Software and connected devices

A device that is software, contains software or connects to a network raises regulatory questions that a self-contained device does not. This branch covers them, divided by the question each part answers: how software came under device regulation, whether the software is a medical device and in which class, what its documentation has to show, and what the file says about cybersecurity and connectivity. What law on artificial intelligence adds is left to regulating AI in medical devices, and data protection in research generally to confidentiality and data protection.

• How software came under device regulation — how digital health grew from health information systems run by trained staff into stand-alone apps and wearables, technology companies entering the device field, the harmonisation of software regulation and the IMDRF's definition and guidance documents, how the MDR takes software in, and what software legislation aims to balance and why its rules keep having to adapt
• When software is a medical device, and in which class — the qualification decision that comes first, the device definition and medical device software, standalone software, accessories and parts of devices, the MDCG 2019-11 flowchart, apps on either side of the line in the EU and the United States, Rule 11 and the classes it sets, the adapted IMDRF framework and the realistic scenario it looks for, and why class I is hard to place software in
• What the documentation of medical device software has to show — the requirements and conformity routes the risk class sets, the EU and US regulations and standards that apply, the software requirements a quality management system meets, the clinical evidence under the MDR and the IMDRF and from post-market data, the data-protection regime an app meets as well, and the medical writer's part
• Cybersecurity and connectivity in device documentation — what cybersecurity covers, which devices and data are exposed and what an attacker can do with them, what makes a device vulnerable, the standards and how the framework developed, cybersecurity in the instructions for use, device data in disclosed trial documents, the human as the weakest link and what the writer contributes, and the questions assessors ask about a diagnostic device's connectivity