# MD Regulatory ## Posts - [ISO 80369: Small-Bore Connectors and Misconnection Risk](https://mdregulatory.com/iso-80369/): ISO 80369: Small-Bore Connectors and Misconnection Risk Introduction ISO 80369 exists because the Luer connector is too good at its job. A single conical fitting that lets almost any syringe join almost any tube was a genuine convenience for decades — and it is also why an enteral feed has been infused intravenously, why an epidural has been dosed with a drug meant for a vein, and why regulators on three continents eventually concluded that colour-coded labels and staff training were never going to fix a hazard built into the geometry itself. ISO 80369 fixes the geometry instead: it replaces one […] - [ISO 15223: The Symbols Standard for Medical Device Labels](https://mdregulatory.com/iso-15223/): ISO 15223: The Symbols Standard for Medical Device Labels Introduction ISO 15223 is the reason a device label can say almost nothing in words and still say everything a regulator requires. Under MDR Annex I, a single label has to carry the manufacturer’s identity, the lot number, the sterilisation method, whether the device contains a CMR substance, whether it may be reused, and half a dozen other facts — on a surface the size of a coin, in every language the device ships to. Symbols are not a design choice here. They are the only way the requirement is physically satisfiable. […] - [IEC 60601-1 Electrical Safety: Clause 8 and the MOP Rules](https://mdregulatory.com/iec-60601/): IEC 60601-1 Electrical Safety: Clause 8 and the MOP Rules Introduction IEC 60601-1 electrical safety compliance is not a single test you run at the end of development — it is a chain of decisions that starts in the risk file and ends in a CB test report, and a mistake anywhere in that chain shows up as a nonconformity months later, usually the week before a submission deadline. The standard’s third edition replaced the old prescriptive tables of the 1988 version with a risk-based structure built around the ISO 14971 risk management process, and that structure is exactly where most […] - [ISO 20417: The Complete Guide to the 2026 Edition](https://mdregulatory.com/iso-20417/): ISO 20417: The Complete Guide to the 2026 Edition Introduction ISO 20417 is the horizontal standard that decides what has to be on a medical device label, in its instructions for use and in its packaging — and on 17 March 2026 the version most technical files still cite was withdrawn. ISO 20417:2026, the second edition, replaced it with six changes that turn what used to be flexible or informative into fixed, normative, auditable requirements. None of this is cosmetic. A labelling procedure that still leans on the 2021 edition’s normative-reference flexibility is not outdated paperwork, it is a direct nonconformity […] - [IEC 62366: Usability Engineering Process, File and Evidence](https://mdregulatory.com/iec-62366/): IEC 62366: Usability Engineering Process, File and Evidence Introduction IEC 62366 is built on one uncomfortable idea: a patient can be seriously harmed while every component of the device performs exactly as specified. The infusion pump delivered precisely the dose that was programmed into it; the problem is that the nurse programmed 10 mL/h when she meant 1.0, because the keypad accepted the entry without a confirmation step and the display rendered both values in the same visual weight. No circuit failed, no software crashed, no specification was violated — and the standard that owns this category of harm is not […] - [ISO 22442: Animal Tissue Medical Devices Under MDR and FDA](https://mdregulatory.com/iso-22442/): ISO 22442: Animal Tissue Medical Devices Under MDR and FDA Introduction Full conformity with ISO 22442 is the part of an animal-tissue file that nobody argues about, and it is not the part that decides whether the device gets certified. The series describes how to manage the risk. It does not describe the procedure a European notified body must follow before it may issue a certificate, it does not classify the device, and it does not tell an FDA reviewer what to expect in a premarket submission. Manufacturers who read the three parts, implement them properly and assume the regulatory question […] - [MDCG 2019-11 for IVD Software: Qualification and Classification Under the IVDR](https://mdregulatory.com/mdcg-2019-11/): MDCG 2019-11 for IVD Software: Qualification and Classification Under the IVDR Introduction MDCG 2019-11 is the guidance that decides two things about a piece of software: whether it is a device at all, and if so, which regulation and which class it falls under. For in vitro diagnostic software the second question has a feature that catches almost everyone coming from the medical device side — there is no software classification rule in the IVDR. Rule 11 exists under the MDR and has no counterpart under Regulation (EU) 2017/746. That absence is not an oversight and it is not a gap […] - [ISO 24971 for IVDs: Risk Management When the Harm Is Indirect](https://mdregulatory.com/iso-24971/): ISO 24971 for IVDs: Risk Management When the Harm Is Indirect Introduction ISO 24971 is the document that explains how to do what ISO 14971 requires, and for in vitro diagnostic medical devices it carries something the standard itself does not: an annex written specifically for IVDs, prepared with the technical committee that writes the clinical laboratory standards. That annex exists because the risk management process was designed around devices that act on a patient, and an IVD does not act on a patient. It produces a number, and somebody else acts on the number. That single structural difference is what […] - [ISO 23640 : Stability Studies for IVDs Under the IVDR](https://mdregulatory.com/iso-23640/): ISO 23640: Stability Studies for IVDs Under the IVDR Introduction ISO 23640 is the standard every IVD manufacturer cites for stability, and it is not harmonised under Regulation (EU) 2017/746. That is not a technicality. It means that when a notified body reviewer opens Section 6.3 of your technical file, there is no presumption of conformity to fall back on, no European annex mapping clauses to requirements, and no shortcut. The reviewer assesses your shelf life against the Regulation itself, and against the performance you claimed in your own instructions for use. This is the section of the file that manufacturers […] - [EU IVDR Transition Deadlines 2027, 2028 and 2029](https://mdregulatory.com/ivdr-transition/): EU IVDR Transition Deadlines 2027, 2028 and 2029 Table of Contents Introduction What Regulation (EU) 2024/1860 Actually Changed Which Devices Count as Legacy Devices The Three End Dates, by IVDR Class Class A Non-Sterile Has No Transition at All The Two Dated Gates: Application, Then Written Agreement The Application Gate The Written Agreement Gate The IVDD Certificate Trap The Conditions That Run for the Whole Period What Counts as a Significant Change IVDR Obligations That Already Apply to Legacy Devices EUDAMED and the Registration Deadlines Devices Already in the Supply Chain Why a Fourth Extension Is Not a Plan What to […] - [ISO 20916 : Good Study Practice for IVD Performance Studies](https://mdregulatory.com/iso-20916/): ISO 20916: Good Study Practice for IVD Performance Studies Table of Contents Introduction What changed when ISO 20916 became a harmonised standard What the standard covers, and the studies it deliberately leaves out How much of the standard applies to your study Ethical considerations, and the consent problem that is specific to IVDs Planning is clause 5, and clause 5 is most of the standard Risk evaluation comes before the design, not after it The protocol, and why you should only write one of them Specimen accountability, sites, monitoring and labelling Initiation, conduct and monitoring Close-out, the study report and what […] - [MDCG 2025-10: Post-Market Surveillance Under the IVDR](https://mdregulatory.com/mdcg-2025-10/): MDCG 2025-10 Explained: Post-Market Surveillance Under the IVDR Introduction MDCG 2025-10 is the first guidance to describe what a post-market surveillance system has to do rather than what documents it has to produce, and the distinction is the whole point. Published in December 2025 and covering both the MDR and the IVDR, it walks Article 78 IVDR through the plan, the sources of data, the analysis and the eight processes that surveillance output has to feed — and it exposes a structural mistake that sits in a large proportion of IVD files: a plan written to describe a reporting cycle rather […] - [MDCG 2022-2 Explained: Clinical Evidence for IVDs](https://mdregulatory.com/mdcg-2022-2/): MDCG 2022-2: Clinical Evidence for IVDs Under the IVDR Introduction MDCG 2022-2 is the document that tells you what the IVDR means by clinical evidence. The Regulation itself spreads the concept across Article 56, Annex XIII and Annex I, and never assembles it in one place. The guidance does that assembly, and in doing so it settles several questions that manufacturers had been answering differently from one another. It is not a long document — thirty-one pages including two appendices — and most of the commentary written about it summarises the purpose section and stops. That is a missed opportunity, because […] - [IVDR Technical Documentation: Annex II Section by Section](https://mdregulatory.com/ivdr-technical-documentation/):       IVDR Technical Documentation: Annex II Section by Section Table of Contents Introduction IVDR Annex II at a glance — the six sections and Annex III Section 1 — Device description and specification Section 1.1 — what has to be described, and how precisely Section 1.2 — previous and similar generations Section 2 — Information supplied by the manufacturer Section 3 — Design and manufacturing information Section 4 — General safety and performance requirements Section 5 — Benefit-risk analysis and risk management Section 6 — Product verification and validation Sections 6.1 and 6.2 — analytical and clinical performance Sections […] - [What MDCG 2025-5 settles that the Regulation left open](https://mdregulatory.com/mdcg-2025-5/):       Table of Contents Introduction What MDCG 2025-5 settles that the Regulation left open Article 57 catches every performance study, and that is where most files go wrong What counts as a performance study, and what stops short of one Research use only, and the moment a reagent becomes a device The four criteria that turn a study into an application The two routes that require only a notification Three definitions decide more cases than the decision tree does Surgically invasive sample-taking includes an ordinary blood draw Interventional means something different here than in medicines law Left-over samples, and […] - [IVDR Explained: What Regulation (EU) 2017/746 Requires](https://mdregulatory.com/ivdr/):       IVDR Explained: What Regulation (EU) 2017/746 Requires Table of Contents Introduction What the IVDR changed, and why the change was structural Which products the IVDR captures, and which it leaves out Qualification runs through the six purposes of Article 2(2) The four exclusions are narrower than manufacturers expect Classification is the decision every other IVDR obligation follows from The ten implementing rules come before the seven classification rules Rule 3 is where most devices land, and it has thirteen indents What the class actually costs you at conformity assessment The technical documentation the IVDR asks for Why the […] - [EU MDR Annex II: Technical Documentation Structure, Section by Section](https://mdregulatory.com/eu-mdr-annex-ii-structure/):       EU MDR Annex II: Technical Documentation Structure, Section by Section Table of Contents Introduction EU MDR Annex II at a glance — the six sections Section 1 — Device description and specification Section 1.1 — the ten sub-elements, (a) to (j) Section 1.2 — previous and similar generations Section 2 — Information supplied by the manufacturer Section 3 — Design and manufacturing information Section 4 — General safety and performance requirements Section 5 — Benefit-risk analysis and risk management Section 6 — Product verification and validation Section 6.1 — pre-clinical and clinical data Section 6.2 — additional information […] - [EN 18286: The AI Act Standard for Medical Devices](https://mdregulatory.com/en-18286/): EN 18286: The AI Act QMS Standard for Medical Devices Table of Contents Introduction What EN 18286 is, and why CEN refused to reuse ISO/IEC 42001 The definition of quality that reverses the customer relationship Two layers inside one standard Why the July 2026 timeline