In 2011, Marc Andreessen, a venture capitalist, stated “Software is Eating the World”. Ten years later, software development has accelerated and expanded industries that could not have been imagined a decade ago. Automated medical devices are central to this phenomenon and complex software programs with increasingly advanced algorithms are designed to operate with hardware in order to fulfill its intended use. These innovative medical devices are adopting Artificial Intelligence and Machine learning (AI/ML) and Software as a Medical Device or SaMD, where software programs run one or multiple algorithms usually paired with a device or computer which is the main component of a device in the goal of treating, diagnosing, driving or informing clinical management regarding an illness or disease.
The typical regulatory framework assumes that once a medical device is approved (Class 3) or cleared (Class 2) by the FDA, that the configuration and performance of the device is consistent and that any significant software change will require a new regulatory submission as it changes the risk profile of the device. However, in the case of automated machine learning algorithms the power and key feature is that these AI/ML-based SaMD lies within the ability to constantly learn and adapt its algorithm based on new data and real-world experience. The FDA has realized that these adaptive AI/ML SaMD really do not fit within the normal paradigm of medical device regulation and instead a total product lifecycle (TPLC) approach that works within a rapid product improvement cycles as well as maintaining effective safeguards for the device.
The TPLC in summary is designed to allow for ongoing algorithm changes so long that they are implemented according to pre-specified performance objectives, follow defined algorithm change protocols, utilize a validation process that is committed to improving the performance, safety, and effectiveness of AI/ML software, and include real-world monitoring of performance. Figure 2 is a visual representation of the TPLC System.
Like all aspects of the FDA’s oversight, priority and focus is risk based, with two main areas of focus: 1) Significance of information provided by the SaMD to the healthcare decision and 2) State of healthcare situation or condition
The TPLC is based on set principles to ensure that AI/ML-based SaMD is as safe an effective as possible, they include:
- Establishing clear expectation on quality systems and good Machine Learning Practices (GMLP);
- Conduct premarket review for those SaMD that require premarket submission to demonstrate reasonable assurance of safety and effectiveness and establish clear expectations for manufacturers of AI/ML-based SaMD to continually manage patient risks throughout the lifecycle;
- Expect manufacturers to monitor the AI/ML device and incorporate a risk management approach and other approaches outlined in “Deciding When to Submit a 510(k) for a Software Change to an Existing Device” Guidance in development, validation, and execution of the algorithm changes (SaMD Pre-Specifications and Algorithm Change Protocol); and
- Enable increased transparency to users and FDA using postmarket real-world performance reporting for maintaining continued assurance of safety and effectiveness.
Devices that rely on AI/ML are expected to demonstrate analytical and clinical validation, as described in the SaMD: Clinical Evaluation guidance (Figure 3). The specific types of data necessary to assure safety and effectiveness during the premarket review, including study design, will depend on the function of the AI/ML, the risk it poses to users, and its intended use.
FDA’s main focus with this methodology is to ensure the definition and executing of proper change control through planning and coordination. The predetermined change control plan would include the types of anticipated modifications which include SaMD Pre-Specifications (SPS) which are based on the retraining and model update strategy, and the associated methodology. These are the anticipated modification to the “performance” or “Inputs” or changes related to the intended use of the device of the AI/ML-based SaMD. Essentially, this is what the manufacturer intends the algorithm to become as it learns.
Additionally, an Algorithm Change Protocol (ACP) needs to be in place as those changes are implemented to allow for change control that manages risks to patients. The ACP is a step-by-step delineation of the data and procedures to be followed so that the modification achieves its goals and the device remains safe and effective after the modification. On overview of an ACP is in Figure 4.
As mentioned earlier, regarding changes to the SaMD at the early development and initial reviews with the agency, but there is further work and diligence required once the SaMD has received marketing authorization from the FDA. Any further modifications, must go through the FDA’s software modifications guidance, to determine if the changes are outside of the agreed upon SPS and APC, or of the intended use changes with the modifications. In both these are true a new premarket review cycle would be necessary, if not then a revised SPS and APC and review with the agency would be the likely outcome.
In order to fully adopt a TPLC approach in the regulation of AI/ML-based SaMD, manufacturers must work to assure the safety and effectiveness of their software products by implementing appropriate mechanisms that support transparency and real-world performance monitoring. This could include programs that help explain the methodology of the algorithm by reverse engineering its decisions or real time data feeds displayed on a dashboard for visibility and further understanding by interested parties. Transparency about the function and modifications of medical devices is a key aspect of their safety. Transparency may include updates to FDA, device companies and collaborators of the manufacturer, and the public, such as clinicians, patients, and general users.
- Proposed Regulatory Framework for Modification to Artificial Intelligence/Machine Learning (AI/ML)- Based Software as a Medical Device (SaMD) – Discussion Paper and Request for Feedback. Food and Drug Administration.
TPLC – Total Product Lifecycle
AI/ML– Artificial Intelligence and Machine learning
SaMD – Software as a Medical Device
SPS – SaMD Pre-Specifications
ACP – Algorithm Change Protocol