Brownfield Import Wizard
This page covers each step of the Brownfield Import wizard. To launch it, click Brownfield in the left sidebar, then click + Create Project on the Sessions page.
Before you begin
- Access to your source code repository (URL or downloadable archive).
- Existing design documents, project plans, and technical documentation, if any.
- Any available test reports, risk analyses, or regulatory submissions.
- Information about your CI/CD pipeline and build toolchain.
- The regulatory framework you are targeting (EU MDR, FDA, etc.) and your intended device classification.
Import Project
This step introduces the import process. Review the summary of what P4SaMD needs from you, the types of evidence it can ingest, and what the evaluation produces (the gap analysis). Click Get Started.
Use Case
Select the primary reason for your compliance assessment. The use case focuses the gap analysis on your situation.
| Use Case | Description | Select it when… |
|---|---|---|
| Regulatory Change | Evaluate impact of a standard version update on an existing compliant product. | Your product is certified under an earlier edition of ISO 14971 or IEC 62304 and you need to re-align to the current version (ISO 14971:2019/A11:2021 or IEC 62304:2006/AMD1:2015). |
| Add Regulation | Bring an existing product into scope of a new regulatory standard it was never assessed against. | Your product is compliant with one framework (e.g., IEC 62304) and you need to overlay an additional one (e.g., IEC 62366-1:2015) without changing the primary compliance target. |
| Delta Certification | Identify the compliance gap between your current evidence state and the requirements of a target certification. | You are preparing a first certification or re-certification dossier and want to know exactly what is missing or out-of-date before submission. |
| Change Region | Adapt compliance evidence for a new geographic market with different regulatory requirements. | You are entering a new market (e.g., adding a UK or US target alongside an existing EU MDR target) and need to identify what evidence is portable and what must be reworked. |
| Technical Update | Verify that updated or modernized legacy components remain compliant. | You are upgrading libraries, replacing legacy modules, or migrating technology stacks, and need to re-verify SOUP, architecture, and risk records. |
| Add Feature | Assess the compliance impact of new functional capabilities added to an existing product. | You are adding a new feature or module to a certified product and need to extend risk assessments, SRS, V&V records, and traceability to cover the new scope. The assessment covers the new module's compliance for use in a medical device. |
| Audit Preparation | Verify readiness for an upcoming regulatory audit without making product changes. | A Notified Body surveillance audit or an internal audit against EU MDR, IEC 62304, or FDA cybersecurity requirements is approaching and you want to identify open findings before the auditors do. |
| General | Run a broad compliance assessment without a specific change scenario. | None of the above precisely fits your situation, or you want an overview evaluation across all document categories. |
Custom is reserved for future use and is not available in the current release.
Click Next after selecting a use case.
Target Definition
Define the compliance target that P4SaMD will assess your project against. The regulatory framework, device class, safety classification, and intended use together determine which requirements are checked.
| Field | Description |
|---|---|
| Intended Use | Plain-language statement of the software's intended medical purpose |
| Regulatory Framework | IEC 62304 (software life cycle), ISO 14971 (risk management), IEC 62366-1 (usability engineering), EU MDR, EU AI Act, GDPR, NIS2, MDCG 2019-16, or US FDA (cybersecurity, SBOM, labeling and postmarket) |
| Software Safety Class | IEC 62304 classification: Class A, B, or C |
| Target Market Jurisdiction | Geographic markets where the device will be placed. Supported: EU (MDR (EU) 2017/745), US (FDA), UK (UKCA / UK MDR 2002). Selecting UK applies the same supported frameworks listed under Regulatory Framework above; there is no UK-specific rule content. See Regulatory Coverage for what each market covers. |
Technical Assets
Upload the technical artifacts that make up your software product. Assign an artifact category to each file: the category sets which part of the compliance lifecycle the file belongs to and what the evaluation checks against it. You do not need to cover every category. The more you provide, the more complete the evaluation.
| Category | What belongs here |
|---|---|
| Requirements | Requirements specifications, change control records |
| Design | Architecture descriptions, detailed design documents, database schemas |
| Risk Management | Risk analysis files, hazard logs, risk control measure records |
| Software Implementation | Source code archives, git repositories, SBOM / SOUP declarations |
| Verification | Unit, integration, and system test results; code review records |
| Configuration | CI/CD pipeline files, build manifests, infrastructure definitions, dependency lock files |
Supported upload formats: .zip, .tar.gz, .json, .yaml, .toml, .lock.
Documentation
Upload existing compliance documentation. Assign an artifact category to each document, as with technical assets. The category determines how the document is weighted in the gap analysis and which remediation tasks it can satisfy.
| Category | Document examples |
|---|---|
| Requirements | Software Requirements Specification, traceability matrices, change request records |
| Design | Software Design Specification, Architecture Description |
| Risk Management | Risk Management File, FMEA, Hazard Analysis, RCM records |
| Verification | Test Plans, Test Reports, Test Summary Reports |
| Configuration | SOPs, Work Instructions, development environment records |
| Requirements / Risk Management | Regulatory submissions (Technical File, FDA cybersecurity documentation, Declarations of Conformity) |
Supported file formats: PDF, Word (.docx), Markdown, plain text.
Summary & Submit
Review everything you have provided: the use case, target definition, uploaded technical assets, and uploaded documents. To correct anything, use the Back button to return to the relevant step.
Click Submit for Evaluation. P4SaMD begins processing your uploaded materials immediately.
After submission you are redirected to the Evaluation page. It shows the current processing status (Evaluating → Evaluated, or Failed if the evaluation could not complete) and a progress indicator for each analysis phase. Processing can take from a few minutes to several hours depending on the volume of content. The evaluation runs in the background, so you can leave the page and return later.
To pause before finishing the wizard, click Save as Draft in the wizard footer at any step. To resume, open the Brownfield section from the left sidebar and click Resume on your draft session card.
Where to go next