From spreadsheets and scripts to controlled software lifecycles: recommendations for laboratory-developed software under ISO 15189 and IVDR

Medical laboratories increasingly rely on in-house software for data processing, interpretation, and reporting of diagnostic results. Historically, such software has often taken the form of spreadsheet-based solutions or ad hoc scripts because of their accessibility and flexibility. However, evolving regulatory frameworks, most notably ISO 15189 and Regulation (EU) 2017/746 on in vitro diagnostic medical devices (IVDR), place explicit requirements on validation, traceability, risk management, and lifecycle control for software used in diagnostic workflows. In this paper, we provide practical recommendations for laboratories seeking to transition from loosely controlled spreadsheets and scripts toward controlled software solutions that are verified against specified requirements, version-controlled and validated for their intended use in the intended laboratory environment. Compiled executables are discussed as one practical approach to strengthening release integrity, deployment control, and reproducibility. We outline key risks associated with legacy approaches, propose best practices for software architecture and quality management, and illustrate the implementation of these recommendations through two examples: middleware development for laboratory data integration and a standalone executable for DNA variant typing.