Saltar a contenido

EPPA Regulatory Posture — Executive Overview

Status: Research-grade software, not a medical device

As of the date of this document, EPPA is not placed on the market as a medical device in any jurisdiction. All references in this overview to "Class IIa", "Class II", "510(k)", "CE marking" or "EUDAMED registration" describe the likely future classification if and when EPPA is placed on the EU/US market. See 91-non-device-disclaimer.md for the disclaimer language that must surface in the product and the docs.

1. What EPPA is, today

EPPA (Episodic Postural Photographic Assessment) is a Next.js + Python FastAPI clinical research tool developed by LABIS UCA (Universidad Católica Argentina). It analyses still photographs of standing patients (anterior, posterior and both lateral views), allows a trained clinician to place anatomical markers, and outputs derived metrics (alignment scores, segment angles, qualitative classifications such as "normal" / "left deviation" / "right deviation").

It is currently used by physiotherapists, kinesiologists and postural-medicine physicians in Argentina in a research-use context. There is no commercial product, no QMS, no clinical evaluation file, no regulatory submission and no post-market surveillance system in place.

2. Likely classification (when placed on the market)

Jurisdiction Likely class Basis
EU Class IIa SaMD under Regulation (EU) 2017/745 ("EU MDR"), Annex VIII, Rule 11, second indent Software intended to provide information used to take decisions with diagnosis or therapeutic purposes is at least Class IIa unless decisions may cause death or irreversible deterioration (Class III) or serious deterioration / surgical intervention (Class IIb). EPPA outputs informing a diagnostic conclusion about postural alignment falls into Class IIa.
US (FDA) Class II under 21 CFR Part 892 (radiology / image-processing software) or 21 CFR Part 890 (physical-medicine devices), via the De Novo or 510(k) route as a SaMD under the FDA SaMD framework EPPA is not a Class I exempt device because it produces a diagnostic interpretation. It is also not Class III because there is no life-supporting/sustaining claim. A predicate device (e.g. surface-topography postural analysers, K-numbered) would be needed for 510(k).
AR (ANMAT) Class II under Disposición ANMAT 2318/2002 + Disposición 727/2013 (software de uso médico) Argentinian SaMD framework largely mirrors EU MDR risk-based classification.
BR (ANVISA) Classe II under RDC 751/2022 (replaces RDC 185/2001) RDC 751 transposes IMDRF SaMD principles.
DE (BfArM) Same as EU; additional national rules under Medizinprodukterecht-Durchführungsgesetz (MPDG) Notified body activity for Class IIa is BfArM-supervised in DE.

The reference instruments are:

  • EU MDR Annex VIII Rule 11 (Regulation (EU) 2017/745).
  • MDCG 2019-11 ("Guidance on qualification and classification of software in Regulation (EU) 2017/745 — MDR and Regulation (EU) 2017/746 — IVDR").
  • IMDRF/SaMD WG/N12FINAL:2014 ("Software as a Medical Device: Possible Framework for Risk Categorisation and Corresponding Considerations").
  • 21 CFR 820 and the FDA SaMD action plan (January 2021).

A full Rule-11 walkthrough is planned for 10-eu-mdr-saMD-classification.md (Lane L2-future). An FDA-pathway analysis is planned for 20-fda-samd-path.md.

3. Target markets

EPPA's product strategy targets six markets in parallel — all of which require either a CE-marked or FDA-cleared device for commercial clinical use:

Market Locale Primary regulator Privacy regime
Argentina es-AR ANMAT Ley 25.326 + ANMAT Disp. 9/2023
Spain es-ES AEMPS (under EU MDR) GDPR + LOPDGDD 3/2018
EU (general) en, de National competent authorities under EU MDR GDPR (Regulation (EU) 2016/679)
US en FDA CDRH HIPAA (45 CFR Parts 160 and 164)
Brazil pt-BR ANVISA LGPD (Lei 13.709/2018)
Germany de BfArM GDPR + BDSG-neu (2018)

