Global Medical Device Podcast powered by Greenlight Guru

In this episode, Etienne Nichols sits down with Staci Miller, a Human Factors and UX Strategist at GenUX, to demystify the role of human factors (HF) in the medical device regulatory pathway. Staci explains that many companies mistakenly treat HF as a "box-checking" exercise late in development, leading to costly submission delays or rejections when the FDA finds the documentation fails to tell a cohesive safety story.The conversation dives deep into the technical distinctions between a Use-Related Risk Analysis (URRA) and a User Failure Mode and Effects Analysis (uFMEA). Staci provides a framework for deciding which approach fits your product, emphasizing that while large conglomerates with post-market data may lean toward uFMEAs, startups and those with novel devices should prioritize the URRA to effectively map out user interactions without the crutch of existing market data.Finally, Staci addresses one of the most persistent myths in the industry: the idea that clinical trial data can replace human factors validation. She clarifies that while the two can overlap in specific, premeditated circumstances (such as complex implants like aortic valves), they serve entirely different masters—one focused on clinical efficacy and the other on the safety of the user interface across diverse environments.Key Timestamps04:12 – The common disconnect: Integrating Human Factors into ISO 14971 risk management.06:45 – URRA vs. uFMEA: How to choose based on your post-market data and predicate device status.10:30 – The "Definition of Done": Tracking the lifecycle of HF documentation from phase zero to market release.13:15 – System errors vs. Use errors: How to identify root causes during summative studies.18:50 – The "Clinical Trial Myth": Why efficacy data is not the same as usability validation.22:10 – Design Inputs vs. Design Outputs: The "Blueprint and the House" analogy for FDA submissions.25:40 – The impact of the "Use Environment": Testing for movement in ambulances and lighting in radiology suites.Quotes"The FDA doesn't put things out there just to have a good time... If they've made human factors a requirement and you're treating it as a 'suggestion,' you're giving yourself enough rope to hang yourself." - Staci Miller"People are obsessed with the product themselves—the design outputs. But the FDA wants to see the design inputs. They want to see the blueprints of how you built that house, not just the wallpaper." - Staci MillerTakeawaysPremeditation is Key: If you intend to use clinical trial data for HF validation, it must be planned in the protocol from the start; you cannot retroactively claim clinical data satisfies usability requirements.Map User Groups Early: Distinguish clearly between primary and secondary users. Bloating user sets without explaining how or why they engage with the device complicates your risk profile.Environment Matters: Documentation must account for the physical "10,000-foot view," including noise, lighting, and motion (e.g., an ambulance), as these are often where critical use errors occur.HF is Risk Management: Human factors should not live in a silo. It must align with the scales of harm (negligible to catastrophic) defined in ISO 14971 and work in tandem with Quality and Regulatory teams.ReferencesISO 14971: The global standard for the application of risk management to medical devices.FDA Human Factors Guidance: The primary document outlining expectations for usability testing and documentation.Etienne Nichols: LinkedIn ProfileMedTech 101: URRA vs. uFMEAThink of a uFMEA (User Failure Mode and Effects Analysis) like a car manufacturer looking at an old model to see why the brakes failed in the past—it relies on known data to fix specific parts.A URRA (Use-Related Risk Analysis) is like teaching someone to drive a brand-new type of vehicle (like a spaceship) for the first time. Since you don't have "crash data" yet, you have to carefully map out every single step the pilot takes and imagine every possible way they could push the wrong button in the heat of the moment.SponsorsGreenlight Guru: This episode is brought to you by Greenlight Guru, the only quality management platform designed specifically for the medical device industry. Whether you need to manage your QMS to stay compliant with ISO 14971 or streamline your clinical data through their EDC solutions, Greenlight Guru helps you move faster with less risk.Feedback Call-to-ActionWe want to hear from you! Do you have questions about your specific regulatory pathway or a topic you’d like us to cover? We provide personalized responses to every listener who reaches out. Send your thoughts, reviews, or suggestions to podcast@greenlight.guru.

