What is UOUP? A Professional Explanation for the Medical Device Industry

Introduction

In medical device development, responsibility for user interfaces and ensuring safety is a critical concern. User interfaces that are not directly designed by developers—particularly those inherited from already-marketed products or legacy systems—present challenges from the perspective of usability and risk management. Against this background, the concept of UOUP has emerged within international standards.

UOUP stands for “User Interface of Unknown Provenance,” meaning “user interface with unknown origin.” This concept was formally defined for the first time in the international standard IEC 62366-1:2015 and has become an important framework in the evaluation of usability engineering for medical devices.

Definition and Background of UOUP

Based on IEC 62366-1:2015, the definition of UOUP is as follows: “A UOUP is a user interface or parts of a user interface of a medical device previously developed for which adequate records of the usability engineering process of this standard are not available.”

Specifically, UOUP applies in the following cases:

First, user interfaces marketed before the publication of the standard in 2015, at which time the implementation of the usability engineering process based on IEC 62366-1:2015 was not legally required.

Second, user interfaces inherited from existing products where records of the development process are incomplete or do not meet the requirements of IEC 62366-1:2015. Examples include generic components such as computer mice and interface designs inherited over multiple generations.

Third, user interfaces inherited from products acquired through mergers and acquisitions, where the development history and detailed technical specifications are unclear.

Reasons Why UOUP Requires an Evaluation Process

Evaluation processes are required for UOUP for the following reasons:

First, user interfaces of unclear origin do not necessarily guarantee usability that meets the requirements of IEC 62366-1:2015. In particular, when designed before the publication of the standard, the conformity with current usability engineering requirements is not clear.

Second, integrating such interfaces into a medical device may create risks to patients or users. If a user cannot properly operate the device or uses it incorrectly, there is concern that hazardous situations may arise.

Third, the usability of medical devices is directly linked to patient safety and healthcare effectiveness. Both IEC 62366-1:2015 and the EU Medical Device Regulation (MDR) position usability engineering as an important element in ensuring patient safety.

Fourth, for existing marketed products with accumulated post-market surveillance (PMS) data, empirical information regarding usability-related risks can be obtained from such data. This enables more efficient risk assessment without the need to repeat all evaluations equivalent to those for newly developed products.

Characteristics of the UOUP Evaluation Process

The UOUP evaluation approach is a streamlined process defined in Annex C of IEC 62366-1:2015. This process is designed to reduce implementation burden compared to the complete usability engineering process (sections 5.1–5.9 of Chapter 5), while still meeting important patient safety-related risk management requirements.

The UOUP evaluation process comprises the following five steps:

Step 1: Establishing the Use Specification

Define the intended use of the medical device, target patient population, characteristics of intended users, use environment, and operating principle. This step is identical to the first step of the complete usability engineering process.

Step 2: Reviewing Post-Production Information

Analyze all information related to usability collected after the marketing of the medical device—including complaints, adverse event reports, incident reports, and near-misses. From this information, identify cases where use errors (actions or lack of actions resulting in unintended consequences) could lead to hazardous situations.

Step 3: Controlling Usability-Related Risks

Verify that risk control measures are appropriately implemented for risks identified in Step 2, ensuring all risks are reduced to acceptable levels. Evaluation must be harmonized with the risk management process based on ISO 14971:2019.

An important point is that if changes to the UOUP are determined necessary in this step, those changed parts no longer qualify as UOUP and become subject to the complete usability engineering process (IEC 62366-1:2015, sections 5.1–5.9). Only the unchanged user interface portions remain as targets for UOUP process application.

Step 4: Reassessing Overall Residual Risk

Based on evaluation results from previous steps, reassess the overall residual risk (risk remaining after risk control measures have been applied) of the entire medical device according to ISO 14971:2019 requirements and confirm its acceptability.

Step 5: Creating the Usability Evaluation File

Document the entire process records, analysis results, and supporting rationale. This evaluation file serves as part of the technical documentation under the EU Medical Device Regulation (MDR) or FDA submission materials.

Limitations and Conditions for UOUP Application

When the UOUP process is applied, several important restrictions apply.

