When a company buys and uses software that is off the shelf software, like the Windows operating system there is still some responsibility to the developer to check that the software works as it is supposed to work. With other pieces of software, say the National Instruments – LabView that is incorporated into more medical devices, National Instruments as a company does not validate the software.
This is the responsibility of the integrator since National Instruments essentially provides the tools and is not in the business of building a validated medical system.
FDA does provide some guidance as to how to use the off the shelf software and the process is relatively simple for software that is peripheral and not directly involved in the decision making process. (http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/GuidanceDocuments/ucm073778.htm). FDA does regulate the design of the medical device very carefully in the document shown in the link below, which is inclusive of software but is more general.
However, with software essentially it comes down to :
- Establish in advance of activities, what you are going to do
- Do what you say you are going to do
- Be able to provide documents or evidence that you did what you were supposed to do.
The general principles can be found here,
(http://www.fda.gov/medicaldevices/deviceregulationandguidance/guidancedocuments/ucm085281.htm) but there is significant steps that go into making the software that is beyond just coding the framework.