reset gives you three years, not a reprieve What Regulation (EU) 2026/1744 actually changed Why the MDR and the IVDR stayed in Annex I, Section A Article 17 obligation by obligation, and where the evidence sits Clause 4.4 is where a notified body will start reading Clause 8.5 turns your datasets into controlled records Clauses 9.4 […] - [AI Medical Device Regulation: EU MDR, FDA and ISO 42001](https://mdregulatory.com/ai-medical-device/): AI Medical Device Regulation: EU MDR, FDA and ISO 42001 AI Medical Device Regulation: EU MDR, FDA and ISO 42001 Table of Contents Introduction What “AI medical device regulation” actually means in 2026 Qualification and classification under EU MDR: Rule 11 first, everything else after When AI software qualifies as a device How Rule 11 sets the class, and therefore the AI Act trigger The EU AI Act: what changed in 2026 and what did not The Digital Omnibus on AI: adopted, and it did not exempt you MDR 2.0 and the Section B question What Chapter III actually demands, and […] - [ANVISA Registration: The Complete Guide for Medical Devices](https://mdregulatory.com/anvisa-registration/): ANVISA Registration: The Complete Guide for Medical Devices ANVISA Registration: The Complete Guide for Medical Devices Table of Contents Introduction Why ANVISA registration defeats companies that already hold a CE certificate The regulations that govern ANVISA registration RDC 751/2022 — the framework RDC 848/2024 — the essential requirements Classification: four classes, twenty-two rules How the rules in Annex I actually work Grouping: families, systems and kits The Brazilian Registration Holder (BRH) What the BRH actually carries Why an independent BRH is worth the extra cost Notification or marketing authorisation Notification — Class I and Class II Marketing authorisation — Class III […] - [Software Bill of Materials (SBOM) for Medical Devices: IEC 62304 and FDA Guide](https://mdregulatory.com/sbom/):   Software Bill of Materials (SBOM) for Medical Devices: IEC 62304 and FDA Guide Table of Contents Introduction What an SBOM Is — and Why Medical Device Software Needs One FDA Requirements: Section 524B and the Premarket Cybersecurity Guidance Which devices qualify as cyber devices The three statutory obligations SBOM Content: NTIA Minimum Elements and FDA Additions IEC 62304: where the SBOM lives in the software lifecycle SOUP requirements as the SBOM content source From SOUP management to a machine-readable inventory CycloneDX vs SPDX: Choosing a Format EU Requirements: MDR, MDCG 2019-16, IEC 81001-5-1 and the Cyber Resilience Act Building and […] - [EUDAMED Registration Requirements: Step-by-Step Guide for Medical Device Manufacturers](https://mdregulatory.com/eudamed-registration/): EUDAMED Registration Requirements: Step-by-Step Guide for Medical Device Manufacturers EUDAMED Registration Requirements: Step-by-Step Guide for Medical Device Manufacturers Table of Contents Introduction Why EUDAMED Registration Is Now Mandatory The Key 2026 Deadlines You Cannot Miss Who Must Register — A Decision Path The Six EUDAMED Modules Step-by-Step: How to Register in EUDAMED Step 1: Confirm Your Actor Role and Gather Data Step 2: Submit Actor Registration and Obtain the SRN Step 3: Create Device Records Step 4: Link Notified Body Certificates Step 5: Maintain and Keep Data Current Machine-to-Machine Integration: When and Why Common Registration Mistakes and How to Avoid Them […] - [Medical Device Cybersecurity Risk Assessment: Threat Modeling and FDA Requirements](https://mdregulatory.com/medical-device-cybersecurity-risk-assessment/): Medical Device Cybersecurity Risk Assessment: Threat Modeling and FDA Requirements Medical Device Cybersecurity Risk Assessment: Threat Modeling and FDA Requirements Table of Contents Introduction Why Cybersecurity Risk Assessment Is Now a Gate, Not a Formality Step 1: Scope, Assets and Trust Boundaries Step 2: The Data Flow Diagram Step 3: STRIDE Threat Modeling Step 4: Risk Estimation — Exploitability Against Patient Safety Step 5: Security Controls and Step 6: Residual Risk How Security Risk Connects to the ISO 14971 Safety Risk File FDA and EU Requirements: One Assessment, Two Submissions Post-Market: The Assessment Is Never Finished Common Cybersecurity Risk Assessment Audit […] - [ISO 13485 Design Controls: Requirements and Design History File](https://mdregulatory.com/iso-13485-design-controls/): ISO 13485 Design Controls: Requirements and Design History File ISO 13485 Design Controls: Requirements and Design History File Table of Contents Introduction Why ISO 13485 Design Controls Exist Design and Development Planning (Clause 7.3.2) Design Inputs and Design Outputs (Clauses 7.3.3 and 7.3.4) Design Inputs (Clause 7.3.3) Design Outputs (Clause 7.3.4) Design Review (Clause 7.3.5) Design Verification and Design Validation (Clauses 7.3.6 and 7.3.7) Design Verification (Clause 7.3.6) Design Validation (Clause 7.3.7) Design Transfer and Design Changes (Clauses 7.3.8 and 7.3.9) The Design History File: Structure and Traceability Common Design Control and DHF Audit Findings Frequently Asked Questions Conclusions Introduction The […] - [EU MDR GSPR Checklist: How to Demonstrate General Safety and Performance Requirements](https://mdregulatory.com/eu-mdr-gspr-requirements/):       EU MDR GSPR Checklist: How to Demonstrate General Safety and Performance Requirements Table of Contents Introduction GSPR checklist: all 23 requirements of MDR Annex I What the GSPR are and where they sit in Annex I Chapter I: the foundational requirements every device must address Chapter II: design and manufacture requirements by technology Chapter III: the labelling and IFU requirements The harmonisation gap and what it means for compliance Building the GSPR checklist that survives Notified Body review The five mandatory columns, with a worked example Cybersecurity expectations under section 17 Cross-references that hold the technical file together […] - [IEC 62304 Software Verification and Validation: Requirements by Safety Class](https://mdregulatory.com/iec-62304-software-verification/):       IEC 62304 Software Verification and Validation: Requirements by Safety Class Table of Contents Introduction What IEC 62304 actually covers — and what it does not Software safety classes: the gating decision Which verification activities are required at each class Software unit verification: clause 5.5 Software integration and integration testing: clause 5.6 Software system testing: clause 5.7 Traceability: the spine of the verification record Risk control verification under clause 7 Documentation deliverables FDA documentation levels and the QMSR convergence Common audit findings on software verification Frequently asked questions Conclusions Introduction The title of this article reflects how the industry […] - [ISO 13485 Supplier Management: Qualification, Approved Supplier List and Audits](https://mdregulatory.com/iso-13485-supplier-qualification/): ISO 13485 Supplier Management: Qualification, Approved Supplier List and Audits ISO 13485 Supplier Management: Qualification, Approved Supplier List and Audits Table of Contents Introduction What ISO 13485 Clause 7.4 Requires Risk-Based Supplier Classification The Supplier Qualification Process The Approved Supplier List (ASL) — Clause 7.4.1 Purchasing Controls — Clause 7.4.2 Supplier Audits — When and How FDA QMSR 2026 — What Changed for Supplier Management Ongoing Supplier Monitoring and Re-evaluation Frequently Asked Questions Conclusions Introduction ISO 13485 supplier management is one of the most operationally complex requirements of the standard — and one of the most consistently found-deficient in Notified Body […] - [FDA De Novo Pathway: When to Use It and How to Submit](https://mdregulatory.com/fda-de-novo-pathway/): The FDA De Novo pathway is one of the most strategically important — and most misunderstood — routes to US market authorization for medical devices. It exists to solve a specific regulatory problem: what happens when you develop a novel, low-to-moderate-risk device that has no legally marketed predicate device to compare against? The De Novo pathway provides marketing authorization for novel, low-to-moderate-risk devices without a predicate, creating a new Class I or II classification with general or special controls. It is authorized by a grant order, not a clearance — and it creates a product code that future similar devices can reference through […] - [EU MDR Post-Market Surveillance : PMS Plan, PSUR and PMCF Requirements](https://mdregulatory.com/eu-mdr-post-market-surveillance/): EU MDR Post-Market Surveillance: PMS Plan, PSUR and PMCF Requirements Introduction Post-market surveillance is where the EU MDR departs most sharply from the Directive it replaced. Under the MDD, PMS was a general obligation with no defined deliverables. Under the MDR it is a documented system with named outputs, fixed frequencies, and mandatory feedback into the clinical evaluation and the risk management file. The gap between what the Regulation asks for and what most manufacturers have in place is widest here, and the reason is structural rather than technical. PMS is the only part of the technical documentation that never finishes: […] - [Biocompatibility Testing for Medical Devices: ISO 10993 Complete Guide](https://mdregulatory.com/biocompatibility-testing-medical-device/):       Biocompatibility Testing for Medical Devices: ISO 10993 Complete Guide Table of Contents Introduction Does My Device Need Biocompatibility Testing? What Is the ISO 10993 Series? How Is a Device Categorized Under ISO 10993-1? Contact Type (ISO 10993-1:2025, Tables 1–4) Contact Duration and Total Exposure Which Biocompatibility Tests Do I Need? The Biological Evaluation Process — Step by Step Step 1 — Device Characterization Step 2 — Biological Evaluation Plan (BEP) Step 3 — Chemical Characterization (ISO 10993-18) Step 4 — Toxicological Risk Assessment (ISO 10993-17) Step 5 — Biological Testing (When Required) Step 6 — Biological Evaluation Report […] - [ISO 14971 Risk Management for Medical Devices: Complete Process Guide](https://mdregulatory.com/iso-14971-risk-management/):       ISO 14971 Risk Management for Medical Devices: Complete Process Guide Table of Contents Introduction What Is ISO 14971 and Why the 2019 Edition Matters Key ISO 14971 Terminology The ISO 14971 Risk Management Process — Step by Step Step 1 — Risk Management Planning (Clause 4.4) Step 2 — Hazard Identification (Clause 5) Step 3 — Risk Estimation (Clause 5) Step 4 — Risk Evaluation (Clause 6) Step 5 — Risk Controls (Clause 7) Step 6 — Benefit-Risk Analysis and Overall Residual Risk (Clause 8) Step 7 — Risk Management Review and Report (Clause 9) Step 8 — […] - [ISO 13485 CAPA Procedure: How to Manage Corrective and Preventive Actions](https://mdregulatory.com/iso-13485-capa/): ISO 13485 CAPA: Clauses 8.5.2 and 8.5.3 Requirements Introduction The ISO 13485 CAPA procedure — covering corrective and preventive action — is consistently one of the most scrutinised elements of a medical device quality management system. In every Notified Body audit, every FDA inspection, and every MDSAP assessment, CAPA is examined in depth. And for good reason: a CAPA system that works is the clearest possible signal that an organisation understands its own quality problems, fixes them at the root, and prevents them from recurring. A CAPA system that exists only on paper is, in regulatory terms, almost worse than no […] - [Software as a Medical Device (SaMD): Classification, Requirements and Regulatory Pathway](https://mdregulatory.com/software-as-a-medical-device-samd-classification-requirements-and-regulatory-pathway/): Software as a Medical Device (SaMD): Classification and Regulatory Pathway Introduction Software as a Medical Device is defined by the IMDRF as software intended for one or more medical purposes that performs those purposes without being part of a hardware medical device. The definition is the global baseline, adopted by the FDA, the EU and most other jurisdictions. Everything downstream of that definition is jurisdiction-specific, and the divergence is wider than most teams expect. The same product is Class IIa in Europe under Rule 11 and a Class II 510(k) in the United States; the classification logic that produces those two […] - [EU MDR Clinical Evaluation Report: Requirements, Structure and Common Mistakes](https://mdregulatory.com/eu-mdr-clinical-evaluation/): EU MDR Clinical Evaluation Report: Requirements, Structure and Common Mistakes Introduction The Clinical Evaluation Report is the most consequential document in