> Disclaimer: This content is for educational and reference purposes for software builders only. It does not constitute medical, legal, financial, or regulatory advice. Consult a qualified professional before making decisions based on this content.
510(k) Clearance
A premarket submission made to FDA to demonstrate that a medical device (including SaMD) is substantially equivalent to a legally marketed predicate device. Most low-to-moderate risk SaMD goes through the 510(k) pathway rather than full PMA review. (21 CFR Part 807)
Algorithm Change Protocol (ACP)
A document submitted with an AI/ML-based SaMD application that describes the types of anticipated changes the manufacturer intends to make to the algorithm without requiring a new premarket submission. The ACP must specify the types of changes, performance bounds, and the testing to be conducted before implementation. (FDA AI/ML SaMD Action Plan, 2021)
Audit Trail
A chronological record of system activities that enables the reconstruction and examination of the sequence of events and changes made to electronic records in a SaMD system. Required under 21 CFR Part 11 for software systems that create, modify, maintain, archive, retrieve, or transmit electronic records that are equivalent to paper records.
Biocompatibility
The property of a material being compatible with living tissue by not producing a toxic, injurious, or immunological reaction. For SaMD, relevant when the device outputs influence treatment decisions involving implants or materials that contact the patient.
Change Control
A systematic process for managing modifications to SaMD after market release. Includes documenting the nature of the change, assessing its regulatory impact (substantial vs. non-substantial), testing, and updating design history file (DHF) records. A major regulatory trigger: changes that affect safety or effectiveness typically require a new premarket submission.
Clinical Decision Support (CDS)
Software that analyzes data to help healthcare providers make clinical decisions. Under the 21st Century Cures Act and FDA guidance, CDS software is either non-device (when it displays clinical guidelines and the clinician can independently review the basis) or device (when it provides a treatment recommendation the clinician cannot easily review the basis of). SaMD classification affects which CDS tools are subject to FDA oversight.
Combination Product
A product comprising two or more regulated components (drug/device, device/biologic, drug/biologic) subject to a single regulatory review under a primary mode of action determination. Some SaMD used to control drug delivery devices are classified as combination products under 21 CFR Part 3.
Corrective and Preventive Action (CAPA)
A quality system element requiring manufacturers to investigate, analyze, and address non-conformances or customer complaints in SaMD. FDA inspectors specifically examine CAPA records during Quality System Regulation (QSR) inspections. Effective CAPA processes demonstrate product safety through systematic root cause analysis and preventive measures.
Cybersecurity Threat Modeling
A structured process for identifying, categorizing, and mitigating cybersecurity threats to SaMD. FDA's 2023 Cybersecurity Guidance requires manufacturers to include threat model documentation in premarket submissions. Standard frameworks used include STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) and MITRE ATT&CK for ICS.
De Novo Classification
A regulatory pathway for novel, low-to-moderate risk SaMD that has no legally marketed predicate device. Allows FDA to establish special controls to provide reasonable assurance of safety and effectiveness. Creates a new classification for subsequent similar devices to use as a predicate for 510(k). (21 CFR Part 860 Subpart D)
Design History File (DHF)
A compilation of records that describes the design history of a finished medical device. For SaMD, the DHF includes software requirements specification, software design specification, software architecture documents, software verification and validation records, and risk management records. Required under 21 CFR 820.30.
Device Master Record (DMR)
A compilation of records containing the procedures and specifications for a finished device. For SaMD, the DMR includes software version specifications, build procedures, test instructions, and quality assurance procedures. Required under 21 CFR 820.181.
Device History Record (DHR)
A compilation of records documenting that each device was manufactured in accordance with the DMR. For SaMD distributed via download or cloud, the DHR captures the specific software version released, release date, and associated validation records. Required under 21 CFR 820.184.
Essential Performance
The performance required of a medical device to avoid unacceptable risk. For SaMD, essential performance typically encompasses the accuracy, precision, and reliability of the software's primary function (e.g., diagnostic algorithm output, treatment recommendation). Essential performance specifications must be documented, verified, and validated. (Referenced in IEC 62304 risk framework)
Exempt Device
A device classified into Class I that is exempt from premarket notification requirements (510(k)). Some SaMD may qualify if they have minimal patient impact. However, exempt status does not relieve manufacturers from compliance with quality system regulations (21 CFR Part 820) and general controls.
