Medical Software Application Certification Validation
Classification, Certification and Validation of Medical Software Application and Active Medical Devices
If your company is developing medical software or software-integrated devices and plans to access the European market, it is essential to understand the regulatory framework defined by the EU Medical Device Regulation (MDR). The CE Certification process for software as a medical device (SaMD) or software integrated in active medical devices follows strict classification and validation requirements.
Three Regulatory Contexts for Medical Software Validation
In Medical Software Application Certification and Validation, three different systems must be considered:
Software used in the Product Itself (usually Active Medical Devices)
If software is part of the Medical Device (e.g., diagnostic apps, embedded control software, therapy planning tools), it must be assessed according to its risk classification (per MDR Annex VIII). If classified as a Medical Device, the software must undergo conformity assessment and demonstrate compliance with applicable standards.
Software used in the Manufacturing Process
Software Systems that influence the production quality of a Medical Device (e.g., test systems, monitoring tools) must be validated to ensure they function as intended and do not compromise product safety or performance.
Software used in the context of Quality Management System (QMS)
Any digital tool used to control processes within your QMS, including document control, complaint handling, or training management, must also be validated. This ensures the reliability and traceability of quality-relevant activities and data.
The focus in all of this is on the influence of the Software on the Medical Device or Service. The manufacturer must ensure to use only verified and suitable Software (Software Validation).
What Does Software Validation Involve?
Validation requires documented and traceable evidence to prove that a system reliably meets its intended purpose in actual use. In the EU context, this includes:
- Defining user requirements and intended use
- Risk-based approach to software validation depth
- Developing test plans and scenarios
- Performing IQ/OQ/PQ activities:
- IQ (Installation Qualification) – Ensures software is installed correctly in its intended environment.
- OQ (Operational Qualification) – Verifies the software performs its intended functions under simulated conditions.
- PQ (Performance Qualification) – Confirms that the software consistently performs in real-world usage.
The main question is whether these requirements can be effectively, practically and efficiently implemented. Although validation has been a topic in DIN EN ISO 13485 for a long time, there is still uncertainty regarding the scope and depth of these activities in medical technology.
Our team of experts can answer all the relevant questions on Mobile Device Management Certification
- How do I integrate validation activities into the process?
- Do I need a validation master plan?
- Who carries out the validation of Medical Devices?
It is not easy to answer if a Medical App is a Medical Device. The intended use is crucial. A simple monitoring of blood sugar levels does not automatically lead to classification as a Medical Device. Once the classification of the software has been clarified, questions arise regarding DIN EN ISO 62366 (Usability Engineering) or 62304 (Software Life Cycle).
Software Validation • MDR / IEC 62304
Clarify your validation strategy
Software as a medical device requires robust validation evidence.
WQS determines whether your software is subject to validation, classifies your software according to MDR Annex VIII, and defines the scope of your validation.
Frequently Asked Questions
What classification rules apply to Medical Software in the EU?
Medical Software is classified under Annex VIII, Rule 11 of the MDR. Software that provides information used for diagnostic or therapeutic decisions is generally classified as Class IIa, IIb or III, depending on the risk.
What is software validation in the context of MDR?
Validation ensures that your software reliably meets its intended use. It includes defining requirements, risk assessment, and performing tests (IQ/OQ/PQ). This applies to software embedded in devices, used in manufacturing, or in the QMS.
Does software used in manufacturing processes also need validation?
Yes. Software that affects product quality (e.g., testing, inspection, monitoring systems) must be validated to demonstrate that it does not compromise safety or performance.
What are IQ, OQ, and PQ in software validation?
• IQ (Installation Qualification) – Ensures software is installed correctly in its intended environment.
• OQ (Operational Qualification) – Verifies the software performs its intended functions under simulated conditions.
• PQ (Performance Qualification) – Confirms that the software consistently performs in real-world usage.
This page provides regulatory information and does not constitute legal advice. Regulatory requirements vary by jurisdiction.