an EU MDR technical file, and the one Notified Bodies most often find inadequate. It causes more delays, more remediation cost and more risk to a CE marking timeline than any other single deliverable. The reason is not that the requirements are obscure. It is that the MDR raised the standard in three specific places — equivalence, what counts as sufficient clinical evidence, and the obligation to keep the report current — and a great deal of CER practice carried […] - [ISO 13485 Internal Audit Checklist: Clause-by-Clause Guide with Common Findings](https://mdregulatory.com/iso-13485-internal-audit-checklist/): ISO 13485 Internal Audit Checklist: Clause by Clause with Common Findings Introduction The internal audit is the most powerful tool a quality team has, and the one most often reduced to a formality. Done well, it finds the weaknesses before a Notified Body or an FDA investigator does. Done badly, it becomes evidence against you: a documented record that the organisation examined its own quality system and failed to find what a regulator later found in a single day. Since February 2026 the stakes are higher. The FDA QMSR brought internal audit records within the scope of routine inspection — under […] - [EU MDR Technical Documentation Requirements: Complete Guide to Annex II and III](https://mdregulatory.com/eu-mdr-technical-documentation/):       EU MDR Technical Documentation Requirements: Complete Guide to Annex II and III Table of Contents Introduction What is EU MDR technical documentation? Who needs EU MDR technical documentation? Annex II — section by section Device description and specification Design and manufacturing information General safety and performance requirements Benefit-risk analysis and risk management Product verification and validation Clinical evaluation Labelling and instructions for use Annex III — post-market surveillance documentation Post-market surveillance plan PSUR and PMSR PMCF plan and report Key differences between MDR and MDD technical documentation Technical documentation requirements by device class Common Notified Body findings in […] - [EU MDR Transition Deadlines 2026, 2027 and 2028: The Complete Guide for Medical Device Manufacturers](https://mdregulatory.com/eu-mdr-transition-deadlines/):       EU MDR Transition Deadlines 2027 and 2028: The Complete Guide for Medical Device Manufacturers Last updated 5 August 2026. The 26 May 2026 deadline for custom-made Class III implantable devices has passed. The next hard date is 27 November 2026, for EUDAMED registration of legacy devices. Table of Contents Introduction Where the EU MDR transition stands today MDD to MDR transition timeline — the complete deadline table Background: why the EU MDR transition was extended Conditions for benefiting from the 2027 and 2028 extended deadlines The 26 May 2026 deadline — what happened, and what it means now […] - [Medical Device Cybersecurity Testing: Methods, Requirements and Regulatory Compliance](https://mdregulatory.com/medical-device-cybersecurity-testing/): Medical Device Cybersecurity Testing: Methods, Timing and Documentation Introduction Cybersecurity testing for medical devices has moved from recommended practice to submission requirement. The FDA expects security testing documentation in the premarket submission, and MDCG 2019-16 states plainly that testing is the primary means of security verification and validation. What has not moved with it is how most manufacturers organise the work. Testing is still commonly treated as a single event before submission — a penetration test booked when the release candidate is ready — and that shape is precisely what regulators have begun to push back on. The two most consequential […] - [IEC 81001-5-1: The Complete Guide to Cybersecurity for Health Software](https://mdregulatory.com/iec-81001-5-1-cybersecurity-health-software/): IEC 81001-5-1: The Complete Guide to Cybersecurity for Health Software Table of Contents Introduction What Is IEC 81001-5-1? Why IEC 81001-5-1 Matters — The Cybersecurity Case for Health Software Scope and Structure of IEC 81001-5-1 Key Requirements of IEC 81001-5-1 1. Cybersecurity Risk Management 2. Security Requirements Specification 3. Secure Development Practices 4. Security Testing and Verification 5. Vulnerability Management and Patch Management 6. Incident Response IEC 81001-5-1 and the Security Development Lifecycle Regulatory Alignment — EU, US, and Beyond Practical Implementation — How to Achieve IEC 81001-5-1 Compliance Start with a Cybersecurity Gap Analysis Integrate Cybersecurity into the Quality Management […] - [ISO 13485 : 2016 — The Complete Guide to Medical Device Quality Management](https://mdregulatory.com/iso-13485/): ISO 13485:2016 — The Complete Guide to Medical Device Quality Management Introduction ISO 13485 is the quality management system standard for medical devices, and since February 2026 it is also the legal basis for FDA quality system inspections in the United States. That change makes it the single most consequential standard a device manufacturer works to: one compliant quality system now underpins market access in the EU, the US, Canada, Japan, Brazil and Australia. ISO 13485:2016 was placed into systematic review in January 2025 and reconfirmed as current, so this is the version in force and there is no announced replacement. […] - [SOUP Management Under IEC 62304: A Complete Guide for Medical Device Software](https://mdregulatory.com/soup-management-iec-62304/):       SOUP Management Under IEC 62304: Requirements, Process and SBOM Table of Contents Introduction What is SOUP? Definition under IEC 62304 Why SOUP management matters — the regulatory and safety case IEC 62304 requirements for SOUP — clause by clause The SOUP management process — step by step Step 1 — Identification and documentation Step 2 — Risk assessment Step 3 — Verification and validation Step 4 — Configuration management and change control Step 5 — Ongoing monitoring throughout the lifecycle SOUP and cybersecurity — an increasingly critical intersection Common pitfalls — what auditors find Best practices for SOUP […] - [IEC 62304: The Complete Guide to the Medical Device Software Standard](https://mdregulatory.com/iec-62304/): IEC 62304: Safety Classes, Lifecycle Processes and the Edition 2 Timeline Introduction IEC 62304 defines the life cycle processes for medical device software. It is the standard a Notified Body reaches for first when it opens a software technical file, and the one the FDA recognises as a consensus standard. It has been in force, in substance, since 2006. If you have read about it recently you will have seen that a second edition was due in August 2026. Several widely read guides published this year gave the date precisely, one of them down to 12 August. That date has passed […] - [The Benefit-Risk Analysis: Avoid Critical Mistakes and Achieve Full Compliance](https://mdregulatory.com/benefit-risk-analysis/): Benefit-Risk Analysis under EU MDR: Requirements, Methods and Common Mistakes Introduction The benefit-risk determination is the conclusion the whole technical file exists to support. Every risk control, every clinical study, every piece of post-market data feeds one judgement: that the benefits of this device, for this intended purpose, outweigh the residual risks in light of the state of the art. Under the EU MDR that judgement is not a document you write once. It appears in six places across the Regulation, it is owned jointly by risk management and clinical evaluation, and it has to be re-made whenever post-market data change […] - [GAMP-5 Mastery: Essential Guide to Computer System Validation for Regulated Industries](https://mdregulatory.com/gamp-5/): GAMP 5: Software Categories, the V-Model and the Second Edition Introduction GAMP 5 is the internationally recognised approach to validating computerised systems in regulated industries. GAMP stands for Good Automated Manufacturing Practice, and the guide is published by ISPE, the International Society for Pharmaceutical Engineering, which established the framework in 1991. Two things about it are frequently misunderstood, and both matter before any validation work starts. GAMP is a guideline, not a regulation: nobody is inspected against GAMP, they are inspected against 21 CFR Part 11, Annex 11 or ISO 13485, and GAMP is the recognised method for demonstrating compliance with […] - [ISO 10993-1:2025 – A Breakthrough Update Reshaping Medical Device Biocompatibility](https://mdregulatory.com/iso-10993-1/):       ISO 10993-1:2025 — What Changed and What to Update Table of Contents Introduction Summary of the Key Changes Impact on Device Categorisation 2018 to 2025: The Re-categorisation Worksheet Biological endpoints to biological effects Redefinition of Biological Endpoints Classification of biological effects Assessment of Systemic Toxicity ISO 10993-1 and Risk Management What is the Impact of the New ISO 10993-1 Impacts on the devices under Development Impact on different Countries / Regulations Is it necessary to perform Additional Testing? Reasonably Foreseeable Misuse to be Taken in Consideration What About the Transition Period? General Flowchart for Biological Assessment According to […] - [MDSAP Audits: No More Secrets for your Certification](https://mdregulatory.com/mdsap-audits/): MDSAP Audits: Process Chapters, Grading and How to Prepare Introduction The Medical Device Single Audit Program lets one audit of a quality management system satisfy five regulatory authorities: Australia’s TGA, Brazil’s ANVISA, Health Canada, Japan’s MHLW and PMDA, and the US FDA. The audit is performed by an authorised Auditing Organization against ISO 13485 plus the country-specific requirements of each participating jurisdiction. A successful audit produces a certificate valid for three years, with surveillance audits in between. That is the administrative description, and it is not the reason MDSAP is difficult. The difficulty is structural: MDSAP audits by process, in a […] - [Hidden Rules of 510k: What FDA Really Expects](https://mdregulatory.com/510k/): 510(k) Submissions: Substantial Equivalence, eSTAR and What FDA Expects Introduction The 510(k) is the most common route to the US market for medical devices. Named after Section 510(k) of the Federal Food, Drug, and Cosmetic Act, it asks the manufacturer to demonstrate that a device is substantially equivalent to one already legally marketed, rather than to prove safety and effectiveness from first principles as a Premarket Approval requires. That distinction is what makes the pathway fast, and it is also what makes it fail. A 510(k) is not an evidence exercise, it is a comparison exercise: almost every avoidable delay traces […] ## Pages - [Saudi Arabia](https://mdregulatory.com/sfda-saudi-arabia-registration/): SFDA Saudi Arabia medical device registration — MD Regulatory Market Access Hub / Saudi Arabia Saudi Arabia · SFDA SFDA Saudi Arabia medical device registration Saudi Arabia closed its shortcut. Until 2021 an approval from the EU, the US, Canada, Japan or Australia could carry a device into the Kingdom; since January 2022 the Technical... - [India](https://mdregulatory.com/india/): CDSCO India medical device registration — MD Regulatory Market Access Hub / India India · CDSCO CDSCO India medical device registration India now regulates every medical device under the Medical Devices Rules, 2017 — licensing closed on Class A and B in October 2022, and on Class C and D in October 2023. A foreign... - [Brazil](https://mdregulatory.com/brazil/): ANVISA Brazil medical device registration — MD Regulatory Market Access Hub / Brazil Brazil · ANVISA ANVISA Brazil medical device registration Around half of Brazil’s medical devices are imported, making it one of the most attractive emerging markets — and one of the most exacting. Registration runs through ANVISA under RDC 751/2022 and the essential... - [Market Access Hub](https://mdregulatory.com/market-access/): Market Access Hub — MD Regulatory Market Access Hub Register your device in any market, from one documentation system Every country wants its own dossier, its own classification, its own language. Our country kits turn that maze into a repeatable method — gap analysis, essential requirements, technical file — built straight from the regulations. Explore... - [IEC 62304 Software Documentation Kit](https://mdregulatory.com/iec-62304-kit/): IEC 62304 Software Documentation Hub IEC 62304 Medical Software Documentation The complete software lifecycle file for medical device software and SaMD — development plan to release record, plus the cybersecurity documentation Notified Bodies now expect. Clause-referenced, safety-class scalable (A/B/C), fully editable. Or buy only the document you need. ✓ 12 coordinated templates ✓ IEC 62304... - [AI/ML Medical Device Documentation](https://mdregulatory.com/ai-ml-medical-device-documentation/): AI/ML Medical Device Documentation Hub AI/ML Medical Device Documentation The deliverable documentation kit for AI/ML-enabled medical devices — one coordinated set, five markets. Covers the full lifecycle, from AI Development & Lifecycle Plan to Postmarket Performance Monitoring, with the IMDRF Good Machine Learning Practice principles as the convergent spine across FDA, EU AI Act, Health... - [EU MDR Technical Documentation Kit](https://mdregulatory.com/eu-mdr-technical-documentation-kit/) - [Risk Management Documentation](https://mdregulatory.com/risk-management-documentation/): Risk Management Documentation Hub Risk Management Documentation The audit-ready risk management documentation kit for Regulation (EU) 2017/745 and EN ISO 14971:2019/A11:2021. Cover the full process — from Risk Management Plan to GSPR Checklist — with 6 coordinated templates and active Excel FMEA worksheets that calculate residual risk automatically. Or buy only the template you need.... - [EU MDR Clinical Documentation](https://mdregulatory.com/eu-mdr-clinical-documentation/) - [Contact](https://mdregulatory.com/contact-2/): Get in touch Have a question, a project, or just want to say hello? We'd love to hear from you. Contact information Choose what works best for you. We respond to every message personally. 