Sign in
Layered regulatory documents for IEC 62304, ISO 14971, FDA and CE marking
Services · Regulatory consulting

Regulatory consulting for EU MDR and FDA submissions.

Manufacturers bringing a device to the EU or the US market need a clear route, a complete file and quick answers when the notified body (the independent organisation that certifies a device under the EU MDR) or the FDA asks questions. The regulatory specialists and FDA consultants of Silurus Software advise on the route, prepare the Pre-Submission, write and review the documentation and support the submission.

Book a 30 minute call Write to us
Markets
EU MDR · FDA
Standards
ISO 13485 · IEC 62304 · ISO 14971
First step
Gap analysis
Team
EU MDR regulatory specialists, FDA consultants
What we cover

Regulatory work from strategy to submission

01

Strategy and route

We propose the route for each market, the classification rationale under MDR Annex VIII, with Rule 11 and MDCG 2019-11 (guidance from the EU Medical Device Coordination Group) for software as a device and the other rules where the software is part of a hardware device, the FDA product code and regulation, the standards that apply and the order of the documents.

03

Quality management system

We advise on the QMS and bring templates for the software procedures and the IEC 62304 documents. For the US market the system is mapped to the FDA QMSR (21 CFR 820).

04

Technical documentation

Our regulatory specialists write the software related parts of the technical documentation under Annex II and III in your templates, including the GSPR (general safety and performance requirements of the EU MDR) checklist and the software parts of the clinical evaluation and the post market surveillance plan. Device level evidence such as biocompatibility, electrical safety or sterilisation stays with the manufacturer and its own specialists, as do the clinical evaluation strategy and the clinical evidence.

05

Software and cybersecurity documentation

Written together with our engineers under IEC 62304 and IEC 81001-5-1. For existing software, each document states which evidence existed, which was reconstructed and which was newly verified, and what cannot be shown is listed as a gap.

Retrospective IEC 62304 documentation →
06

Risk and usability files

ISO 14971 risk management and IEC 62366-1 usability files written or completed.

07

Independent review

A written list of findings with a priority for each, before the notified body or the FDA reads it. The reviewer did not write the documents under review. Whether the review covers the documents alone or also the evidence behind them is agreed before it starts.

IEC 62304 gap analysis →
08

Submission and questions

We assemble the submission and prepare the answers, consistent with the rest of the file.

In practice

Situations we are asked to solve

Situation

A device developed under the EU MDR, going to the FDA

A European manufacturer prepares a first 510(k) (the FDA premarket notification for a device similar to one already on the market). The software was developed under the MDR, and the team has not worked with the FDA before.

How we approach it

Our FDA consultants start with the route and the predicate, then a gap analysis (a review of what is missing against the standard) of the existing file against the FDA expectations, including the Basic or Enhanced documentation level, which follows the risk of the software function and is separate from the IEC 62304 safety class (A, B or C, by the harm a software failure could cause), and, for a cyber device under section 524B, the threat model (a structured analysis of how the device could be attacked), the SBOM (software bill of materials, the list of every software component in the build) and the plan for postmarket vulnerabilities. A Pre-Submission is prepared where the FDA's view is worth having before the submission. The missing documents are written and the eSTAR submission is assembled with your team.

Situation

CE marked AI software and the EU AI Act

AI based diagnostic software is CE marked under the MDR, and the obligations of the EU AI Act have to be added to the existing file.

How we approach it

We check whether the software is a high risk AI system under Article 6(1) of the EU AI Act. That applies when the AI system is the device or a safety component of a device and the MDR requires a notified body. The requirements for these systems apply from a later date than for other high risk systems, and we plan the work against the date that applies to your product. We then add the missing parts on risk management, data governance, logging, transparency, human oversight, accuracy and resilience to errors and faults to the same file. We extend the existing MDR quality system and check it against each AI Act requirement. Some requirements, such as data governance and accuracy, may need new evidence as well as new documents. Where a requirement changes the software or the process, that change is planned and made with your team as well.

Situation

A quality system without software procedures

A startup has an ISO 13485 quality system for its hardware, and no procedures for software development.

How we approach it

We bring templates for the software procedures and the IEC 62304 documents, fit them to the existing system and train the team, so the first software release already runs under them.

How it runs

From the first call to the submission

Step 1

First look and gap analysis

The intended route and the current file compared, with prioritised findings and a plan.

Step 2

Strategy

Route confirmed, classification rationale, standards and the documents in the order they are needed.