Food, Drug, and Cosmetic Act (FD&C Act)
The primary federal law governing medical devices in the United States. Section 520(o) of the FD&C Act, added by the 21st Century Cures Act (2016), defines when software is and is not a medical device. Software for administrative support, patient/provider communication of general wellness information, and certain CDS is excluded from device definition.
Hazard Analysis
A systematic review of potential hazards associated with the SaMD that could result in patient harm. Forms the foundation of risk management per IEC 62304 clause 4 and ISO 14971. Hazard analysis outputs drive software safety classification (Class A, B, or C) and determine the rigor of software development lifecycle activities required.
Human Factors Engineering (HFE)
The application of knowledge of human capabilities and limitations to the design of SaMD user interfaces. FDA expects HFE/usability engineering to be integrated into the design process for SaMD. Requirements include formative usability studies during development and summative usability testing prior to market submission. (FDA HFE Guidance, 2016)
IEC 62304
International standard for medical device software - software lifecycle processes. Defines three software safety classes (A, B, C) based on severity of potential patient harm and prescribes required development activities for each class. Referenced throughout FDA guidance as the expected framework for software development process compliance. Note: This is a copyrighted ISO/IEC standard; reference by clause number only in regulatory submissions, never reproduce clause text verbatim.
Intended Use
The objective intent of the manufacturer regarding the device's clinical function. For SaMD, FDA reviews the intended use statement to determine device classification, predicate eligibility, and what clinical validation data is required. The intended use drives the entire regulatory strategy. Must be precisely defined and consistently used throughout all submissions.
ISO 14971
The international standard for application of risk management to medical devices. Describes the risk management process: risk analysis, risk evaluation, risk control, residual risk evaluation, and risk management review. FDA recognizes ISO 14971 as an accepted consensus standard for SaMD risk management. Note: Copyrighted ISO standard; reference by section number only.
Labeling
All written, printed, or graphic matter that accompanies a device. For SaMD, labeling includes on-screen text, help files, user manuals, and any promotional materials. FDA regulations require labeling to be truthful, not misleading, and adequate for intended use. (21 CFR Part 801)
Machine Learning (ML) in SaMD
The application of ML algorithms to SaMD is subject to FDA's AI/ML-based SaMD framework. ML models that "lock" (fixed function) are evaluated similarly to traditional SaMD. "Continuously learning" algorithms face additional regulatory considerations because changes to the locked algorithm may constitute device modifications requiring new submissions.
Medical Device Reporting (MDR)
Mandatory reporting requirements for manufacturers when a device has or may have caused or contributed to a serious injury, death, or malfunction. For SaMD, software bugs or algorithm errors that led to patient harm trigger MDR obligations under 21 CFR Part 803. Manufacturers must establish written MDR procedures.
Non-Substantial Equivalence
A FDA finding that a device subject to 510(k) review is NOT substantially equivalent to a predicate device. Results in automatic Class III classification and PMA requirement. For SaMD, this often occurs when novel technology introduces different intended use or new technology that raises different questions of safety and effectiveness.
Objective Intended Use
A precise statement defining what the SaMD is designed to accomplish and in what clinical context. Differs from "claims" (marketing) in that it is used for regulatory classification. Must distinguish between: conditions the software detects/diagnoses, conditions it monitors, and conditions it treats or controls.
Post-Market Surveillance (PMS)
Systematic processes to collect and analyze field data for marketed SaMD, including adverse events, customer complaints, software defects, and cybersecurity vulnerabilities. Required under 21 CFR 820.198 (complaint handling) and FDA MDR regulations. For AI/ML SaMD, the ACP must describe PMS activities that validate algorithm performance in real-world use.
Predicate Device
A legally marketed device that serves as the basis for substantial equivalence in a 510(k) submission. For SaMD, the predicate must have the same intended use or different intended use but same technological characteristics, without raising new safety/effectiveness questions. Predicate selection is the single most consequential regulatory strategy decision for 510(k) submissions.
