I don&#x27;t know how it works out for stuff used during surgery, but for diagnostic devices (where if a device fails by becoming inoperable, the stakes are a lot lower), you can lump basically any software that you don&#x27;t have total control and design history on (so this includes random proprietary software and most FOSS stuff) as &quot;software of unknown providence&quot; (SOUP).<p>Now based on the class of medical device you are developing, you can either get to use SOUP without justifying at all, or you have to explain&#x2F;justify why you can use SOUP at all.<p>For example, even if your OS was Linux, because you don&#x27;t have formal documentation on verifying that Linux infact does all the things its suppose to do (hell, does Linux even have a true spec?), you would then have to justify why you&#x27;re using Linux. If a kernel update comes out, you then have to justify why you&#x27;re using it.<p>What you WOULD have to do is verify&#x2F;validate that your software that interacts with SOUP (so in this case running on an OS) still works correctly. You would not have to verify&#x2F;validate the OS update per se.