I think the regulation should happen upstream of the software. Code that goes in a medical device should be subject to different levels of rigor than code that goes into a free to play mobile game.

To use your example of CAD software, certainly the system used to design a bridge should be built differently than the one used to make inputs to a consumer level 3D printer.

There’s no such thing as a “casual” bridge or a “good enough” pacemaker, but that analogy holds in the software industry.

Software’s infinite flexibility means that it should be regulated within its context of use.