The hard part is not knowing what to do. It is having the mandate to do it before the pressure to ship takes over.
- Software item decomposition before any code. Map item boundaries and classify clinical risk before framework selection. Class A/B/C drives the verification burden for the lifetime of the product.
- Risk management as a design input, not a document. ISO 14971 hazard analysis runs before architecture decisions. Network boundaries, failover patterns and auth design are identified as risk controls before implementation.
- Every vendor onboarded as SOUP from day one. Version-pinned and assessed, and formally qualified under ISO 13485 clause 7.4 before contracts are signed, not after the first audit finding.
- Independent observability from sprint one. Structured logging, CloudTrail and clinical anomaly alerting. Observability is CAPA infrastructure: you can't close the loop on a problem you can't detect.
- Architecture decisions documented when made. Written down while the context is clear and the people are in the room, not reconstructed 18 months later under audit pressure.
- CI/CD as change control infrastructure. Every deployment traceable, reviewable and approved. Manual deployments are a DHF gap. The pipeline is your change control process in executable form.
The most important decision in a SaMD project is not technical. It is deciding who owns the connection between engineering and regulatory obligations, before sprint one.
Seen this differently?
Questions, corrections and counterexamples are welcome.
