Glossary

The FDA rule on electronic records and electronic signatures. It sets the conditions under which electronic records and signatures are treated as equivalent to paper records and handwritten signatures, which matters for any tool that holds quality records.

See alsoCSV and CSA

The FDA’s quality system rule for medical devices. Since 2 February 2026 it is the Quality Management System Regulation, which incorporates ISO 13485:2016 by reference and adds a small number of FDA-specific requirements.

Read moreISO 13485 · Design Controls See alsoQMSR · QSR

A submission to the FDA showing that a new device is substantially equivalent to a predicate device already legally marketed in the United States. The usual route for Class II devices. A successful 510(k) results in clearance, not approval.

Read moreFDA 510(k) See alsoPredicate device · Substantial equivalence · De Novo · PMA

A US standards developer. It publishes the US adoptions of many ISO and IEC device standards, and technical information reports such as TIR45 on Agile practices and TIR57 on security risk management.

See alsoISO · IEC

The wording the EU regulations use for how far risk must be reduced: as far as possible without adversely affecting the benefit-risk ratio. It is stricter than weighing risk reduction against cost.

Read moreISO 14971 · CE Mark See alsoALARP · Residual risk

The US professional body for accountants. It issues the attestation standards and the Trust Services Criteria used for SOC reports.

Read moreSOC 2 See alsoTrust Services Criteria · Attestation

A principle for deciding when a risk has been reduced enough, by weighing further reduction against how practicable it is. ISO 14971 lets the manufacturer set its own policy for risk acceptability. For the EU, the regulations require reduction as far as possible instead.

Read moreISO 14971 See alsoAFAP

In IEC 62304, any condition that deviates from what was expected on the basis of requirements, design documents, standards or someone’s experience. Anomalies are found in review, test, analysis or use, and are recorded and evaluated rather than only fixed.

Read moreIEC 62304 · V&V & Traceability See alsoKnown residual anomaly

The part of medical electrical equipment that, in normal use, necessarily comes into physical contact with the patient. Applied parts are classed as type B, BF or CF according to the protection against electric shock they provide.

Read moreIEC 60601 See alsoME equipment · Means of protection

An independent auditor’s formal opinion on whether something meets stated criteria. A SOC 2 report is an attestation: it contains an opinion, not a certificate.

Read moreSOC 2 See alsoSOC 2 Type 1 and Type 2 · Trust Services Criteria

A person or company established in the EU that a manufacturer outside the EU designates in writing to act on its behalf for specified obligations under the regulations.

Read moreCE Mark See alsoPRRC

An identified and approved version of a set of items, such as requirements, design, code and tests, that serves as the reference for further work. After a baseline, changes go through change control.

Read moreDesign Controls · V&V & Traceability See alsoConfiguration management

In IEC 60601-1, freedom from unacceptable risk directly caused by physical hazards when the equipment is used under normal conditions and under a single fault condition.

Read moreIEC 60601 See alsoEssential performance · Single fault condition

A comparison of the benefits of a device’s intended use against a residual risk. ISO 14971 calls for it when a residual risk is not acceptable under the manufacturer’s criteria and further risk control is not practicable.

Read moreISO 14971 See alsoResidual risk

The quality system process for investigating the cause of a problem that has happened (corrective) or could happen (preventive), acting on the cause, and checking that the action worked. ISO 13485 clauses 8.5.2 and 8.5.3.

Read moreISO 13485 See alsoQMS

The IECEE’s international system for mutual acceptance of test reports and certificates for the safety of electrical equipment. A CB test report lets one set of laboratory results be reused when applying for national certifications.

Read moreIEC 60601 See alsoIEC

The part of the FDA that regulates medical devices and radiation-emitting products.

Read moreFDA 510(k) See alsoFDA

The marking a manufacturer applies to show that a device conforms to the applicable EU requirements. For most devices it can only be applied after a Notified Body has issued the relevant certificates.

Read moreCE Mark See alsoMDR · IVDR · Notified Body · Declaration of conformity

Under the MDR, a systematic and planned process to continuously generate, collect, analyse and assess the clinical data for a device, to verify its safety, performance and clinical benefit. It is documented in a clinical evaluation report and kept current after launch.

