> Disclaimer: This content is for educational and reference purposes for software builders only. It does not constitute medical, legal, financial, or regulatory advice. Consult a qualified professional before making decisions based on this content.
ACP - Algorithm Change Protocol
A predefined plan describing anticipated AI/ML algorithm changes that a manufacturer commits to implementing and validating before deployment, enabling iterative updates without a new premarket submission (FDA AI/ML SaMD Action Plan).
AUC - Area Under the Curve
Statistical metric (0–1) measuring classifier model performance across all classification thresholds; used in SaMD clinical validation studies to demonstrate diagnostic algorithm accuracy. AUC = 0.5 means random performance; AUC = 1.0 means perfect discrimination.
CAPA - Corrective and Preventive Action
A QMS element requiring systematic investigation of nonconformances (corrective) and elimination of root causes to prevent recurrence (preventive). FDA inspectors review CAPA records as a leading indicator of QMS effectiveness during device inspections. (21 CFR 820.100)
CDS - Clinical Decision Support
Software that analyzes patient-specific data to provide evidence-based clinical guidance. FDA distinguishes "non-device CDS" (aids independent clinician review) from "device CDS" (provides direct recommendations where clinician cannot independently verify basis), with only the latter requiring premarket notification.
CFR - Code of Federal Regulations
The codification of US federal regulations published in the Federal Register. Medical device regulations are in Title 21 CFR. Key parts for SaMD: Part 820 (QSR), Part 11 (electronic records), Part 803 (MDR), Part 830 (UDI), Part 807 (510(k)), Part 814 (PMA).
DHF - Design History File
The complete design records for a finished SaMD, evidencing that the device was designed in compliance with 21 CFR 820.30. Contains SRS, SDS, hazard analysis, V&V records, change history, and design review records.
DHR - Device History Record
Manufacturing records demonstrating that each device unit (for SaMD: each released version) was produced in accordance with the DMR. For SaMD, documents the specific software build, configuration, and release date for each distribution.
DMR - Device Master Record
The complete set of specifications and procedures required to produce a finished SaMD. Includes software version specs, build procedures, installer/deployment instructions, test specifications, and packaging/labeling requirements. (21 CFR 820.181)
FMEA - Failure Mode and Effects Analysis
A structured technique for hazard analysis that systematically identifies potential failure modes in SaMD, evaluates their effects on the patient, and determines risk priority. Often used as input to the ISO 14971 risk management process for software.
FMECA - Failure Mode, Effects, and Criticality Analysis
Extension of FMEA that adds a criticality/severity-probability matrix to prioritize failure modes by risk level. Used in SaMD risk management to prioritize risk controls and safety testing investments.
GUDID - Global Unique Device Identification Database
FDA's database containing information about medical devices with UDIs. Manufacturers submit UDI data through the Access GUDID portal. For SaMD, the DI (Device Identifier) captures the product model while the PI (Production Identifier) captures version/release information.
HFE - Human Factors Engineering
The discipline of applying knowledge of human capabilities and limitations to device design to minimize use errors. FDA expects HFE to be integrated throughout SaMD development, culminating in summative usability testing on the final interface before premarket submission.
IDE - Investigational Device Exemption
A regulatory mechanism allowing a device not yet cleared/approved to be used in a clinical investigation. Required when the SaMD's clinical investigation involves significant risk to subjects. Provides the pathway for collecting clinical validation data under FDA oversight. (21 CFR Part 812)
IEC 62304
International standard specifying software development lifecycle requirements for medical device software, defining safety classes A (no injury or damage), B (non-serious injury), and C (death or serious injury). Note: Copyrighted IEC/ISO standard - cite by clause number only; do not reproduce clause text.
IMDRF - International Medical Device Regulators Forum
A voluntary group of medical device regulators from around the world (including FDA) that work to accelerate harmonization and convergence of medical device regulatory practices. IMDRF's SaMD guidance documents inform FDA's regulatory approach.
