IVDR Software Compliance for Diagnostic Labs

Sandorian designs and delivers the traceable, audit-ready software layer that diagnostic labs operating under EU 2017/746 depend on. That means intake workflows, documentation pipelines, audit trails, and in-house device controls - engineered to IVDR, IEC 62304, ISO 15189, and ISO 27001, built around your existing LIMS rather than replacing it.

What IVDR software compliance engineering actually involves

Software as a regulated component under EU 2017/746

If your lab runs software that drives clinical decisions - controlling an instrument, processing sample data, or generating diagnostic reports - that software falls within the regulated scope of EU 2017/746, the In Vitro Diagnostic Regulation. The regulation treats software as a potential in vitro diagnostic device in its own right, or as a component of one. Either way, the engineering obligations are specific: traceability from input to result, documented version history, controlled change management, and a defensible audit trail.

Software engineering and regulatory advice are distinct disciplines. Sandorian engineers the software; your regulatory advisers and notified body make conformity decisions.

The IEC 62304 software lifecycle in a diagnostic lab context

IEC 62304 sets the software lifecycle requirements for medical device software - covering planning, requirements, architecture, detailed design, unit implementation, integration, testing, and maintenance. Applied to bespoke custom lab software, it demands that every requirement traces to a test, every change is documented, and software of unknown provenance (SOUP) is identified and risk-assessed before integration.

In practice, this shapes how Sandorian structures every sprint. Requirements link to risk classification items, and handover documentation includes a design history file ready for review.

Where technical documentation, audit trails, and version control meet

Technical documentation under IVDR is not a PDF assembled after development finishes. It is a living record that begins with requirements and grows through every design decision, test result, and change event. Audit trails make that record defensible: an immutable, timestamped log of every data entry, modification, and access event. Version control - applied to methods, SOPs, and software code alike - ties each result back to the exact configuration that produced it. These three elements form the engineering backbone of audit-ready lab software.

The problem diagnostic labs face without compliance-built software

Manual processes, scattered records, and audit exposure

Most diagnostic labs did not build their current software stack with IVDR traceability in mind. A LIMS handles sample registration, spreadsheets manage instrument results, and paper forms capture analyst sign-offs. At audit time, reconstructing the chain from patient sample to issued report across three disconnected systems is slow, error-prone, and exposes the lab to findings. The problem is not the LIMS - it is the gaps around it.

The in-house device (Article 5(5)) software gap

Article 5(5) of EU 2017/746 permits health institutions to manufacture and use in vitro diagnostic devices in-house, provided they meet a defined set of conditions. One of those conditions is maintaining technical documentation sufficient to demonstrate that the device meets the regulation's general safety and performance requirements. For any lab running in-house devices - whether that is a custom PCR panel, a proprietary algorithm, or a validated in-house assay - the software that supports, controls, or documents that device carries its own documentation obligations. This is the gap most engineering pages never address.

What breaks when software was not built for traceability from the start

Retrofitting traceability onto finished software is fundamentally different from building it in from the first commit. Retrofit approaches typically bolt an audit log onto an existing database schema - but if that schema was not designed to record actor, timestamp, before-value, and after-value for every state change, the log is incomplete by definition. The same applies to version control: tagging releases after development does not recover the requirement-to-test traceability that IEC 62304 expects. Lab data integrity (ALCOA+) principles - Attributable, Legible, Contemporaneous, Original, Accurate, plus Complete, Consistent, Enduring, and Available - cannot be enforced retroactively on a system that was not designed around them.

What Sandorian builds for IVDR-regulated labs

Here is the concrete engineering scope - the actual deliverables Sandorian produces for diagnostic labs operating under IVDR.

Traceable intake and sample registration workflows

Intake is where traceability either starts or breaks. Sandorian builds structured intake workflows that capture sample identity, chain of custody, requested analyses, and requesting entity in a single atomic record - linked from arrival through to result release. Every step carries an actor identifier and a timestamp.