First, UOUP status is limited to cases where the interface remains unchanged. If any part of the user interface is modified, all changed portions and all parts affected by the changes must comply with the complete usability engineering process. This is clarified by IEC 62366-1:2015 Technical Corrigendum 1:2016.

Second, the concept of UOUP applies in principle to user interfaces marketed before the publication date of IEC 62366-1:2015 in February 2015. However, for interfaces developed after this publication date but lacking adequate usability engineering records, application is possible through flexible interpretation of Annex C, which remains subject to ongoing discussion.

Third, IEC 62366-1:2015 Annex C is positioned as a “transitional measure” arising from the historical background of the standard’s 2015 publication. For products newly marketed after publication, implementation of the complete usability engineering process is expected.

Relationship with Related Standards

The UOUP concept must be understood in parallel with the “SOUP” (Software of Unknown Provenance) concept in IEC 62304. SOUP addresses software broadly, while UOUP is specific to user interfaces.

In medical device development, risk-based evaluation is required for components of unknown origin in both software and user interfaces. IEC 62304 establishes detailed risk analysis and evaluation requirements for SOUP use, while IEC 62366-1 provides a streamlined evaluation process specific to UOUP.

Furthermore, FDA Guidance “Off-The-Shelf Software Use in Medical Devices” (2019) and the EU Medical Device Regulation (MDR) technical guidance also demonstrate regulatory expectations regarding the evaluation of ready-made or legacy components, advancing toward international regulatory harmonization.

Regulatory Environment Trends and Current Status in 2024-2025

Several years have passed since full implementation of the EU Medical Device Regulation (MDR), and regulatory authorities increasingly interpret usability engineering requirements more strictly. In particular, Notified Bodies are requiring clearer justification and more detailed post-market surveillance data for UOUP applicability determinations.

The FDA also specifies more detailed requirements for medical device software risk management and verification in its 2021 revised guidance “Software Validation” and additional guidance planned for 2024-2025. Harmonization between IEC 62304 and FDA requirements is strengthening, requiring companies to develop integrated compliance strategies across multiple standards.

Additionally, as medical device software incorporating artificial intelligence (AI) and machine learning (ML) grows rapidly, discussions continue within the industry and regulatory agencies regarding whether the existing UOUP concept is applicable to new component formats or whether additional risk assessments are needed.

Implementation Challenges and Recommended Approaches

From a practical perspective, UOUP process implementation presents multiple challenges.

First, the quality and completeness of post-market surveillance information. In many organizations, data such as complaint reports collected historically are fragmented, and analysis focused on usability is often insufficient. Systematic re-evaluation of existing data therefore becomes necessary.

Second, clarification of use specifications. Particularly for legacy systems, the originally intended use may diverge from current actual use, and clear documentation of this point is important.

Third, consistency of risk assessment. Risk assessment in the UOUP process must align with the organization’s overall medical device risk assessment based on ISO 14971, and it is complex to consider both safety at the time of the device’s market introduction and safety in the current regulatory environment.

To address these challenges, the following implementation approaches are recommended:

1. Multidisciplinary team composition – Collaboration among usability engineers, risk management specialists, and regulatory professionals is essential.
2. Establishing continuous data collection and analysis systems – Build robust post-market surveillance data collection and analysis infrastructure.
3. Developing integrated documentation strategy – Ensure consistency across international standards (IEC 62304, IEC 62366-1, ISO 14971, and ISO 13485).

Conclusion

UOUP is a realistic and important concept in the medical device industry, providing a framework for rationally evaluating usability risks of existing products and legacy systems. This concept should be understood not as a binary approach that reduces burden compared to complete new development, but rather as part of a continuous risk management perspective.

To comply with standards required by the EU Medical Device Regulation (MDR), FDA guidance, and the international standard IEC 62366-1, manufacturers must establish a comprehensive usability evaluation strategy that includes the UOUP process. The regulatory trends from 2024-2025 show that legacy component management is increasingly being demanded more rigorously, and companies must proactively address this.

By implementing an appropriate UOUP evaluation process, medical devices become safer and more effective, directly serving patient interests and advancing the quality of healthcare delivery.