Read moreCE Mark See alsoPMCF · Performance evaluation

Identifying the items that make up the software, controlling changes to them, and recording their status so that any released version can be recreated. IEC 62304 clause 8.

Read moreIEC 62304 See alsoBaseline · SOUP

The process of demonstrating whether the requirements of the regulation have been met for a device. The permitted routes depend on the device class and are set out in Annexes IX to XI of the MDR and IVDR.

Read moreCE Mark See alsoNotified Body · Device classification

Computer system validation is the traditional term for showing that software used in production or in the quality system does what it is meant to do. Computer software assurance is the FDA’s risk-based approach to the same goal, focusing effort where a failure would matter most. Neither refers to software in the device itself.

Read moreISO 13485 · V&V & Traceability See also21 CFR Part 11

In section 524B of the US Federal Food, Drug, and Cosmetic Act, a device that includes software, can connect to the internet, and has technological characteristics that could be vulnerable to cybersecurity threats. Submissions for cyber devices must include cybersecurity information.

Read moreFDA 510(k) See alsoSBOM

An FDA pathway for a novel device of low to moderate risk that has no predicate. A granted De Novo request classifies the device into Class I or II, and the device can then serve as a predicate for later 510(k)s.

Read moreFDA 510(k) See also510(k) · PMA

Two different things. In the EU, the manufacturer’s signed statement that a device meets the regulation, drawn up before the CE mark is applied. In an FDA submission, a statement that the device conforms to a recognized consensus standard.

Read moreCE Mark · FDA 510(k) See alsoRecognized consensus standard · CE mark

The record set required by ISO 13485 clause 7.3.10: the records that show conformity to the design and development requirements, including design changes. It is the equivalent of the former US Design History File.

Read moreDesign Controls · ISO 13485 See alsoDHF · Medical device file

The set of linked activities that keep device development controlled and documented: planning, inputs, outputs, review, verification, validation, transfer and change control. ISO 13485 clause 7.3.

Read moreDesign Controls See alsoDesign inputs and outputs · Design review · Design transfer

Design inputs are the requirements a device must meet: functional, performance, usability, safety and regulatory, plus the outputs of risk management. Design outputs are the results of design work, such as specifications, code and drawings, in a form that can be verified against the inputs.

Read moreDesign Controls See alsoVerification · Traceability

A planned, documented and systematic examination of a design at a suitable stage, to evaluate whether it can meet its requirements and to identify problems and the actions needed.

Read moreDesign Controls See alsoDesign controls

The step that makes sure design outputs are suitable for manufacturing before they become production specifications. For software, it means a controlled, repeatable build and release.

Read moreDesign Controls See alsoDesign controls

The risk class that decides which regulatory route applies. United States: Class I, II and III. EU MDR: Class I, IIa, IIb and III. EU IVDR: Class A, B, C and D. Canada: Class I to IV. In every scheme the highest class carries the highest risk.

Read moreFDA 510(k) · CE Mark See alsoRule 11 · Software safety class

The former US term for the compilation of records that describes the design history of a finished device. The term is no longer defined in 21 CFR Part 820. The ISO 13485 equivalent is the design and development file.

Read moreDesign Controls See alsoDesign and development file · DMR · DHR

The former US term for the production records of a unit or batch, showing that it was manufactured in accordance with the Device Master Record. ISO 13485 covers the same records under its production and record-keeping clauses.

Read moreISO 13485 See alsoDMR · DHF

The former US term for the compilation of specifications and procedures needed to produce a device. The ISO 13485 equivalent is the medical device file.

Read moreISO 13485 See alsoMedical device file · DHR · DHF

The ability of equipment to work as intended in its electromagnetic environment without disturbing other equipment. For medical electrical equipment, emissions and immunity are covered by IEC 60601-1-2.

Read moreIEC 60601 See alsoEssential performance

In IEC 60601-1, performance of a clinical function, other than that related to basic safety, where loss or degradation beyond the manufacturer’s limits would result in unacceptable risk. It must be maintained in normal use and under a single fault condition.

