October 2026 Newsletter – Does your quality system restrict best practices for software development?
Medical Device Software Development for Innovation and Compliance
Many companies struggle with medical device software development. Why is that? I think the main reason is that our quality systems were originally written and focused on hardware development and manufacturing. Where they mentioned software, it was typically assuming the embedded software of the 1990s. Software technology and software development methods have changed enormously over the past 30 years but our quality system procedures have not and this creates friction and conflict for product teams developing new software-intensive medical devices. The answer isn’t to return to developing software the way we did in the 1990s; the answer is to adapt quality system procedures and tools to fit the needs of modern software teams.
Medical device software is never really finished
That adaptation means the procedures and tools need to support development of medical devices that:
- change frequently during development,
- continue to evolve after initial product launch with new features and enhancements to existing features,
- require regular maintenance patches and cybersecurity patches.
The best practices for developing and supporting software-intensive medical devices are well-established. The secret is to make sure our quality system procedures and tools support these best practices and don’t conflict with them.
Does your quality system restrict best practices for software development?
If you’re seeing repeated problems with software development and compliance, don’t assume the blame is with the software engineers–the root cause may be your quality system. The QMS may have been designed around a linear, once-through approach to product development that conflicts with highly iterative software development and frequent post-market changes. Fixing that mismatch involves re-examining the Software Development Life Cycle (SDLC) and other aspects of design controls, risk management (see webinar below), change management, and release management to align with best practices for software development.
Contact us if you’d like advice on making your quality system more flexible and efficient for supporting rapid, innovative software development.
Webinar: From Static to Dynamic: Rethinking Risk Management for Connected Medical Devices
Traditional risk management wasn’t built for today’s software-intensive, connected medical devices. Join our panel discussion for a candid conversation on what dynamic risk management actually looks like in practice. Our panel will unpack why platform-based approaches are replacing static, document-driven processes and what increased FDA scrutiny under QMSR means for your risk files.
Date: Thursday, November 5th, 2026 at 10:00AM ET
Panelists: Aaron Joseph, Ben Higgitt, and Joe Sitomer
RSVP: https://cognition.us/events/
International MedTech Safety Conference
Last June I attended the International Medtech Safety Conference here in Boston. This is a small, focused conference that brings together experts from around the world to discuss best practices for medical device risk management and ways to improve patient safety. Naveen Agarwal put together a nice summary of the conference here:
For me it was a great learning experience and I’m looking forward to attending next year’s conference in Dublin, Ireland.
https://www.medsafety.net/programoverview
FDA QMSR
For a good, practical overview of this new FDA audit approach and what it means for your company, I recommend this article by Etienne Nichols of Greenlight Guru:
https://www.greenlight.guru/blog/what-fda-investigators-will-look-for-under-qmsr
For a deeper dive into the relationship of risk management and quality system processes, take a look at this article by Edwin Bills and Christie Johnson in MedDevice Online, which includes a nice diagram of the intersection of ISO 13485 and ISO 14971:
https://www.meddeviceonline.com/doc/the-intersection-of-iso-and-iso-under-the-proposed-fda-qmsr-0001
Upcoming Events
Free webinar: “Risk management vs. the risk based approach: which keeps the armadillo off the production floor?” by Peter Sebelius, founder of MedicalDeviceHQ and member of the technical committees that have authored the latest versions of ISO 13485, ISO 14971 and ISO 19011 standards.
Thursday, Oct 29th, 2026, 11:00 AM Eastern Time
https://us02web.zoom.us/webinar/register/6317907898088/WN_5tyYnTWwR56w-3nIlgQCfg#/registration