4. Current gap (as of 2026-05-21)

Required artefact Status
Intended-use statement DRAFT — see 01-intended-use-statement.md
Quality Management System (ISO 13485:2016) Missing
Risk-management file (ISO 14971:2019) Missing
Software lifecycle process (IEC 62304:2006/A1:2015) Missing — software is built but with no formalised V-model artefacts
Software safety class (IEC 62304 §4.3) Not assigned — preliminary assessment: Class B (non-life-threatening injury possible from incorrect output)
Clinical evaluation plan (EU MDR Annex XIV part A) Missing — no clinical evaluation file exists
Post-market surveillance plan (EU MDR Art. 83) Missing
Cybersecurity assessment (MDCG 2019-16) Missing
GDPR Data Protection Impact Assessment (Art. 35) DRAFT — see 30-gdpr-dpia.md
HIPAA Security Rule readiness (45 CFR §164.308–§164.312) Not started
ANMAT Disp. 9/2023 software registration Not started
Non-device disclaimer in product and docs DRAFT — see 91-non-device-disclaimer.md 
   ┌─────────────────────┐    ┌──────────────────────┐    ┌─────────────────────┐
   │  Phase 1 (now → +6m) │ ─→ │  Phase 2 (+6 → +12m)  │ ─→ │ Phase 3 (+12 → +18m)│
   │  Research Use Only   │    │  Clinical validation  │    │  CE marking + FDA   │
   │  ───────────────────  │    │  ───────────────────  │    │  ────────────────── │
   │  · No marketing       │    │  · Multi-site study   │    │  · Notified body    │
   │    claims             │    │    under ISO 14155    │    │    audit (Class IIa)│
   │  · Disclaimer in UI   │    │  · Clinical eval rpt  │    │  · 510(k) or De Novo│
   │  · DPIA + ROPA done   │    │  · ISO 14971 risk file│    │  · EUDAMED entry    │
   │  · Intended-use lock  │    │  · IEC 62304 lifecycle│    │  · ANMAT, ANVISA    │
   └─────────────────────┘    └──────────────────────┘    └─────────────────────┘

Phase 1 — Research Use Only (immediate, next 6 months). EPPA continues to operate as a research tool. Every UI surface, marketing page, README and CSV export carries the "Research Use Only — Not a Medical Device" disclaimer (see 91-non-device-disclaimer.md). GDPR DPIA, ROPA and the intended-use statement are signed off as living documents. No diagnostic claims are made, and the tool is only made available to qualified clinicians within an approved research protocol.

Phase 2 — Clinical validation (+6 to +12 months). Run at least one multi-site, IRB/ethics-approved clinical validation study (reference: ISO 14155:2020 "Clinical investigation of medical devices for human subjects — Good clinical practice"). Concurrently, stand up the ISO 13485 QMS, the ISO 14971 risk file, and formalise the IEC 62304 software lifecycle. Without these artefacts, no notified body will accept a Class IIa CE-marking application.

Phase 3 — Market authorisation (+12 to +18 months). File the EU MDR technical documentation with a notified body (Class IIa, conformity assessment via Annex IX Chapter I or Annex XI Part A). In parallel, file a 510(k) or De Novo with the FDA, file with ANMAT in Argentina, and with ANVISA in Brazil. Only after market authorisation in a given jurisdiction may the non-device disclaimer be removed in that jurisdiction.

Why 12 to 18 months and not sooner

Notified-body audit slots for Class IIa SaMD in the EU are currently backlogged 6 to 9 months (MDCG 2022-14 "Notified body capacity"). A clinical evaluation file for a SaMD requires a minimum of one prospective clinical investigation with a pre-registered protocol; recruitment + follow-up + analysis is rarely less than 6 months even for a postural assessment cohort. These two activities sit on the critical path.

6. Cross-references to other compliance documents

  • 01-intended-use-statement.md — the foundational claim document.
  • 30-gdpr-dpia.md — Data Protection Impact Assessment under GDPR Art. 35.
  • 91-non-device-disclaimer.md — disclaimer language in es/en/de/pt-BR.
  • 10-eu-mdr-saMD-classification.md (planned) — Rule-11 walkthrough.
  • 11-iec-62304-lifecycle.md (planned) — software lifecycle artefacts.
  • 12-iso-14971-risk.md (planned) — risk management.
  • 20-fda-samd-path.md (planned) — FDA pathway analysis.
  • 90-roadmap.md (planned) — phased regulatory roadmap with effort estimates.

References