Table of Contents

The Food and Drug Administration (FDA or the Agency), the US regulating authority in the sphere of healthcare products, has published a draft guidance dedicated to a Predetermined Change Control Plan (PCCP) to be included in marketing submissions related to medical devices utilizing Artificial Intelligence / Machine Learning (AI/ML) technologies. The document provides an overview of the applicable regulatory requirements, as well as additional clarifications and recommendations to be taken into consideration by medical device manufacturers (software developers) and other parties involved. At the same time, guidance documents issued by the FDA are non-binding in their legal nature, nor are they intended to introduce new rules or impose new obligations. Moreover, the authority explicitly states that an alternative approach could be applied, provided such an approach is in line with the underlying legislation and has been agreed with the authority in advance. 

The approach described in the guidance is intended to reduce the regulatory burden for medical device manufacturers and also to facilitate the processes and procedures associated with changes and modifications to AI/ML devices already placed on the market. In accordance with the respective regulatory requirements, the changes and modifications described in a PCCP included in the initial application for marketing approval would not require an additional submission before being implemented. At the same time, significant changes falling outside the scope of the said plan would require additional approval should the respective requirements be triggered. 

The document describes, inter alia, the aspects related to update procedures. In particular, the authority explains the approach to be applied with respect to updates the initial medical device manufacturer intends to implement and also outlines the regulatory requirements associated thereto.

Software Verification and Validation

When determining the need for additional software verification and validation, and also the extent they are required to, a party responsible for a medical device should take into consideration such factors as:

• Whether the modifications in question require a different software verification and validation plan in comparison to the one used for the initial device;
• What type of testing will be performed? Will the modified device be validated to function in an integrated environment? 
• In case the device subject to review contains functions other than ML-based ones, how would the changes impact such functions, and how would this impact be assessed;
• In case the device contains other functions described hereabove, how would these functions impact the performance of a modified ML-based function. 

Update Implementation

The guidance also describes the approach to be applied to implement updates introduced by the manufacturer. The questions to be considered in this respect include, inter alia, the following ones:

• The decision-making process related to updates, including the timelines and frequency;
• The way updates should be implemented (for instance, whether they should be implemented automatically or manually by persons using the device in question);
• The approach to be applied in order to achieve very proper performance following the implementation of updates;
• Global or local nature of the updates; and
• Cybersecurity protocols are to be applied when implementing the updates.

Communication and Transparency

The authority additionally emphasizes the importance of ensuring that all the important information related to the device with respect to its safety and proper performance is duly communicated to its users. In this regard, the guidance outlines the following main questions:

• How will the PCCP be described in the public summary document and/or labeling?
• How will updates be communicated to users, including, but not limited to, in updated labeling (e.g., release notes)?
• What information about modifications to the device (e.g., performance) will be communicated to the user?
• How will version information be presented to the user when reviewing device outputs? 
• Will users have the option to review labeling before implementing an update?
• How will any know biases or other performance issues with the potential to result in individual or social harm be disclosed, including, but not limited to, in labeling?
• What information about the population and methods for validation will be provided?
• If patient data from previous device use is available and can be rerun on an updated ML model, will this activity be performed for the available data and will those updated results be available to patients and users? Is there a plan to communicate if patient results before and after an update would provide clinically meaningful differences?

Device Monitoring Plan

Another important aspect addressed in the guidance relates to the device monitoring plan. As explained by the authority, the questions to be considered in this respect include, inter alia, the following ones:

• The approach to be applied in order to ensure adverse events associated with the device are duly tracked, considering the updates;
• Whether there is a plan in place describing the way the real-world performance of a medical device will be monitored (the absence of such a plan should be duly justified); 
• The approach to be applied to identify changes in the actual performance of the device for different subpopulations of patients;
• The way newly identified risks will be addressed;
• The way of action in case of unexpected performance deficiencies identified;
• The approach to be applied with respect to minor issues that do not meet the reporting threshold set forth for adverse events. 

In summary, the present draft FDA guidance outlines additional aspects to be considered by medical device manufacturers involved in operations with ML-based products to accommodate the specific nature of such devices and the risks associated thereto. The aspects highlighted in the guidance address the matters related to monitoring the actual performance of a medical device before and after the implementation of changes and updates, as well as adverse events reporting.

Sources:

https://www.fda.gov/regulatory-information/search-fda-guidance-documents/marketing-submission-recommendations-predetermined-change-control-plan-artificial

How Can RegDesk Help?

RegDesk is a holistic Regulatory Information Management System that provides medical device and pharma companies with regulatory intelligence for over 120 markets worldwide. It can help you prepare and publish global applications, manage standards, run change assessments, and obtain real-time alerts on regulatory changes through a centralized platform. Our clients also have access to our network of over 4000 compliance experts worldwide to obtain verification on critical questions. Global expansion has never been this simple.