Implementing EN 62304:2006 on existing and proven medical devices

[josemfluguerto]

Hello all. This is my first time here, and I am looking for some advice on this standard. The thing is our company manufactures simple medical devices (all in class IIa according to rule X of 93/42/EEC), and the devices are well-proven and widely sold here in Argentina and some other markets worldwide, but now we are trying to make our software development process compy completely with the standard. We already have some structure and documents regarding EN 62304 because the company used to comply with the standard but lost that status some time ago (before I was hired). So my main problem is, instead of designing an all new development process, I need to adapt our already existing and functioning process to the standard. So I am really confused about this: if we don´t have all the records that the standard requires, do I need to reconstruct developing records from 10 years ago? Or would it be enough to prove that our medical devices are safe (complying with ISO 14971) and establishing we are going to record everything needed from now on?

Thanks in advance,
José Manuel

 

[yodon]

The 62304:2015 version of the standard actually addresses this "legacy software" issue. In part, you do a gap analysis, create a plan for any missing required elements (and execute to the plan), look at your historical data for any risks / hazards, and then start operating in accordance with the standard for changes going forward.

Of course, you couldn't assert compliance to the :2006 version but it's a reasonable path forward.

 

[josemfluguerto]

Hello yodon, thanks for your reply. So if I understand well, we won´t be able to assert compliance with 2006 version by any means?

 

[yodon]

Well, you could, if you built up all the required materials. Doesn't seem practical. Is there a reason you wouldn't want to assert compliance to the :2015 version?

 

[josemfluguerto]

Not really. I would have to obtain the 2015 version and start working on it I suppose that there will be no problem with our CE certificate regarding this change of version, right? (It is an amendment, not even a new version). Anyway, you say "create a plan for any missing elements and act upon it". Does this mean "create the elements and use them FROM NOW ON"? If not, I can´t see the difference with tracking or inventing the missing records.

 

[yodon]

There are a couple of things that are mandatory if you go the legacy route. These include risk management associated with continued use of the legacy software (there are some substantial implications there) and Software System Test (records). Any other gaps need to be assessed and determined whether not having them increases risk.

 

[josemfluguerto]

OK, I will discuss this with my Manager! Thank you!