13485:2016, Sections 4.1.6, 7.5.6 and 7.6 - Validation of Software - Need some Advice please

[Exxili]

Hi There, I have a quick question regarding the validation of Software used under scope, in relation to
13485:2016, Particularly sections 4.1.6, 7.5.6 and 7.6


Does Software used to create the Software that is used under scope (e.g Visual Studio, used to create a Application used in Production) need to be validated?

Seem to be having a lot of confusion on what precisely needs to be validated, The Actual app used in production, or the software used to make the App

Any help here would be appreciated!

 

[Tidge]

Does Software used to create the Software that is used under scope (e.g Visual Studio, used to create a Application used in Production) need to be validated?

I believe you are describing NPS - non-product software.

4.1.6 is about software used to support the Quality System. It is unlikely that NPS used on the production floor supports the quality system. It is typical that all software used in a medical device company is subjected to a formal assessment which can serve as the record for how the software is used. (see the note in 4.1.6 about records)

7.5.6 is the general "validate your production processes" section. If an app (let's say "compiler studio") is used to make an executable used in production (not medical device software!), ultimately you only have to validate that the executable meets its intended use. If the "compiler studio" is not being used in production, there is no need to subject it to NPS validation(1). If libraries from the studio end up as part of the production executable, they will end up being "validated by inclusion."

7.6 has specific details if the executable used in manufacturing is applying some 'test method'. It is unlikely that a compiler studio itself is subject to the requirements of this section.

(1) It is typical that the "compiler studio" will be documented at some level specifically so that a manufacturer can support an NPS executable "through the lifetime" of that executable. This can include storing the "studio" such that executable code can be touched up and/or recompiled. Detailing and archiving an off-the shelf studio is a very narrow form of (NPS) validation.

As long as you are subjecting the output of the studio package to 7.5.6, you are under no circumstances are you obligated to 'prove' that the visual studio works.

 

[Exxili]

Thank you very much for your reply Tidge that clears up the confusion greatly for me.

 

[Ash Watson]

Not sure if the policy is to start a new thread or tag on my questions here: I'll move this at your urging

First: For 4.1.6: Software used to support the QMS. What is the standard approach taken with widely used enterprise tools like Google Drive and it's relatives, Google Docs, Sheets, E-signature software etc... Google and Microsoft products will already have better IQ, OQ, PQ done than just about anyone can manage. (just talking about 13485 here, not 21CFR requirements)

Secondly: with reference to 4.1.6, 7.5.6 and 7.6, for a SaMD company/product what is the expectation and sensible approach for externally hosted and widely used production environments, services and microservices (thinking GoogleCloud, AWS etc..). What are the expected articles of evidence here?