scope:

This Consensus Report (CR) provides a set of 6 key recommendations for assessing and managing risks associated with using public cloud computing resources for medical devices and medical device quality systems and includes guidance for implementing each recommendation. These recommendations are focused on utilization of 3rd party, cloud-based software as part of a medical device or a Quality Management System (QMS) and not on software developed by the device manufacturer itself.

This CR focuses specifically on the question of maintaining a validated state when part or all of a medical device (or QMS system) is operating on a 3rd party public cloud computing service. The question of a validated state is uniquely pressing given the rapid adoption of cloud computing to the operation of medical devices and QMS systems. There are other topics which, while pertinent to medical devices and public cloud services, are not so uniquely relevant and have been covered in other industry efforts (e.g., privacy and security) and are therefore out of the scope of this CR.

The recommendations made in this CR are intended to be additive guidance to existing medical device regulations and standards, providing clarity around the topic of validated state as it relates to public cloud computing. However, adoption and use of this guidance does not relieve a medical device manufacturer from complying with any applicable, existing regulations or standards.