📧 Email info [at] mdregulatory.com Use the form for a structured reply ⏱️ Response time Within 1 business day Monday to... - [Combined Kit ISO 13485 + MDSAP](https://mdregulatory.com/iso-mdsap-documentation/): Premium Bundle · ISO 13485 + MDSAP ISO 13485 + MDSAP Combine the ISO 13485 QMS Kit with the MDSAP Documentation Kit in one premium package. ISO 13485:2016/A11:2021, EU MDR, FDA QMSR, and all 5 MDSAP markets in one integrated foundation. Single integrated QMS, no duplication 5 MDSAP markets (BR / JP / CA /... - [All Kits](https://mdregulatory.com/all-kits/): Browse All Compliance Kits Complete bundles, standalone kits or individual documents — choose what fits your audit needs. All documents instantly downloadable, fully editable in Word & Excel. Kits & Bundles Audit-ready packages covering all documents for a specific standard, framework or market. Premium Bundles ✦ Premium Bundle · EU MDR MDR Complete Bundle The... - [ISO 13485 Documentation Kit](https://mdregulatory.com/iso-13485-documentation/): ISO 13485 · QMS Documentation ISO 13485 Documentation A complete, customizable QMS documentation kit aligned with ISO 13485:2016/A11:2021, EU MDR, FDA QMSR (effective Feb 2026), and MDSAP. Audit-ready EU MDR + FDA QMSR + MDSAP aligned Word & Excel, fully editable Quality Manual + Master Tracker Get the Complete Kit → Browse Individual Packages ↓... - [MDSAP Documentation](https://mdregulatory.com/mdsap-documentation/) - [Audit Success](https://mdregulatory.com/audit-success/): Audit Report — Download | MDRegulatory MDRegulatory ← Back to website ✓ Payment confirmed Your report is ready Thank you for your purchase. Click below to download your complete ISO 13485:2016 audit report. 📄 ISO 13485:2016 Full Audit Report Your complete gap analysis report including all sections, AI-generated findings, document references, and remediation tracker. Executive... - [Terms & Conditions](https://mdregulatory.com/terms-and-conditions/): Terms and Conditions Last updated: 5 May 2026 Welcome to www.mdregulatory.com (the “Website”). These Terms and Conditions (“Terms”) govern your access to and use of the Website, including the purchase of digital documentation products, consulting services, self-audit tools, and any other content or services made available through the Website (collectively, the “Services”). By accessing the... - [Consulting](https://mdregulatory.com/consulting/): Expert Regulatory Consulting Medical Device Regulatory Consulting Services ISO 13485, EU MDR, FDA QMSR, MDSAP — practical regulatory support from an experienced ISO 13485 Lead Auditor with broad international expertise. Request a Free Consultation ✓ ISO 13485 Lead Auditor ✓ 15+ Years Experience ✓ Broad International Expertise ✓ EU MDR & FDA QMSR Expert ✓... - [My account](https://mdregulatory.com/my-account/) - [Checkout](https://mdregulatory.com/checkout/) - [Cart](https://mdregulatory.com/cart/) - [Blog](https://mdregulatory.com/blog/): One-Pot Solution for All Your Regulatory Needs Regulatory Consulting ServicesExpert guidance for seamless medical device complianceFind Out MoreOnline WebShopOnline Webshop with a huge number of templates, SOPs, Checklist and supporting documents availableFind Out MoreOnline and On-Site TrainingVast Number of Online and Onsite Training AvailableClick Here Latest from Our Blog Explore insights into the medical device... - [Contact](https://mdregulatory.com/contact/): Contact MD Regulatory Questions about a kit, support with an order, or a consulting brief. Every message is read and answered by a regulatory professional — not a ticket queue. Typical reply within one business day, Monday to Friday Kit & order support Download link not received, invoice with your VAT number, file format questions,... - [About](https://mdregulatory.com/about/): About — MD Regulatory (preview) About Global Expertise. Practical Solutions. Audit-Ready Results. Practical regulatory expertise for medical device companies — built from the inside out. 15+Years of experience 10+Markets covered 7+Regulatory frameworks 4Continents covered ISO 13485 Lead Auditor ISO 9001 Lead Auditor EU MDR & FDA QMSR Expert MDSAP Qualified Software & Cybersecurity — IEC... - [Home](https://mdregulatory.com/): Training · Documentation · Regulatory Consulting Navigate Global Regulation with Confidence Audit-ready documentation, expert consulting, self-audit tools andonline training for medical device companies — ISO 13485, EU MDR, FDA QMSR,MDSAP and beyond. ✓ Audit-Ready Templates✓ Online Training Courses✓ ISO 13485 · EU MDR · FDA QMSR✓ 10+ Markets CoveredExplore the AcademyBrowse DocumentationGet a Free Consultation... - [](https://mdregulatory.com/privacy-policy/): Privacy Policy - [How to Access The Course](https://mdregulatory.com/how-to-access-the-course/): Every Academy course is delivered on this website. Here is everything you need to log in, find your course and get started. 1. Log in Your username is the email address you used at checkout. Log in from the login page or from the account icon in the menu. If this is your first purchase, your account was created automatically during checkout. Set your password here — enter your email and follow the link you receive. 2. Find your course Once logged in, you can reach your course in three ways: the Start the course button in your order confirmation email; […] - [IEC 62366-1: Usability Engineering of Medical Devices](https://mdregulatory.com/usability-2/): IEC 62366-1: Usability Engineering of Medical Devices — MD Regulatory Academy IEC 62366-1 · FDA HUMAN FACTORS GUIDANCE · EU MDR ANNEX I IEC 62366-1: Usability Engineering of Medical Devices Most usability engineering files fail late and for the same reason. The evaluation itself is well run: fifteen participants per group, a realistic environment, a facilitator who does not interfere. What it evaluates is a set of scenarios that was already incomplete three steps earlier. This course follows the process one clause at a time, so you can read a file and say what is missing from it. Get the course […] - [12 — User interface of unknown provenance, and the file](https://mdregulatory.com/usability/unknown-provenance-and-the-file/) - [11 — Summative evaluation](https://mdregulatory.com/usability/summative-evaluation/) - [10 — Design, implementation and formative evaluation](https://mdregulatory.com/usability/design-and-formative-evaluation/) - [09 — The evaluation plan](https://mdregulatory.com/usability/evaluation-plan/) - [08 — The user interface specification](https://mdregulatory.com/usability/user-interface-specification/) - [07 — Selecting the scenarios for summative evaluation](https://mdregulatory.com/usability/selecting-the-scenarios/) - [06 — Hazard-related use scenarios](https://mdregulatory.com/usability/hazard-related-use-scenarios/) - [05 — Known and foreseeable hazards and hazardous situations](https://mdregulatory.com/usability/hazards-and-hazardous-situations/) - [04 — User interface characteristics and use errors](https://mdregulatory.com/usability/characteristics-and-use-errors/) - [03 — Use specification](https://mdregulatory.com/usability/use-specification/) - [02 — Principles and the usability engineering file](https://mdregulatory.com/usability/principles-and-the-file/) - [01 — Scope, applicability and the vocabulary of use](https://mdregulatory.com/usability/scope-and-vocabulary/) - [00 — Introduction](https://mdregulatory.com/usability/introduction/) - [IEC 62366-1: Usability Engineering of Medical Devices](https://mdregulatory.com/usability/) - [Medical Device Risk Management: ISO 14971, ISO/TR 24971 and Artificial Intelligence](https://mdregulatory.com/risk-management-training-course/): Medical Device Risk Management: ISO 14971, ISO/TR 24971 and Artificial Intelligence — MD Regulatory Academy ISO 14971:2019 · ISO/TR 24971:2020 · ISO/TS 24971-2:2026 · EU MDR · EU IVDR · EU AI Act Medical Device Risk Management: ISO 14971 and Artificial Intelligence Most risk management files are complete in form and thin in substance. They contain a hazard table, a set of scores and a report, and they cannot answer the question the whole exercise exists for: when something goes wrong in the field, was it already in the file, what was estimated, what was supposed to prevent it, and was […] - [12 — The risk management file in practice](https://mdregulatory.com/risk/the-file-in-practice/) - [11 — In vitro diagnostics: risk management under the IVDR](https://mdregulatory.com/risk/in-vitro-diagnostics/) - [10 — Production and post-production: the loop that closes the file](https://mdregulatory.com/risk/production-and-post-production/) - [09 — Overall residual risk, benefit-risk and the review before release](https://mdregulatory.com/risk/overall-residual-risk/) - [08 — Autonomy, human oversight and information for safety](https://mdregulatory.com/risk/autonomy-and-oversight/) - [07 — Risk control, risks introduced by controls, and security](https://mdregulatory.com/risk/risk-control-and-security/) - [06 — Risk estimation, acceptability criteria and risk evaluation](https://mdregulatory.com/risk/estimation-and-evaluation/) - [05 — Bias as a source of hazard](https://mdregulatory.com/risk/bias-as-a-source-of-hazard/) - [04 — Hazards, hazardous situations and the techniques that find them](https://mdregulatory.com/risk/hazards-and-techniques/) - [03 — Intended use, misuse and characteristics related to safety](https://mdregulatory.com/risk/intended-use-and-characteristics/) - [02 — The risk management system: process, plan and file](https://mdregulatory.com/risk/the-risk-management-system/) - [01 — The three standards, the two regulations and the AI Act](https://mdregulatory.com/risk/standards-and-regulations/) - [00 — Introduction](https://mdregulatory.com/risk/introduction/) - [Medical Device Risk Management: ISO 14971, ISO/TR 24971 and Artificial Intelligence](https://mdregulatory.com/risk/) - [EN 18286 Training Course](https://mdregulatory.com/en-18286-training-course/): EN 18286 in Practice: The Quality Management System Required by the EU AI Act — MD Regulatory Academy EN 18286:2026 · EU AI Act Article 17 · ISO 13485 · ISO/IEC 42001 EN 18286 in Practice: the quality system the AI Act requires A provider implements a harmonised standard cover to cover, then finds at the assessment that part of Article 17 was never in its scope. The compliance strategy of clause 4.4 does not exist, so nothing connects to anything. None of these are hard problems: they are the consequence of reading EN 18286 as a list of clauses rather […] - [esame — Final examination](https://mdregulatory.com/en18286/final-examination/) - [08 — Performance evaluation, and putting it in place](https://mdregulatory.com/en18286/performance-evaluation/) - [07 — Post-market, serious incidents and non-compliance](https://mdregulatory.com/en18286/post-market-and-incidents/) - [06 — Operations, supply chain and modifications](https://mdregulatory.com/en18286/supply-chain-and-modifications/) - [05 — Data, identification, continuous learning and