Skip to content
We’re back once again with more important updates on the ever-evolving guidance on AIaMD. If you’ve missed the previous Versions of this blog, you can look back and find Version 1 here and Version 2 here as we’ve removed some information so you get just the very latest guidance. We continuously stay abreast of the updates so you don’t have to.
US FDA Artificial Intelligence Program
The previous version of this blog only included the joint work on Good Machine Learning Practice from the FDA as their recent work – well, it turns out they’ve been very busy and they’re ready to talk about it.
In June 2024, the FDA published information on 6 projects they are working on concerning AI in healthcare. Each of these topics has its own page, giving insight into likely future guidance from the FDA and what FDA staff will be considering when they are reviewing your medical device – just because it isn’t official, doesn’t mean it isn’t useful.
Predetermined Change Control Plans
In August 2024, the FDA released draft guidance on “Predetermined Change Control Plans” (PCCPs); a mechanism through which changes to your AI algorithm can be pre-approved by the FDA meaning they can be released without requiring a time-consuming 510(k) process. While the guidance is draft, it is very common for the FDA to apply draft guidance documents for years while their thinking develops before releasing a final document and ultimately, all guidance documents are ultimately “more guidelines than rules”.
The guidance document includes principles for PCCPs (previously published as their own document), a Policy on the creation, approval, use and control of a PCCP, the type of modifications to be considered under a PCCP and what content should be included in a PCCP. It also includes some useful examples of PCCPs for manufacturers to refer to.
This is a huge step forward for AI Medical Devices in the US and creates a mechanism that could (when used effectively) greatly reduce time spent awaiting approvals from the regulator to release new versions of your algorithm.
Good Machine Learning Practice
In 2023, the UK MHRA, US FDA and Health Canada released a rare joint statement on Good Machine Learning Principles for Medical Device Manufacturers. It’s a short document but gives a clear indication of the thinking of these three major medical device regulators.
These provisions are a stepping stone towards further guidance for AI/ML medical devices and are being used as a starting position by the FDA in chairing the International Medical Device Regulatory Forum (IMDRF) in 2024. Given its approval by three independent regulators (all members of the IMDRF), it is expected that this will act as the basis of guidance documents on AI/ML medical devices from multiple regulators over the next few years.
Transparency for machine learning-enabled medical devices: guiding principles
In June of 2024, Good Machine Learning Practice (GMLP) was expanded upon with extra guidance around transparency – how information about the machine-learning enabled device is communicated to users, patients and support staff – and how manufacturers need to focus on the human-centric design of these communications and explainability of how the system works, where it fits in the clinical workflow and what could go wrong.
Unsurprisingly, this aligns well with the framework provided by the Clinical Safety Standards, DCB0129 and DCB0160. The standards are built upon identifying and controlling patient harm that could be caused by either system design (DCB0129) or its implementation (DCB0160). The process of assessment allows hazards to be communicated to necessary stakeholders. A significant part of the Clinical Safety Case Report and Hazard Logs are built upon the implementation of the technology in clinical workflows and transparency to the hazards of the systems. There is also often an expectation of deploying organisations to contribute to manufacturers’ software development lifecycle through continuous feedback which can be factored into the Clinical Risk Management System.
BS/AAMI 34971:2023
ISO 14971 is the international standard for medical device risk management; BS/AAMI 34971:2023 is new guidance on the specific application of ISO 14971 to medical devices that include Machine Learning components. It provides valuable guidance on how Machine Learning components can impact product risks and gives a method to integrate these into the ISO 14971 approach to risk management.
There is a clear intersection between ISO 14971 and DCB0129 (the UK’s standard for Clinical Safety in the NHS for health care technology) and we recently wrote about the crossover in another blog here. For any AI / SaMD manufacturers planning on working in the UK/NHS, DCB0129 is an important and achievable standard that can form part of a robust quality management system.
If you’re not currently applying ISO 14971 as part of your Quality Management System or are unsure how to do so effectively, our team can help.
ISO/IEC 42001:2023
A management system standard in the vein of ISO 9001, ISO 13485 and ISO/IEC 27001, ISO/IEC 42001:2023 guides organisations creating or using AI towards good practices and also allows for certification by a certification body of an organisation’s AI Management System (although at least in the UK, there appear to be no certification bodies accredited for this standard at the time of writing).
However, a recent webinar from the European Commission highlighted the work done by the European Committee for Standardisation in identifying that ISO/IEC 42001:2023 was not sufficient to fulfil the obligations of a Quality Management System under the EU AI Act and would need extra work to be adopted through harmonisation.
