What is the difference between Basic and Enhanced documentation level?

Enhanced applies when a failure or flaw of a device software function could present a hazardous situation with a probable risk of death or serious injury, assessed before risk controls. Basic applies otherwise. Enhanced adds the software design specification, complete configuration management and maintenance plans, and unit and integration test protocols and reports to the submission.

Does a Class III device always need Enhanced documentation?

FDA generally recommends Enhanced for Class III devices and for device constituents of combination products, but a sponsor can determine Basic applies if it provides a detailed rationale in the submission.

Does the software documentation level set the cybersecurity documentation?

No. Cybersecurity documentation scales with the cybersecurity risk assessed for the device, independent of the software documentation level.

Basic or Enhanced: how to pick your software documentation level

The 2023 software guidance replaced three levels of concern with two documentation levels. The choice turns on one question about failure, and it decides how much of your design file goes into the submission.

FDA's June 2023 guidance, "Content of Premarket Submissions for Device Software Functions," replaced the 2005 guidance and its three levels of concern with two documentation levels: Basic and Enhanced. The level sets the minimum software documentation FDA expects in a 510(k), De Novo or PMA that includes a device software function. Get it right early, because it decides whether your software design specification and your unit and integration test records go into the submission or stay in the design history file.

The one question

The guidance defines Enhanced Documentation as applying to "any premarket submission that includes device software function(s) where a failure or flaw of any device software function(s) could present a hazardous situation with a probable risk of death or serious injury, either to a patient, user of the device, or others in the environment of use." Basic applies when Enhanced does not.

Three details matter in that sentence. The risk is assessed before risk controls are applied, so you cannot mitigate your way to Basic. "Probable" is meant to exclude purely hypothetical risks. And you must consider all foreseeable hazards, including reasonably foreseeable misuse and the likelihood that functionality is compromised by inadequate cybersecurity.

Categories FDA steers to Enhanced

FDA recommends Enhanced Documentation for devices that test blood donations for transfusion-transmitted infections, determine donor and recipient compatibility, automated blood cell separators, and blood establishment computer software. It also generally recommends Enhanced for devices that are a constituent part of a combination product and for Class III devices. In those last two cases you can still argue for Basic, but the submission should carry a detailed rationale for why.

If you are unsure, the guidance points you to a Pre-Sub to get FDA's view on the level before you file.

What each level has to include

Both levels share most of the list. The differences are in three rows.

Both levels:

A documentation level evaluation: a statement of the level and the rationale, referencing the risk file and software description.
A software description covering significant features, functions, inputs, outputs and hardware platforms.
A risk management file: plan, assessment showing risks are mitigated, and report.
A software requirements specification with enough structure to trace to the other documents.
System and software architecture diagrams showing modules, layers, interfaces, data flow, and how users and external products interact with the software.
A software version history with dates, version numbers and changes relative to the previously tested version.
A list of unresolved software anomalies with an evaluation of each one's impact on safety and effectiveness.

Where Enhanced adds work:

Software design specification. Basic keeps it in the design history file. Enhanced submits it, with enough detail to show how the design implements every requirement and traces to the SRS.
Development, configuration management and maintenance. Basic wants a summary of the lifecycle plan and configuration management, or a Declaration of Conformity to IEC 62304 covering specific subclauses. Enhanced wants the complete configuration management and maintenance plans, or a broader IEC 62304 declaration.
Testing. Basic wants a summary of unit, integration and system testing plus the full system-level protocol and report. Enhanced adds the unit and integration level protocols and reports, with expected results, observed results and pass or fail.

A practical way to decide

Write the hazard analysis first, before controls, and ask for each software function what happens if it fails or is wrong. If any credible failure path ends in death or serious injury, you are Enhanced, and the unit and integration records you would have kept anyway now need to be submission-quality. If every path ends in inconvenience, delay that a clinician catches, or a minor injury, you are Basic. Either way, state the level and the reasoning in a short document at the front of the software section; reviewers read that page first.

Cybersecurity is assessed on its own scale. The cybersecurity guidance says its documentation scales with cybersecurity risk, "not on any other criteria or level of risk/concern established in a separate FDA guidance." A Basic documentation level device can still carry a full cybersecurity package.