Moving from client-server to cloud-based, is that a new submission?

[SSchoepel]

Our device is a class II software-only device. We currently provide clinics with client and server recommended profiles but do not provide any hardware.

There are two discussions right now:
1. move one module to be a cloud-based service that perhaps we provide or perhaps customers set up their own remote-server/cloud version (in order to gain more computing power).
2. move the server portion to be cloud-based and/or sell the device to others who may install it as a client and cloud-based solution.

Would one or both of these together warrant a new submission?

Number 1 seems to be a gray area if we provide customers with recommended specs for servers that may end up being in a cloud environment they provide and manage.

Note: for reference our intended use statement only references the client portion of the product but specifications show client and server information.

 

[Ronen E]

1. Did you go through these?
https://www.fda.gov/media/99812/download
https://www.fda.gov/media/99785/download

2. The "Intended Use" is concluded based on the sum of the Manufacturer's labelling, statements and actions; not on an intended use statement alone.

 

[SSchoepel]

Yup, I read through both of those. To me it seems like we should if we move a module to a cloud-based service that we provide and/or if the intended use changes to be client-server or client-cloud. I just trying to confirm my conclusion.

 

[grsabourin]

I think the answer to this question is risk analysis and is this change is a significant change. That can be answered only be understanding the real impact of transferring the application in the cloud. An other interesting point is in the flowchart at page 13 of the second document cited previously (99785).

3a
"Does the change introduce a new risk or modify an existing risk that could result in significant harm and that is not effectively mitigated in the most recently cleared device?"

Without knowing details about your change but It is really possible that your change introduce new risk regarding data transfer and data corruption.

3b
"Does the change create or necessitate a new risk control measure or a modification of an existing risk control measure for a hazardous situation that could result in significant harm?"

In your new cloud implementation, are you doing something different to try to control the risk?

In the case of "Yes", the flowchart guides you to a new 510K