documentation](https://mdregulatory.com/en18286/data-and-continuous-learning/) - [04 — AI system realization: life cycle, risk, design, V and V](https://mdregulatory.com/en18286/ai-system-realization/) - [03 — Leadership, planning and support](https://mdregulatory.com/en18286/leadership-planning-support/) - [02 — The foundations: clause 4](https://mdregulatory.com/en18286/the-foundations/) - [01 — Article 17, EN 18286 and the presumption of conformity](https://mdregulatory.com/en18286/article-17-and-the-standard/) - [00 — Introduction](https://mdregulatory.com/en18286/introduction/) - [EN 18286 in Practice: The Quality Management System Required by the EU AI Act](https://mdregulatory.com/en18286/) - [EU IVDR Technical Documentation Kit](https://mdregulatory.com/eu-ivdr-technical-documentation-kit/) - [Artificial Intelligence in Medical Devices](https://mdregulatory.com/artificial-intelligence-in-medical-devices/): Artificial Intelligence in Medical Devices: Regulatory Requirements — MD Regulatory Academy EU AI ACT · EU MDR / IVDR · FDA · INTERNATIONAL Artificial Intelligence in Medical Devices For a conventional device you demonstrate safety by showing how it works. For a device built on a learned model you cannot: nobody wrote the rules it applies. This course is about what you demonstrate instead — where the data came from, how the truth was established, how performance was measured and on whom, what a human can still catch, and how you would know if it stopped working. Get the course See […] - [FIN — Final test](https://mdregulatory.com/ai/final-test/) - [15 — Technical documentation and the notified body](https://mdregulatory.com/ai/technical-documentation/) - [14 — Other markets and the international layer](https://mdregulatory.com/ai/other-markets/) - [13 — The FDA route](https://mdregulatory.com/ai/fda-route/) - [12 — Generative AI, foundation models and LLMs](https://mdregulatory.com/ai/generative-ai/) - [11 — Post-market monitoring and vigilance](https://mdregulatory.com/ai/post-market/) - [10 — Change control and PCCP](https://mdregulatory.com/ai/change-control/) - [09 — Clinical evaluation and performance evidence](https://mdregulatory.com/ai/clinical-evidence/) - [08 — Transparency, usability and human oversight](https://mdregulatory.com/ai/transparency-oversight/) - [07 — Risk management, robustness and cybersecurity](https://mdregulatory.com/ai/risk-and-security/) - [06 — QMS and software lifecycle for AI](https://mdregulatory.com/ai/qms-and-lifecycle/) - [05 — Bias, model development and evaluation](https://mdregulatory.com/ai/bias-and-evaluation/) - [04 — Data governance](https://mdregulatory.com/ai/data-governance/) - [03 — Intended purpose and requirements](https://mdregulatory.com/ai/intended-purpose/) - [02 — The regulatory landscape and the clock](https://mdregulatory.com/ai/regulatory-landscape/) - [01 — Qualification and classification](https://mdregulatory.com/ai/qualification/) - [00 — Introduction](https://mdregulatory.com/ai/introduction/) - [Artificial Intelligence in Medical Devices: Regulatory Requirements](https://mdregulatory.com/ai/) - [Post-market Surveillance Training Course](https://mdregulatory.com/post-market-surveillance-training-course/): Post-Market Surveillance Requirements for Medical Devices — MD Regulatory Academy Articles 83–89 · Annex III · US & Australia Post-Market Surveillance Requirements for Medical Devices The surveillance loop end to end — from the plan that starts it to the file that records what it changed. Get the course See the outline 10 modules 3h 21 of video Self-paced Workbook included Certificate on completion Scope What the course covers Where a requirement is quoted, it is quoted in full and then explained. Where something is an interpretation rather than a rule, the course says so. 01 The regulation Articles 83 to […] - [Clinical Evaluation Training Course](https://mdregulatory.com/clinical-evaluation-training-course/): Clinical Evaluation according to EU MDR 2017/745 — MD Regulatory Academy Article 61 · Annex XIV · Annex XV Clinical Evaluation according to EU MDR 2017/745 From the plan that decides what has to be demonstrated, to the report somebody else assesses — and everything that has to hold in between. Get the course See the outline 13 modules 3h 23 of video Self-paced Workbook included Certificate on completion Scope What the course covers Where a requirement is quoted, it is quoted in full and then explained. Where something is an interpretation rather than a rule, the course says so. 01 […] - [Medical Device SW Training Course](https://mdregulatory.com/medical-device-sw-training-course/): Medical Device Software Verification and Validation — MD Regulatory Academy IEC 62304 · IEC 82304-1 · EU MDR Medical Device Software Verification and Validation What the software lifecycle standards actually require, how the documentation fits together, and what a notified body opens first. Get the course See the outline 4 modules 2h 30 of video Self-paced Workbook included Certificate on completion Scope What the course covers Where a requirement is quoted, it is quoted in full and then explained. Where something is an interpretation rather than a rule, the course says so. 01 The regulation The general safety and performance requirements […] - [MD Regulatory Academy](https://mdregulatory.com/academy/): MD Regulatory Academy MD Regulatory Academy One subject at a time, all the way down Each course takes a single area of the European medical device regulation and works through it completely: the requirements, the evidence, the documents that result, and the cases most training leaves out. Browse the courses How they are taught Self-paced Fully online Access does not expire Workbook included Certificate on completion Approach Depth, and no survey courses A course covers one area end to end rather than touring the whole regulation. Where something is an interpretation rather than a rule, it says so — in these […] - [FIN — Final test](https://mdregulatory.com/ce/final-test/) - [12 — Clinical evaluation and post-market clinical follow-up](https://mdregulatory.com/ce/pmcf/) - [11 — Clinical investigation](https://mdregulatory.com/ce/clinical-investigation/) - [10 — The Clinical Evaluation Report](https://mdregulatory.com/ce/clinical-evaluation-report/) - [09 — Article 61(10): the route without clinical data](https://mdregulatory.com/ce/article-61-10/) - [08 — Clinical evaluation of medical device software](https://mdregulatory.com/ce/software/) - [07 — Legacy devices and sufficient clinical evidence](https://mdregulatory.com/ce/legacy-devices/) - [06 — Clinical equivalence](https://mdregulatory.com/ce/equivalence/) - [05 — Analysis of clinical data](https://mdregulatory.com/ce/analysis/) - [04 — Identification and appraisal of clinical data](https://mdregulatory.com/ce/identification-and-appraisal/) - [03 — State of the art](https://mdregulatory.com/ce/state-of-the-art/) - [02 — The clinical evaluation plan](https://mdregulatory.com/ce/clinical-evaluation-plan/) - [01 — Requirements, guidance and definitions](https://mdregulatory.com/ce/requirements/) - [00 — Introduction](https://mdregulatory.com/ce/introduction/) - [Clinical Evaluation according to EU MDR 2017/745](https://mdregulatory.com/ce/) - [09 — PMS in audit and inspection](https://mdregulatory.com/pms/audit-and-inspection/) - [08 — Post-market risk management](https://mdregulatory.com/pms/post-market-risk-management/) - [07 — PSUR and PMS report](https://mdregulatory.com/pms/psur/) - [06 — Post-market clinical follow-up](https://mdregulatory.com/pms/pmcf/) - [05 — Trend reporting, serious incidents and field safety actions](https://mdregulatory.com/pms/trend-and-field-actions/) - [04 — Vigilance reporting: MIR, IMDRF codes and other jurisdictions](https://mdregulatory.com/pms/vigilance-reporting/) - [03 — Vigilance reporting: criteria and timelines](https://mdregulatory.com/pms/vigilance-criteria/) - [02 — Complaint handling process](https://mdregulatory.com/pms/complaint-handling/) - [01 — PMS system and PMS plan](https://mdregulatory.com/pms/pms-plan/) - [00 — Introduction](https://mdregulatory.com/pms/introduction/) - [Post-Market Surveillance Requirements for Medical Devices](https://mdregulatory.com/pms/) - [FIN — Final test](https://mdregulatory.com/sw-vv/final-test/) - [03 — IEC 82304-1](https://mdregulatory.com/sw-vv/iec-82304/) - [02 — IEC 62304](https://mdregulatory.com/sw-vv/iec-62304/) - [01 — Design and development of medical device software](https://mdregulatory.com/sw-vv/design-and-development/) - [00 — Introduction](https://mdregulatory.com/sw-vv/introduction/) - [Medical Device Software Verification and Validation](https://mdregulatory.com/sw-vv/) - [Verify a Certificate](https://mdregulatory.com/verify-a-certificate/) ## Products - [FDA 510(k) SOP + Substantial Equivalence Matrix — 21 CFR & QMSR (USA)](https://mdregulatory.com/product/mdsap-usa-marketing-authorization/): Process Package — Marketing Authorization USA (FDA) Complete framework for FDA medical device authorization. Covers 21 CFR 862-892 classification, the four pathways (Exempt / 510(k) / De Novo / PMA), Establishment Registration and Listing, UDI/GUDID, eSTAR submissions (mandatory for 510(k) since Oct 2023), and the FDA QMSR transition (in force Feb 2026). What’s included: SOP-REG-US... - [TGA ARTG SOP + Pathway Selection Template — Australia](https://mdregulatory.com/product/mdsap-australia-marketing-authorization/): Process Package — Marketing Authorization Australia (TGA) Complete framework for Australian TGA ARTG inclusion. Covers Sponsor designation, classification under TG (MD) Regulations 2002, the five conformity assessment pathways, Essential Principles (Schedule 2), AusUDID (effective 2025), and Annual Reports for ARTG-included devices. What’s included: SOP-REG-AU Marketing Authorization Australia — full procedure: Sponsor designation, classification rules, 5... - [FDA MDR SOP + Reportability Worksheet — 21 CFR Part 803 (USA)](https://mdregulatory.com/product/mdsap-usa-vigilance/): Process Package — Vigilance Reporting USA (FDA MDR) Complete framework for FDA Medical Device Reporting under 21 CFR Part 803. Covers MDR reportability (death/serious injury caused or contributed to, plus the unique ‘malfunction recurrence’ criterion), 30-day standard timeline vs 5-day expedited reporting, eMDR submission via the FDA Electronic Submissions Gateway, and the §803.18 records retention... - [TGA MDIR SOP + Exemption Worksheet — Australia](https://mdregulatory.com/product/mdsap-australia-marketing-authorizatio/): Process Package — Vigilance Reporting Australia (TGA) Complete framework for Australian medical device incident reporting. Covers Medical Device Incident Report (MDIR) under TG (MD) Regulations 2002, the Australia-specific exemption mechanism (events that meet specific criteria can be aggregated in Annual Reports rather than reported individually), and the PRAC (Procedure for Recalls, Product Alerts and Product... - [Health Canada MPR + Foreign Risk Notification SOP — SOR/98-282 §59 & §61.2](https://mdregulatory.com/product/mdsap-canada-vigilance/): Process Package — Vigilance Reporting Canada Canada has TWO distinct reporting paths and both are audited. (1) MPR — Mandatory Problem Report under SOR/98-282 §59 with 10-day or 30-day timelines for events in Canada; (2) FRN — Foreign Risk Notification under §61.2 requiring 72-hour notification when a foreign regulator/manufacturer has taken corrective action abroad on... - [PMDA Registration SOP + JMDN Template — Shonin / Ninsho / Todokede (Japan)](https://mdregulatory.com/product/mdsap-japan-vigilance/): Process Package — Vigilance Reporting Japan (PMDA) Complete framework for Japanese medical device vigilance under PMD Act Art. 68-10. Covers the LISTED vs UNLISTED logic (events already in tempu bunsho follow 30-day path; UNLISTED follow stricter 15-day path), causality assessment, mandatory PSB/PSD fax notification for deaths, and tempu bunsho management strategy. What’s included: SOP-VIG-JP Vigilance... - [ANVISA Registration SOP + Classification Template — RDC 751/2022 (Brazil)](https://mdregulatory.com/product/mdsap-brazil-marketing-authorization/): Process Package — Marketing Authorization Brazil (ANVISA) Complete framework for ANVISA medical device authorization. Covers BRH designation, classification under RDC 751/2022, Notificação vs Registro pathway selection, B-GMP certification (with MDSAP leverage), INMETRO and ANATEL conformity, and UDI/SIUD compliance (in force since July 2025). What’s included: SOP-REG-BR Marketing Authorization Brazil — full procedure: BRH designation criteria... - [ANVISA