Level of concern and documentation level: What the FDA wants to achieve with it

The FDA distinguishes between three so-called "Levels of Concern," which are very reminiscent of the safety classes of IEC 62304. However, some differences repeatedly lead to problems during inspections or 510(k) approvals.

Caution: Note that FDA published a draft of a new guidance document on 04/11/2021 that will supersede the Levels of Concern. You will learn more about this in Chapter 4.

1. Definition and determination of the level of concern

The FDA defines three levels of concern for classifying software:

• Minor: We believe the level of concern is Minor if failures or latent design flaws are unlikely to cause any injury to the patient or operator.
• Moderate: We believe the level of concern is Moderate if a failure or latent design flaw could directly result in minor injury to the patient or operator [...].
• Major: We believe the level of concern is Major if a failure or latent flaw could directly result in death or serious injury to the patient or operator [...]

In its guidance document Content of Premarket Submissions for Software Contained in Medical Devices, the FDA identifies these three classes and guides to help determine the Level of Concern.

For this purpose, the FDA has defined a decision tree and two lists of questions. The first list contains the following questions, among others:

• Is the software an accessory to a medical device with a "Major Level of Concern"?
• Can a software error (before risk control measures!) lead to a death or serious injury, for example, because the software controls a treatment or serves vital data monitoring in potentially life-threatening situations?

The Level of Concern is determined as soon as one can answer "yes" to one of the questions.

2. Level of concern: what consequences this classification has

Scope of the documentation to be submitted

The Level of Concern controls the amount of documentation to be submitted:

Off-the-Shelf Software

The level of concern also plays a decisive role for off-the-shelf software (OTSS): it regulates

• the scope of the documentation required for this (e.g., Basic Documentation, Special Documentation),
• whether and which risk-minimizing measures must be documented,
• whether an audit of the manufacturer is necessary, if applicable, and
• whether this component may be used at all.

As a manufacturer, you should be aware of and follow this FDA Off-the-Shelf Software Guidance.

3. Safety classification according to IEC 62304 vs. level of concern according to FDA

The levels of concern are reminiscent of the safety classification of software components in IEC 62304:2007:

• Class A: No injury or damage to health is possible
• Class B: No serious injury is possible
• Class C: Death or serious injury is possible

Does this make these two classifications equivalent? No!

1. The FDA classification specifies which documents must be submitted for approval, and the IEC 62304 classification defines which documents must be prepared.
   For the low classes, you can save yourself much work. On the other hand, for the FDA audit, the documentation for all components must be available. The fact that this is usually not done, especially for low-classified components, is another matter.
2. While Class A depends only on the severity, the Minor Level of Concern also considers the probability ("unlikely"). In this way, the FDA avoids the absurd discussion that even the most uncritical software can cause a great deal of damage in the most unlikely case and that all software, therefore, actually belongs to class C. The FDA aims to solve this problem by amendment to the safety class. IEC 62304 aims to solve this problem with the amendment to the safety class.

4. Changes: End of Level of Concern

On 04.11.2021, the FDA published a draft guidance document Content of Premarket Submissions for Device Software Functions. This document replaces the guidance document that introduced the Level of Concern.

This new guidance document distinguishes only two classes.

a) Determination of the classes

The FDA no longer defines three "Levels of Concern" but two "Documentation Classes."

1. Basic Documentation
2. Enhanced Documentation

The software requires "Enhanced Documentation" if at least one of the following conditions is met:

The product that contains the software or is the software,

1. is a combination product,
2. is used in transfusion medicine or organ donation (determination of organ donors and recipients),
3. falls into class III or
4. can lead to death or serious injury in the event of a fault.

On the fourth point, FDA refers to reasonably foreseeable risks.

b) Consequence of classification

Similar to the Level of Concern, the classification also affects the scope of the (software) documentation to be submitted:

The new requirements are very reminiscent of the previous moderate and major levels. This means that manufacturers cannot submit software documentation that only meets the very lax requirements of the minor level of concern.

c) Conclusion

The FDA makes substantial reference to IEC 62304 but no longer permits a Class A approach, at the latest with the new version of the guidance document. In addition, manufacturers should be aware that the amount of documentation to be submitted is independent of the amount of documentation produced.

Therefore, the Johner Institute fundamentally recommends manufacturers to work and document in conformity with the requirements of safety class C.