation levels.
Table taken directly from the FDA guidance.
Important Recommendations from FDA
Overall, FDA recommends that device manufacturers consider four general topics when incorporating OTS software into their medical device or updating the OTS software in a device:
- Maintenance and obsolescence
- Operating systems, drivers, and utilities
- Local area networks (LANs) and other networks
- Innovative technologies
For a premarket submission specifically, regardless of the documentation level, FDA recommends that a manufacturer provide an overview and description of the OTS software features and function(s), including, but not limited to:
- What the OTS is (e.g., title, manufacturer, version number)
- What the OTS software does
- What the computer system specifications are
- How the manufacturer will control the OTS software (e.g., maintain software configuration, verify the device is using the right version, as well as maintenance and support of the software).
FDA recommends that some of this information, including the version of the OTS software and the minimum operating platform, should be included in the medical device labeling. Along with a software description, for both basic and enhanced documentation, a manufacturer should conduct a risk assessment of the OTS software as part of the risk management file. This assessment should consider all the risks associated with the OTS software, as well as demonstrate that identified risks have been appropriately mitigated.
“The procedure for OTS software risk assessment is the most noteworthy modification to the guidance,” said Todd Etzel, Software Development Life Cycle Consultant at Enzyme. “While the previous guidance emphasized a Level of Concern (LoC) partitioning system and a decision tree to establish OTS software risk and documentation levels, the updated guidance instead relies on the latest ‘Content of Premarket Submission for Device Software Functions’ to determine the requisite documentation level.”
As for all medical device software, the OTS software should also undergo software testing as part of verification and validation. In the premarket submission, a manufacturer should describe the OTS software testing, highlighting that the testing is appropriate and adequate for the hazards associated with the OTS software as documented in the risk management file, and provide the results of the testing and any existing OTS software defects. This information helps FDA determine whether the OTS software impacts the overall benefit-risk assessment of the medical device.
“The previous guidance outlined a highly specific methodology for conducting hazard analysis on OTS software,” said Todd. “The updated guidance, however, mandates that manufacturers integrate the risk assessment of OTS software into their comprehensive risk management file, in alignment with the FDA’s current perspective on adopting a ‘least burdensome approach.’”
Within the revised guidance, FDA also touches on the use of Master Files to support the use of OTS software with medical devices, considerations of whether OTS software could result in the need for a new submission, and the use of OTS software in Investigational Device Exemptions (IDEs) and Premarket Approvals (PMAs).
If you’d like to learn more about the regulatory and quality considerations for OTS software or request help with developing your submission documentation, don’t hesitate to reach out to Enzyme.
_____________________________________________________________
(1) Guidance for Industry and Food and Drug Administration Staff: Content of Premarket Submissions for Device Software Functions. Issued June 14, 2023. https://www.fda.gov/media/153781/download
