Healthcare
Technology Industry
Your software ships every sprint. FDA clears it like a device. We make both true at once.
When code makes a medical claim, it becomes a regulated product.
Software as a Medical Device, AI-enabled diagnostics, clinical decision support, remote monitoring, and connected platforms all live under FDA's device authorities and, in Europe, under the MDR. The moment your algorithm informs, drives, or makes a clinical decision, it carries a classification, a submission, and a quality system.
The friction is cultural before it is regulatory. Engineering teams iterate continuously; the device framework expects a controlled, documented, verifiable product. We embed as the regulatory leadership that lets a modern software team keep shipping without tripping the very rules that clear it, from the first classification call through an AI change-control plan the reviewer will accept.
Risk follows what the software decides, and how sick the patient is.
The IMDRF framework FDA relies on categorizes SaMD by two axes. Where you land sets the evidence bar and the pathway.
situation
situation
situation
Not every clinical function is a device. The 21st Century Cures Act carved certain clinical decision support out of the device definition. Knowing which side of that line your feature sits on is the first regulatory decision, and it governs everything after it.
Three doors into the US market for software.
Most SaMD reaches patients through one of three pathways. We choose the one that fits your risk, your predicate landscape, and your timeline.
510(k)
The fastest route when a legally marketed predicate exists. The case turns on a clean equivalence argument and software documentation that matches the risk.
De Novo
For first-of-kind software with no predicate. It creates the classification and the special controls, and it becomes the predicate everyone after you cites.
PMA
Reserved for Class III functions where software drives a critical decision. Clinical evidence carries the approval, and the review is a partnership.
A change-control plan lets your model improve without a new submission.
FDA has authorized well over a thousand AI-enabled devices, and the Predetermined Change Control Plan is how the agency now lets an algorithm evolve inside pre-agreed limits. Get the PCCP right and routine retraining is a documented event, not a new 510(k). Get it wrong and every improvement is a regulatory project.
PCCP scope
The exact modifications you may make, bounded so the reviewer can approve the envelope once.
Change protocol
The methods to develop, validate, and deploy each change, with objective acceptance criteria.
Good ML practice
GMLP across data management, training, and evaluation so performance claims hold up under audit.
Real-world monitoring
Post-market surveillance of drift, subgroup performance, and transparency so the model stays safe in the field.
A clearance is a promise about how the software is engineered.
Three disciplines decide whether a submission survives review and an audit survives the field.
Software lifecycleIEC 62304 · 82304
Risk-classed lifecycle processes, requirements traceability, and verification that map cleanly to what FDA and Notified Bodies expect to see.
CybersecuritySection 524B · SBOM
A security architecture, threat model, and software bill of materials that meet the premarket cyber mandate and stay maintainable post-market.
InteroperabilityHL7 FHIR · real-world data
Standards-based data exchange and real-world performance evidence that support both the submission and the value story after launch.
Regulatory leadership that speaks fluent software.
Fractional heads of regulatory and quality who have cleared SaMD and AI-enabled devices, embedded alongside your product and engineering teams.
Ship faster, clear cleaner, and defend it later.
From a first classification call to a Predetermined Change Control Plan, we bring the regulatory judgment healthcare technology needs, at the pace software moves.
Book a Strategy Call