ISO 13485-paragraphs for a SaaS SAMD needed or not?

[Hirvo]

The company has a low risk SaaS Samd, which have been in production use for years. No we are finalizing the quality system and I am asking your comments/opinions, which of the following paragraph should we cover in the quality system and which can we let be?

We have no physical product. It is only a software in cloud. All customers use the same solution with their own accounts. New customer gets the user accounts and some configurations are made in the service and the customers get a training to use the software. There is also some manuals in Internet to read. We have a sales support team for helping the customers for using the customer.

My best guess is following:
7.5 Production and service provision
7.5.1 Control of production and service provision ???
7.5.2 Cleanliness of product NA
7.5.3 Installation activities NA
7.5.4 Servicing activities ???
- "If your medical device requires servicing, then you must define servicing requirements, specifications, and procedures for doing so; these items are part of the medical device file. Servicing also requires special attention to make sure the device meets its specifications after the product has been serviced. Servicing records shall be documented and maintained as part of the product’s records."
7.5.5 Particular requirements for sterile medical devices NA
7.5.6 Validation of processes for production and service provision ???
7.5.7 Particular requirements for validation of processes for sterilization and sterile barrier systems NA
7.5.8 Identification NA
7.5.9 Traceability NA
7.5.10 Customer property NA
7.5.11 Preservation of product NA
7.6 Control of monitoring and measuring equipment NA
8 Measurement, analysis and improvement (PMS Process)
8.1 General (PMS Process)
8.2 Monitoring and measurement (PMS Process)
8.2.1 Feedback (PMS Process)
8.2.2 Complaint handling (PMS Process)
8.2.3 Reporting to regulatory authorities (PMS Process)
8.2.4 Internal audit (Internal Audits Process)
8.2.5 Monitoring and measurement of processes (CAPA)
8.2.6 Monitoring and measurement of product NA
8.3 Control of nonconforming product NA
8.3.1 General NA
8.3.2 Actions in response to nonconforming product detected before delivery NA
8.3.3 Actions in response to nonconforming product detected after delivery NA
8.3.4 Rework NA

 

[yodon]

7.5.3 Installation activities. I would include. You DO install the software. You probably do something to make sure the install is correct.

7.5.4 Service. I've been in some debate about "service" related to software. I think we came to the agreement that there could be cases where "service" applies. For example, you may have to clear out logs or databases or something periodically. I was able to convince the auditor that bug fixes were not servicing.

7.5.6 Validation of processes. The problem here is that you do use computer software in the 'production' process (compilers / IDEs). So we include it.

7.5.8 Identification. I think we include it and tailor it for software; i.e., we can always tell what a production build is -v- a debug build. Mostly administrative (segregation).

7.5.11 Preservation of product. The software could be "adulterated" in the install process. This kind of ties with 62304 5.8.5. We include a checksum to ensure the installed product matches the as-built load.

8.2.6 Monitoring and measurement of product. Absolutely! You certainly test before release!

8.3 Control of nonconforming product. You can absolutely have "nonconforming" product in fielded software. It's handled much differently than physical products but I think there's an expectation that if you fail to meet specifications, it's nonconforming.

This is a healthy discussion and I would enjoy seeing if others have my same or different thoughts.

 

[DannyK]

Here are some comments. I hope it helps.

7.5.3 Installation-This is your deployment process and could also include the initial training.
7.5.4 Servicing- there may be issues that may require software patches. You will track all these inquiries and complaints however they are sent to you.
7.5.6 Validation- are there any automated processes?
7.5.8 Identification- identify the build number and software version
7.5.9 Traceability- which clients have which software version
8.2.6 Monitoring and measuring of product- you have to release the product to ensure that it meets requirements.
8.3 Nonconforming product- you have to track bugs

 

[OECO22]

The company has a low risk SaaS Samd, which have been in production use for years. No we are finalizing the quality system and I am asking your comments/opinions, which of the following paragraph should we cover in the quality system and which can we let be?

We have no physical product. It is only a software in cloud. All customers use the same solution with their own accounts. New customer gets the user accounts and some configurations are made in the service and the customers get a training to use the software. There is also some manuals in Internet to read. We have a sales support team for helping the customers for using the customer.

My best guess is following:
7.5 Production and service provision
7.5.1 Control of production and service provision ???
7.5.2 Cleanliness of product NA
7.5.3 Installation activities NA
7.5.4 Servicing activities ???
- "If your medical device requires servicing, then you must define servicing requirements, specifications, and procedures for doing so; these items are part of the medical device file. Servicing also requires special attention to make sure the device meets its specifications after the product has been serviced. Servicing records shall be documented and maintained as part of the product’s records."
7.5.5 Particular requirements for sterile medical devices NA
7.5.6 Validation of processes for production and service provision ???
7.5.7 Particular requirements for validation of processes for sterilization and sterile barrier systems NA
7.5.8 Identification NA
7.5.9 Traceability NA
7.5.10 Customer property NA
7.5.11 Preservation of product NA
7.6 Control of monitoring and measuring equipment NA
8 Measurement, analysis and improvement (PMS Process)
8.1 General (PMS Process)
8.2 Monitoring and measurement (PMS Process)
8.2.1 Feedback (PMS Process)
8.2.2 Complaint handling (PMS Process)
8.2.3 Reporting to regulatory authorities (PMS Process)
8.2.4 Internal audit (Internal Audits Process)
8.2.5 Monitoring and measurement of processes (CAPA)
8.2.6 Monitoring and measurement of product NA
8.3 Control of nonconforming product NA
8.3.1 General NA
8.3.2 Actions in response to nonconforming product detected before delivery NA
8.3.3 Actions in response to nonconforming product detected after delivery NA
8.3.4 Rework NA

Hi Hirvo,
How did it end up going with your QMS. I'm in the exact situation with audits coming up and was wondering if auditors agreed with the non-applicable clauses?