Manager
Regulatory Affairs | 10+ Years of Experience Medical device
Rarely is medical device software static. Medical device software is often updated by manufacturers to fix bugs or security flaws, improve performance, improve algorithms, or add features. However, changes made to medical device software after it is placed on the market could affect the safety or clinical performance, intended use, or regulatory compliance of the device.
The crucial question is not whether the software has been changed. The critical issue is whether the change to the software has a clinically significant effect that requires regulatory re-evaluation or a new submission to the relevant authorities.
The US Food and Drug Administration (FDA) provides guidance in Deciding When to Submit a 510(k) for a Software Change to an Existing Device. While the guidance applies to devices subject to 510(k) requirements, FDA’s risk-based approach offers a practical basis for addressing any modification to a medical device software.
Why Do Software Changes Require Regulatory Assessment?
Changes made to the software may seem inconsequential from a development perspective but may have downstream clinical effects or impact existing risk controls. For instance, modifying an algorithm in a cardiac arrhythmia detector software can have downstream clinical effects or impact existing risk controls. For example, a change in the way an algorithm works may affect the accuracy of detecting a clinically significant cardiac arrhythmia. Similarly, a change in a patient-monitoring application software may affect alarms, data interpretation, and the information available to the healthcare professional.
Before making such changes to the software, a manufacturer should assess their impact on the device’s safety, effectiveness, performance specifications, and intended use. The assessment should also take into account any unintended consequences of the proposed change, even if the modification was made to enhance maintenance or cybersecurity.
When May a New Regulatory Submission Be Required?
Under FDA’s 510(k) regulations, a new submission is required when: There could be a substantial change to the device safety or effectiveness; or When there is a significant change in intended use or population. Finally, the determination depends on the device and its cleared configuration and the nature of the modification.The following situations require careful assessment:
- Changes to clinical functionality or performance
Revisions of core algorithms, diagnostic thresholds, clinical calculations, or alarm logic could impact a device’s intended performance. A new 510 (k) may be required if a change is likely to affect the device’s clinical performance substantially.
- Changes to the intended purpose or indications for use
The expansion of a software product’s application to a new patient population, clinical setting, or clinical indication is generally associated with a change in its regulatory context.
Such a change must be evaluated in the contet of the product’s current authorized indications or claims.
For more information, see Understanding the Intended Purpose of SaMD.
- Changes introducing a new hazard
Software changes may introduce new or additional hazards or adversely affect the control of an existing hazard.
Manufacturers should evaluate and update their risk analyses to identify new or changed risk-control measures.
- Major changes in infrastructure or architecture
The migration to a new operating system, changes in software drivers, major code rewriting efforts, or support for new hardware may introduce undesirable side effects.
Manufacturers should consider the implications and potential impact of the change even if the intended functionality is not affected.
- Changes to AI/ML model and model outputs
An update to an AI-based medical device may affect the properties of the underlying model or its outputs.
Manufacturers should evaluate such changes to determine whether the change is within the scope of the existing regulatory authorization and, if not, whether a new submission is required.
Which Changes May Not Require a New Submission?
Not every software modification requires a new regulatory submission. According to the FDA’s software-change guidance, changes that solely aim to enhance cybersecurity, reestablish the device’s previous cleared specifications, or make only cosmetic modifications are examples that may not require a new 510(k).
This conclusion should not be made based only on the change description. Instead, manufacturers need to evaluate the change’s impact on the device’s safety and effectiveness, perform the necessary verification and validation, and justify the decision.
Thus, a security patch, for instance, may not require a new submission if it is determined through analysis that it does not affect other aspects of the software or device. However, if such a patch caused an unexpected effect on the device’s clinical functionality, the regulatory decision should be revised.
A Practical Framework for Software Change Assessment
To support the regulatory decision-making, manufacturers can implement a change-control process to help them reach a well-documented conclusion. The following steps can be considered as a practical example of such a process:
Define the change
Document the scope of the proposed change, the reason or rationale for the change, and the affected software components, functionality, or product versions.
Evaluate the risk and intended use.
Assess the change for new or modified hazards, threats, or harmful effects, and determine whether the existing risk control measures are adequate. Also, evaluate the clinical performance and product function against the device’s intended use and claims.
