Pre-market Services
Support compliant software development and maintenance throughout the product lifecycle with processes aligned to regulatory and quality requirements. Whether you are developing a medical device, an electronic health record system or wellness application, lifecycle management is important.
Software lifecycle management is a core requirement for healthcare related software including medical device software, AI-enabled systems, electronic health record systems, and wellness applications. Manufacturers must demonstrate that software is developed, maintained, and updated through controlled processes that support safety, performance, and regulatory compliance.
We support organisations in implementing software lifecycle processes aligned with IEC 62304, the MDR, IVDR, FDA guidance, EHDS, AI Act, CRA, and related international standards. This includes definition of your product’s lifecycle from development through, maintenance processes and ultimately decommissioning. We cover aspects to ensure traceability, risk management, cybersecurity management and delivery of the appropriate software documentation.
Our approach focuses on integrating lifecycle management into practical development workflows. Effective software processes support compliance while helping organisations manage updates, changes, cybersecurity considerations, and long-term product maintenance.
Explore our blog posts on MDR, IVDR, and EU AI Act medical device compliance to stay ahead of regulatory changes.
ISO/IEC 27001 has been the reference standard for information security management systems since 2005, and its third edition, ISO/IEC 27001:2022, was published on 25 October 2022 (ISO/IEC 27001:2022 and Amendment 1:2024). The transition from
Manufacturers have been able to register in EUDAMED, the European database on medical devices, since December 2020 for the Actor module and since October 2021 for UDI and device data, but only on a voluntary basis. That changed on 28
Using the EUDAMED UDI/Devices module became mandatory on 28 May 2026. This follows the Commission Decision (EU) 2025/2371, which formally declared the first four modules functional. Published in the Official Journal back on 27 November 2025, that decision kicked off
We are pleased to welcome Eva Kurilova-Sahin to the MedQAIR team. Eva brings a background in medicine, clinical science, radiology, and oncology research, together with experience in AI-enabled medical technology. Over the past 10 years, her work has brought her
The regulatory landscape for medical devices is becoming more complex as artificial intelligence becomes part of diagnosis, monitoring, treatment, and clinical decision support. For manufacturers, understanding the EU AI Act medical devices requirements is now essential alongside the existing Medical
Artificial intelligence is evolving faster than the regulatory frameworks around it. But that gap is beginning to close, with a growing body of AI medical device standards now moving towards publication and wider regulatory recognition.
Find answers to common questions about our services, compliance processes, and how we can assist your business.
A PCCP is not mandatory, but it is the FDA-recognized mechanism (finalized in the December 2024 guidance) that allows you to make pre-specified modifications to an AI/ML-enabled device after authorization without a new 510(k) submission. If your model will be retrained, updated, or refined post-market, including a PCCP in your original submission can save months or years of regulatory rework. The PCCP must define the specific modifications, the modification protocol, and an impact assessment. Within the EU we also expect manufacturers to be able to apply PCCP’s for medical devices and AI Systems.
Software lifecycle management is the process of planning, developing, maintaining, updating, and retiring medical device software through controlled procedures. It helps manufacturers demonstrate that software remains safe, effective, and compliant throughout its entire lifecycle rather than only at the point of market entry.
In most cases, yes. IEC 62304 is the internationally recognised standard for medical device software lifecycle processes and is widely used to demonstrate structured software development, maintenance, risk management, configuration management, and problem resolution activities for software-based medical devices.
Yes. IEC 62304 applies to both standalone Software as a Medical Device (SaMD) and software embedded within medical devices. The standard provides a framework for managing software activities throughout development, maintenance, and eventual retirement regardless of how the software is deployed.
Software lifecycle management provides the processes and documentation needed to demonstrate compliance with MDR and IVDR requirements. Traceability, risk management, software maintenance, verification, validation, and change control activities all contribute to demonstrating that software remains safe and performs as intended.
The exact documentation depends on the product and regulatory pathway, but commonly includes software development plans, software requirements specifications, architecture documentation, risk management files, verification and validation records, cybersecurity documentation, maintenance procedures, and traceability records linking requirements to testing and risk controls.
Software changes should be managed through formal change control processes that assess potential impacts on safety, performance, cybersecurity, regulatory compliance, and documentation. Effective change management helps organisations determine whether updates require additional validation, regulatory notifications, or revised risk assessments.
Software traceability is the ability to link requirements, risks, design decisions, development activities, testing, and released functionality throughout the software lifecycle. It helps demonstrate compliance, supports audits and regulatory reviews, and provides evidence that requirements have been implemented and verified appropriately.
Cybersecurity should be integrated throughout the software lifecycle rather than treated as a separate activity. Secure development practices, threat modelling, vulnerability management, software updates, security testing, and post-market monitoring all contribute to maintaining software security throughout the product lifecycle.
Software lifecycle management includes controlled decommissioning and end-of-life planning. Manufacturers should establish processes for managing product retirement, supporting customers, maintaining records, addressing cybersecurity considerations, and ensuring regulatory obligations continue to be met where applicable.
Yes. Agile development methodologies can be used for regulated medical device software provided appropriate controls, documentation, traceability, risk management, and verification activities are maintained. Many organisations successfully integrate agile practices within compliant software lifecycle frameworks.
Yes. MedQAIR supports organisations in establishing and improving software lifecycle processes aligned with IEC 62304, MDR, IVDR, FDA expectations, and related standards. This includes lifecycle planning, software documentation, traceability, risk management integration, cybersecurity considerations, maintenance activities, and change management processes.
Yes. Software lifecycle obligations continue throughout the product’s operational life. MedQAIR supports manufacturers with software maintenance processes, lifecycle documentation updates, change management, cybersecurity activities, audits, regulatory updates, and broader post-market software compliance activities.