This episode features Ivanny Franklin, Managing Partner at MedSight Capital, who brings a wealth of experience from her background in molecular biology and her decade-long tenure at NAMSA. The conversation centers on the shifting paradigms of medical device investment, specifically how the industry is moving away from service-based models toward a focus on clinical outcomes.Etienne and Ivanny explore the critical intersection of global regulatory bodies—such as the NMPA in China and the FDA in the US—and the necessity of a cohesive clinical evidence strategy. Ivanny emphasizes that for startups, understanding market-specific data requirements is not just a regulatory hurdle but a fundamental component of commercialization and investor conviction.The discussion also dives into the "patient empowerment" movement, fueled by the convergence of wearables, AI, and at-home monitoring. Ivanny shares her bullish outlook on technologies that give patients control over their data, while acknowledging the tension this creates for physicians and the ongoing need for rigorous regulatory oversight to ensure safety and effectiveness.Key Timestamps[03:15] Global Regulatory Strategy: Insights into the NMPA (formerly CFDA) and why China requires in-country clinical evidence.[07:42] Leveraging Data: How to run a single clinical trial to satisfy multiple global regulatory bodies.[10:18] The At-Home Monitoring Shift: The rise of wearables and OTC testing in the wake of COVID-19.[13:45] The "Data Gap": Addressing the friction between patient-gathered data and physician adoption.[18:22] Investment Non-Negotiables: Why revenue-generating companies and clear regulatory classifications are key for MedSight Capital.[23:10] Diligence and Deception: The importance of honesty regarding reimbursement codes and 510(k) vs. PMA paths.[27:45] SPV vs. Hedge Fund Models: A breakdown of how Special Purpose Vehicles allow family offices to be nimble in MedTech.Quotes"FDA and NMPA, for example, are quite strict in clinical evidence coming from in-country... as a startup, you really need to understand can we run a single trial with multiple global sites to achieve clearance cohesively." - Ivanny Franklin"I’m an advocate for [at-home monitoring]. I do think that’s the future. However, there is concern around what types of information should patients be receiving and how are they going to act on that information?" - Ivanny FranklinTakeawaysRegulatory is the Roadmap: An investment is often "de-risked" based on the clarity of the regulatory path. If a founder cannot distinguish between a 510(k) and a PMA, it is a major red flag for investors.Harmonize Your Trials: To achieve "economies of scale" in clinical evidence, work with consultants to design trials that meet the stringent requirements of both the FDA and international bodies like the NMPA early on.Commercial Scalability over Hype: For revenue-generating companies, investors are less concerned with the "idea" and more focused on physician retention, training, and the cost of scaling the sales team.Honesty in Reimbursement: Never "make up" or guess CPT codes. Investors utilize experts (like ex-FDA personnel) to pressure-test your reimbursement strategy during diligence.ReferencesNMPA (National Medical Products Administration): The primary regulatory body for China (formerly the CFDA).NAMSA: A world-leading Medical Device CRO mentioned as Ivanny’s former professional home.LSI (Life Science Intelligence): The upcoming conference mentioned where Etienne and Ivanny will speak on a panel.Greenlight Guru: The preferred platform for QMS & EDC solutions to manage medical device quality and clinical data.Etienne Nichols: Connect on LinkedIn.MedTech 101: SPV (Special Purpose Vehicle)Think of a Special Purpose Vehicle (SPV) like a "carpool" for investors. Instead of a massive bus (a Hedge Fund) that picks up everyone's money and decides where to go over several years, an SPV is a single car created for one specific trip—in this case, one specific company.Investors put their money into the SPV, and the SPV makes one investment in one startup. This allows smaller investors or family offices to pool their resources together to act as one large "passenger" on a company's cap table.SponsorsThis episode is brought to you by Greenlight Guru. Moving from a "service-based" model to an "outcome-based" model requires impeccable data and quality management. Greenlight Guru offers both QMS (Quality Management System) and EDC (Electronic Data Capture) solutions designed specifically for the medical device industry. Whether you are gathering clinical evidence for an NMPA submission or scaling a revenue-generating product, Greenlight Guru helps you stay compliant and efficient.Feedback Call-to-ActionWe want to hear from you! Did this breakdown of investment vehicles help you? Do you have suggestions for future MedTech topics? We provide personalized responses to every listener who reaches out. Send your thoughts, reviews, and questions to podcast@greenlight.guru.

