Software as a medical device now has an inspection date

In medical technology, inspection deadlines are everyday business. The defibrillator has its safety inspection, the scale its metrological check, and every device carries a sticker. For software there was nothing like it. Since 1 August 2025 there is.

What Section 17 MPBetreibV requires

The German Medical Device Operator Ordinance was reissued in 2025. Its Section 17 sets out special duties for certain software: software as a medical device of classes IIb and III under the MDR and software as an in-vitro diagnostic of classes C and D. It contains three duties.

First, before operation: the manufacturer or a person authorised by it must have checked the proper installation and instructed a person appointed by the operator. The installation check may explicitly be carried out by remote access. And under paragraph 2, only instructed persons may use the software.

Second, in healthcare facilities, a recurring review. Paragraph 3 states that IT security reviews must be carried out at least every two years by the end of the month in which the software was installed or the last review took place. In German:

„Die IT-Sicherheitsüberprüfungen sind spätestens alle zwei Jahre mit Ablauf des Monats durchzuführen, in dem die Installation der Software erfolgte oder die letzte IT-Sicherheitsüberprüfung durchgeführt wurde.“

If defects are to be expected earlier, the review must take place earlier. And a report must be drawn up recording the date of the review and its results.

Third, who may review. Under paragraph 4, only persons, businesses or bodies that meet the requirements of Section 5 for exactly this review. In-house IT is not automatically excluded, but it must be able to demonstrate the qualification.

Under the transitional provision in Section 20(3), Section 17 has applied since 1 August 2025.

Why this concerns IT

Until now, medical technology was responsible for its devices and IT for its servers. Software as a medical device sits right in between: it runs on IT's servers and workstations, depends on its network, updates and user accounts, and is still subject to medical device rules. Who organises the review, who files the report and who keeps track of the next date has not yet been decided in many organisations.

• First the list. Which software in the organisation is a class IIb or III medical device? The answer is in the manufacturer's declaration of conformity, not in the users' gut feeling.
• Then the date. For each installation, the date from which the two years run, counted to the end of the month.
• Then the reviewer. Who meets the requirements of paragraph 4, internally or externally?
• And the instruction. Under Section 4(3), also after updates that change handling more than marginally.

How isidaten handles this

In the medical device operation module, the IT security review under Section 17 is a separate inspection type alongside safety and metrological checks. The deadline is calculated to the end of the month as in the ordinance, 24 months by default. A daily check reminds the responsible person during the lead time at most once a week and reports overdue reviews; if an external service provider is recorded, it receives the reminder too. The qualification as IT security reviewer under Section 17(4) is kept as a separate role, and a product's end of support can be linked to the associated IT system.

The test question

How many installations of class IIb and III medical device software are there in your organisation, and when is the next IT security review due for each?

If the first number is unknown, the second question is not yet on the table.

Sources

Medical Device Operator Ordinance (MPBetreibV) of 14 February 2025 (German), last amended on 31 October 2025, Section 4(3), Section 17 and Section 20(3), retrieved on 30.10.2026.