The application of off-the-shelf software in medical devices is becoming more and more common. The medical device software should follow the requirements of the “Guiding Principles for the Technical Review of Medical Device Software Registration” during the registration and application process. With the development of new medical device technologies and the standardization of review, medical device software has an impact on off-the-shelf software in the process of technical review and administrative approval. This article sorts out the relevant requirements and response methods of some off-the-shelf software in the registration and application process.

Off-the-shelf software can be divided into finished software, legacy software and outsourced software:

1. Finished software: software that has been developed and generally available, but the manufacturer has not carried out complete life cycle control, including commercial software and free software;

2. Legacy software: software that was previously developed by the manufacturer but there is no enough development records;

3. Out sourced software: software that developed by a third party.

According to the regulatory requirements, it can be explained in two ways:

1. The use of all off-the-shelf software generally exists in the registration of software components, that is , the software is only used as a part of a medical device registration unit.

2. For independent software, only part of the off-the-shelf software should be used. For example, the third-party cloud services on the market now use part of the off-the-shelf software.

All of the software medical device registration declaration using off-the-shelf software

Registration differentiation between three types of off-the-shelf software:

a. Finished software: applicants should provide a copy of the outsourcing contract or statement, software description document, and a copy of the registration certificate if the finished software is already listed in China market.

b. Legacy software: applicants should provide supporting documents for legacy software (such as a copy of registration certificate or marketing approval before the implementation of YY/T 0664 or IEC 62304),software description documents, and post-marketing clinical evaluation data

c. applicants should provide a copy or statement of the outsourcing contract, and software description documents.

Part of the software medical device registration declaration using off-the-shelf software

The manufacturer should describe them in the corresponding terms of the software description document.

1. Software identification: Level A, B, and C specify the name, model specification, release version, supplier and production address of the off-the-shelf software;

2. Structure function: A, B, C level indicate the name, release version and type of the off-the-shelf software used in the component modules and clinical function modules;

3. Risk management: A, B, and C levels provide risk management materials for off-the-shelf software;

4. Requirements specification: Level B and C provide requirements specification data for off-the-shelf software;

5. Life cycle: Level B and C clarify the requirements of off-the-shelf software in the development life cycle plan, configuration management plan and maintenance plan;

6. Verification and confirmation: Level A, B, and C provide verification and confirmation data of off-the-shelf software;

7. Defect management: Level B and C specify the defect management process and known remaining defects of the off-the-shelf software;

8. Update history: A, B, and C levels clearly define the version naming rules for off-the-shelf software

9. Core algorithm: Level B and C list the name (or number), purpose and clinical function of the core algorithm of the off-the-shelf software. The new clinical function provides verification data for safety and effectiveness.