In this episode, Etienne Nichols sits down with Dr. Kristy Katzenmeyer-Pleuss, President and Founder of KP Medical Device Consulting, to unpack the complexities of the medical device life cycle. The conversation centers on how manufacturers often overlook critical phases of a product’s journey, such as transportation, shelf life, and the decommissioning phase, focusing instead solely on the point of patient use.Dr. Katzenmeyer-Pleuss highlights the significance of the upcoming ISO 10993-1:2025 standard and its renewed emphasis on life cycle-based risk assessments. She explains how the transition between global markets—particularly between the EU and the US—can lead to unexpected FDA deficiencies when manufacturers rely on justifications that worked for notified bodies but do not meet more stringent FDA testing expectations for reusable or in situ curing devices.The discussion concludes with actionable advice on early design decisions, such as narrowing down material suppliers and reprocessing options to reduce testing burdens. They also explore the critical need for cross-functional communication and quality system integration to ensure that learnings from one project or regulatory interaction are captured and applied across a company’s entire portfolio.Key Timestamps01:45 – Introduction of Dr. Kristy Katzenmeyer-Pleuss and the mission of KP Medical Device Consulting.04:12 – Defining the Medical Device Life Cycle: Concept to decommissioning and the "hidden" phases in between.05:30 – ISO 10993-1:2025: The impact of the new biological evaluation standard on risk-based approaches.09:15 – Global Regulatory Discrepancies: Why a device approved in Europe might face hurdles at the FDA regarding "worst-case" testing.13:40 – Reusable Devices & Reprocessing: Managing the "permutation explosion" of cleaning agents and sterilization cycles.17:22 – Early Design Decisions: How limiting options in the IFU can significantly decrease your regulatory testing burden.21:05 – In Situ Curing Devices: The unique testing challenges of materials that change states during use.25:10 – Quality System Integration: Strategies for linking regulatory deficiencies and materials across multiple projects.Quotes"The life cycle is really the concept of the medical device from when it’s a concept all the way through to the end where you are disposing or decommissioning... shelf life and transport are steps that usually don’t get a lot of focus, but they are very important." - Dr. Katzenmeyer-Pleuss"You might have one device where literally they don’t ask these questions at all, and then other times they’re very, very picky... the longer you go in that process, the harder it is to pivot without spending a lot of time and money." - Dr. Katzenmeyer-PleussTakeawaysFront-load Risk Assessments: Don’t wait for FDA deficiencies to consider how shelf life or reprocessing affects device safety; integrate these into the biological evaluation plan from day one.The "Worst-Case" Strategy: When designing testing protocols for reusable devices, aim for a "worst-case" scenario that covers future iterations or additional suppliers to avoid redundant, expensive re-testing.Standardize Your IFU Early: Providing users with infinite cleaning or sterilization options creates an exponential increase in testing requirements; narrow these down to the essentials to streamline market entry.Break the Silos: Use your QMS to link specific material risks or regulatory feedback across different project teams so that knowledge isn't lost when personnel leave.ReferencesISO 10993-1:2025: The updated international standard for the biological evaluation of medical devices within a risk management process.Etienne Nichols on LinkedIn: Connect with the host for more MedTech insights.MedTech 101: In Situ CuringIn this episode, Dr. Katzenmeyer-Pleuss mentions In Situ Curing. Think of this like a medical-grade "liquid bandage" or dental filling. The device starts as a liquid or gel and is applied to the body, where it then hardens into a solid "in the spot" (in situ).From a regulatory standpoint, this is complex because you aren't just testing one device; you have to test the safety of the liquid, the safety of the solid, and any chemicals released during the hardening process. It is essentially three devices in one when it comes to testing.SponsorsThis episode is brought to you by Greenlight Guru. When navigating the complex life cycle of a medical device—from the initial risk assessments discussed today to post-market surveillance—you need a unified system. Greenlight Guru’s QMS (Quality Management System) and EDC (Electronic Data Capture) solutions work together to ensure your data is linked, your testing is documented, and your clinical trials are seamless. By connecting your quality and clinical data, you can avoid the "disjointed" project management pitfalls Etienne and Kristy discussed.Feedback Call-to-ActionWhat are your biggest hurdles in managing the full medical device life cycle? We want to hear from you. Whether it's a specific regulatory challenge or a topic suggestion for a future guest, send your thoughts to podcast@greenlight.guru. We read every email and pride ourselves on giving personalized responses to our MedTech community.

