Discussed in telecon. Agreed wording of second sentence should not include SHALL. If desired, a profile would make this requirement mandatory.

The current content of the XML file does not expose sensitive data (private keys or passwords) and the import would only be allowed by administrators, so we don't see any reason it would not be allowed by CRF 11.

This is an export/import format. Not a config file. A seperate utility could be used to convert to whatever format is required by regulation.

If this is not allowed then how do the regulators expect apps to be configured?

21 CFR does not like "ASCII" files that can change the behaviors or the security of the system IF they can be easily modified by an unauthorized person.
As long as this format is used only for import / export, not as a configuration file, there is no problem. It will be the responsibility of the server vendor to:
1) Make sure that only an authorized person may perform import/export operation, which is the case.
2) This imported file is not used as configuration file or at very minimum it is not accessible to unauthorized person on the server.
3) For audit purpose, the server vendor provides a way to guarantee that the exported file content as not been tempered, electronic signing or something else, it will be ok.

The spec clearly gives applications the option of using an import/export utility for updates.

Made the schema optional. Should not be an issue.