Integration of EU medical device regulatory requirements into a CI/CD pipeline

Abstract

Manufacture of medical device software is strictly controlled by the law in European Union region. The medical device regulations could be seen as cumbersome and difficult to incorporate into the manufacturing process of a software. The regulations introduce a rigid product life cycle process to medical device software products, which could be seen as counter-intuitive by the software industry. Meanwhile, the software industry has found DevOps culture and practices, such as process automation and delivery pipelines, which are utilized to improve the competitiveness and reliability of the software business.

This thesis tries to find a common ground between the European Union medical device regulatory requirements and modern software development practices. The European Union medical device regulatory framework is introduced, followed by a systematic document analysis of the standards IEC 62304 and IEC 82304-1 to identify applicable requirements for a CI/CD pipeline. As a result, a reference model for regulated CI/CD pipeline is introduced.

For practitioners, tools and activities were found, that could help to overcome some of the burdensome activities, required by the medical device regulations. Additionally, the benefits of integrating CI/CD pipeline into the medical device manufacturing process is examined, such as the possibility for early customer feedback.

For researchers, a document analysis based on the standards IEC 62304 and IEC 82304-1 is provided. Moreover, the proposed regulated CI/CD pipeline model can be expanded to cover more regulatory requirements. Finally, research topics related to medical device software manufacturing are discussed.