Verify and validate the change.
The verification and validation process should be performed based on the proposed change and its risk category. The manufacturer should investigate any deviations or unexpected results rather than focusing on consistently achieved outcomes.
Determine the regulatory impact.
Based on the above steps, define the submission, notification, or approval needed for the intended markets of the device. A regulatory decision for the US FDA should not be automatically applied to other jurisdictions since different regulations may apply.
Document the decision.
The rationale, risk analyses, testing, approvals, and regulatory decisions should be documented and maintained in the quality management system (QMS) per the applicable change-control process.
Assess its regulatory impact before implementation
FDA’s Quality Management System Regulation (QMSR)
The FDA’s new Quality Management System Regulation (QMSR) became effective on 2 February 2026 and incorporates ISO 13485:2016 by reference. According to the regulation, manufacturers should ensure that their change-control processes comply with the applicable current Quality Management System requirements.
What Is the Role of a Predetermined Change Control Plan?
For certain AI-based medical devices, a Predetermined Change Control Plan (PCCP) may be used to allow for future changes within a controlled framework. The plan details the proposed changes and the approach to their development, validation, and implementation, as well as an evaluation of the impact of the changes.
FDA’s final guidance of August 2025 provides recommendations for submitting a PCCP for AI-based devices’ software functions. A PCCP is not “a permission slip for any future software change.” A manufacturer must adhere to the PCCP included in the appropriate marketing application.
Read more: Predetermined Change Control Plan (PCCP) for SaMD
In addition, manufacturers must establish post-market processes for identifying changes that may be necessary to address complaints, newly identified clinical risks, cybersecurity threats, or performance issues.
How Operon Strategist Can Help With SaMD Regulatory Compliance?
Determining the regulatory impact of proposed changes to a software development can be challenging if the product includes AI/ML, clinical decision support, patient monitoring or has multiple users. Manufacturers must ensure that the intended purpose, indications for use, product claims, risk controls, clinical evidence and technical documentation are aligned.
Operon Strategist offers regulatory consulting and documentation support for medical device and Software as a Medical Device (SaMD) manufacturers, including:
- SaMD regulatory strategy and classification: Support for US FDA SaMD classification and submission.
- Software documentation: Guidance on global regulatory requirements for SaMD, including documentation planning.
- Risk management: Support for medical device risk management including the evaluation of new hazards and existing risk controls.
- Clinical evidence planning: Support for clinical evaluation and evidence documentation.
- Quality management: QMS and ISO 13485 support for controlled change management.
- Market specific regulatory support: Assistance with US FDA regulatory requirements, EU MDR and IVDR documentation and medical device technical documentation.
Operon Strategist can help manufacturers assess proposed software modifications, identify documentation gaps and align regulatory decisions with the product’s intended use and target markets.
Risk management, clinical evidence planning and US FDA or EU MDR documentation support
FAQ's
Does every medical device software update require regulatory reassessment?
Every change should be evaluated through the manufacturer’s change-control process. Not every change requires a new regulatory submission.
When does a software change require a new FDA 510(k)?
A new 510(k) submission may be needed if the change has the potential to have a significant impact on safety or effectiveness or is a major change in intended use or population.
Can cybersecurity patches be implemented without a new submission?
Cybersecurity-only changes may be exempt from a new 510(k) if they do not affect the device in any other way besides enhancing cybersecurity. The manufacturer should retain records of the evaluation and confirm that it does not impact the device.
Can an AI/ML medical device be updated after clearance?
An AI/ML-based medical device can be updated post-clearance, but it should be done according to regulations. The appropriate PCCP could address the specific planned modifications to the device. If the modification is beyond the scope of the PCCP, then it requires separate evaluation.
What documentation should manufacturers maintain?
Documentation includes the description of the change, risk assessment, verification and validation, the impact on the intended use and performance, the justification of regulatory requirements, and approvals.
Manager – Regulatory Affairs | 10+ Years of Experience
Medical device regulatory professional specializing in US FDA 510(k), EU MDR CE marking, Software as a Medical Device (SaMD), regulatory strategy, technical documentation, and risk management. Her expertise includes regulatory submissions, device classification, and regulatory gap assessments.
