Overview
ISO/TR 80002-2:2017 - Medical device software - Part 2: Validation of software for medical device quality systems - is a technical report published by ISO in collaboration with IEC. It provides guidance on the validation of process software used within medical device quality systems as described in ISO 13485. The report applies to software that automates or supports device design, testing, component acceptance, manufacturing, labelling, packaging, distribution, complaint handling and other quality-management activities. It explicitly does not apply to software that is itself a medical device or software that is a component of a medical device.
Key Topics
- Scope and applicability: Clarifies which types of process software fall under validation requirements (quality management system, production/service provision, monitoring and measurement).
- Definition of software validation: Interprets validation broadly as all activities that establish confidence the software is appropriate for its intended use.
- Risk-based approach: Emphasizes risk management as a primary driver for the level of validation rigor.
- Critical thinking: Promotes applying critical thinking to select appropriate confidence-building activities rather than one-size-fits-all testing.
- Toolbox of confidence-building activities: Describes various tools and lifecycle activities (annexes list tables of practical tools).
- Lifecycle model guidance: Covers lifecycle phases-determine scope, development (define/implement/test/deploy), maintenance, and retirement-and how to plan validation across these phases.
- Validation planning and documentation: Explains two planning elements: documentation rigor (driven by process risk) and tool selection (driven by software risk).
- Supporting material: Includes informative annexes on toolbox items, risk management, and example case studies.
Applications
ISO/TR 80002-2:2017 is practical guidance for validating software used in medical device quality systems:
- Validating QMS software (document control, CAPA workflows, training records).
- Validating production and service software (production control, acceptance testing).
- Validating monitoring and measurement systems used for compliance with ISO 13485.
The report helps determine “how much validation is enough,” which validation activities to choose, and how to document evidence in an auditable way.
Who should use this standard
- Medical device manufacturers (quality and regulatory teams)
- Software developers of process and enterprise tools intended for use in medical device QMS
- Quality engineers and validation specialists
- Regulators and auditors assessing compliance with ISO 13485
- Suppliers of off-the-shelf process software used by medical device organizations
Related standards
- ISO 13485 (quality management systems for medical devices) - referenced for requirements and context
- General risk and quality standards (ISO 9000 series) are used for terminology and concepts
Keywords: ISO TR 80002-2:2017, medical device software, software validation, ISO 13485, quality management system, risk-based validation, critical thinking.