Read moreIEC 60601 See alsoBasic safety · Single fault condition

The FDA’s interactive PDF template for preparing premarket submissions. It has been required for 510(k) submissions since 1 October 2023.

Read moreFDA 510(k) See also510(k)

The EU’s database for economic operators, devices and their UDI data, Notified Bodies and certificates, clinical investigations, vigilance and market surveillance. Its first modules became mandatory on 28 May 2026.

Read moreCE Mark See alsoUDI

The US federal agency that regulates medical devices, among other products. Device regulation sits with its Center for Devices and Radiological Health.

Read moreFDA 510(k) See alsoCDRH

A bottom-up technique that takes each way a component or function can fail and works out the effects. It is a useful tool inside risk analysis but is not a complete one, because it does not find hazards that arise when nothing has failed.

Read moreISO 14971 See alsoFTA · Hazard

Usability evaluations under IEC 62366-1. Formative evaluations happen during development to explore the strengths and weaknesses of the user interface. The summative evaluation happens at the end, to obtain objective evidence that the interface can be used safely.

Read moreV&V & Traceability See alsoIEC 62366-1 · Use error

A top-down technique that starts from an undesired event and works back through the combinations of causes that could produce it.

Read moreISO 14971 See alsoFMEA

Annex I of the MDR and of the IVDR: the requirements every device must meet to be CE marked. Technical documentation normally includes a checklist showing how each requirement is met and with what evidence.

Read moreCE Mark See alsoTechnical documentation · Harmonised standard

In ISO 14971, injury or damage to the health of people, or damage to property or the environment.

Read moreISO 14971 See alsoHazard · Hazardous situation · Risk

A European standard whose reference has been published in the Official Journal of the European Union for a given regulation. Conforming to it gives a presumption of conformity with the requirements it covers.

Read moreCE Mark See alsoGSPR · State of the art

In ISO 14971, a potential source of harm.

Read moreISO 14971 See alsoHazardous situation · Harm

In ISO 14971, a circumstance in which people, property or the environment are exposed to one or more hazards. Risk analysis traces the sequence of events from a hazard to a hazardous situation and on to possible harm.

Read moreISO 14971 See alsoHazard · Harm · P1 and P2

The federal department that regulates medical devices in Canada under the Medical Devices Regulations. Devices are classed I to IV. Class II, III and IV devices need a medical device licence, and the manufacturer needs an MDSAP certificate.

Read moreISO 13485 See alsoMDSAP · Device classification

The international standards body for electrical and electronic technology. It publishes IEC 62304 and the IEC 60601 series, and develops some device standards jointly with ISO.

See alsoISO · AAMI

The safety standard series for electrical equipment for measurement, control and laboratory use. Part 2-101 covers in vitro diagnostic medical equipment, which is outside the scope of IEC 60601.

Read moreIEC 60601 See alsoIVD · ME equipment

Medical devices — Application of usability engineering to medical devices. It defines a process for analysing, specifying, designing and evaluating the user interface so that use errors and the risks they cause are reduced.

Read moreISO 14971 See alsoUse error · Formative and summative evaluation

Health software and health IT systems safety, effectiveness and security — Part 5-1: Security — Activities in the product life cycle. It sets out security activities arranged around the same life cycle stages as IEC 62304.

Read moreIEC 62304 See alsoSBOM · Cyber device

Health software — Part 1: General requirements for product safety. It applies to health software products that run on general-purpose computing platforms and are placed on the market without dedicated hardware. It requires IEC 62304 for the life cycle and adds product-level requirements, including validation.

Read moreIEC 62304 See alsoSaMD · Validation

A group of medical device regulators that works on harmonising regulation between countries. The term “software as a medical device” and its risk categorisation framework come from IMDRF documents.

See alsoSaMD · MDSAP

Intended use is the general purpose of a device: what it does. Indications for use describe the disease or condition it diagnoses, treats, prevents or mitigates, and the patients it is for. Both anchor risk analysis and, in a 510(k), the comparison with the predicate.

Read moreISO 14971 · FDA 510(k) See alsoSubstantial equivalence

The international standards body that publishes ISO 13485 and ISO 14971, among many others. Its standards are reviewed every five years.

