Greetings, forum.
If a medical device consists only of a software program, does it need a Risk Management Report (as per ISO 14971:2000)? The thrust of 14971 seems to be physical systems, which may integrate software. But for software-only products, it seems that much of the standard does not apply.

The FDA guidance on software validation (938) says:

"This guidance recommends an integration of software life cycle management and risk management activities."

Can anyone shed any light what is the requirement for ISO 13485, and what is the best thing to do?

Many thanks (again)

Greetings, forum.
If a medical device consists only of a software program, does it need a Risk Management Report (as per ISO 14971:2000)? The thrust of 14971 seems to be physical systems, which may integrate software. But for software-only products, it seems that much of the standard does not apply.

The FDA guidance on software validation (938) says:

"This guidance recommends an integration of software life cycle management and risk management activities."

Can anyone shed any light what is the requirement for ISO 13485, and what is the best thing to do?

Many thanks (again)Risk management activities are required and ISO 13485 directs you to ISO 14971 for guidance. The principal is the same for software as for a "physical" system. The questions you must ask are, what are the possible hazards to the patient if the software fails to perform properly, what could cause these failures and how can I mitigate them?

I haven't seen the document, AAMI TIR32:2004, (http://www.aami.org/pressroom/2005/0222.tir32.html)Medical device software risk management (http://www.aami.org/pressroom/2005/0222.tir32.html), but it might be worth looking into.