The new article highlights the aspects related to the general approach to the changes related to software products and also describes the most important concepts used.
Table of Contents
The Food and Drug Administration (FDA or the Agency), the US regulating authority in the sphere of healthcare products, has published a guidance document dedicated to marketing submission recommendations for a Predetermine Change Control Plan (PCCP) for an artificial intelligence/machine learning (AI/ML)-enabled device software functions (ML-DSFs). The said plan is supposed to describe in detail the changes the software will undergo after being initially placed on the market. In such a case, additional applications for marketing approval for such changes would not be required.
It is important to mention that FDA guidance documents are non-binding in their legal nature, nor are intended to introduce new rules or impose new obligations, but rather to provide additional clarifications regarding the applicable regulatory requirements, as well as recommendations to be followed by medical device manufacturers (software developers) and other parties involved in order to ensure compliance thereto. Moreover, the authority explicitly states that an alternative approach could be applied, provided such an approach is in line with the existing legislation and has been agreed with the authority in advance. The authority also reserves the right to make changes to the guidance and recommendations provided therein, should such changes be reasonably necessary to reflect corresponding amendments to the underlying regulations.
Terms and Definitions
First of all, the authority provides definitions of the most important terms and concepts used in the context of healthcare products utilizing AI/ML-based solutions. These definitions include inter alia, the following ones:
- Device Software Function (DSF): a software function that meets the device definition in section 201(h) of the FD&C Act. The authority also mentions that the term “function” is used to describe a distinct purpose of the product, which could be intended use or a subset of the intended use of the product.
- Training Data stands for the data used by the ML-DSF manufacturer in procedures and ML training algorithms to build an ML model, including to define model weights, connections, and components. It is important to mention that due to the specific nature of the products in question, this happens after them being actually placed on the market.
- Tuning Data – the type of data used by the ML-DSF manufacturer to evaluate a small number of trained ML-DSFs in order to explore, for example, different architectures or hyperparameters. According to the guidance, this usually takes place at the last stage of the development process before testing. The authority also mentions that even still the word “validation” is sometimes used with respect to such operations, such use is not something recommended.
- Testing Data – the data used to characterize the performance of the ML-DSF. At this stage, additional actions are to be taken in order to collect additional data supporting the claims of the manufacturer with respect to the safety and effectiveness of the product in question. The authority additionally emphasizes that testing data should be independent of data used for training and tuning and should be from multiple sites different from those that were used to generate training and tuning data.
- Modification Protocol – the documentation describing the methods that will be followed when developing, validating, and implementing modifications delineated in the Description of Modification section of the PCCP. According to the guidance, the Modification Protocol includes the verification and validation activities (including pre-defined acceptance criteria) for those modifications and is intended to provide a step-by-step delineation of how the modifications proposed in the PCCP will be implemented while ensuring the device remains safe and effective.
- Impact Assessment stands for the documentation of the assessment of the benefits and risks of implementing a proposed PCCP, as well as the plan for risk mitigation (it could be a separate section of a PCCP or incorporated into the Modification Protocol, whichever is least burdensome for a particular marketing submission).
Regulatory Policy: Key Points
The authority acknowledges the specific nature of the softened development is an iterative process where the changes are implemented in order to improve the products. At the same time, the FDA emphasizes the importance of ensuring the proper evaluation takes place with respect to the potential impact such changes could have on the safety and effectiveness of a medical device. Should it appear that the intended use, safety, or effectiveness of a medical device is affected significantly by such changes, the appropriate marking submission should be filed by the medical device manufacturer.
As it was mentioned before, a PCCP approved by the authority contains information about modifications that, if implemented separately, would require a new marketing submission under the respective regulatory framework. In terms of the decision-making process related to changes to software-based products, the authority refers to the appropriate guidance documents. In particular, an authorized PCCP includes the “range of FDA-authorized specifications” for the characteristics and performance of the planned modifications to the device, along with the associated verification and validation testing and acceptance criteria to assure the device remains safe and effective across relevant patient populations and documentation of the assessment of the benefits and risks of implementing a proposed PCCP. This approach is based on the idea that the changes described in an authorized PCCP have already been reviewed by the authority in the course of review of the initial application, hence, do not require additional authorization before being implemented.
In summary, the present FDA guidance provides definitions of the most important terms and concepts used in the context of AI/ML-based medical devices and also describes the basics of the regulatory approach to be applied with respect to the changes thereto. The document pays special attention to the legal nature of a PCCP and the information it should contain.
How Can RegDesk Help?
RegDesk is a holistic Regulatory Information Management System that provides medical device and pharma companies with regulatory intelligence for over 120 markets worldwide. It can help you prepare and publish global applications, manage standards, run change assessments, and obtain real-time alerts on regulatory changes through a centralized platform. Our clients also have access to our network of over 4000 compliance experts worldwide to obtain verification on critical questions. Global expansion has never been this simple.