See alsoIEC

The international standard for an information security management system. Unlike SOC 2 it is certifiable. The two overlap, and many organisations hold both.

Read moreSOC 2 See alsoTrust Services Criteria

A device, including reagents, instruments and software, used to examine specimens taken from the human body in order to provide information about a person’s health. In the EU these fall under the IVDR rather than the MDR.

Read moreCE Mark See alsoIVDR · IEC 61010 · Performance evaluation

Regulation (EU) 2017/746, the EU regulation for in vitro diagnostic medical devices. It has applied since 26 May 2022, with transition periods for devices placed on the market under the earlier directive.

Read moreCE Mark See alsoMDR · IVD

An anomaly that is known at release and has not been resolved. IEC 62304 clause 5.8 requires these to be documented and, for Class B and C software, evaluated to confirm they do not contribute to unacceptable risk. FDA submissions ask for the same list as “unresolved anomalies”.

Read moreIEC 62304 · V&V & Traceability · FDA 510(k) See alsoAnomaly

A device still placed on the EU market under a certificate or declaration from the earlier directives, during the transition to the MDR or IVDR. It cannot have significant changes to its design or intended purpose.

Read moreCE Mark See alsoSignificant change

In IEC 62304, medical device software that was legally placed on the market and is still marketed, but for which there is not enough objective evidence that it was developed in line with the current version of the standard. Clause 4.4 gives a route for bringing it into compliance.

Read moreIEC 62304 See alsoSoftware safety class

An expert group of representatives from EU member states. It publishes the guidance documents that Notified Bodies and manufacturers use to interpret the MDR and IVDR.

Read moreCE Mark See alsoNotified Body

An abbreviation with two meanings. In the EU, the Medical Device Regulation, Regulation (EU) 2017/745. In the United States, Medical Device Reporting under 21 CFR Part 803: the mandatory reporting of deaths, serious injuries and certain malfunctions to the FDA.

Read moreCE Mark See alsoIVDR · Vigilance

A programme in which one audit of a manufacturer’s quality system, based on ISO 13485 plus each country’s requirements, is accepted by the regulators of Australia, Brazil, Canada, Japan and the United States.

Read moreISO 13485 See alsoHealth Canada · IMDRF

In IEC 60601-1, electrical equipment that has an applied part, or transfers energy to or from the patient, or detects such energy transfer, and is intended for diagnosis, treatment or monitoring of a patient.

Read moreIEC 60601 See alsoApplied part · PEMS

In IEC 60601-1, a measure that reduces the risk of electric shock. The standard generally requires two, and distinguishes means of patient protection (MOPP) from means of operator protection (MOOP), with stricter requirements for the patient.

Read moreIEC 60601 See alsoApplied part · Single fault condition

Required by ISO 13485 clause 4.2.3: for each device type or family, a file containing or referencing the documents that show conformity, including the device description and intended use, labelling, and specifications for the product, manufacturing, packaging, storage, measuring, installation and servicing.

Read moreISO 13485 See alsoDMR · Design and development file · Technical documentation

An organisation designated by an EU member state to assess whether devices meet the regulations before they are placed on the market. It audits the quality system, reviews technical documentation and issues the certificates needed for CE marking.

Read moreCE Mark See alsoConformity assessment · MDCG

Data that supports the existence or truth of something, obtained by observation, measurement, test or other means. Verification and validation both rest on it.

Read moreV&V & Traceability See alsoVerification · Validation

The FDA’s term for a generally available software component that a device manufacturer uses but did not develop, and for which it cannot claim complete life cycle control. It overlaps with SOUP in IEC 62304.

Read moreIEC 62304 · FDA 510(k) See alsoSOUP

A common way to split the probability of harm, described in ISO 14971. P1 is the probability that a hazardous situation occurs. P2 is the probability that the hazardous situation leads to harm. For a software cause, the probability of the failure itself is conventionally taken as certain.

Read moreISO 14971 See alsoHazardous situation · Risk

A plan, reviewed and authorised by the FDA as part of a marketing submission, that describes specific planned modifications to a device and how they will be developed, validated and implemented. Changes made in line with it do not need a new submission.