US State Department and NIST
It’s not just the FDA in the US joining in on thinking about and developing policies to govern the responsible use of AI. The US Department of State, Bureau of Cyberspace and Digital Policy has released a “guide for organisations to design, develop, deploy, use, and govern AI in a manner consistent with respect for international human rights.” It includes a list of risks related to Human Rights (rather than just a patient’s health) that echo the EU AI Act’s focus on the impact on Fundamental Rights. Whilst there are no particular actions to take at this time, this might point towards US Policy on regulating AI devices in future.
The US National Institute of Standards and Technology (NIST) also released a Risk Management Framework for Generative AI in July 2024, examining the types and extents of risks associated with this tool.
Australia TGA AIaMD Guidance
The Australian Therapeutic Goods Administration (TGA) released guidance in May 2024 for AI developers covering how to determine if they are a medical device and providing an overview of how they would be regulated.
A key point to notice is their inclusion of “safety, reliability and performance”, pointing to the issue of proving reliability of adaptive AI Algorithms (i.e. algorithms that adapt in use, rather than are released in a “frozen” state). No medical device regulator (even the FDA through Predetermined Change Control Plans) has allowed release of adaptive AI algorithms in Medical Devices and with this guidance, the Australian TGA has clarified their adoption of this position as well.
Upcoming Guidance and Standards
International regulators are already aware of the potential opportunities and harm posed by the rise of AI in medical devices. Below we have summarised what we know is already being developed:
UK MHRA
Alongside completely overhauling the UK’s medical device regulations (although this is expected to look a lot like copying the EU’s homework in the form of adopting the EU Medical Device Regulation into UK law), the MHRA have three work packages planned that AI medical device developers specifically should be aware of:
- “Rigour” – including Good Machine Learning Practice as above, standards and guidance on the application of Medical Device Regulations to AI medical devices
- Interpretability – Increasing requirements around being human-centric in AI system development and making AI systems trustworthy.
- Adaptivity – perhaps the holy grail for AI developers, this points towards the option of allowing AI systems to continuously learn.
The Office for Artificial Intelligence, under the Department for Science Innovation and Technology, has published a Policy Paper explaining the UK’s “Pro-Innovation” approach to AI regulation, perhaps suggesting some exemptions or reduced requirements for AI/ML medical devices in the UK. Most recently, the MHRA have confirmed they plan to adopt the IMDRF recommendations for software risk classification, which means there will be a route for some AI/ML medical devices to be self-certified in the UK (unlike in the EU MDR, which adopted an amended version that ruled out self-certification for AI/ML software).
EU
The major AI-related development in the EU is the progression of the EU AI Act towards implementation after it was approved in March 2024. The EU AI Act lists medical device applications as a High-Risk area for AI, requiring additions and changes for AI products within product-specific regulations (i.e. EU Medical Device Regulation and EU In Vitro Diagnostic Regulation). Once adopted (which looks almost certain now), AI medical device manufacturers should expect to see additional or clearer requirements implemented through changes to the EU MDR and IVDR, the introduction of new Medical Device Coordination Group (MDCG) guidelines and harmonisation of standards over a 3-year transition period.
US FDA
The FDA AI/ML-Based Software as a Medical Device Action Plan was released three years ago and includes an overview of their approach to Total Product Lifecycle for AI/ML medical devices:
This includes 4 key areas to be addressed:
- Quality Management Systems (QMSs) – the FDA expects QMSs to be adapted to the specifics of developing AI/ML Medical Devices.
- Initial Premarket Assurance – the FDA wants to have data available to review on the Valid Clinical Association, Analytical Validation and Clinical Validation of the AI/ML Medical Device. This will prove critical in establishing ethical AI and ensuring that bias is accurately recorded or removed from the technology.
- The FDA plans to implement a system of “Predetermined Change Control Plans” – a mechanism of the FDA pre-approving changes to medical devices that include AI components where careful justification and evidence exist to support allowing these changes. – This has now been drafted; see section US FDA Artificial Intelligence Program.
- Transparency and Post-Market Surveillance – the FDA wants to ensure AI/ML medical devices are performing well over time and that developers are being transparent when changes in performance occur.
Summary
Any AI/ML medical device manufacturer should know they are in a rapidly evolving space – this applies to both competition and technology, but also the regulatory landscape. As regulators get a better handle on regulating AI/ML medical devices, expect to see current players experience regulatory troubles if they don’t keep on top of these changes in regulations, standards and guidelines.
However, keeping abreast of and applying the relevant guidance as it emerges, will keep you ahead of any changes and give you a competitive edge. By embedding your compliance and regulatory strategy as part of the wider business strategy, your business will be well-positioned to provide safe, ethical and impactful outcomes for customers and end users.
How 8fold can help you
We at 8foldGovernance are here to support your medical device regulatory needs. We focus on SaMDs and have extensive experience with SaMDs incorporating AI/ML; reach out to us for advice on Regulatory Strategy and keeping ahead of frequent changes in medical device regulations and standards through our Quality Management as a Service.