Premarket Approval (PMA)
The FDA process for Class III devices requiring the most rigorous type of review, including clinical data demonstrating safety and effectiveness. Class III SaMD - those supporting or sustaining human life or preventing impairment of health - require PMA. (21 CFR Part 814)
Quality Management System (QMS)
A formalized system documenting processes, procedures, and responsibilities for achieving quality policies and objectives. For SaMD, FDA mandates compliance with Quality System Regulation (QSR) under 21 CFR Part 820 (being aligned with ISO 13485:2016 requirements). QMS documentation is the primary subject of FDA inspections.
Quality System Regulation (QSR)
FDA regulations at 21 CFR Part 820 governing the methods, facilities, and controls used for manufacturing, processing, packing, labeling, storing, installing, and servicing of medical devices, including SaMD. Requires documented procedures for design controls, production and process controls, CAPA, complaint handling, and records management.
Real-World Evidence (RWE)
Evidence derived from analysis of real-world data (RWD) generated during routine clinical practice rather than clinical trials. FDA's RWE program supports use of RWD to inform premarket regulatory decisions for SaMD when traditional clinical trials are infeasible. Relevant for AI/ML models trained or validated on clinical datasets.
Risk Management File
The complete set of records and documents produced by the risk management process for a medical device. For SaMD, includes hazard analysis, FMEA, risk evaluation, risk control measures, residual risk assessment, and benefit-risk analysis. Must be maintained and updated throughout the product lifecycle per ISO 14971.
SBOM (Software Bill of Materials)
A formal, machine-readable inventory of all software components, libraries, and dependencies in a SaMD product. FDA's 2023 Cybersecurity Guidance (Section IV.B.1) requires manufacturers to include an SBOM in premarket submissions to enable identification of known vulnerabilities (CVEs) in third-party components.
Software as a Medical Device (SaMD)
As defined by IMDRF: software intended to be used for one or more medical purposes that perform these purposes without being part of a hardware medical device. FDA regulates SaMD when it meets the definition of a "device" under the FD&C Act. Classification is determined by the seriousness of the disease/condition the SaMD targets and the SaMD's significance in the care pathway.
Software of Unknown Provenance (SOUP)
Software components whose development history is not documented to the degree required for the SaMD development process (typically third-party libraries). IEC 62304 clause 8.1.2 requires manufacturers to identify SOUP, document its intended use within the SaMD, and implement procedures to manage risks from SOUP. The SBOM serves as the basis for SOUP management.
Software Requirements Specification (SRS)
A document that describes all software requirements, including functional, performance, interface, and safety requirements. For SaMD, the SRS must be traceable to the device requirements and must specify requirements addressing identified hazards. IEC 62304 clause 5.2 prescribes content and rigor based on software safety class.
Substantial Equivalence
The determination that a new device is as safe and effective as a legally marketed predicate device. FDA makes this determination in 510(k) review by comparing intended use, technological characteristics, and performance data. For SaMD, "substantially equivalent" does not mean "identical" - new technologies can achieve equivalence via different means if they do not raise new safety questions.
Traceability Matrix
A document linking software requirements to design elements, implementation modules, test cases, and risk controls. FDA expects traceability for SaMD as evidence that all requirements have been implemented and tested and that risks have been addressed. Bidirectional traceability (requirements → tests and tests → requirements) is the expected standard.
Unique Device Identifier (UDI)
A unique numeric or alphanumeric code that identifies a device through distribution and use, consisting of a device identifier (DI) and a production identifier (PI). For SaMD distributed electronically, the UDI must appear in labeling. UDI data must be submitted to the FDA Global UDI Database (GUDID). (21 CFR Part 830)
Validation
Confirmation by examination and provision of objective evidence that device specifications conform to user needs and intended use. For SaMD, validation includes clinical validation (performance in the intended clinical environment) and software validation (confirmation that software functions as intended per user needs). Distinct from verification.
Verification
Confirmation by examination and provision of objective evidence that specified requirements have been fulfilled. For SaMD, verification demonstrates that software design outputs meet software design inputs at each phase of development. Includes code reviews, static analysis, unit tests, integration tests, and system tests against requirements. Distinct from validation.