FDA software documentation: what a premarket submission actually needs

Standard & Framework · FDA Premarket Submission

FDA's June 2023 guidance, "Content of Premarket Submissions for Device Software Functions," decides Basic or Enhanced documentation for a 510(k), De Novo, or PMA submission from a documented risk assessment, and an Enhanced submission must trace each hazard analysis entry to its mitigation and verification evidence.

What software documentation does an FDA premarket submission need?

FDA's June 2023 guidance decides Basic or Enhanced documentation for a 510(k), De Novo, or PMA submission from a documented risk assessment. An Enhanced submission must trace each hazard analysis entry to its mitigation and verification evidence.

Submitting Basic-level documentation for a device that requires Enhanced is the fastest way to a deficiency letter.

Two documentation levels, one risk-based test

The 2023 guidance replaced the old "Level of Concern" (minor/moderate/ major) framework with a binary determination: Basic Documentation Level or Enhanced Documentation Level. A device requires Enhanced documentation if a software failure or latent flaw could result in death or serious injury — to the patient or the operator — either directly or by delaying care. If that test is met, Enhanced applies regardless of how mature or well-tested the manufacturer believes the software to be.

What each level requires

Artifact	Basic	Enhanced
Software Description	Required	Required, more detailed
Risk Management File summary	Summary	Full ISO 14971 file referenced, hazard-mitigation traceability shown
Software Requirements Specification	Summary-level	Complete, individually identified requirements
System/Architecture Design Chart	Not required	Required
Software Design Specification	Not required	Required for Class C-equivalent items
Traceability (requirement → hazard → test)	Not required	Required, explicit
Unresolved Anomalies list	Required	Required, with safety-impact classification per anomaly

A worked hazard analysis excerpt

Every Enhanced-level 510(k) or PMA submission needs traceability from a specific hazard to its mitigation to its verification evidence, recorded in the hazard analysis. A minimal worked row:

Hazard ID: HZ-014
Hazard: Delayed delivery of a critical alarm due to a software processing stall
Hazardous situation: Clinician not notified of a patient condition requiring
    immediate action within the specified alarm-latency bound
Severity: Serious injury (per ISO 14971 severity scale)
Mitigation: Watchdog timer forces alarm-subsystem restart within 2s of a
    detected stall; redundant alarm path via hardware-level buzzer
Verification: TEST-088 (fault-injection: forced processing stall, alarm
    latency measured against the 2s bound, n=30 runs, 0 failures)
Residual risk: Acceptable per risk-acceptability criteria in RMF-2026-03

Engineering reference only. Not formal regulatory counsel, not a determination of which documentation level applies to your device — that determination requires your own risk assessment under your quality system.

Artifact: hazard-analysis-excerpt.md

Generated client-side; no server round-trip, no account required.

# Hazard Analysis Excerpt (worked example, v1.0.0)

Engineering reference example only — one row of a Risk Management File per
ISO 14971. Not a substitute for a complete hazard analysis under your own
quality system.

| Field | Value |
|---|---|
| Hazard ID | HZ-014 |
| Hazard | Delayed delivery of a critical alarm due to a software processing stall |
| Hazardous situation | Clinician not notified of a patient condition requiring immediate action within the specified alarm-latency bound |
| Severity | Serious injury (ISO 14971 severity scale) |
| Probability (pre-mitigation) | Occasional |
| Mitigation | Watchdog timer forces alarm-subsystem restart within 2s of a detected stall; redundant alarm path via hardware-level buzzer |
| Verification | TEST-088 (fault-injection: forced processing stall, alarm latency measured against the 2s bound, n=30 runs, 0 failures) |
| Residual risk | Acceptable per risk-acceptability criteria in RMF-2026-03 |
| Traced software requirement | REQ-221 (alarm-subsystem watchdog behavior) |

Download hazard-analysis-excerpt.md

Useful next step

Run the IEC 62304 gap assessment

Related resources

Provenance & review state

Last reviewed

September 11, 2026

Sources

FDA Content of Premarket Submissions for Device Software Functions (2023) — U.S. Food and Drug Administration
ISO 14971:2019 — International Organization for Standardization
ISO 13485:2016 §7.3 (former 21 CFR §820.30, replaced under the QMSR) — International Organization for Standardization
Former FDA 21 CFR §820.30 (in force until February 2, 2026) — U.S. Food and Drug Administration

Ingested from