CBER Finalizes Standards Guidance

The US FDA Center for Biologics Evaluation and Research (CBER) finalized the December 2017 draft guidance titled “Standards Development and the Use of Standards in Regulatory Submissions Reviewed in the Center for Biologics Evaluation and Research” today.  The guidance makes clear that CBER recognizes the value and proper usage of standards and further encourages the use of appropriate standards in the development and qualification of CBER-regulated medical products.  The guidance acknowledges that the use of standards can “provide a more efficient evaluation of regulatory submissions, including investigational new drug applications (INDs), biologics license applications (BLAs), new drug applications (NDAs), investigational device exemptions (IDEs), premarket approval applications, and premarket notifications, supplements, and amendments.”  This guidance however does make clear that CBER will not “endorse the activities of specific Standards Development Organizations (SDOs) or recommend specific standards for use in regulatory submissions.”

What about medical devices, particularly that contain software?  While the guidance does not address software directly, the guidance does make clear that “use of consensus standards is not mandatory for medical device regulatory submissions unless the consensus standard has been incorporated by reference into a regulation. For devices regulated by CBER, a sponsor or manufacturer of a medical device may use either standards that have been “recognized” by CDRH or non- recognized standards to support regulatory submissions for medical devices.”  One should consider that IEC 62304 is a recognized standard by CDRH but use of IEC 62304 is not mandated by the regulations.  However, SoftwareCPR would advise the use of an IEC 62304 compliant process for any software developed for use in a medical device since it requires safety risk management activities.

Depending on the intended use, there could be software impact from “Data Standards” and/or “Performance Standards”.  The guidance defines data standards may “describe the data elements and relationships necessary to achieve the unambiguous exchange of information between disparate information systems.”  Performance Standards “state requirements in terms of required results without stating the methods for achieving those results. A performance standard may define the functional requirements for the item, operational requirements, and/or interface and interchangeability characteristics.”

Download the guidance here:  Standards-Development-and-Use-of-Standards-in-Regulatory-Submissions_Final

CDRH maintains a list of Recognized Consensus Standards that can be found at https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfStandards/search.cfm.

Click this link to see a search of all SoftwareCPR posts related to consensus standards:  https://www.softwarecpr.com/?s=consensus

About the author

Partner and General Manager, Brian Pate is ISO 1385:2016 Lead Auditor certified for Medical Device Quality Management Systems (MD), and ISO 19011:2018 Management Systems Auditing (AU) and Leading Management Systems Audit Teams (TL). Brian started his medical device career in anesthesia clinical research in 1985 and has since worked both academia and industry including many years with Johnson & Johnson, Baxter Healthcare, and GE Medical. Brian’s roles have included software engineering, systems engineering, quality assurance, and regulatory affairs. Brian has served on multiple AAMI TIR working groups, including TIR32-2008 (Application of ISO 14971 Risk Management to Software; now IEC 80002-1) and TIR45-2012 (Guidance on the use of Agile practices in the development of medical device software) and served as a reviewer for the 2nd edition of TIR45. Brian serves on the AAMI Software Committee and as an AAMI instructor for the software, design controls, and agile methods courses. Brian also is a member of the Underwriters’ Laboratories (UL) Standards Technical Panel for UL1998 (Software in Programmable Components) and or UL5500 (Remote Software Updates).

SoftwareCPR Training Courses

ISO13485:2016 ISO 13485 Internal Audit(or) Training Course (Live, 3-day)

IEC 62304 and other Emerging Standards Impacting Medical Device Software (Live, 3-day)

Being Agile & Yet CompliantISO 14971 SaMD Risk Management

Software Risk Management

Medical Device Cybersecurity

Software Verification

IEC 62366 Usability Process and Documentation

Or just email training@softwarecpr.com for more info.

Corporate Office

15148 Springview St.
Tampa, FL 33624
USA
+1-781-721-2921
Partners located in the US (CA, FL, MA, MN, TX) and Canada.