Notivisa Vigilance SOP + Reportability Worksheet — RDC 67/2009 (Brazil)](https://mdregulatory.com/product/mdsap-brazil-vigilance/): Process Package — Vigilance Reporting Brazil (Notivisa) Complete framework for Brazilian medical device vigilance. Covers RDC 67/2009 reportability assessment, Notivisa submission, causality classification, foreign event tracking, and field actions. What’s included: SOP-VIG-BR Vigilance Reporting Brazil — full procedure with the 4-question reportability framework per RDC 67/2009, Notivisa submission process, causality classification, timelines (10 days for... - [Health Canada MDL SOP + Application Checklist — SOR/98-282 (Canada)](https://mdregulatory.com/product/mdsap-canada-marketing-authorization/): Process Package — Marketing Authorization Canada (Health Canada) Complete framework for Health Canada MDL and MDEL. Covers Schedule 1 classification (16 medical device rules), MDL application by class, MDEL for importers/distributors, MDSAP certificate as mandatory QMS evidence, Annual Licence Review (April 1 deadline), bilingual EN/FR labeling, and faxed amendments. What’s included: SOP-REG-CA Marketing Authorization Canada... - [PMDA Registration SOP + JMDN Template — Shonin / Ninsho / Todokede (Japan)](https://mdregulatory.com/product/mdsap-japan-marketing-authorization/): Process Package — Marketing Authorization Japan (PMDA) Complete framework for Japanese PMDA medical device authorization. Covers DMAH designation, Foreign Manufacturer Registration (Form 63-5), JMDN code mapping, the three pathways (Todokede / Ninsho / Shonin), STED dossier, ICH E5 ethnic factor assessment, and tempu bunsho management. What’s included: SOP-REG-JP Marketing Authorization Japan — full procedure: MAH/DMAH... - [Document Control SOP + Templates — ISO 13485 & MDSAP Compliant](https://mdregulatory.com/product/mdsap-document-control/): Process Package — Document and Record Control A complete, audit-ready document control system covering all requirements of ISO 13485:2016 §4.2.4–4.2.5, MDSAP Chapter 1, and 21 CFR Part 11 for electronic records. What’s included: SOP-CORE-01 Document and Record Control — full standard operating procedure with cover page, control page, responsibilities matrix, document hierarchy, lifecycle workflow, periodic... - [MDSAP Documentation Kit — 15 SOPs + 18 Templates for All 5 Jurisdictions (BR · JP · CA · AU · USA)](https://mdregulatory.com/product/mdsap-complete-kit/): MDSAP Documentation Kit — Complete The flagship kit. Everything your QMS needs to face an MDSAP audit confidently across all 5 jurisdictions: Brazil, Japan, Canada, Australia, USA. 15 procedures + 18 templates + a User Guide and Master Index, all aligned to the latest 2025-2026 regulatory frameworks. What’s included: Shared Core (4 procedures + 8... - [CAPA SOP + Template — ISO 13485, MDSAP & FDA QMSR Compliant](https://mdregulatory.com/product/mdsap-capa/): Process Package — Corrective and Preventive Action (CAPA) A complete CAPA system covering ISO 13485:2016 §8.5.2–8.5.3, MDSAP Chapter 1–2, and FDA QMSR expectations. CAPA is the most-cited finding area in regulatory audits — this package addresses it head-on with a lifecycle-complete template and a procedure that integrates risk-based prioritization. What’s included: SOP-CORE-04 CAPA — full... - [Internal Audit SOP + 3 Templates — ISO 13485 & MDSAP Compliant](https://mdregulatory.com/product/mdsap-internal-audit/): ISO 13485:2016 §8.2.4 · MDSAP Chapter 1 · Internal audit Process Package — Internal Audit The procedure, the annual programme, the audit plan and the audit report — four documents that turn an audit into evidence an assessor accepts. €69 VAT calculated at checkout Get the package 4 documents · Word and Excel · updated... - [Management Review SOP + Template — ISO 13485 & MDSAP Compliant](https://mdregulatory.com/product/mdsap-management-review/): Process Package — Management Review Complete, audit-ready management review system covering ISO 13485:2016 §5.6 and MDSAP Chapter 1 expectations. Includes the 17 mandatory review inputs, output decisions framework, and integration with CAPA and KPI processes. What’s included: SOP-CORE-02 Management Review — full procedure with frequency, agenda structure, input checklist (all 17 ISO §5.6 inputs), output... - [IEC 62366-1: Usability Engineering of Medical Devices](https://mdregulatory.com/product/iec-62366-1-usability-engineering-of-medical-devices/): IEC 62366-1 · FDA HUMAN FACTORS GUIDANCE · EU MDR ANNEX I IEC 62366-1: Usability Engineering of Medical Devices Thirteen modules that follow the usability engineering process one clause at a time, so you can read a usability engineering file and say what is missing from it. €229 VAT calculated at checkout Get the course 13 modules · 2h 32 of video · CertificateAccess does not expire The summative evaluation is run correctly, against the wrong set of scenarios Most usability engineering files fail late and for the same reason. The evaluation itself is well run: fifteen participants per group, a […] - [ISO 14971, ISO/TR 24971 and Artificial Intelligence](https://mdregulatory.com/product/iso-14971-iso-tr-24971-and-artificial-intelligence/): ISO 14971 · ISO/TR 24971 · ISO/TS 24971-2 · EU MDR / IVDR · EU AI Act Medical Device Risk Management: ISO 14971, ISO/TR 24971 and Artificial Intelligence From the acceptability policy to the post-market loop — each requirement stated precisely, and shown in the document that holds it. €229 VAT calculated at checkout Get the course 13 modules · 3h 25 · workbook · certificateAccess does not expire Complete in form, thin in substance Most risk management files contain a hazard table, a set of scores and a report. They satisfy the structure of the standard, and they cannot answer […] - [EN 18286 in Practice: The Quality Management System Required by the EU AI Act](https://mdregulatory.com/product/en-18286-in-practice/): EN 18286 · EU AI Act Article 17 · ISO 13485 EN 18286 in Practice: The Quality Management System Required by the EU AI Act All 146 requirements of the standard, clause by clause — each one mapped to the document, record or decision it obliges you to hold. €229 VAT calculated at checkout Get the course 9 modules · 2h 44 · workbook · certificateAccess does not expire Four ways an Article 17 file goes wrong A provider implements a harmonised standard cover to cover, then finds at the assessment that part of Article 17 was never in its scope. […] - [EU IVDR Complete Bundle](https://mdregulatory.com/product/eu-ivdr-complete-bundle/): EU IVDR · Technical · Performance · Risk EU IVDR Complete Bundle The three kits together, already cross-referenced, plus six documents that are not sold anywhere else. Everything a complete IVDR submission needs, in one download. €999 VAT calculated at checkout Get the kit 31 templates · Word and ExcelSave €178 · instant download The three kits were designed to work together Section 5 of the technical file points at the risk management report. Section 6.2 points at the performance evaluation report. The PMPF plan cites the gaps numbered in that report. The summary of safety and performance draws on all […] - [IVDR Risk Management Documentation Kit](https://mdregulatory.com/product/ivdr-risk-management-documentation-kit/): EU IVDR · ISO 14971 · ISO/TR 24971 · Annex I IVDR Risk Management Documentation Kit A risk file that treats a wrong result as the hazard it actually is — because for a diagnostic the harm is indirect, and a hazard library written for therapeutic devices does not reach it. €349 VAT calculated at checkout Get the kit 6 templates · 4 Word + 2 ExcelAuto-calculated risk priority · GSPR checklist ISO 14971 does not change. The hazard library does. The process transfers from the MDR unchanged: plan, hazard identification, risk estimation, risk control, residual risk, benefit-risk, production and post-production […] - [EU IVDR Performance Evaluation Kit](https://mdregulatory.com/product/eu-ivdr-performance-evaluation-kit/): EU IVDR · Annex XIII · Annex III · MDCG 2022-2 EU IVDR Performance Evaluation Kit Three reports, one evaluation, and the post-market loop that closes it — the evidence architecture the IVDR requires and the MDR does not have. €399 VAT calculated at checkout Get the kit 11 Word templates · Annex XIII Part A and BInstant download · free updates The IVDR splits what the MDR keeps together A medical device has one clinical evaluation report. An in vitro diagnostic has three: scientific validity, analytical performance and clinical performance — assembled into a performance evaluation report that assesses them […] - [EU IVDR Technical Documentation Kit](https://mdregulatory.com/product/eu-ivdr-technical-documentation-kit/): EU IVDR · Annex II · Annex III · Annex IV EU IVDR Technical Documentation Kit The full Annex II technical file for an in vitro diagnostic, in the order the Regulation itself sets — so a completeness check runs straight through instead of stopping on the first section. €429 VAT calculated at checkout Get the kit 8 Word templates · Annex II to Annex IVInstant download · free updates Most IVDR files fail on structure, not on science The assay is validated. The stability data are real. And then Section 6 is filed as a single block, labelling sits at […] - [Artificial Intelligence in Medical Devices: Regulatory Requirements](https://mdregulatory.com/product/artificial-intelligence-in-medical-devices-regulatory-requirements/): EU AI Act · EU MDR / IVDR · FDA · International Artificial Intelligence in Medical Devices: Regulatory Requirements From qualifying the product and writing an intended purpose that holds, to the evidence a reviewer actually asks for — and everything that has to hold in between. €279 VAT calculated at checkout Get the course 16 modules · 5h 20 · workbook · certificateAccess does not expire For a learned model, you cannot show how it works For a conventional device you demonstrate safety and performance by showing the mechanism. It is physical, it can be inspected, and the evidence follows […] - [Clinical Evaluation according to EU MDR 2017/745](https://mdregulatory.com/product/clinical-evaluation-according-to-eu-mdr-2017-745/): Article 61 · Annex XIV · Annex XV Clinical Evaluation according to EU MDR 2017/745 From the plan that decides what has to be demonstrated, to the report somebody else assesses — and everything that has to hold in between. €229 VAT calculated at checkout Get the course 13 modules · 3h 23 · workbook · certificateAccess does not expire Most clinical evaluations fail on structure, not on science A plan written after the data, describing what was found rather than deciding what was needed. A state of the art section built from papers about your own device. An analysis written […] - [Post-Market Surveillance Requirements for Medical Devices](https://mdregulatory.com/product/post-market-surveillance-course/): Articles 83–89 · Annex III · US & Australia Post-Market Surveillance Requirements for Medical Devices The surveillance loop end to end — from the plan that starts it to the file that records what it changed. €229 VAT calculated at checkout Get the course 10 modules · 3h 21 · workbook · certificateAccess does not expire Most surveillance systems produce records, not evidence A plan that could belong to any device on the market. Indicators with thresholds nobody has ever crossed, on any product, in any year. Complaints handled correctly one at a time, and never looked at together. None of […] - [Medical Device Software V&V Training Course + SW Documentation Kit Gold](https://mdregulatory.com/product/medical-device-software-vv-training-course-sw-documentation-kit-gold/): IEC 62304 · IEC 82304-1 · AAMI CR34971 · MDCG 2019-16 Course + SW Documentation Kit Gold: Software, AI/ML and Cybersecurity The course on how a software file is built, plus the 23 templates that hold the lifecycle, the model and the cybersecurity documents in one coherent set. €929 VAT calculated at checkout Get the course and kit Course €229 + Gold kit €799Access does not expire Where an AI software file comes apart A team documents IEC 62304 properly and treats the model as an implementation detail, so the file describes how the code was written and says nothing about […] - [Medical Device Software V&V Training Course + SW Documentation Kit](https://mdregulatory.com/product/medical-device-software-vv-training-course-sw-documentation-kit/): IEC 62304 · IEC 82304-1 · ISO 13485 §7.3 · 21 CFR 820.30 Medical Device Software: Course and Documentation Kit The software lifecycle explained clause by clause, and the twelve templates that turn the gaps you find into a file you