Level of Concern and Documentation Level: What the FDA wants to achieve with it

1. Documentation Level: End of Level of Concern

On June 14, 2023, the FDA released the guidance document Content of Premarket Submissions for Device Software Functions. This document replaces the guidance document introducing the Level of Concern and only distinguishes between two classes.

a) Determination of the classes

The FDA no longer defines three “Level of Concern” but two “Documentation Classes.”

1. Basic Documentation
2. Enhanced Documentation

A software requires “Enhanced Documentation” if at least one of the following conditions is met:

The product that contains the software or is the software,

1. is a combination product,
2. is used in transfusion medicine or organ donation (determination of organ donors and recipients),
3. falls into class III, or
4. can lead to death or serious injury in the event of a fault.

On the fourth point, FDA refers to reasonably foreseeable risks. The assessment is carried out before risk measures are taken.

b) Consequence of classification

The classification affects the scope of the (software) documentation to be submitted:

software documentation element	Basic Documentation	Enhanced Documentation
determination of the documentation class	x	x
software description	x	x
system and software architecture	x	x
risk management	x	x
software requirements specification	x	x
software design specification	–	x
documentation of software development and maintenance	x	x (extended)
software testing	x (without details of the unit and integration testing)	x
version history	x	x
list and evaluation of anomalies	x	x

The new requirements are very reminiscent of the previous moderate and major levels. This means that manufacturers cannot submit software documentation that only meets the very lax requirements of the minor level of concern.

Unlike the Level of Concern, OTS is no longer classified independently but inherits the documentation level of the overall software.

As a manufacturer, you should know and consider this Off-the-Shelf Software guidance from the FDA.

Read more about the similarities and differences between OTS and SOUP here.

c) Assessment

The FDA makes substantial reference to IEC 62304 but no longer permits a class A approach, at the latest with the new version of the guidance document. In addition, manufacturers should be aware that the amount of documentation to be submitted is independent of the amount of documentation produced.

Therefore, the Johner Institute fundamentally recommends manufacturers to work and document in conformity with the requirements of safety class C.

2. How it was before: Definition and determination of the Level of Concern

In its previous guidance document Content of Premarket Submissions for Software Contained in Medical Devices, the FDA defined three Levels of Concern for the classification of software:

• Minor: We believe the level of concern is Minor if failures or latent design flaws are unlikely to cause any injury to the patient or operator.
• Moderate: We believe the level of concern is Moderate if a failure or latent design flaw could directly result in minor injury to the patient or operator […].
• Major: We believe the level of concern is Major if a failure or latent flaw could directly result in death or serious injury to the patient or operator […]

In its guidance document, the FDA not only named these three classes, but also provided assistance in determining the Level of Concern.

For this purpose, the FDA has defined a decision tree and two lists of questions. The first list contains the following questions, among others:

• Is the software an accessory to a medical device with a “Major Level of Concern?”
• Can a software error (before risk control measures!) lead to a death or serious injury, for example, because the software controls a treatment or serves vital data monitoring in potentially life-threatening situations?

The Level of Concern is determined as soon as one can answer “yes” to one of the questions.

Scope of the documentation to be submitted

The Level of Concern controls the amount of documentation to be submitted:

document	Minor Level of Concern	Moderate Level of Concern	Major Level of Concern
software description	yes	yes	yes
hazard analysis	yes	yes	yes
software requirements	yes	yes	yes
software architecture	no	yes	yes
software design specification	no	yes	yes
software development environment description	no	yes	yes
verification and validation	shortened	yes	yes
traceability analysis	yes	yes	yes

Off-the-Shelf Software

The Level of Concern also plays a decisive role for Off-the-Shelf Software (OTSS): It regulates

• the scope of the documentation required for this (e.g., Basic Documentation, Special Documentation),
• whether and which risk-minimizing measures must be documented,
• whether an audit of the manufacturer is necessary, if applicable, and
• whether this component may be used at all.

3. Safety classification according to IEC 62304 vs. Level of Concern according to FDA

The Levels of Concern are reminiscent of the safety classification of software components in IEC 62304:2007:

• Class A: No injury or damage to health is possible
• Class B: No serious injury is possible
• Class C: Death or serious injury is possible

Does this make these two classifications equivalent? No!

The FDA classification specifies which documents must be submitted for approval, and the IEC 62304 classification defines which documents must be prepared.

For the low classes, you can save yourself much work. On the other hand, for the FDA audit, the documentation for all components must be available. The fact that this is usually not done, especially for low-classified components, is another matter.

---

Change history

• 2024-01-19: Final guidance on documentation level considered