Read moreFDA 510(k) See also510(k)

In IEC 60601-1, medical electrical equipment or a system containing one or more programmable electronic subsystems. Clause 14 sets development life cycle requirements for it and refers to IEC 62304 for the software.

Read moreIEC 60601 · IEC 62304 See alsoME equipment

Under the IVDR, the assessment and analysis of data to establish the scientific validity, analytical performance and clinical performance of an in vitro diagnostic device. It is the IVDR counterpart of clinical evaluation.

Read moreCE Mark See alsoClinical evaluation · IVD

The FDA’s most stringent pathway, required for most Class III devices. The FDA reviews scientific evidence of safety and effectiveness and, if satisfied, approves the device.

Read moreFDA 510(k) See also510(k) · De Novo

A continuous process that updates the clinical evaluation by proactively collecting and evaluating clinical data from the use of a CE-marked device.

Read moreCE Mark See alsoPMS · Clinical evaluation

The manufacturer’s systematic process for proactively collecting and reviewing experience with devices on the market, in order to identify any need for corrective or preventive action.

Read moreCE Mark · ISO 14971 See alsoPSUR · PMCF · Vigilance

A device already legally marketed in the United States to which a new device is compared in a 510(k).

Read moreFDA 510(k) See alsoSubstantial equivalence · 510(k)

A person with the required expertise in medical devices whom Article 15 of the MDR and IVDR requires a manufacturer to have available. Responsibilities include checking conformity before release and keeping technical documentation and the declaration of conformity up to date.

Read moreCE Mark See alsoAuthorised representative

A report that summarises the results and conclusions of post-market surveillance, with any actions taken. Required under the MDR for Class IIa devices and above, and under the IVDR for Class C and D.

Read moreCE Mark See alsoPMS

The FDA programme for asking for feedback before or during a marketing submission. A Pre-Submission is the common type: written questions, usually followed by a meeting, about things such as the predicate, the test plan or the documentation level.

Read moreFDA 510(k) See also510(k)

The organisational structure, responsibilities, procedures, processes and resources an organisation uses to meet quality and regulatory requirements. For medical devices the reference standard is ISO 13485.

Read moreISO 13485 See alsoQMSR · CAPA

The current form of 21 CFR Part 820, in effect since 2 February 2026. It incorporates ISO 13485:2016 by reference and adds FDA-specific requirements on matters such as records, labelling and packaging controls.

Read moreISO 13485 · Design Controls See alsoQSR · 21 CFR Part 820

The form of 21 CFR Part 820 that applied until 1 February 2026. Its design control requirements were in section 820.30. It has been replaced by the QMSR.

Read moreDesign Controls See alsoQMSR

A standard the FDA has formally recognized. A submitter can declare conformity to it in a premarket submission to meet the requirements the standard covers, which reduces the documentation the FDA needs to review.

Read moreFDA 510(k) See alsoDeclaration of conformity · Harmonised standard

Testing carried out after a change to confirm that it has not introduced faults or adversely affected parts of the software that were not meant to change.

Read moreV&V & Traceability · IEC 62304 See alsoVerification · Baseline

In ISO 14971, the risk that remains after risk control measures have been implemented. Each residual risk is evaluated, and so is the overall residual risk of the device.

Read moreISO 14971 See alsoRisk control measure · Benefit-risk analysis

In ISO 14971, the combination of the probability of occurrence of harm and the severity of that harm.

Read moreISO 14971 See alsoHarm · P1 and P2 · Residual risk

An action that reduces a risk or keeps it within a set level. ISO 14971 gives a fixed order of priority: inherently safe design, then protective measures, then information for safety. Each measure is verified as implemented and as effective.

Read moreISO 14971 · V&V & Traceability See alsoResidual risk

The set of records and other documents produced by risk management for a device. It does not have to be one physical file, but everything in it must be traceable.

Read moreISO 14971 See alsoRisk · Traceability

The classification rule for software in Annex VIII of the MDR. Software that provides information used for diagnostic or therapeutic decisions, or that monitors physiological processes, is Class IIa at least, rising to IIb or III with the severity of what could go wrong. All other software is Class I.

Read moreCE Mark See alsoDevice classification · SaMD

Software intended for one or more medical purposes that performs them without being part of a hardware medical device. The term comes from the IMDRF.

