WHO Global Model Regulatory Framework for Medical Devices including In Vitro Diagnostic Medical Devices 8.2-8.4-NRA-policy: NRA: set policy on reprocessing single-use devices and refurbishing, and build oversight of SaMD and machine learning devices, including local dataset representativeness, update and cybersecurity risks and real-world evidence

What does 8.2-8.4-NRA-policy require?

The NRA should state whether and under what conditions single-use devices may be reprocessed (treating the reprocessor as manufacturer, considering reprocessing in incident investigations), and state that refurbishers and refurbished devices meet the original device requirements and what information original manufacturers must provide. For software it should define which software is a regulated device and the oversight it needs, use risk categorisation such as the IMDRF SaMD framework, ensure reviewers and auditors have the expertise or rely on reference regulators, check that datasets represent local populations, assess human oversight, data flows across borders, network failure risks (with telecom, privacy and cybersecurity authorities), and set post-market protocols that capture real-world evidence.