This episode explores the transition from the Quality System Regulation (QSR) to the Quality Management System Regulation (QMSR) and the foundational elements required for medical device compliance. Host Etienne Nichols and guest Mike Drues discuss the philosophy of building a usable system rather than a "museum of SOPs," emphasizing that the standard list of QMS sections should be viewed as a starting point rather than an exhaustive checklist.The conversation examines the critical differences between 510(k), De Novo, and PMA pathways regarding manufacturing requirements. While a 510(k) submission may not strictly require detailed manufacturing information at the time of filing, Mike explains why companies must remain audit-ready from the moment they register their establishment with the FDA. The discussion clarifies the timing of registration and the "radar" companies enter once they become commercially active.Finally, the dialogue focuses on a "triage" approach for resource-constrained startups. By prioritizing Design Controls and Risk Management during early development, teams can remain compliant and ethical without over-investing in post-market systems, such as complaint handling, before they have a product on the market. Mike warns against the dangers of "copy-and-paste" quality systems, urging manufacturers to use professional judgment to tailor their processes to their specific technology.Key Timestamps00:00 - Introduction to QMS requirements and guest Mike Drues.03:45 - The core sections of a QMS according to the Quality System Regulation.05:12 - Why the QSR list is a starting point, not a stopping point.08:20 - Regulatory vs. Ethical vs. Economical: The three legs of the medical device stool.10:30 - Do you need a full QMS for 510(k) vs. PMA submissions?13:15 - Understanding the timing and strategy for FDA Establishment Registration.15:40 - The Triage Approach: Which QMS sections matter most during early development?19:00 - The dangers of boilerplate SOPs and non-specific quality manuals.Quotes"This is a starting point. This is not a stopping point... Use your own good judgment." — Mike Drues"The goal is not really to build a museum of SOPs; the goal is a quality management system that teams will actually use." — Etienne NicholsTakeawaysPrioritize the Big Four: During the development phase, focus your limited resources on Design Controls, Risk Management, Document Control, and Supplier Quality Management.Understand Pathway Nuances: While 510(k) submissions don't require manufacturing details, you must be fully compliant and ready for inspection once your establishment is registered and the product is launched.Avoid Boilerplate SOPs: Quality systems must be specific to your organization. Including irrelevant device types or procedures in your QMS is a significant red flag for FDA inspectors.Strategic Registration: Register your establishment 60–90 days before your planned commercial launch to manage costs and stay off the FDA inspection radar until necessary.The Preamble is Key: Read the preamble of the QSR to understand the "why" behind the regulations, which allows for better justification of your quality decisions during an audit.ReferencesFDA Design Control Guidance (1997): A foundational document for medical device engineering and documentation.FDA Establishment Registration: Guidance on the timing and requirements for small business fee waivers.Etienne Nichols LinkedIn: https://www.linkedin.com/in/etiennenichols/MedTech 101 SectionConcept: The Quality Management System (QMS) Think of a QMS like a pilot’s pre-flight checklist. You don't just "wing it" when you get into a cockpit; you have a documented process to ensure the engine is working, the fuel is full, and the wings are clear. For a small plane (a low-risk Class I device), your checklist is shorter and simpler. For a commercial jumbo jet (a high-risk Class III device), the checklist is massive and detailed. However, the goal for both is identical: ensuring the passengers (the patients) arrive safely at their destination through a repeatable, controlled process.SponsorsThis episode is brought to you by Greenlight Guru. The subject of right-sizing your quality system is exactly why Greenlight Guru offers both QMS and EDC solutions. Their Ultralight eQMS is designed specifically for fast-moving, product-led teams who need a flexible, compliant system without the overhead of a "museum of SOPs." Whether you are in early-stage R&D or preparing for a global launch, Greenlight Guru provides the tools to keep your quality and clinical data connected and audit-ready.Feedback Call-to-ActionWe want to hear from you! What are the biggest hurdles your team faces when scaling your quality system? Send your feedback, reviews, and topic suggestions to podcast@greenlight.guru. We read every email and pride ourselves on providing personalized responses to our listeners.

Dr. Jenny Hoffmann, MedTech executive and author of Open Up: Step Into the Leader You Are Meant to Be, joins host Etienne Nichols to discuss the evolution of leadership in the medical device industry. Drawing from her experience as a bioengineer and CEO, Dr. Hoffmann explains why the traditional model of the "rigid, perfect leader" is no longer sustainable. She shares her personal journey—from being one of the first IVF babies in the U.S. to navigating life-threatening health complications—and how these experiences shaped her mission to help others lead with authenticity.The conversation centers on the concept of "SOS moments," which Dr. Hoffmann defines as those critical points of distress or crisis that occur in both personal lives and product development. By applying her CEC framework—Curiosity, Empathy, and Connection—leaders can transform these high-pressure moments into stories of strength. This approach is particularly vital in MedTech, where the ultimate goal is to serve patients during their own most vulnerable SOS moments.Etienne and Jenny also explore the intersection of human leadership and emerging technology. While AI continues to streamline technical workflows, Dr. Hoffmann argues that human empathy and curiosity remain irreplaceable assets for innovation. The episode concludes with a practical look at the return on investment (ROI) for "opening up," demonstrating how personal connection leads to higher quality products, better team retention, and the resilience needed to survive the "messy middle" of product development.Key Timestamps00:00 - Introduction of Dr. Jenny Hoffmann and her background in MedTech and innovation.01:28 - Motivation for writing Open Up: Scaling impact through vulnerable storytelling.04:23 - The shift from the "perfectly