Technical documentation and performance evaluation support tooling

Performance evaluation under IVDR requires labs to demonstrate, through documented evidence, that a device performs as claimed across its intended use population. Sandorian builds documentation generation pipelines that pull structured data from assay records, validation runs, and method versions into formatted evidence packages - cutting the manual assembly work that typically consumes QA teams before a notified body review.

In-house device software controls and UDI-adjacent record management

For labs operating under Article 5(5), Sandorian builds device-specific record structures: a design history file, a risk file, version-controlled method records, and the traceability matrix linking requirements to test evidence. Where UDI-adjacent record management is needed - tracking device identifiers, configurations, and batch records - this is built into the same data model, not managed separately.

Post-market surveillance data collection and reporting

Post-market surveillance is an ongoing obligation under IVDR, not a one-time exercise. Sandorian builds the data collection hooks - result trend monitoring, complaint intake, field safety event flagging - and the reporting structures that feed your post-market surveillance plan. This includes CAPA workflow integration so deviations trigger structured investigation and closure records automatically.

LIMS integration and augmentation, not replacement

Most labs that approach us have a functioning LIMS. The answer is never to replace it. LIMS integration and instrument middleware is the Sandorian model: we scope what your LIMS already covers, then build the compliance layer around it - intake workflows, documentation tooling, reporting portals, and instrument middleware your LIMS vendor never intended to deliver. The LIMS keeps doing what it does well; the surrounding layer makes the whole stack audit-ready.

Capability checklist - what Sandorian delivers:

  • Audit trail with immutable log schema (actor, timestamp, before/after values)
  • Version-controlled method and SOP records with full change history
  • eIDAS-sealed reporting and certificate portals for issued results
  • Structured documentation generation workflows for technical files and performance evaluation packages
  • Instrument and LIMS integration middleware for end-to-end data flow
  • Role-based access controls aligned to ISO 27001 access management requirements

Book a scoping call with a Sandorian engineer - map your IVDR software gaps in one session.

How Sandorian embeds compliance into the software delivery

Requirements-first: engineering against what your regulatory advisers define

A five-step process diagram showing how Sandorian delivers IVDR-regulated software from requirements through to a handover package.

Sandorian does not interpret IVDR or advise on conformity. We take the requirements your regulatory advisers produce and engineer software that meets them - with the traceability evidence to prove it. This separation is a feature, not a limitation. It keeps each discipline accountable and gives your notified body a clean audit trail of who decided what, and who built what.

IEC 62304 practices applied from the first sprint

Every Sandorian engagement for a regulated lab applies IEC 62304 software lifecycle practices: software safety classification at the outset, requirements documented before design begins, risk controls identified before code is written, and test evidence recorded against each requirement. Change management follows the same structure - every post-release change goes through impact assessment, retesting, and documentation update before deployment.

The delivery flow runs: requirements and risk classification > architecture and detailed design > sprint delivery with test records > validation documentation > handover package including design history file and traceability matrix.

Change management, traceability matrices, and handover documentation

At project close, the lab receives a handover package that includes the full traceability matrix (requirement > design > test > result), the design history file, the risk file, SOUP inventory, and validation summary. This is the documentation your quality team and notified body will review. Sandorian produces it as a byproduct of how the project runs - not as a documentation effort bolted on at the end. You can explore building regulated software for IVD laboratories in more depth in our knowledge base.

Security and data integrity under ISO 27001 and IVDR

Data integrity as an engineering control, not an afterthought

IVDR requires that data supporting a diagnostic result is attributable, legible, contemporaneous, original, and accurate - the ALCOA+ framework familiar to regulated industries. Achieving this in software means database schemas that record state changes atomically, application layers that enforce write-once semantics on result records, and access controls that prevent unauthorised modification. These are engineering decisions, not policy decisions.

ISO 27001 access management and audit log standards in lab software

ISO 27001 information security management controls map directly onto the access management and audit logging requirements that IVDR data integrity demands. Sandorian builds role-based access control structures aligned to ISO 27001 Annex A controls: least-privilege access, user provisioning workflows, access review schedules, and audit logs that capture every authenticated action. The result is a security posture that satisfies both your information security auditor and your notified body reviewer.

