Medical device software compliance, explained for engineers: IEC 62304, MDR Rule 11, cybersecurity, ISO 14971.https://doxeva.com/en-UShttps://doxeva.com/en/blog/sbom-medical-device/https://doxeva.com/en/blog/sbom-medical-device/The SBOM went from best practice to legal requirement: FDA §524B, the Cyber Resilience Act, IEC 81001-5-1. What it must contain, the CycloneDX/SPDX formats, and how to generate and maintain it.Tue, 21 Jul 2026 00:00:00 GMThttps://doxeva.com/en/blog/technical-file-mdr-software/https://doxeva.com/en/blog/technical-file-mdr-software/MDR Annexes II and III applied to a SaMD: which sections, which artifacts, and the mistakes that stall an audit. The technical file structure a notified body expects.Tue, 21 Jul 2026 00:00:00 GMThttps://doxeva.com/en/blog/fda-524b-cybersecurity-plan/https://doxeva.com/en/blog/fda-524b-cybersecurity-plan/Section 524B of the FD&C Act: cyber device criteria, the 4 legal requirements (vulnerability plan, secure development, SBOM, patches), differences with the EU, and an 8-point checklist.Mon, 20 Jul 2026 00:00:00 GMThttps://doxeva.com/en/blog/iec-62304-docs-ci-cd-pipeline/https://doxeva.com/en/blog/iec-62304-docs-ci-cd-pipeline/Generating IEC 62304 documentation from the CI/CD pipeline: SOUP list from the SBOM, requirements-tests traceability, PR reviews, release notes. Concrete mapping and an example pipeline.Mon, 20 Jul 2026 00:00:00 GMThttps://doxeva.com/en/blog/iec-81001-5-1-where-to-start/https://doxeva.com/en/blog/iec-81001-5-1-where-to-start/A realistic 5-step IEC 81001-5-1 catch-up plan for existing code: SBOM, threat model, vulnerability management, security testing and documentation — without rewriting your product.Mon, 20 Jul 2026 00:00:00 GMThttps://doxeva.com/en/blog/mdr-rule-11-class-iia/https://doxeva.com/en/blog/mdr-rule-11-class-iia/Rule 11 of Annex VIII of the MDR explained for CTOs: decision tree, MDCG 2019-11 guidance, concrete consequences and edge cases. Why almost all SaMD is at least Class IIa.Mon, 20 Jul 2026 00:00:00 GMT