Validation QMS Software and SaMDs

Home / MS & CE Marking Consultancy

Validation of QMS Software & Software as a Medical Device (SaMD)

At EUmAccess GmbH, we provide expert consultancy for the validation of Quality Management System (QMS) software and Software as a Medical Device (SaMD), ensuring compliance with ISO 13485:2016, ISO 62304, ISO 14971, MDR 2017/745, and IVDR 2017/746.

Validation of QMS Software (ISO 13485:2016 & 21 CFR Part 11)

  • What is QMS Software Validation?
    • Quality Management System (QMS) software validation ensures that software used for regulatory compliance (e.g., document control, complaint handling, CAPA) functions correctly, consistently, and securely.

  • Regulatory Requirements
    • ISO 13485:2016 – Clause 4.1.6 → Requires validation of software used in QMS
    • 21 CFR Part 11 → Ensures electronic records & signatures are secure and traceable
    • GAMP 5 Guidelines → Risk-based approach to computerized system validation

  • How We Help
    • Validation planning & risk assessment
    • Software installation qualification (IQ), operational qualification (OQ), and performance qualification (PQ)
    • Compliance with electronic records & audit trail requirements
    • Documentation & validation report preparation

Validation of Software as a Medical Device (SaMD) – IEC 62304 & MDR

  • What is SaMD?
    • Software as a Medical Device (SaMD) refers to standalone software that performs a medical function without being embedded in hardware (e.g., diagnostic apps, AI-based analysis tools).

  • Regulatory Requirements for SaMD
    • MDR 2017/745 & IVDR 2017/746 → Classifies SaMD based on risk & requires conformity assessment
    • IEC 62304:2006 (Software Lifecycle Processes) → Framework for software development & maintenance
    • ISO 14971:2019 (Risk Management) → Identifies & mitigates software-related risks
    • ISO 27001 (Information Security) → Ensures data protection & cybersecurity compliance

  • Key SaMD Validation Steps
    • Software Development Planning (Risk-based approach)
    • Software Design & Architecture Documentation
    • Risk Management (ISO 14971 Compliance)
    • Software Testing (Unit, Integration, System, User Acceptance Testing - UAT)
    • Cybersecurity & Data Integrity Validation
    • Performance Evaluation & Clinical Validation
    • Ongoing Post-Market Surveillance (PMS) & Updates

  • How We Help
    • SaMD classification & regulatory strategy (EU MDR & IVDR compliance)
    • Software development lifecycle validation (IEC 62304)
    • Cybersecurity risk assessment & penetration testing

Technical documentation & Notified Body submission

TOP