composed" leader to the vulnerable leader.05:45 - Dr. Hoffmann’s personal origin story: Being one of the first IVF babies in the U.S.08:30 - Listening to the "whisper" and the courage required to respond to inner intuition.10:14 - The ROI of Vulnerability: How personal connection drives higher quality and team motivation.14:39 - Defining SOS moments: Turning distress signals into leadership strengths.18:42 - The CEC Method: Breaking down Curiosity, Empathy, and Connection.20:25 - AI in MedTech: Why human empathy is the one thing machines cannot replace.25:57 - Strategic Sharing vs. Oversharing: How to lead by example without losing professional boundaries.28:52 - The power of storytelling for engineers and data-driven professionals.Quotes"The leader is the first one to step out on the bridge that no one’s sure if they want to cross. You paint that vision of the bridge, and then you’re the first one to step out on it." - Dr. Hoffman"If we can put empathy first and think about how we are each a patient first... then we can uncover the real needs to solve. Then we can be more innovative." - Dr. HoffmanTakeawaysThe CEC Framework: Use Curiosity to open the mind, Empathy to open the heart, and Connection to drive outsized results in technical teams.Embrace SOS Moments: View professional crises or personal struggles as distress signals that, when analyzed with curiosity, provide the data needed to build resilience.Human-Centric AI Strategy: Leverage AI for efficiency and data processing, but double down on human empathy to solve complex patient needs that machines cannot grasp.Strategic Vulnerability: Sharing personal stories is a leadership skill. Start small by sharing "Monday morning" anecdotes before moving to deeper personal values to build team trust.The Mission Dimension: In MedTech, motivation isn't just about time and effort; it is about the "third dimension" of mission-driven impact that keeps teams moving through the "messy middle" of a project.ReferencesOpen Up: Step Into the Leader You Are Meant to Be by Dr. Jenny Hoffmann – The core book discussed, focusing on vulnerable leadership.New England Medical Innovation Center (NEMIC) – Where Dr. Hoffmann serves as Executive Director.Sure Footing Consulting – Dr. Hoffmann’s leadership and strategy firm.Etienne Nichols LinkedIn – Connect with the host.MedTech 101: SOS MomentsIn a medical context, an SOS is a distress signal indicating an immediate need for help. In leadership, Dr. Hoffmann uses "SOS moments" as an acronym for "Story of Strength" and an analogy for those times when you feel overwhelmed, fearful, or hit a major roadblock in a project (like a failed regulatory submission or a budget crisis), it can also be a moment to look back on and learn from.Just as a clinician responds to a patient’s distress signal by diagnosing the underlying issue, a MedTech leader should respond to their own "emotional SOS" by using the CEC Method.SponsorsThis episode is brought to you by Greenlight Guru. In the medical device industry, the "messy middle" of development is often where teams lose momentum. Greenlight Guru helps you stay focused on your mission by providing the only dedicated MedTech Lifecycle Excellence platform. Their QMS (Quality Management System) ensures your documentation is always audit-ready, while their EDC (Electronic Data Capture) solution streamlines clinical data management. By integrating quality and clinical data, Greenlight Guru allows leaders to spend less time on paperwork and more time on the vulnerable, innovative leadership discussed in today's episode.Feedback Call-to-ActionWe want to hear from you. How do you balance vulnerability with technical authority in your leadership role? Have you experienced an "SOS moment" that changed your career path? Please send your thoughts, reviews, or suggestions for future topics to podcast@greenlight.guru. We read every email and look forward to providing personalized responses to our listeners.

In this episode, we delve into the complexities and essentials of quality and regulatory roles in the medical device industry. Our esteemed guest, Jennifer Mascioli-Tudor, CEO and founder of JMT Compliance Consulting, shares her wealth of experience from top MedTech companies, underscoring the importance of proactive quality management, project management skills, and the ability to influence and communicate within organizations.Key Timestamps:[00:00:50] Introduction to Jennifer Mascioli-Tudor and her extensive background in the MedTech industry.[00:03:30] Jennifer's origin story in quality and regulatory roles.[00:07:15] The pivotal learning moments in quality management and regulatory affairs.[00:10:45] Strategies for influencing business leaders and the importance of storytelling in quality and regulatory roles.[00:16:30] The significance of human factors in product design and learning from end-user feedback.[00:21:50] Project management skills for quality and regulatory professionals.[00:25:20] The concept of 'design freeze' in the MedTech space and its impact on product development.[00:29:55] Jennifer's insights on agility and adaptability in building a quality management system.Quotes:"A really good quality and regulatory professional needs to have really good project management skills." - Jennifer Mascioli-Tudor"It's not just about the design and about the product. It's about everything ancillary that feeds into that finished medical device." - Jennifer Mascioli-TudorMedTech Trends:An emphasis on proactive quality management to ensure patient safety and product efficacy.The rising importance of human factors and user-centered design in medical device development.The shift towards integrating software and digital solutions in medical devices.Practical Tips:Quality and regulatory professionals should hone their project management skills.Communication and storytelling are key in influencing business decisions and leadership.Always present solutions and alternatives when addressing compliance challenges.References:JMT Compliance ConsultingJennifer Mascioli-Tudor on LinkedInEtienne Nichols on LinkedInGreenlight Guru’s platform for Quality Management & Clinical InvestigationsQuestions for the Audience:Discussion: "How do you envision MedTech changing the landscape of healthcare in the next decade?"Feedback:Love the episode? Have suggestions or topics you’d like to hear about? Email us at podcast@greenlight.guru and leave a review on iTunes!Sponsors:This episode is brought to you by Greenlight Guru, the only quality management software designed specifically for the medical device industry. Streamline your process and foster innovation with Greenlight Guru’s intuitive platform!

