Company · How we work

How we work with medical device manufacturers.

Silurus Software works for medical device manufacturers as a work package with defined deliverables, or as a dedicated team or team extension inside the client's QMS. Work on existing software starts with a gap analysis.

Engagement models: Work package · Dedicated team · Team extension
Entry: Gap analysis, 3 weeks
Team size: Sized to the work
Contracting party: Silurus Software Kft., Budapest

Engagement models

Ways to contract the work.

Each one runs inside the manufacturer's ISO 13485 quality management system, and the split of tasks between the manufacturer and Silurus Software is written down before work starts.

Work package with defined deliverables

A fixed scope with deliverables, acceptance criteria and milestones in writing, delivered by a Silurus team with its own technical lead and project manager, quoted for the agreed scope.

Dedicated team with its own lead

A Silurus team with its own technical lead owns a workstream such as verification, DevOps or a platform module, for as long as the roadmap needs it.

Team extension

Engineers who join your own teams and work under your leads, procedures, tools and review workflow.

Gap analysis as the entry

Three weeks, one software system. Documents, code and process reviewed against IEC 62304:2006+A1:2015, with the FDA and EU MDR expectations for the software sections noted where they apply. Depth and exclusions are agreed in writing before the work starts, and the prioritised report is the basis for what comes next. P1 is a gap that blocks an audit or a submission, P4 an improvement without a compliance impact.

How a project starts

Assessment first, then a package or a team.

For existing software we start with the gap analysis, because the report sizes everything after it.

The report lists the gaps between documentation, code and process, prioritised from P1 to P4. From there the remediation or the next development phase is ordered as a work package with fixed deliverables, or handed to a dedicated team that works inside your QMS.

New development without existing software starts with a scoping call and a written proposal for a work package or a team. In every model the manufacturer makes the release decision, and Silurus supplies the evidence it rests on.

Responsibilities

Who is responsible for what.

Activity	Manufacturer	Silurus	What Silurus delivers
Legal manufacturer, intended use, device classification	A · R	C	Input on the IEC 62304 software safety class
Quality management system, procedures, design controls	A · R	I	Work under your procedures, trained on them before the first change
Person responsible for regulatory compliance (PRRC)	A · R	None
Software development plan	A	R	The plan, drafted for your approval
Software requirements, architecture, detailed design	A	R	SRS, architecture and design documents
Implementation, code review, unit verification	A	R	Source code, review records, unit tests
Software risk analysis within the ISO 14971 file	A	R	Software hazards and risk controls, entered in your risk management file
Verification protocols, their execution, test reports	A	R	Protocols, executed test runs and test reports
Traceability, SOUP list	A	R	Matrix and records in your document system
Cybersecurity documentation for FDA section 524B	A	R	SBOM, threat model and the postmarket vulnerability plan content, which the manufacturer submits
Clinical evaluation and clinical investigation	A · R	None
Technical documentation and submission to the notified body or FDA	A · R	C	The software sections and answers to reviewer questions on the software
Release decision	A · R	I	Release evidence: test reports, traceability, known anomalies
Post market surveillance and complaint handling	A · R	C	Root cause analysis of software problem reports

R responsible · A accountable · C consulted · I informed. The Silurus column applies to the work contracted in the order.

Contracting

Five things in every contract.

NDA first

A mutual NDA is signed before any specification, document or source code is exchanged.

Contracting party

Silurus Software Kft., registered in Budapest, Hungary, an EU company, awarded AAA creditworthiness by Dun & Bradstreet in 2025.

Framework and orders

Work runs under a framework agreement. Each work package or team period is a separate order with its scope, deliverables, duration and price in writing.

Commercial basis

Work packages and the gap analysis are quoted individually for the agreed scope. Dedicated teams are billed monthly on the effort in a statement both sides approve.

Rights to the results

Code and documents written for a client belong to the client once paid. When the engagement ends, we hand over the repositories, the documentation and the open items in a handover session.

Scope

When to call Silurus.

When to call Silurus

Software for a medical device under IEC 62304, EU MDR or FDA, from requirements to release
Existing software whose documentation is missing for a submission or an audit
An in house team that needs more engineers working inside its QMS
Verification, test automation and DevOps alongside a running development
Medical imaging, radiotherapy, DICOM and PACS integration
Embedded firmware and drivers for regulated devices

Entry package

IEC 62304 gap analysis, three weeks.

One software system, three weeks, a prioritised report. The same review we ran for a safety-critical surgical device's firmware in the case study below.

Price: Quoted after a first look at the code and the documents
Basis: One software system, scope and price agreed in writing before the work starts
Duration: Three weeks from kickoff to the report
Start: Within two weeks of the signed order
Team: A senior engineer for the device's technology and a regulatory specialist
From you: The software documentation as it exists, read access to the source code, the process documents and one contact for questions

Deliverables

Document review: SRS, SyRS, SDS and architecture against the IEC 62304 lifecycle
Code review of the software against its documented design
Process assessment against IEC 62304, with the FDA and EU MDR expectations for the software sections
Gap report: findings categorised and prioritised P1 to P4, with a remediation recommendation for each
A walkthrough of the report with your engineering and regulatory leads

The report is yours, also when your own team does the remediation. If you contract the remediation to us, it becomes a work package or a dedicated team with its own order.

FAQ

Questions buyers ask before they sign.

How much does a project cost?

Every engagement is priced individually. The gap analysis is quoted per software system after a first look at the code and the documents, work packages after the gap analysis or a scoping call. Dedicated teams are billed monthly on effort.

How fast can a project start?

The gap analysis starts within two weeks of the signed order and takes three weeks. The first engineers of a dedicated team can start within two to three weeks of signature.

Who is the legal manufacturer when Silurus writes the software?

You are. The manufacturer owns the intended use, the QMS, the PRRC role and the release decision. Silurus is responsible for the software lifecycle work contracted in the order and for the evidence it produces.

Do you execute the verification protocols, or only write them?

Both, when the order includes it. We write the protocols, run them, record the results and write the test reports, and you approve them under your procedures.

Will you take over an existing codebase that someone else wrote?

Yes. Two of our case studies started from existing code: a laboratory device refactored and validated in three months, and safety-critical surgical device firmware reviewed in a three week gap analysis. A takeover starts with the gap analysis, so both sides know the state of the code before a remediation is planned.

How do you work with our ISO 13485 QMS?

We develop medical device software inside our clients' ISO 13485 quality management systems, under their procedures and design controls. Our engineers specialise in ISO 13485 and IEC 62304, and we also advise manufacturers on their software processes, gap analyses and cybersecurity. The details are on the Quality and standards page.

Which language and time zone do you work in?

English and German, from Budapest in Central European Time, the same working day as the DACH region and the Benelux.

Related work and pages.

Client names are withheld unless the client has agreed to be named.

Case study

IEC 62304 gap analysis of safety-critical surgical device firmware

Documents, code and process reviewed against IEC 62304, FDA and MDR in three weeks, then the remediation.

Case study

Lab device refactoring and IEC 62304 documentation

Desktop application and firmware of a Dutch university medical centre's lab device made testable, with the IEC 62304 package, in three months.

Case study

Engineering capacity for a mission critical imaging platform

Eight engineers inside a European manufacturer's teams, IEC 62304, quarterly releases, over several years.

Dedicated engineering teams Retrospective IEC 62304 documentation Verification and validation Quality and standards FAQ

Talk to us

Not sure which model fits your project?

Tell us where the product is in its lifecycle. We will propose the engagement model and the first step.

Send your requirements Book a 30 minute technical call