ISO 13485
International standard for quality management systems specific to medical devices. FDA's QSR (21 CFR Part 820) is based on ISO 9001; FDA is harmonizing toward ISO 13485:2016 via the Quality Management System Regulation (QMSR), effective May 2024.
ISO 14971
International standard for application of risk management to medical devices. Note: Copyrighted ISO standard - cite by section number only; do not reproduce section text.
MDR - Medical Device Reporting
The mandatory FDA reporting system (21 CFR Part 803) requiring manufacturers to report when a device has or may have caused or contributed to a death, serious injury, or malfunction that could cause death/serious injury if it recurs.
MITRE ATT&CK
An adversarial tactics and techniques knowledge base used for cybersecurity threat modeling. For SaMD, MITRE ATT&CK for ICS (Industrial Control Systems) provides the most relevant threat taxonomy for networked medical devices. Referenced in FDA 2023 Cybersecurity Guidance.
OTS - Off-The-Shelf Software
Commercial or open-source software not developed for a specific SaMD but incorporated as a component (e.g., operating systems, database engines, cryptographic libraries). Requires specific management procedures under IEC 62304 as a form of SOUP.
PMA - Premarket Approval
FDA's most stringent regulatory pathway for Class III medical devices, requiring clinical evidence of safety and effectiveness. SaMD that supports or sustains human life, or that presents an unreasonable risk of illness or injury, requires PMA rather than 510(k). (21 CFR Part 814)
PMS - Post-Market Surveillance
Systematic collection and evaluation of data on market performance of SaMD to identify and address problems and opportunities for improvement. Includes MDR reporting, complaint handling, trend analysis, and for AI/ML SaMD, real-world performance monitoring against ACP-defined bounds.
QMS - Quality Management System
A documented system defining an organization's processes, responsibilities, and resources for achieving quality objectives. For SaMD, FDA requires QMS compliance with 21 CFR Part 820 (QSR). Includes design controls, document control, CAPA, complaint handling, and records management.
QSR - Quality System Regulation
FDA regulations at 21 CFR Part 820 governing quality systems for medical device manufacturers, including SaMD developers. Being updated to align with ISO 13485:2016 via the QMSR effective May 2024.
RWD / RWE - Real-World Data / Real-World Evidence
Data collected outside of traditional clinical trials (electronic health records, registries, claims data) and the evidence derived from analysis of such data. FDA programs allow RWE to support premarket decisions for SaMD, particularly for AI/ML performance validation.
SaMD - Software as a Medical Device
Software intended to be used for one or more medical purposes that performs those purposes without being part of a hardware medical device (IMDRF definition). FDA's regulatory oversight depends on the SaMD's intended use and risk classification.
SBOM - Software Bill of Materials
A machine-readable inventory of all software components, libraries, and their dependency relationships in a SaMD product. Required in FDA premarket submissions per the 2023 Cybersecurity Guidance to enable identification of known vulnerabilities.
SDS - Software Design Specification
A document describing the architectural and detailed design of the software, serving as the primary design output. For Class B and C SaMD (IEC 62304 classification), the SDS must document software architecture, unit design, and interface definitions.
SOUP - Software of Unknown Provenance
Third-party or legacy software components included in a SaMD where the development lifecycle was not controlled to the same standards required by IEC 62304. Requires specific documentation, testing, and risk management.
SRS - Software Requirements Specification
A document that specifies software functional, performance, safety, and interface requirements. For SaMD, SRS requirements must be traceable to device requirements and must address all identified hazards.
TPLC - Total Product Life Cycle
FDA's framework for evaluating device safety and effectiveness across the entire product life cycle, from development through market withdrawal. For SaMD, TPLC encompasses premarket review, post-approval studies, complaint surveillance, and change management.
UDI - Unique Device Identifier
A unique numeric or alphanumeric code comprising a device identifier (DI) and production identifier (PI), used to identify a specific device and its version throughout distribution and use. Required on SaMD labeling and in the GUDID database.