Step 3

Documentation

Written and reviewed in your templates. Where the FDA's view is worth having, the Pre-Submission comes before the documents that depend on it.

Step 4

Submission

The submission assembled, and the reviewer's questions answered.

EU and US

What we prepare for each market

European Union

EU MDR and CE marking

Technical documentation, software and risk documentation, and the answers to the notified body, written by our regulatory specialists.

United States

FDA 510(k) and De Novo

Pre-Submission, submission sections, software and cybersecurity documentation, and the answers to the FDA, prepared by our FDA consultants.

Technologies and standards

What we work with

Standards, regulations and practices

MDCG 2019-16FDA section 524BEU AI ActMDCG 2025-6EU MDRMDCG guidanceTechnical documentationCE markingFDA Pre-Submission (Q-Sub)eSTARFDA 510(k)FDA De NovoFDA QMSR (21 CFR 820)FDA guidance on premarket submissions for device software functionsFDA premarket cybersecurity guidanceISO 13485IEC 62304ISO 14971IEC 62366-1IEC 81001-5-1

Silurus Software

  • Silurus Software, founded in 2017, offices in Budapest, Hungary, and Singapore
  • More than 40 engineers, EU MDR regulatory specialists and FDA consultants
  • Work inside the client's ISO 13485 quality management system, with the split of tasks written down before the work starts. Where the client has no documented software process yet, we bring IEC 62304 templates for the client to adopt into its own system
  • Multi-year engineering partner of a European MedTech manufacturer
  • Founder and CTO Péter Török, in medical technology software since 1999, formerly software development director at Siemens Healthcare (syngo.via) and head of R&D at Mediso Medical Imaging Systems
  • ISO 9001:2015 (NQA, certificate 171041, valid until March 2027) and ISO/IEC 27001:2022 (NQA, certificate 728872, valid until August 2029)
  • Awarded AAA, Highest Creditworthiness, by Dun & Bradstreet in 2025
  • Research partner of ELTE Eötvös Loránd University, Budapest
  • Industrial partner of the University of Bologna, the University of Pisa, the University of Amsterdam and Masaryk University, Brno, in the EU Horizon Europe project LOGOS from 2027
  • Female Business Leader of the Year 2025 and The Pioneer Award 2026, awarded to CEO Dr. Linda Szántó
How we work →Quality and standards →Sample deliverables →Case studies →
Related

Related work and pages.

Client names are withheld unless the client has agreed to be named.

Case study

IEC 62304 gap analysis of safety-critical surgical device firmware

Two people reviewed a safety-critical surgical device's firmware, documents and process against IEC 62304, FDA and MDR in three weeks. The remediation was then contracted to Silurus Software.

Case study

Lab device refactoring and IEC 62304 documentation

Desktop application and firmware of a Dutch university medical centre's lab device refactored to be testable, with IEC 62304 documentation, in three months.

IEC 62304 gap analysisRetrospective IEC 62304 documentationVerification and validationMedical device cybersecurityMedTech startups
FAQ

Frequently asked questions

01

Can you prepare our FDA Pre-Submission?

Yes. Our FDA consultants prepare the package with the questions for the agency, prepare you for the meeting and follow up on the feedback. You submit the package as the manufacturer and decide how to use the FDA's feedback, which is not binding.

02

Can you write the technical documentation for CE marking?

Yes, the software related parts, in your templates and under your document control, with the software and risk documentation. Device level evidence such as biocompatibility or electrical safety stays with your specialists.

03

We plan the EU and the US market. Can one team cover both?

Yes. The documents are planned so that both routes use the same evidence where they can.

04

Can you review a file our own team wrote?

Yes. The review ends in a written list of findings with a priority for each.

05

How does it start, and what does it cost?

With a free call. The gap analysis or the first work package is quoted individually and agreed in writing.

06

Do you prepare the eSTAR submission?

Yes. Our FDA consultants assemble the submission in the FDA eSTAR template with your team and prepare the answers to the FDA's questions.

07

Do you also cover the EU AI Act for AI software?

Yes, for AI software that is a medical device and needs a notified body: the additions the AI Act asks for are written into the existing technical documentation.

08

Can you set up the software procedures of our QMS?

Yes. We bring templates for the software procedures and IEC 62304 documents and fit them to your ISO 13485 system.

Talk to us

Tell us about the device and the market.

The device, the market and where the file stands. Write a few lines, or book a free call.

Book a 30 minute technical call
We reply within one working day.