Read moreIEC 62304 See alsoIEC 82304-1 · IMDRF · Rule 11

A machine-readable list of the software components in a product, including third-party and open-source components and their versions. It is required in FDA submissions for cyber devices and is the natural companion to a SOUP list.

Read moreFDA 510(k) See alsoSOUP · Cyber device

For a legacy device in the EU, a change to the design or intended purpose that would end its right to stay on the market under the old certificate. MDCG guidance sets out which changes, including software changes, count as significant.

Read moreCE Mark See alsoLegacy device

In IEC 60601-1, a condition in which a single means for reducing a risk is defective, or a single abnormal condition is present. Equipment must remain safe when it occurs.

Read moreIEC 60601 See alsoBasic safety · Essential performance · Means of protection

The two forms of SOC 2 report. Type 1 covers whether controls are suitably designed at a point in time. Type 2 covers whether they were suitably designed and operated effectively over a period, commonly three to twelve months.

Read moreSOC 2 See alsoAttestation · Trust Services Criteria

The IEC 62304 classification of software as A, B or C according to the severity of harm it could contribute to. The class decides which activities and records the standard requires.

Read moreIEC 62304 See alsoDevice classification · SOUP

The decomposition used in IEC 62304. A software system is the integrated collection of software items that does a job. A software item is any identifiable part of it. A software unit is an item that is not subdivided further.

Read moreIEC 62304 See alsoSoftware safety class

In IEC 62304, a software item that is already developed and generally available but was not developed for the medical device, or software previously developed for which adequate records of the development process are not available. Libraries, operating systems and open-source components are typical SOUP.

Read moreIEC 62304 See alsoOTS software · SBOM · Configuration management

Requirements specific to a type of Class II device, set by the FDA to give reasonable assurance of safety and effectiveness. They can include performance standards, guidance documents, labelling requirements and postmarket surveillance.

Read moreFDA 510(k) See alsoDevice classification

What is currently and generally accepted as good practice in technology and medicine, based on the consolidated findings of science, technology and experience. It does not mean the most advanced solution available.

Read moreCE Mark · ISO 14971 See alsoHarmonised standard

The standard a 510(k) has to meet. The new device has the same intended use as the predicate and either the same technological characteristics, or different ones that raise no different questions of safety and effectiveness and are shown to be at least as safe and effective.

Read moreFDA 510(k) See alsoPredicate device · 510(k)

The documentation a manufacturer must draw up and keep current to show conformity with the MDR or IVDR. Annex II sets out its content, from device description to verification and validation results, and Annex III covers post-market surveillance.

Read moreCE Mark See alsoGSPR · Medical device file

Documented links between user needs, requirements, design, risk control measures and the tests that verify them. A trace matrix is the usual way of presenting those links.

Read moreV&V & Traceability See alsoVerification · Design inputs and outputs

The AICPA’s criteria against which a SOC 2 examination is performed. There are five categories: security, availability, processing integrity, confidentiality and privacy. Security is required in every report.

Read moreSOC 2 See alsoSOC 2 Type 1 and Type 2 · Attestation

A system for identifying devices through distribution and use. Each device carries a code made up of a device identifier and a production identifier, and its data is recorded in a regulator’s database: GUDID in the United States and EUDAMED in the EU.

Read moreCE Mark · ISO 13485 See alsoEUDAMED

In IEC 62366-1, a user action, or lack of action, while using the device that leads to a different result than the one intended by the manufacturer or expected by the user.

Read moreISO 14971 See alsoIEC 62366-1 · Formative and summative evaluation

Confirmation, through objective evidence, that the device meets user needs and its intended use. It is performed on the finished device or an equivalent, in actual or simulated conditions of use.

Read moreV&V & Traceability · Design Controls See alsoVerification · Objective evidence

Confirmation, through objective evidence, that specified requirements have been met: that the outputs of a design stage meet its inputs.

Read moreV&V & Traceability · Design Controls See alsoValidation · Objective evidence

The EU system for reporting serious incidents and field safety corrective actions to the competent authorities, and for acting on them.

Read moreCE Mark See alsoPMS · MDR