can hand to a reviewer. €629 VAT calculated at checkout Get the bundle 4 modules · 2h 30 · 12 templates · certificateAccess does not expire Four ways a software file goes wrong A team writes the development plan after the software is written, so the plan describes what happened rather than what was decided. A safety class is assigned […] - [Medical Device Software V&V — Course](https://mdregulatory.com/product/medical-device-software-vv-course/): IEC 62304 · IEC 82304-1 · EU MDR Medical Device Software Verification and Validation What the software lifecycle standards actually require, how the documentation fits together, and what a notified body opens first. €229 VAT calculated at checkout Get the course 4 modules · 2h 30 · workbook · certificateAccess does not expire Most software files fail review for the same handful of reasons A safety class stated without a rationale. A SOUP register that names components but never says what they are relied on to do. Test records that hold every result and never say which version was tested. None […] - [Full Saudi Arabia Market Access Kit](https://mdregulatory.com/product/saudi-arabia-market-access-kit/): The Saudi Arabia toolkit in one download — the SFDA gap analysis plus the Annex 3 technical documentation kit — at a saving. - [Saudi Arabia Technical Documentation Kit](https://mdregulatory.com/product/saudi-arabia-technical-documentation-kit/): A fill-in Word template that builds the SFDA technical documentation on the Annex 3 structure, with the essential-principles checklist embedded and GSPR-mapped, plus a README and master index. - [SFDA Saudi Gap Analysis](https://mdregulatory.com/product/sfda-saudi-gap-analysis/): A scored Excel workbook measuring your device file against the SFDA's Medical Device Marketing Authorization requirements (MDMA Saudi Route), with a filing-gate verdict. - [Full India Market Access Kit](https://mdregulatory.com/product/full-india-market-access-kit/): The India toolkit in one download — the CDSCO gap analysis plus the Device and Plant Master File templates — at a saving. - [India CDSCO Technical Dossier Kit](https://mdregulatory.com/product/india-cdsco-technical-dossier-kit/): Fill-in Word templates for India's Device Master File and Plant Master File under the Medical Device Rules 2017, plus a README and master index. - [India CDSCO Gap Analysis](https://mdregulatory.com/product/india-cdsco-gap-analysis/): A scored Excel workbook measuring your device file against India's Medical Device Rules 2017 (CDSCO), with a filing-gate verdict. - [Full Brazil Market Access Kit](https://mdregulatory.com/product/full-brazil-market-access-kit/): Everything you need to prepare an ANVISA submission — the gap analysis, the essential requirements checklist and the technical dossier pack — in one download, at a saving. - [Brazil Technical Dossier Pack](https://mdregulatory.com/product/brazil-technical-dossier-pack/): A set of fill-in Word templates that build an ANVISA technical dossier on the IMDRF table of contents, plus a master index to keep it all straight. - [Brazil Essential Requirements Checklist](https://mdregulatory.com/product/brazil-essential-requirements-checklist/): The full set of ANVISA essential requirements (RDC 848/2024), each cross-referenced to the matching EU MDR GSPR so you can reuse your CE evidence. - [ANVISA Gap Analysis — Brazil](https://mdregulatory.com/product/anvisa-gap-analysis-brazil/): A scored Excel workbook that measures your device file against every ANVISA requirement and tells you, in one verdict, whether it is ready to file. - [SW Documentation Kit Gold](https://mdregulatory.com/product/sw-documentation-kit-gold/): What it is: the complete software file for AI/ML-enabled medical devices and SaMD, in one coordinated set. Twenty-three professionally drafted templates across three modules — the full IEC 62304 software lifecycle, the complete AI/ML documentation set built on the IMDRF Good Machine Learning Practice principles, and the cybersecurity file expected under Regulation (EU) 2017/745. Everything a Notified Body or FDA reviewer expects for machine-learning-based software, from development plan to postmarket AI performance monitoring. What is included Module 01 — Software Lifecycle (IEC 62304), 9 templates: Software Development Plan — Clause 5.1, scaled by safety class A/B/C Software Architecture & Detailed Design […] - [Software Documentation Bundle Kit](https://mdregulatory.com/product/software-documentation-bundle-kit/): What it is: the complete IEC 62304 software lifecycle file plus the cybersecurity documentation expected under Regulation (EU) 2017/745, in one coordinated set. Twelve professionally drafted templates covering software development, verification, maintenance, and security — the full documentation package Notified Bodies expect for medical device software (safety Class A, B, or C) and SaMD. What is included Cybersecurity (MDCG 2019-16, IEC 81001-5-1): Cybersecurity Risk Assessment & Threat Model — STRIDE-based, CVSS-compatible scoring, ISO 14971 interface Cybersecurity Management Plan — secure development lifecycle and post-market security monitoring Vulnerability Disclosure Policy — coordinated disclosure per ISO/IEC 29147 and ISO/IEC 30111 IEC 62304 software […] - [Vulnerability Disclosure Policy](https://mdregulatory.com/product/vulnerability-disclosure-policy/): Coordinated vulnerability disclosure policy — scope, safe-harbour, reporting channel and assessment-to-disclosure timelines. - [Cybersecurity Management Plan](https://mdregulatory.com/product/cybersecurity-management-plan/): Lifecycle cybersecurity management plan per IEC 81001-5-1 §5.6–§5.7 — vulnerability monitoring, CVSS triage and security patch management. - [Cybersecurity Risk Assessment & Threat Model](https://mdregulatory.com/product/cybersecurity-risk-assessment-threat-model/): Security risk assessment and threat model using STRIDE + DREAD + CIA, aligned to IEC 81001-5-1 and the FDA 2023 cybersecurity guidance. - [Problem Resolution & Anomaly Log (IEC 62304)](https://mdregulatory.com/product/problem-resolution-anomaly-log-iec-62304/): Anomaly and problem-resolution log per IEC 62304 §9 — severity, safety impact, root cause and an auto-calculated summary dashboard. - [Software Release & Configuration Management Record (IEC 62304)](https://mdregulatory.com/product/software-release-configuration-management-record-iec-62304/): Per-release configuration and release record per IEC 62304 §5.8 & §8 — semantic versioning, locked baseline and release-gate checklist. - [Software Verification & Validation Report (IEC 62304)](https://mdregulatory.com/product/software-verification-validation-report-iec-62304/): V&V Report capturing test execution, security/vulnerability-scan results, SOUP verification, deviations and the signed V&V conclusion. - [Software Verification & Validation Plan (IEC 62304)](https://mdregulatory.com/product/software-verification-validation-plan-iec-62304/): V&V Plan per IEC 62304 §5.5–§5.7 with a structured test-case register (unit, integration, system, security) and defined release criteria. - [SOUP List & Evaluation Record (IEC 62304)](https://mdregulatory.com/product/soup-list-evaluation-record-iec-62304/): SOUP register and evaluation record per IEC 62304 §8, with CVE screening, safety classification and re-evaluation history. Active Excel workbook. - [Software Traceability Matrix (IEC 62304)](https://mdregulatory.com/product/software-traceability-matrix-iec-62304/): Active Excel traceability matrix linking requirements, architecture, tests, risk controls and anomalies, with auto-calculated coverage summary. - [Software Requirements Specification (IEC 62304)](https://mdregulatory.com/product/software-requirements-specification-iec-62304/): IEC 62304 §5.2 Software Requirements Specification with risk-control flags, per-requirement safety class and traceability hooks. Editable Word template. - [Software Architecture & Detailed Design (IEC 62304)](https://mdregulatory.com/product/software-architecture-detailed-design-iec-62304/): Architecture and detailed design template per IEC 62304 §5.3 — item/unit decomposition, interfaces and SOUP integration. Editable Word template. - [Software Development Plan (IEC 62304)](https://mdregulatory.com/product/software-development-plan-iec-62304/): IEC 62304 Software Development Plan with safety classification, lifecycle activities and full regulatory mapping. Editable Word template. - [AI/ML Medical Device Documentation Kit - Complete Bundle](https://mdregulatory.com/product/ai-ml-medical-device-documentation-kit-complete-bundle/): All 10 AI/ML documents + README + Master Index (Excel). One coordinated set, five markets. Save ~28% vs buying individually. - [SOP — AI/ML Model Development & Lifecycle (AI-09)](https://mdregulatory.com/product/sop-ai-ml-model-development-lifecycle-ai-09/): The procedural SOP your ISO 13485 QMS requires: roles, steps and stage gates for AI/ML model development, built on ISO 13485 §7.5 and GMLP. - [Clinical Evaluation Report — AI-Augmented (AI-08b)](https://mdregulatory.com/product/clinical-evaluation-report-ai-augmented-ai-08b/): The reporting counterpart to AI-08a on a real CER template with [AI MODULE] markers, documenting the AI clinical evidence and benefit-risk contribution. - [Clinical Evaluation Plan — AI-Augmented (AI-08a)](https://mdregulatory.com/product/clinical-evaluation-plan-ai-augmented-ai-08a/): A clinical evaluation plan on a real CEP template, with AI-specific additions flagged as [AI MODULE] for integration with your clinical process. - [Postmarket AI Performance Monitoring (AI-07)](https://mdregulatory.com/product/postmarket-ai-performance-monitoring-ai-07/): Real-world performance monitoring: drift detection, logging strategy and re-training triggers feeding back into the PCCP and risk file. - [Human Oversight & Transparency Plan (AI-06)](https://mdregulatory.com/product/human-oversight-transparency-plan-ai-06/): GMLP principles P7/P9 plus the Transparency guiding principles and EU AI Act Articles 13–14, in one coordinated plan. - [Predetermined Change Control Plan — PCCP (AI-05)](https://mdregulatory.com/product/predetermined-change-control-plan-ai-05/): The flagship PCCP — pre-authorised modifications, modification protocol and impact assessment, aligned to FDA and Health Canada nomenclature. - [AI Risk Management Plan & Report (AI-04)](https://mdregulatory.com/product/ai-risk-management-plan-report-ai-04/): ISO 14971 risk management extended with AAMI CR34971 guidance on AI/ML-specific hazards (drift, automation bias, generalisation failure). - [Model Validation & Performance Report (AI-03)](https://mdregulatory.com/product/model-validation-performance-report-ai-03/): Standalone performance evaluation plus subgroup/sub-population analysis, with the methodology reviewers expect across five markets. - [Data Governance & Bias Management Plan (AI-02)](https://mdregulatory.com/product/data-governance-bias-management-plan-ai-02/): Data sourcing, representativeness, dataset independence and bias identification & mitigation across the AI lifecycle. - [AI Development & Lifecycle Plan (AI-01)](https://mdregulatory.com/product/ai-development-lifecycle-plan-ai-01/): Master AI/ML lifecycle plan integrating IEC 62304, the IMDRF GMLP principles and the Health Canada 9-stage ML lifecycle. - [MDR Complete Bundle](https://mdregulatory.com/product/mdr-complete-bundle/): The complete EU MDR documentation set in one premium bundle. Three coordinated kits covering technical file, clinical evaluation and risk management. 