Digital Health Series – Part 2: Software as a Medical Device Regulated by the US FDA

Artificial Intelligence has achieved major milestones in the US, with the FDA granting clearance to the first AI-based software for clinical decision making, Viz LVO, in 2018. The system analyses CT angiograms for suspected large vessel embolic stroke, alerting the medical specialist via mobile, in the case of a positive result.

However, the first US regulation of software for healthcare purposes can be traced back to 2009. At the time, the Health Information Technology for Economic and Clinical Health (HITECH) Act became the first legislation passed, primarily focusing on the use of information technology (IT) for electronic documentation of patient records, and monitoring of any IT violations of protected health information. This legislation was followed by the 21^st Century Cures Act of 2016, which aimed to “accelerate the discovery, development, and delivery of technologically advanced treatments”. This was the first law defining software as a medical device regulated by the FDA.

FDA Classification for Software as a Medical Device

When it comes to Software as a Medical Device (SaMD), the FDA has adopted International Medical Device Regulators Forum’s (IMDRF) definition:

software intended to be used for medical purposes that perform these purposes without being part of a hardware medical device.

Software as a medical device (SaMD) regulated by the FDA, follows the general medical device classification: Class I, Class II, or Class III. This classification is risk-based, related the level of control necessary to provide reasonable assurance of its safety and effectiveness.

• Class I devices present the lowest risk and likelihood of illness or injury and are regulated by general FDA controls. If the device is exempt from the premarket approval process, which is highly likely for Class I devices, this will be stated in the FDA classification regulation.
• Class II devices present a moderate risk, meaning further data must be supplied to ensure safety and efficacy, so general controls and special controls both apply. Regulation is primarily based on existing FDA approval of a substantially equivalent device, cleared by the FDA 510(k) pathway. It is however possible to have a Class II device exempt from premarket approval or use the more recent De Novo pathway when no appropriate predicate can be identified.
• Class III devices present the highest risk as they are intended to support or sustain life. These are subject to general controls, special controls, and in-depth premarket approval (PMA), which studies device-specific safety and efficacy, with data mostly generated from clinical trials.

Certain low risk software may meet the device definition, nevertheless, because they pose a lower risk to the public, FDA intends to exercise enforcement discretion, meaning it does not, at this time, intend to enforce requirements under the FD&C Act. Examples are included in the Policy for Device Software Functions and Mobile Medical Applications. This position may quickly change, and manufacturers are strongly advised by the FDA to already follow medical device requirements for such devices.

Documentation Requirements for Software Products

Guidance on the level of documentation required in a premarket submission for device software functions is made available by the FDA, highlighting information necessary for evaluating the safety and effectiveness of a software device in a premarket submission. This guidance focuses on three “levels of concern” (minor, moderate, major), which considered severity as well as likelihood of harm potentially caused by the software. Depending on the Level of Concern, different documentation must be submitted.

Table 1. Software Levels of Concern: Documentation Required for FDA Submission

However, as of November 2021 a new draft guidance Content of Premarket Submissions for Device Software Functions was released, with the aim to replace the aforementioned (not yet finalized). This measure will reduce the categories of level of documentation to two:

• Basic Documentation, which should be provided for any premarket submission that includes device software functions where Enhanced Documentation does not apply.
• Enhanced Documentation, which should be provided for any premarket submission that includes device software functions, where any of the following factors apply:
  • The device is a constituent part of a combination product.
  • The device (a) is intended to test blood donations for transfusion-transmitted infections; (b) is used to determine donor and recipient compatibility; or (c) is a
    Blood Establishment Computer Software.
  • The device is classified as class III.
  • A failure or latent flaw of the device software function(s) could present a probable risk of death or serious injury, either to a patient, user of the device, or others in
    the environment of use. These risk(s) should be assessed prior to implementation of risk control measures. You should consider the risk(s) in the context of the device’s
    intended use; the direct and indirect impacts to safety, treatment, and/or diagnosis; and other relevant considerations.

The new categories mostly align with the previous moderate and major levels of concern, and reinforce the message that these levels do not take into account risk control measures. This is contradictory to the FDA recognized consensus international standard on software development lifecycle (IEC 62304), where external risk controls can be considered when determining software safety classification (A, B, C with C being the highest risk of harm).

Nevertheless, IEC 62304 focuses on documentation to be created based on the software classification, whereas the FDA guidance refers to what needs to be submitted to the FDA. However, this does not mean that other documentation is not expected to be authored and maintained by the manufacturer.

The required documentation for the new FDA guidance, are highlighted below.

Table 2. Basic and Enhanced Software Documentation to be submitted to the FDA

FDA Approval Pathways for Software as a Medical Device

Depending on the device classification above and the existence of a predicate device, the SaMD must fulfil certain FDA premarket approval requirements as described through the: 510(k), PMA (Pre-Market Approval), or De Novo pathways (image below).

• The 510(k) pathway is dedicated to Class I devices which do not obtain an “exemption”, or for Class II devices which can be shown to have a substantially equivalent predicate marketed in the US, under 510(k) or De Novo pathways.
• The De Novo pathway is a more recent market authorization pathway, created through the 1997 FDA Modernization Act. It applies to novel devices for which general controls alone, or general and special controls, provide reasonable assurance of safety and effectiveness, but for which there is no legally marketed predicate device. Class II devices which do not have an equivalent predicate must show proof of being Class II, in order to submit under the De Novo pathway. Note, devices that are classified as class I or II through a De Novo classification request, may be used as predicates for future 510(k) submissions.
• The Pre-Market Approval (PMA) pathway is the most strict authorization process, requiring more than general and special controls. Those are deemed insufficient to determine safety and effectiveness  of the device. This means a unique methodology should be used to demonstrate this – most of the time this consists of clinical data through clinical trials.