The FDA's new Quality Management System Regulation (QMSR), which replaces the 21 CFR Part 820 Quality System Regulation (QSR) and incorporates ISO 13485:2016 by reference, represents a significant harmonization effort in the medical device industry. While viewed by some as a mere streamlining, the change is mandatory, with an effective and fully enforceable date of February 2, 2026. The episode addresses industry complacency and details critical steps manufacturers must take immediately.The episode debunks the myth that familiar quality documents like the DHF, DMR, and DHR are being eliminated. While the specific terms are removed from the regulation's language, their substance is retained and mapped to new, ISO-aligned conceptual requirements: the Device Master Record (DMR) becomes the Medical Device File (MDF), the Design History File (DHF) becomes the Design and Development File (DDP), and the Device History Record (DHR) is captured in the Batch or Lot Record. The host emphasizes that internal documents can retain the old terminology, provided a clear regulatory mapping is established.Crucially, compliance requires more than just an ISO 13485 certificate. Two major philosophical shifts must be addressed: the explicit requirement for integrating lifecycle risk management as the DNA of the entire QMS, and the loss of the audit privilege, which makes internal audit reports, supplier audit reports, and management review records inspectable regulatory evidence. Furthermore, manufacturers must comply with retained, US-specific requirements under the QMSR's prevalence rule, especially concerning mandatory record content (§ 820.35) and specific labeling and packaging controls (§ 820.45).Key Timestamps[0:50] QMSR: The biggest shakeup to US quality requirements since 1996.[2:00] Effective Date: February 2, 2026—the clock is ticking.[2:42] The Goal: Harmonization with ISO 13485:2016 to reduce redundancy for global manufacturers.[3:50] Myth 1 Busted: The FDA is eliminating the DHF, DMR, and DHR (Documentation Dissolution).[5:10] Terminology Shift: DMR > Medical Device File (MDF, ISO 13485 Clause 4.2.3).[6:30] Terminology Shift: DHF > Design and Development File (DDP, ISO 13485 Clause 7.3.10).[7:40] Terminology Shift: DHR > Batch or Lot Record (ISO 13485 Clause 7.5.1).[8:40] The Practical Takeaway: Internal naming is fine, but regulatory mapping is mandatory.[10:30] Critical Shift 1: Risk Management is the DNA of the QMS—Explicitly required across all clauses.[13:00] Critical Shift 2: Loss of the Audit Privilege—Internal audit and management review records are now inspectable.[17:00] Critical Shift 3: Retained FDA Specifications (Prevalence Rule).[17:35] Retained Req. A: Mandatory Record Keeping Content (21 CFR Part 820.35)—UDI/UPC in complaint/service records.[19:00] Retained Req. B: Extended Record Retention Period (Device life, no less than two years).[20:10] Retained Req. C: Specific Labeling and Packaging Controls (21 CFR Part 820.45)—Inspection for accuracy.[22:00] Immediate Action Plan: Gap analysis and restructuring to the new terminology.Quotes"Your internal audit reports, your management review minutes, if you were expecting to keep those shielded from any outside eyes, they are now inspectable regulatory evidence." - Etienne NicholsTakeawaysMandatory Regulatory Mapping: Manufacturers must conduct a thorough mapping exercise to ensure their existing DMR, DHF, and DHR content fulfills the new requirements of the Medical Device File (MDF), Design and Development File (DDP), and Batch/Lot Records, respectively.Embed Lifecycle Risk Management: The QMSR requires a holistic, lifecycle approach to risk management, making it an explicit core component of all QMS clauses (e.g., supplier controls, design and development), moving beyond isolated, perfunctory steps.Prepare for Full Documentation Exposure (Regulatory): Recognize that the former privilege is gone; internal audit reports, supplier audit reports, and management review records are now subject to routine FDA inspection. Draft these documents with the utmost rigor and awareness of their new status as regulatory evidence.Confirm Compliance with FDA Retained Sections: ISO 13485 certification is not enough. You must address the US-specific requirements retained under the prevalence rule, particularly the mandatory inclusion of UDI/UPC in complaint records (§ 820.35) and the strict labeling/packaging inspection controls (§ 820.45).Transition is Immediate: The compliance date of February 2, 2026, is a hard deadline. Proactive gap analysis, process restructuring, and staff training based on the QMSR's requirements and the FDA's preamble are essential for uninterrupted market access.ReferencesISO 13485:2016: The international Quality Management System standard for medical devices incorporated by reference into the QMSR.21 CFR Part 820 (New QMSR): The revised Code of Federal Regulations that replaces the