Medical Device Software Development — IEC 62304 Compliant, FDA Ready

SaMD (Software as a Medical Device) performs a medical function independently — for example, a mobile app that analyzes medical images to detect abnormalities. SiMD (Software in a Medical Device) is software that's part of a physical medical device — for example, firmware in an insulin pump. Both require IEC 62304 compliance. The key difference is regulatory: SaMD must demonstrate clinical validity on its own and follows its own regulatory pathway (FDA 510(k), De Novo, or PMA), while SiMD is submitted as part of the device it controls.

Medical device software development typically costs $80,000-$500,000+ depending on the software's safety classification, regulatory pathway, and complexity. A Class B companion app costs $80K-$150K. A Class B SaMD mobile app costs $120K-$250K. AI/ML diagnostic SaMD can cost $150K-$350K. The primary cost driver is documentation and compliance — typically 30-50% of total project cost for IEC 62304, ISO 14971, and FDA submission deliverables. Code development accounts for only 20-30% of total effort, unlike standard software projects.

The primary standards for medical device software are: IEC 62304 (software lifecycle process), ISO 14971 (risk management), IEC 62366 (usability engineering), ISO 13485 (quality management system), and FDA 21 CFR 820 (design controls — US). For cybersecurity, the FDA's pre-market cybersecurity guidance (2023) requires a Software Bill of Materials (SBOM) and vulnerability management plan. In Europe, the Medical Device Regulation (MDR) and CE marking requirements apply. For AI-based medical devices, the FDA's AI/ML SaMD framework adds requirements for algorithm validation and change management.

A Class B companion mobile app typically takes 4-7 months. A Class B SaMD product takes 5-9 months. Class C software (safety-critical) takes 8-14 months or longer. Timelines for medical device software development are longer than standard software because formal documentation, risk management, and verification/validation activities account for 50-60% of the total timeline. The FDA submission and review process adds additional time — a 510(k) review typically takes 3-6 months after submission.

A Software Bill of Materials (SBOM) is a complete inventory of every software component in your medical device — including open-source libraries, third-party SDKs, and their versions, licenses, and known vulnerabilities. The FDA began requiring SBOMs as part of pre-market submissions following the 2023 cybersecurity guidance. The purpose is to enable post-market vulnerability management — when a new CVE is discovered in a library (like Log4j), the FDA and device manufacturers can quickly determine which devices are affected. We generate SBOMs automatically as part of our CI/CD pipeline using tools like Syft and Grype.

Yes. While we're a software development company (not a regulatory affairs firm), our deliverables are structured specifically for regulatory submission. We produce the complete software documentation package — Design History File (DHF), requirements traceability matrix, risk management file (ISO 14971), V&V protocols and reports, and cybersecurity documentation — in the format that FDA reviewers and notified bodies expect. For 510(k) submissions, we support clients by preparing the software section of the submission. For CE marking under EU MDR, we produce the technical documentation required by notified bodies. We recommend clients also engage a dedicated regulatory affairs consultant for submission strategy — we handle the technical documentation.