The eCOA / ePRO Vendor’s Hidden Obligations
A companion reading from the vendor’s seat — where your build and release choices place you inside the perimeters
REGULATORY OPERATIONSSettle two questions before a sponsor asks: is the app a medical device, and can you hand over the evidence package?
"We're just the software provider" rarely describes where an eCOA / ePRO vendor lands. Whatever the device answer, you own evidence the sponsor cannot produce for you, and each release is a change event in a live trial. Build the package as you go: a vendor that can hand it over is qualified in weeks, not quarters.
Your build and release choices are the sponsor's evidence — and the sponsor cannot produce them for you
An intended-purpose statement and the MDSW determination against the MDCG decision steps — and, if a device, the class under Rule 11.
Verification and analytical-validation evidence (V3) for every measure the app derives, built as you go, not retrofitted at audit.
Audit-trail design, trusted time source and signature binding — the on-device integrity proof only you hold.
A secure development lifecycle, vulnerability handling and, where the app is a cyber device, a current SBOM.
Formative and summative evaluation across the device types and operating systems participants actually use, BYOD included.
A release notice and change log the sponsor can route into change control — every release is a trial change event.
Four facts place you inside the regulated unit, not beside it
MDSW is placed on the market in its own right; the phone or tablet it runs on does not change that. Where it is placed on the market, you are its manufacturer.
Validation, audit trail, change control and security of the app are yours, because only you hold them. The sponsor cannot produce them for you.
The sponsor retains ultimate responsibility for your output under ICH E6(R3) and has to qualify and monitor you — you are almost always a processor, not a controller.
An update can move the app across a perimeter mid-study. Marketing does not decide device status: a "wellness" feature that scores or alerts for an individual can be MDSW.
Six records make you easy to qualify
- 1Determine the app's status early — hold an intended-purpose statement and an MDSW determination against the MDCG decision steps.
- 2Build the validation package as you go — analytical-validation evidence for each derived measure, not retrofitted at audit.
- 3Make integrity and security demonstrable — audit trail, trusted time source, signature binding, secure lifecycle, SBOM for a cyber device.
- 4Evaluate use-safety on the real fleet — formative and summative, across the device types and operating systems participants use.
- 5Treat every release as a change event — issue a notice and change log the sponsor can route into change control.
- 6Hold the instrument licences and migration evidence — copyright position per COA instrument and equivalence to the version replaced.
ICH E6(R3) · MDCG decision steps and MDR Rule 11 · GDPR Art. 28(2) and (4) · IEC 62366-1:2015+A1:2020 · IEC 62304 · IEC 81001-5-1:2021 · FD&C Act s.524B · FDA general wellness and device software function policies
© qointa 2026 – Public – Uncontrolled when printed · Not legal advice; this summary does not classify any device.
sales@qointa.com · qointa.com
More from the library
Digital Health Technologies in Clinical Trials — A Regulatory Position-Paper Series
One device, several perimeters: a framework for assessing the regulatory impact of the technologies a trial relies on.
Read more →Who Is the Manufacturer? Economic-Operator Roles in DHT Supply Chains
How provisioning, importing, kitting and modifying a device assign manufacturer, importer and distributor duties — often by operation of law.
Read more →You Can Delegate the Work, Not the Accountability: Vendor Qualification and Oversight under ICH E6(R3)
The sponsor’s duty to qualify and oversee its DHT vendors — distinct from who holds the economic-operator role.
Read more →Talk to a specialist
Bring one device and one protocol — a wearable, a sensor, an app, anything. We will tell you which regulatory perimeters it opens and what it takes to close them.
Book a 15-minute call