MDSAP Audit Approach (MDSAP AU P0002) C5-T12: Develop device software under design controls and risk management

What does C5-T12 require?

Where a device contains software, the software must have gone through the design and development process and been included in risk management. Clauses: ISO 13485:2016 7.3.2, 7.3.10; TG(MD)R Sch 1 Pt 1 EP 2 and EP 12.1; CMDR 20; RDC 665/2022 Arts 18 to 20, 53 to 58, 61; MO169 Arts 30, 36-2.

Maintained by Gerard Blokdyk

Other controls in Chapter 5: Design and development – MDSAP Audit Approach (MDSAP AU P0002)

C5-T1 Identify which devices are subject to design and development controls in each jurisdiction and maintain the technical documentation evidence they require
C5-T10-T11 Validate the design for the intended use with testing scaled to risk, and perform the clinical evaluation or safety and performance evaluation each jurisdiction requires
C5-T12-US United States: for cyber devices cleared or approved after 29 March 2023, maintain a postmarket vulnerability plan with coordinated disclosure, cybersecure design and update processes, and a software bill of materials
C5-T13 Control design changes (verify or validate and approve before implementation, assess new risks), notify regulators or the MAH where required, and assign new UDI-DIs for new versions or packages
C5-T14-T15 Hold design reviews at planned stages with the right functions and specialists, and review design changes for their effect on product already made and delivered
C5-T16 Transfer the design correctly to production, releasing it only after authorised review of the complete design history
C5-T3-T4 Plan and control each design and development project, with stages, reviews, verification, validation, transfer, responsibilities and interfaces, under established procedures
C5-T5-T6 Establish, review and approve complete, unambiguous, non-conflicting design inputs covering function, performance, safety, intended use, regulations (including Essential Principles), human factors, risk controls and known security vulnerabilities

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All MDSAP Audit Approach (MDSAP AU P0002) controls