Aminalam Meddev Agent Skills Regulatory Eu Mdr

EU MDR Software Requirements (incl. Rule 11)

Purpose

Provide actionable guidance for software under EU MDR, focusing on classification (Rule 11), technical documentation expectations, UDI for software, PMS/PMCF needs, and alignment with MDCG guidance.

When to Apply

• Software intended for EU market (MDR 2017/745).
• Changes affecting intended purpose, data handling, diagnostics/therapy decisions, or networking.
• Updates that may alter classification under Rule 11.
• Preparation/update of technical documentation or NB submissions.

Requirements (testable)

1. Classification (Rule 11): Determine class per MDR Annex VIII Rule 11; document rationale, including data source and decision/diagnosis impact. Rationale: drives conformity assessment route and evidence depth.
2. Intended Purpose & GSPRs: Align software intended purpose with GSPRs (Annex I); map requirements to GSPR coverage. Rationale: completeness of technical documentation.
3. Technical Documentation: Maintain MDR Annex II/III-compliant documentation: device description, design/architecture, risk management, verification/validation (including usability), clinical evaluation linkage, IFU. Rationale: NB review readiness.
4. Risk Management Integration: Use ISO 14971 outputs; include cybersecurity and interoperability risks per MDCG 2019-16/2020-1. Rationale: MDR expects risk coverage including security.
5. UDI for Software: Assign UDI-DI and handle UDI-PI per MDCG 2018-1 v3; display/versioning rules for software releases. Rationale: traceability of versions.
6. PMS/PMCF: Define PMS plan; determine if PMCF is applicable; collect and feed post-market data into risk management. Rationale: lifecycle safety evidence.
7. SOUP & Updates: Document SOUP, versions, and change impacts; ensure updates go through change control and PMS linkage. Rationale: manage new risks with updates.
8. Interoperability: Document external systems/interfaces and standards used; define error handling and safe failure behavior. Rationale: MDR emphasis on interoperability safety.
9. Usability (IEC 62366-1 link): Capture user interface risks and mitigations where software UI affects safety; trace to testing. Rationale: GSPR 5 & 14 coverage.

Recommended Practices

• Keep a Rule 11 classification note per release; highlight any change triggers.
• Maintain a GSPR matrix with software-specific evidence references (tests, analyses).
• Include cybersecurity controls and test evidence as part of GSPR 17 and risk files.
• Automate UDI version stamping in build outputs and release notes.
• Maintain a PMS delta log per release that feeds back into risk and tech file.

Patterns

Rule 11 rationale excerpt:

Rule 11 Classification: Class IIa
Justification:
- Software provides information used to drive therapy adjustment but not for immediate vital decisions.
- Mitigations: clinician confirmation step; alarms for anomalous inputs.
- If failure -> potential non-serious injury. No autonomous closed-loop therapy.

GSPR mapping snippet (CSV-style):

GSPR 17.2 | Cybersecurity | Controls: TLS1.3, mutual auth, SBOM; Tests: PEN-12, DAST-07 | REQ-SEC-21 | PASS
GSPR 14.2 | Maintainability | Update process with signed OTA; rollback supported | REQ-OTA-05 | PASS

UDI handling in release notes:

UDI-DI: EU123456789-SW-001
UDI-PI: lot=2026.01.04 build=1.0.3
Displayed in splash screen and About dialog; included in IFU and EUDAMED entry.

Anti-Patterns (risks)

• Treating all software as Class I under Rule 11 without rationale -> risk: NB nonconformity.
• Missing GSPR evidence mapping -> risk: incomplete technical documentation.
• No UDI update when version changes -> risk: traceability gap.
• Cybersecurity omitted from risk management -> risk: NB findings and patient safety issues.
• PMS not feeding back into risk/tech file -> risk: lifecycle noncompliance.

Verification Checklist

• Rule 11 classification documented with rationale; re-evaluated on changes.
• GSPR matrix updated with evidence for software items.
• Technical documentation (Annex II/III) updated for this change.
• Risk management updated (including cybersecurity/interoperability risks).
• UDI-DI/PI updated and reflected in software build artifacts and IFU where applicable.
• PMS/PMCF plans reviewed; post-market signals assessed for this release.
• SOUP inventory/version impacts evaluated and documented.
• Interoperability behaviors and error handling described and verified.
• Usability-related risks/mitigations tested if UI changes affect safety.

Traceability

• Maintain GSPR matrix linking to requirements/tests.
• Tag releases with UDI-PI and store evidence bundles per version.
• Keep Rule 11 rationale and class in the architecture/risk sections; tie to hazards.

References

• EU MDR 2017/745: Annex VIII Rule 11; Annex I (GSPRs); Annex II/III (technical documentation).
• MDCG 2019-11 Rev.1 (Guidance on Qualification and Classification of Software in Regulation (EU) 2017/745).
• MDCG 2019-16 Rev.1 (Guidance on Cybersecurity for Medical Devices).
• MDCG 2018-1 v3 (Guidance on Unique Device Identification (UDI) for Software).
• MDCG 2020-1 (Guidance on Clinical Evaluation - used here for contextual understanding of benefit-risk).
• MDCG 2022-14 (MDCG Position Paper on the use of the UDI as listed on the GSPRs).
• IEC 62304 and ISO 14971 for lifecycle and risk integration (prerequisites).

Changelog

• 1.0.1 (2026-01-04): Audit review - added revision numbers to MDCG references, added MDCG 2022-14 reference.
• 1.0.0 (2026-01-04): Initial EU MDR skill covering Rule 11, GSPRs mapping, UDI, interoperability, PMS/PMCF.

Audit History

• 2026-01-04: Regulatory audit performed. Verified:
  • Rule 11 classification references are accurate per MDR Annex VIII
  • GSPR references to Annex I are correct
  • Technical documentation references to Annex II/III are accurate
  • MDCG references verified and revision numbers added for clarity
  • Added MDCG 2022-14 for UDI on GSPRs