Cloud Computing & Validation: 6 Key Recommendations

Randy Horton

Published on: April 1st, 2022

2026 Update: This article was originally published in 2022 as part of our series on cloud computing and the validated state, based on work surrounding AAMI CR510:2021. In 2026, AAMI published TIR115:2026, Guidance for the appropriate use of public cloud computing to enable medical device functions, which supersedes CR510 and provides expanded guidance for medical devices that rely on public cloud computing. Learn more about AAMI TIR115.

This is the second article in our three-part series on the Validated State. The series explores ideas originally presented by Randy Horton, Bernhard Kappe and Pat Baird of Philips through their work on cloud computing, validation and medical devices.

Read the full series:

Introduction

Cloud validation for SaMD is an essential part of modern software development. Though MedTech has been slow to adopt the cloud compared to other industries, the benefits that cloud computing provides to any industry’s software products are numerous. The cloud’s on-demand service scales across remotely accessed computers, so as demand increases, computing power increases without driving up costs. The flexibility of the cloud allows software to be updated and deployed at a rapid pace. And firms of any size can use it, bypassing the need for in-house, self-maintained (and costly) servers and data centers.

Third-party cloud providers are constantly reinvesting their profits and effort into improving what makes the cloud so valuable, to the benefit of their user base. But this persistent improvement is a double-edged sword for the MedTech industry. When a developer places their software on the cloud, they are giving up some amount of control of their software to the third-party provider. The environment in which their software runs is subject to updates, rollbacks and changes that providers can make on their schedule, as they constantly improve the security and enhance the functionality of their systems. MedTech developers running software with safety concerns can’t assume they’ll be notified of updates ahead of time – or that they’ll recognize a change after it’s been made.

Relinquishing control can be a frightening prospect for the MedTech industry because it challenges the long-held paradigm of software validation. When medical device software and quality systems are validated, developers are confident they are running as intended, according to industry standards and in line with assurances made to the FDA.

Cloud providers can change the environment on a dime. We don’t have that flexibility; our changes have to be managed according to industry protocols. And when changes to the cloud introduce a bug or compromise our data, we’re in a unique position of potentially doing harm to the patients, clinicians and providers that use and prescribe our software. Software as a Medical Device (SaMD) is not going to achieve everything it could for improving patient outcomes if we cannot get past this issue. We need to find the sweet spot of taking advantage of the obvious benefits of cloud technology while mitigating risks.

At Orthogonal, we’ve pioneered the adoption of modern software development techniques in our industry. We’re pro-cloud – generally and for medical devices. In addition to over a decade of working on medical devices, our legacy includes developing cloud-based software within a year of the introduction of Amazon’s pioneering AWS. That’s why we, along with a team of industry experts, formed an AAMI Consensus Report Task Group to tackle this issue.

AAMI CR510:2021 explored how medical device manufacturers could responsibly use public cloud computing while maintaining appropriate levels of safety, effectiveness and regulatory compliance.

One of the central challenges was validation.

A traditional approach to validation assumes that the system and its operating environment remain sufficiently controlled between planned changes. Public cloud environments do not always work that way. Cloud service providers may make frequent changes that manufacturers cannot directly approve, prevent or evaluate before deployment.

At the time, the Task Group described this challenge through the idea of an “intermittently validated state,” where validation is periodically examined and confirmed using a risk-based approach.

The underlying questions remain important:

What changes can occur between evaluations? How likely is a change to affect device safety or effectiveness? How will the manufacturer detect an impact? How quickly can the issue be addressed?

CR510 approached these questions through six key recommendations.

Six Key Recommendations

CR510 centered on six key recommendations for responsibly using public cloud computing to support the operation of a medical device:

Identify the intended function of the cloud computing resources within your product or service, including the impact of product and process areas.
Apply a risk-based approach to determine whether the cloud computing resources are a good fit for your product or process.
Identify the typical frequency of updates to the cloud computing resources, in order to determine a strategy and criteria for revalidating that is sustainable but also ensures enough control. The frequency depends on the risk and the immediacy of any harm that could happen.
Assess the vendor and its processes with a level of scrutiny that is proportional to the ability of the vendor to adversely impact your product and processes via the cloud computing resources.
Establish a plan in case an update adversely affects the software. That might include things like temporary failback: a process to return the software to a validated state while accommodating the change in the public cloud platform, and includes post-incident analysis to improve the future resiliency of the software.
Develop a supplier monitoring process for promptly detecting an update and verifying whether your system has been adversely impacted after.

These recommendations do not exist in a vacuum. They build on, but do not replace, existing industry practices and standards such as ISO/IEC 62304, ISO 13485 and 14971. As we continue to support and develop industry standards, Orthogonal and partners at AAMI will align our cloud guidance so they are consistent with the existing practices and standards.

AAMI/FDA/BSI International Conference on Medical Device Standards

After the annual AAMI/FDA/BSI International Conference on Medical Device Standards on October 18th–19th, 2022, Orthogonal’s Randy Horton, Chief Solutions Officer, and Philip’s Pat Baird, Regulatory Head of Global Software Standards were invited to the AAMI Studio for a conversation with Robert Burroughs, Chief Learning and Development Officer, and Joseph Lewelling, Senior Advisor, Strategy and Content. You can watch the recording of their conversation in the following video:

From CR510 to TIR115

The work did not end with CR510.

Randy Horton of Orthogonal and Pat Baird of Philips continued as co-chairs of the AAMI Cloud Computing Working Group, with Orthogonal Founder and CEO Bernhard Kappe also serving as a member.

In 2026, that work resulted in AAMI TIR115:2026, Guidance for the appropriate use of public cloud computing to enable medical device functions.

TIR115 supersedes CR510 and provides further guidance for designing, deploying, and maintaining medical devices in public cloud environments, including risk management, MDS/MDDE boundaries, cloud supplier management, architecture, testing, and postmarket monitoring.

Read our TIR115 announcement

More Resources on Cloud Computing and the Validated State

To continue exploring these topics:

Authors

Bernhard Kappe, CEO and Founder

Randy Horton, VP of Solutions & Partnerships

Pat Baird, Head of Global Software Standards, Philips

Reference

1. To get the full report, you must either purchase it or license it through your organization's AAMI access.

Back to Insights