In recent years, information and communication technologies has been broadly applied to medical devices and constantly evolving. This results in frequent updates of software, firmware, or associated hardware in medical devices. Hence, to improve the development of the domestic medical device industry and to clarify relevant regulations of SaMD that have already been approved, the released guideline provides some perspectives and evaluation suggestions regarding post-market change applications of SaMD.
This guideline has also provided examples on whether the changes or updates in SaMD are required to submit post-market change applications. The examples and different circumstances are listed as below:
Situations when post-market change applications are not required
If the changes or updates do not affect the approved performance or the intended use of SaMD, and do not cause harm to the safety and effectiveness while operating, the post-market change applications are not required. This includes but is not limited to the following items:
- 1. Software bug fixes and updates that do not affect the approved performance of the device, such as increasing the length of the password string and requiring the inclusion of special characters.
- 2. Patches of security vulnerabilities that do not affect the approved performance of the device, such as patching of buffer overflow vulnerabilities.
- 3. Changes in the style or appearance of the physical record media in which the software was stored, such as the appearance of the flash disk or CD on which the software is loaded. This modification does not include changing physical record media to downloading from network.
- 4. Changes in the physical appearance, color, shape, pattern, or hardware components that enhance the efficiency/speed of computing (e.g. amplified memory, graphics cards, etc.) of hardware peripherals that are not classified as medical devices, for example, computer hosts, keyboards, or mice.
- 5. Changes in the text, color, position, column order or the remarks of the task list in the user interface.
Situations when post-market change applications are required
This includes but is not limited to the following items:
- 1. Software changes that are not downward compatible or backward compatible, such as when the data generated by the old version of the software cannot be manipulated by the new version of the software.
- 2. Adding, removing, or changing the intended use and performance of SaMD, such as adding functions of suspicious lesion detection, image tagging, image analysis and processing, disease triage recommendations, etc.
- 3. Changes to the core algorithm of SaMD, such as retraining the model with new algorithms, readjusting any algorithm parameters or weights.
- 4. When the operating system used by the software is not backward compatible due to operating system replacement, adding or upgrading, for example, changing the operating system from Windows to iOS or adding iOS to the operating system.
- 5. Incompatible changes to compilers, drivers, libraries, middleware, and database structures used in the software. For instance, when security vulnerabilities force the library to be upgraded to an incompatible version, resulting in the rewriting of codes related to core function.
- 6. When the software code is heavily Rewritten or Refactored, for example, from Functional Programming Paradigm to Object-Oriented Programming Paradigm. This modification does not include the user interface changes mentioned in point 5 of “Examples of post-market change applications are not required”.
- 7. Change in dataset for training or validation. Data for testing must be strictly separated from data for training or validation to avoid bias in validation results.
Guideline for Post-market Change Application of Medical Device Software