22 templates total. Save 15% vs buying separately. - [EU MDR Technical Documentation Kit](https://mdregulatory.com/product/eu-mdr-technical-documentation-kit/): The complete Annex II technical file for EU MDR (Regulation 2017/745) in one coordinated set. Eight professionally drafted Word templates from Device Description to Declaration of Conformity, with Team-NB position papers integrated. Ready for Notified Body submission. - [GSPR Checklist Template - MDR](https://mdregulatory.com/product/gspr-checklist-template-mdr/): Operational Excel checklist covering all 159 General Safety and Performance Requirements of MDR Annex I. Filterable, with applicability dropdown and color-coded compliance status. - [Use-related FMEA (uFMEA) Template - MDR](https://mdregulatory.com/product/use-related-fmea-ufmea-template-mdr/): Active Excel template for Use-related FMEA aligned with EN IEC 62366-1:2015/A1:2020. Includes User Profiles & Use Environments, auto-calculated RPN and three worked examples. - [Design FMEA (dFMEA) Template - MDR](https://mdregulatory.com/product/design-fmea-dfmea-template-mdr/): Active Excel template for Design FMEA aligned with EN ISO 14971:2019/A11:2021. Auto-calculated RPN, automatic Region classification (Acceptable / AFAP / Unacceptable), conditional formatting and three worked examples. - [Hazard Analysis (HAN) Template - MDR](https://mdregulatory.com/product/hazard-analysis-han-template-mdr/): Word template for the Hazard Analysis implementing the full ISO/TR 24971:2020 Annex A questionnaire (46 questions). Systematically identifies hazards across the device lifecycle. - [Risk Management Report (RMR) Template - MDR](https://mdregulatory.com/product/risk-management-report-rmr-template-mdr/): Word template for the Risk Management Report per EN ISO 14971:2019/A11:2021. Documents the execution of the RMP, summarises residual risks and concludes on the benefit-risk balance. - [Risk Management Plan (RMP) Template - MDR](https://mdregulatory.com/product/risk-management-plan-rmp-template-mdr/): Word template for the Risk Management Plan per EN ISO 14971:2019/A11:2021. Defines the process, scoring scales, acceptability thresholds and competence matrix. The framework all other risk documents reference. - [Risk Management Documentation Kit - MDR](https://mdregulatory.com/product/risk-management-documentation-kit-mdr/): The complete risk management documentation kit aligned with EN ISO 14971:2019/A11:2021, IEC 62366-1 and EU MDR Annex I. Six coordinated templates: Risk Management Plan and Report, Hazard Analysis, Design FMEA, Use-related FMEA and General Safety and Performance Requirements Checklist. Save 16% vs buying individually. - [Risk + Clinical Documentation Bundle - MDR](https://mdregulatory.com/product/risk-clinical-documentation-bundle-mdr/): Save 20% by buying the Risk Management Documentation Kit and the EU MDR Clinical Documentation Kit together. Fourteen coordinated templates covering both halves of MDR Annex II in one purchase. - [EU MDR Clinical Documentation Kit](https://mdregulatory.com/product/eu-mdr-clinical-documentation-kit/): Audit-ready clinical and post-market documentation kit for EU MDR (Regulation 2017/745). 8 editable Word templates: CEP, CER, CDP, PMS Plan, PSUR, PMCF Plan, PMCF Evaluation Report, SSCP. - [Summary of Safety and Clinical Performance (SSCP) Template - MDR](https://mdregulatory.com/product/sscp-template-mdr/): Word template for the SSCP per EU MDR Article 32. Required for Class III and implantable devices, suitable for Eudamed publication. - [PMCF Evaluation Report Template - MDR](https://mdregulatory.com/product/pmcf-evaluation-report-template-mdr/): Word template for the PMCF Evaluation Report per EU MDR Annex XIV Part B. Documents the outcomes of executed PMCF activities. - [PMCF Plan Template - MDR](https://mdregulatory.com/product/pmcf-plan-template-mdr/): Word template for the Post-Market Clinical Follow-up Plan, aligned with EU MDR Article 61(11) and Annex XIV Part B. - [Periodic Safety Update Report (PSUR) Template - MDR](https://mdregulatory.com/product/psur-template-mdr/): Word template for the PSUR per EU MDR Article 86. Every 2 years for Class IIa, annual for Class IIb and IIII. - [Post-Market Surveillance (PMS) Plan Template - MDR](https://mdregulatory.com/product/pms-plan-template-mdr/): Word template for the Post-Market Surveillance Plan, aligned with EU MDR Articles 83-84 and Annex III Section 1.1. - [Clinical Development Plan (CDP) Template - MDR](https://mdregulatory.com/product/cdp-template-mdr/): Word template for the Clinical Development Plan per EU MDR Annex XIV Part A. Critical for Class III and implantable devices. - [Clinical Evaluation Report (CER) Template - MDR](https://mdregulatory.com/product/cer-template-mdr/): Word template for the Clinical Evaluation Report, aligned with EU MDR Article 61 and Annex XIV-A. Companion to the CEP, structured for Notified Body review. - [Clinical Evaluation Plan (CEP) Template - MDR](https://mdregulatory.com/product/cep-template-mdr/): Word template for the Clinical Evaluation Plan, aligned with EU MDR Article 61 and Annex XIV-A. Includes PICO, equivalence, state-of-the-art search and GSPR mapping. - [Combined Kit ISO 13485 + MDSAP](https://mdregulatory.com/product/iso-mdsap-combined-kit/): Combined Kit ISO 13485 + MDSAP — the ultimate global QMS documentation bundle. Get every ISO 13485 process plus all 5 MDSAP markets (Brazil, Japan, Canada, Australia, USA) in one premium package. 122 files including Quality Manual, Master Tracker, 41 SOPs, and 70+ templates. Save €199 vs buying separately. - [Document and Record Control — Process Package (ISO 13485)](https://mdregulatory.com/product/iso-document-control/): Audit-ready Document Control SOP plus 3 templates: Master List, Change Request Form, and Record Destruction Authorization. Aligned with ISO 13485:2016 §4.2 and 21 CFR Part 11. - [Notified Body Change Notification — Process Package (ISO 13485)](https://mdregulatory.com/product/iso-nb-change-notification/): Notified Body Change Notification SOP with comprehensive NB Change Notification Form per EU MDR Art. 56(2) + MDCG 2020-3 Rev.2. - [Purchase Management — Process Package (ISO 13485)](https://mdregulatory.com/product/iso-purchase/): Purchase Management SOP with combined Purchase Specification + PO template (Part A specs + Part B PO). - [Labelling and Translation Management — Process Package (ISO 13485)](https://mdregulatory.com/product/iso-labelling/): Labelling and Translation Management SOP with combined Label Specification + IFU + Approvals + Translation Validation template. Aligned with EU MDR Annex I §23 + ISO 15223-1 + ISO 20417. - [Usability Engineering — Process Package (ISO 13485)](https://mdregulatory.com/product/iso-usability-engineering/): Usability Engineering SOP with Use Specification & URRA combined and Usability Engineering File (UEF) Summary. Aligned with IEC 62366-1 + FDA HFE 2016. - [Post-Market Surveillance — Process Package (ISO 13485)](https://mdregulatory.com/product/iso-pms/): Post-Market Surveillance SOP with PMS Plan and PMS Report (Class I) templates. Aligned with EU MDR Art. 84-86 + Annex III + MDCG 2022-21. - [Advisory Notice and FSCA — Process Package (ISO 13485)](https://mdregulatory.com/product/iso-fsca-advisory-notice/): Advisory Notice / FSCA SOP with FSCA Decision Worksheet and Field Safety Notice (FSN) per MDCG 2024-1. - [Sterilization Process Validation — Process Package (ISO 13485)](https://mdregulatory.com/product/iso-sterilization/): Sterilization Process Validation SOP — supplier-provided validation framework per ISO 11135/17665/11137. SOP only (no templates — supplier provides validation docs). - [Incoming Inspection and Control — Process Package (ISO 13485)](https://mdregulatory.com/product/iso-incoming-inspection/): Incoming Inspection SOP with Inspection Plan & Report (Excel) and CoA/CoC Review Record. AQL sampling per ANSI/ASQ Z1.4. - [Production and Service Provision — Process Package (ISO 13485)](https://mdregulatory.com/product/iso-production/): Production and Service Provision SOP with Manufacturing Process Specification (MPS) — equivalent to FDA Device Master Record (DMR). - [Supplier Management — Process Package (ISO 13485)](https://mdregulatory.com/product/iso-supplier-management/): Supplier Management SOP with Evaluation Form, Approved Supplier List (Excel), and bilateral Quality Agreement. - [Infrastructure and Equipment Control — Process Package (ISO 13485)](https://mdregulatory.com/product/iso-infrastructure/): Infrastructure & Equipment Control SOP with Equipment Master List (Excel — auto-calc Days Until Cal) and Maintenance & Calibration Record. - [Strategy for Regulatory Compliance — Process Package (ISO 13485)](https://mdregulatory.com/product/iso-regulatory-strategy/): Strategy for Regulatory Compliance SOP with PRRC Qualification Record per EU MDR Art. 15(1) — pathway (a) or (b). - [Customer Related Processes — Process Package (ISO 13485)](https://mdregulatory.com/product/iso-customer-related/): Customer-Related Processes SOP with Customer Order / Contract Review Form (per ISO 13485 §7.2.2). - [Medical Device File — Process Package (ISO 13485)](https://mdregulatory.com/product/iso-medical-device-file/): Medical Device File SOP with MDF Index template aligned with EU MDR Annex II §1-6 + Annex III. - [Process Validation — Process Package (ISO 13485)](https://mdregulatory.com/product/iso-process-validation/): Process Validation SOP with VMP, IQ/OQ Protocol, and PQ Protocol & Report templates. Aligned with FDA Process Validation Guidance 2011 (Stage 1-2-3). - [Design and Development Control — Process Package (ISO 13485)](https://mdregulatory.com/product/iso-design-control/): Design and Development Control SOP with 6 templates: Plan, I/O Matrix (Excel), Review Record, Verification, Validation, Transfer Checklist. Largest package in the kit. - [UDI Management — Process Package (ISO 13485)](https://mdregulatory.com/product/iso-udi-management/): UDI Management SOP with UDI Master List (Excel) for EUDAMED + FDA GUDID submission tracking. - [Complaint Management — Process Package (ISO 13485)](https://mdregulatory.com/product/iso-complaint-management/): Complaint Management SOP with Complaint File template that INTEGRATES the 4-question Reportability Assessment per Art. 87. - [EU Vigilance Reporting — Process Package (ISO 13485)](https://mdregulatory.com/product/iso-eu-vigilance/): EU Vigilance Reporting SOP with PSUR template (per MDCG 2022-21). Covers Art. 87-92 reporting timelines and EUDAMED submission. - [Clinical Evaluation — Process Package (ISO 13485)](https://mdregulatory.com/product/iso-clinical-evaluation/): Clinical Evaluation SOP with CEP and CER templates. Aligned with EU MDR Annex XIV + MDCG 2020-5 (equivalence) + MDCG 2020-13 (CEAR). - [Change Control — Process Package (ISO 13485)](https://mdregulatory.com/product/iso-change-control/): Change Control SOP with comprehensive Change Form including MDCG 2020-3 substantial change assessment matrix. - [Nonconformance Management — Process Package (ISO 13485)](https://mdregulatory.com/product/iso-nonconformance/): Nonconformance Management SOP with NC Report template (severity classification, RCA, disposition). - [Computer System Validation — Process Package (ISO 13485)](https://mdregulatory.com/product/iso-csv/): Computer System Validation SOP with Validation Plan & Report and IQ/OQ/PQ Protocol templates. Aligned with GAMP 5 and 21 CFR Part 11. - [KPI and Data Analysis — Process Package (ISO 13485)](https://mdregulatory.com/product/iso-kpi-data-analysis/): KPI SOP with KPI Catalog & Dashboard (Excel — 23 pre-populated KPIs, 90 auto-calc formulas) and Quality Objectives Tracker. - [Human Resources and Training — Process Package (ISO 13485)](https://mdregulatory.com/product/iso-hr-training/): HR + Training SOP with Job Description (PRRC role), Training Plan & Record (Excel), and Competence Matrix (16 pre-populated competences). - [Risk Management — Process Package (ISO 13485)](https://mdregulatory.com/product/iso-risk-management/): Risk Management SOP with Plan, Report, Risk Analysis Matrix (Excel with auto-RPN formulas), and URRA per IEC 62366-1. Aligned with ISO 14971:2019/A11:2021. - [CAPA ISO 13485 SOP & Template — MDSAP, FDA QMSR (Word)](https://mdregulatory.com/product/iso-capa/): CAPA SOP with comprehensive CAPA Template covering full lifecycle: Initiation, Triage, Root Cause Analysis, Action Planning, Implementation, Effectiveness Verification. - [Internal Audit — Process Package (ISO 13485)](https://mdregulatory.com/product/iso-internal-audit/): Internal Audit SOP with Annual Audit Programme (Excel), Audit Plan, and Audit Report templates. Covers ISO 13485 §8.2.4 and FDA QMSR. - [Management Review — Process Package (ISO 13485)](https://mdregulatory.com/product/iso-management-review/): Audit-ready Management Review SOP with combined Agenda + Minutes template. Covers all 17 mandatory ISO 13485 §5.6 inputs. - [Complete ISO 13485 QMS Documentation Kit (30 Packages + Quality Manual + Master Tracker)](https://mdregulatory.com/product/iso-13485-complete-kit/): Complete ISO 13485 QMS Documentation Kit — All 30 Process Packages + Quality Manual + Master Tracker. Aligned with ISO 13485:2016, EU MDR 2017/745, FDA QMSR, and MDSAP. - [MDSAP Program Management SOP — Audit-Ready Procedure for All 5 Jurisdictions](https://mdregulatory.com/product/mdsap-program-management/): Audit-ready MDSAP Program Management SOP. The master document tying together all MDSAP processes across 5 jurisdictions (Brazil, Japan, Canada, Australia, USA). ## Optional - [Agent (MCP protocol)](websites-agents.hostinger.com/mdregulatory.com/mcp) [comment]: # (Generated by Hostinger Tools Plugin)