Image 1. Decision Tree for FDA Market Authorization Pathways

Given the challenges often confronted by SaMD companies when deciding on the most optimal regulatory pathway, engaging with the FDA in an early dialogue may provide advantages. This could be achieved by conducting  a pre-submission meeting with the agency, to de-risk the placement of complex SaMD products on the US market. The meeting would serve to seek FDA concurrence before an actual regulatory application is filed, either on the suitability of a predicate, or on FDA expectations regarding the applicable performance data to provide.

Moreover, in 2022 the FDA also launched its Software Pre-certification Pilot Program for medical software applications. This was set up as a potential replacement for premarket submission processes, with the aim to expedite the process for software devices, whilst ensuring appropriate regulatory oversight. For the first time, the process focuses on demonstrating a culture of quality and organizational excellence and a commitment by the manufacturers to monitor product performance.

The “Software Precertification (Pre-Cert) Pilot Program: Tailored Total Product Lifecycle Approaches and Key Findings” report was published with the following key outcomes:

1. FDA has found that rapidly evolving technologies could benefit from a new regulatory paradigm, which would require a legislative change.
2. Given the challenges faced during the pilot, FDA has determined that the proposed approach is not practical to implement under the current statutory and regulatory authorities.
3. The pilot reinforced that a systems-based approach that leverages structured objective data can support a learning regulatory system that benefits from data-driven insights to provide efficient and consistent regulatory decisions.

Since then, the FDA has been progressively publishing new and updated regulatory guidance documents for specific categories of software as a medical device, including:

• Technical Performance Assessment of Quantitative Imaging in Radiological Device Premarket Submissions in June 2022
• Clinical decision support (CDS) software in September 2022
• Medical Device Data Systems, Medical Image Storage Devices, and Medical Image Communications Devices in September 2022

FDA Regulation of Artificial Intelligence

The FDA defines artificial intelligence as a digital health technology imitating human or intelligent behavior, and which includes machine learning, neural networks, and natural language processing. However, the agency has not yet created specific regulatory guidelines for artificial intelligence software or devices in healthcare. In the case of Viz LVO software in 2018, regulatory approval was obtained via the De Novo pathway, laying down the path for future AI-based technologies and serving as a reference equivalent device for future technologies. In fact, it aided in the approval of another AI deep learning-based platform, Aidoc, only 6 months later and many other technologies have been approved since then.

In 2021, the FDA’s Center for Devices and Radiological Health (CDRH) published the Artificial Intelligence and Machine Learning (AI/ML) Software as a Medical Device Action Plan, recognizing that traditional medical device regulations were not intended for artificial intelligence technologies, which are adaptive and undergo learning-based modifications. The FDA has identified these modifications as crucial points, possibly affecting product safety and efficacy, and thus requiring additional premarket reviews.

This framework would require anticipation and transparency on the product’s:

• Potential modifications, termed “Software as a Medical Device Pre-Specifications”.
• The methodology to be used to implement the modifications in controlled manner to manage patient risk, termed “Algorithm Change Protocol”.

This measure would allow the FDA to better regulate the gradual evolution of AI-based software and assess its safety and efficacy over time.

In January 2023, FDA also recognized “AAMI CR34971:2022, Guidance on the Application of ISO 14971 to Artificial Intelligence and Machine Learning” as a new guidance document “appropriate for meeting requirements for medical devices under the Federal Food, Drug, and Cosmetic Act”. This is the first AI/ML focused standard recognized by the FDA. It forms the basis for a technical information report (designated as TIR34971) and then the AAMI (Association for the Advancement of Medical Instrumentation) will highly likely propose it as an international document.

Finally, in April 2023, the draft guidance Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence/Machine Learning (AI/ML)-Enabled Device Software Functions was published. Its purpose is to  further develop a regulatory framework specific to artificial intelligence/machine learning (AI/ML)-enabled devices to increase device effectiveness and patient safety. This guidance covers:

• Least burdensome approaches supporting the iterative improvement of machine learning-enabled device software functions.
• Recommendations on the information to include in a Predetermined Change Control Plan (PCCP) that may be provided in a marketing submission for such devices.

References:

1. He et al. (2019) The practical implementation of artificial intelligence technologies in medicine, Nature Medicine. Link
2. BSI white paper – Recent advancements in AI – implications for medical device technology and certification. Link
3. The Federal Food, Drug, and Cosmetic Act of 1938 section 201(h). Link
4. Naik et al. (2022) Legal and Ethical Consideration in Artificial Intelligence in Healthcare: Who Takes Responsibility?, Frontiers Surgery. Link 
5. A. Yaeger et al. (2019) United States regulatory approval of medical devices and software applications enhanced by artificial intelligence, Health Policy and Technology. Link
6. ICMRA, Informal Innovation Network, Horizon Scanning Assessment Report – Artificial Intelligence, August 6, 2021. Link
7. K. Aronson et al. (2019) Medical Devices: Definition, Classification, and Regulatory Implications, Drug Safety. Link
8. Gerke et al. (2020) The need for a system view to regulate artificial intelligence/machine learning-based software as medical device, NPJ Digital Medicine. Link 
9. International Medical Device Regulators Forum (IMDRF). Software as a Medical Device (SaMD). Link 
10. FDA, Digital Health Terms, Software as a Medical Device. Link 
11. FDA, Artificial Intelligence and Machine Learning in Software as a Medical Device. Link 
12. Muehlematter et al. (2021) Approval of artificial Intelligence and machine learning-based medical devices in the USA and Europe (2015-20): a comparative analysis, Health Policy. Link

Published on: May 25, 2023