QSR, incorporating ISO 13485 and retaining US-specific supplemental provisions.21 CFR Part 820.35 (Control of Records): Retained section requiring specific content, like UDI/UPC, for complaint and service records.21 CFR Part 820.45 (Device Labeling and Packaging Controls): Retained section requiring documented procedures for inspecting labeling and packaging accuracy.QMSR Preamble: The FDA's detailed commentary and response to comments, which is crucial for understanding the Agency's interpretive thinking behind the new rule.Etienne Nichols' LinkedIn: https://www.linkedin.com/in/etienne-nichols/MedTech 101 SectionWhat is the "Prevalence Rule"?The Prevalence Rule is a key concept in the new Quality Management System Regulation (QMSR) that clarifies which set of rules takes priority. Since the FDA is incorporating the international standard ISO 13485:2016 by reference, a conflict could arise between the ISO standard and existing U.S. law. The Prevalence Rule dictates that in any area of conflict, the U.S. Federal Food, Drug, and Cosmetic Act (FD&C Act) and its implementing regulations (like those retained in 21 CFR Part 820) will always supersede the ISO 13485 requirement. Think of it like a recipe: ISO 13485 is the main set of instructions, but the retained 21 CFR sections are non-negotiable, mandatory additions or modifications that must be followed regardless of what the main instructions say. This is why mere ISO certification does not guarantee QMSR compliance.SponsorsThis episode is brought to you by Greenlight Guru. As the medical device industry faces the significant shift to the QMSR, your QMS needs to be audit-ready and easy to update. Greenlight Guru offers an all-in-one MedTech lifecycle excellence platform with specialized QMS and EDC solutions. Our electronic Quality Management System (eQMS) is built to facilitate the traceability and document control necessary to manage the new ISO-aligned terminology and retained FDA...

This episode tackles the complex challenge of applying the hardware-centric clauses of ISO 13485 to Software as a Medical Device (SaMD). Adnan Ashfaq, founder of Simply Medica, joins Etienne Nichols to dissect how traditional standards intended for physical manufacturing must be creatively interpreted for the virtual world of software development, where apps update weekly and cloud-based systems evolve in real-time. The conversation zeroes in on the often-muddy areas of production and service provision (Clause 7.5), emphasizing that these clauses are far from non-applicable, requiring a "virtual manufacturing space" mindset.A significant focus is placed on the Software of Unknown Provenance (SOUP), treating these building blocks as purchased components that require robust supplier evaluation and validation, bridging Clause 7.5 (production) with Clause 7.4 (purchasing). The discussion extends to crucial concepts like the Software Bill of Materials (SBoM), the complexity of Agile vs. Waterfall approaches within the standard's framework, and the essential role of the new FDA Computer Software Assurance (CSA) guidance in risk assessment.Beyond production, the experts explore the application of resource management (Clause 6), specifically addressing infrastructure, contamination control (malware/ransomware), and the critical need for a well-documented Design Transfer to Production (Clause 7.3.8) evidenced by a complete software release package, including all 62304 requirements. The episode provides actionable insights for quality and compliance professionals struggling to maintain speed and innovation while strictly adhering to regulatory requirements.Key Timestamps01:45 - The changing landscape: Why traditional MedTech rules struggle with modern software updates.03:50 - Historical context of ISO 13485 and its non-distinction between hardware/software.05:05 - Starting Point: Clause 7.5 (Production and Service Provision) and the "Virtual Manufacturing Space" concept.06:20 - Unpacking Software of Unknown Provenance (SOUP) and its link to Clause 7.4 (Purchasing).08:35 - The necessity of validating the development environment (GitHub/GitLab) and building blocks.11:10 - Applying Clause 4.1.6 (Software Validation) to SOUP items and master validation plans.12:20 - Applicable vs. Non-Applicable Clauses: Sterilization/Cleanliness vs. Installation.13:55 - Clause 4.2.3 (Medical Device File) for SaMD: E-labels, UDI, System Architecture, and SBoM.16:30 - Cybersecurity controls and the manufacturer's responsibility for identifying state-of-the-art standards.17:35 - Defining "Production" for continuously updating software and managing significant vs. non-significant changes.20:15 - Clash of Standards: Agile development, ISO 13485, and the missing documentation for version control risk assessment.21:30 - Clause 6.3 & 6.4 (Resource & Work Environment): Looking at data security, access controls, and contamination (malware/ransomware).24:45 - Clause 7.3.8 (Design Transfer to Production): The need for a formal software release package and the importance of the Software Design Trace Matrix.26:00 - The 16 essential documents needed to meet IEC 62304 requirements.27:10 - Production controls when the user influences the outcome (customizable features, disclaimers).Quotes"So my starting point really in this conversation is to cherry pick some of those clauses from ISO 13485, which are more akin to production. And then how do we then unpack that and apply it with medical device software in mind?" — Adnan Ashfaq"You've got to look at data corruption, you've got to look at unauthorized code, you've got to look at version controlling malware or ransomware, you've got to look at that as well. That's all part of [contamination control, Clause 6.4.2]." — Adnan AshfaqTakeawaysAdopt a "Virtual Manufacturing Space" Mindset: Treat your development environment (e.g., source control systems like GitHub/GitLab, compilers, cloud platforms) as a production floor that requires the same level of validation and control as a physical cleanroom or factory floor, satisfying ISO 13485 Clause 7.5.Validate SOUP as Purchased Products: Any Software of Unknown Provenance (SOUP) or open-source components must be treated as "purchased product" under Clause 7.4, requiring documented supplier verification, impact assessment, and validation (or documented rationale for non-validation) before integration into your SaMD.Contamination Control is Cybersecurity: ISO 13485 Clause 6.4.2, Contamination Control, must be applied to the digital sphere. This includes safeguards against malware, ransomware, unauthorized code, and data corruption, emphasizing the non-negotiable need for robust cybersecurity controls in your Quality Management System (QMS).Formalize the Software Bill of Materials (SBoM): The SBoM, detailing all software components, libraries, dependencies, and their version controls, is a key deliverable under Clause 4.2.3 (Medical Device File), acting as the digital equivalent of a Bill of Materials for Design Transfer to Production (Clause 7.3.8).Bridge Agile with Documentation: When using Agile development, ensure every iteration, bug fix, or patch includes a documented risk assessment (connecting to ISO 14971) and change history to satisfy ISO 13485’s traceability and control requirements, preventing potential non-conformances in audit.ReferencesEtienne Nichols' LinkedIn: linkedin.com/in/etiennenicholsISO 13485:2016 (specifically Clauses 7.5, 7.4, 4.2.3, 6.3, 6.4, 7.3.8)IEC 62304 (Medical device software – Software life cycle processes)FDA Computer Software Assurance (CSA) Guidance: The new guidance replacing older process validation guidance, focusing on a risk-based approach (High Risk vs. Low Risk) for validating software tools.AAMI TIR 45 (Guidance on the use of agile practices in the development of medical device software)MedTech 101 SectionSoftware of Unknown Provenance (SOUP)SOUP refers to software components that have been developed for purposes other than being part of the medical device, and for which the developer did not use a medical device quality management system (QMS) process. In simple terms, it's off-the-shelf software (like an open-source library, a commercial operating system, or a third-party module) that you integrate into your SaMD.Analogy: If you are building a custom, high-end car (your medical device), the engine block (the SaMD code) is custom-made. However, you decide to use commercially available tires, a standard battery, and a third-party GPS system (the SOUP items). While convenient, you can't be 100% sure how those other developers built them. To use them in your regulated medical product, you must perform your own testing and validation (verification) on the SOUP components to ensure they work reliably and safely within your device's specific intended use, treating them as if you purchased them from an outside supplier under Clause 7.4.Feedback Call-to-ActionWe thrive on your expertise and insights. If you have questions about applying ISO 13485 to your specific SaMD project, or if you'd like to suggest a topic for a future deep-dive, please send us an email. We read every message and offer personalized responses to help you navigate the complexities of MedTech compliance.Contact us at: podcast@greenlight.guruSponsorsThis episode discussing the critical balance of innovation and compliance in SaMD is brought to you by Greenlight Guru. In a world where software updates are weekly, using antiquated paper-based or general-purpose QMS systems is a compliance risk. Greenlight Guru offers MedTech-specific solutions, including a leading QMS platform and an advanced EDC solution, that are designed to handle the complexity of modern device development, like seamless traceability for your Software Bill of Materials and automated audit trails, ensuring you stay compliant with standards like ISO 13485 and IEC 62304.