GDPR and patient data handling in diagnostic software systems

Diagnostic lab software processes personal health data, which makes GDPR compliance an engineering requirement alongside IVDR. Sandorian builds data minimisation into the data model from the start, implements retention and deletion workflows for patient records, and separates identifying data from analytical results where pseudonymisation is appropriate. Our GDPR consulting capability is available as a companion to the engineering engagement.

Proof - digitising ViroVet's lab operation

The challenge: a multi-site veterinary diagnostic lab running on manual processes

ViroVet operates veterinary diagnostic services across multiple sites. Before engaging Sandorian, their operation ran on a combination of manual data entry, paper-based records, and disconnected spreadsheets. Sample intake, result recording, and report issuance each lived in separate systems - creating the exact traceability gaps that audit findings are made of.

What Sandorian built: full lab digitisation, intake to reporting

Sandorian delivered a complete lab digitisation: structured digital intake replacing paper registration, an integrated result recording layer connected to their instruments, automated report generation with electronic sign-off, and an audit trail running end-to-end from sample receipt to report release.

The outcome: 80% reduction in manual errors

80% fewer manual errors after full lab digitisation - ViroVet, Sandorian client

The measurable outcome was an 80% reduction in manual errors across the digitised workflow. Read the full story of how we digitised ViroVet's lab operation to see the architecture and delivery approach in detail.

Who this service is for

If your lab fits any of the profiles below, IVDR software compliance engineering is likely the right conversation to have.

A comparison table matching five lab profiles to their primary IVDR software compliance need, including Article 5(5) controls, traceable workflows, and documentation support.

Lab profile IVDR software need
Hospital or clinical diagnostic lab operating in-house devices Article 5(5) documentation controls and design history file
Independent IVD lab scaling under ISO 15189 Traceable workflows and audit-ready records aligned to ISO 15189
Veterinary diagnostic lab digitising operations Full workflow digitisation with compliance built in from day one
Lab with existing LIMS needing a compliant surrounding layer Intake, reporting, integration, and documentation tooling
Lab preparing for notified body review Technical documentation and performance evaluation support

For broader context on what IVDR means for your lab's operations, that topic is covered by a dedicated Sandorian resource on what IVDR means for diagnostic labs. For information on what lab software projects cost, that is covered separately on the topic of what lab software projects cost.

Start your IVDR software project

A scoping call with a Sandorian engineer covers three things: a review of your existing software stack and where the IVDR compliance gaps sit, a mapping of which engineering deliverables your situation requires, and a definition of what a realistic project scope looks like. No obligations, no generic proposals - an engineer-to-engineer conversation about your actual system.

The IVDR compliance roadmap for laboratory software is a good starting point if you want to orient yourself before the call.

Book a scoping call - talk to a Sandorian engineer about your IVDR software requirements.

Frequently asked questions

Can software make a lab IVDR compliant?

No software alone makes a lab compliant. Software can enforce traceability, version control, audit trails, and documentation workflows that your quality system and regulatory advisers rely on to demonstrate compliance. Conformity decisions stay with your regulatory team and notified body - software gives them the evidence they need to make those decisions confidently.

Do you work alongside our existing LIMS?

Yes. We build the layer around an existing LIMS - intake, documentation, reporting, and integrations - rather than replacing it. We scope what the LIMS already covers first, then build only what is missing. If you are weighing whether you need a new LIMS at all, the topic of whether your lab needs a new LIMS or a better workflow is worth reading first.

Do you give legal or regulatory advice on IVDR?

No. Sandorian engineers software against requirements that your regulatory or legal advisers define. We do not interpret the regulation, advise on classification, or make conformity assessment decisions. That boundary protects both parties and keeps the project accountable.

Which standards do you build against besides IVDR?

Sandorian regularly delivers under ISO 15189, ISO 17025, ISO 27001, and GDPR constraints, and applies IEC 62304 practices where software behaves as a medical device component. The audit trail requirements for regulated laboratories article covers how these standards intersect in practice.

Sources

Let's talk

We build the systems that power your business. Let us know how we can help.

Book a 30-min Call