Clinical Evaluation (IMDRF)

AI/ML-Based SaMD Action Plan

Understanding Software as a Medical Device (SaMD):

According to FDA and the International Medical Device Regulators Forum (IMDRF), SaMD is defined as software intended for medical purposes that performs those purposes without being part of a hardware device. FDA regulates SaMD based on:

• Intended use (diagnosis, prediction, monitoring, etc.)
• Risk level and clinical impact
• Output reliance by healthcare professionals

SaMD may undergo premarket notification (510(k)), De Novo classification, or premarket approval (PMA), depending on its risk classification.

Mobile Medical Applications and Wellness Apps:

FDA distinguishes between:

1. Regulated MMAs: Apps that turn mobile platforms into regulated medical devices (e.g., apps for ECG reading)
2. Low-risk wellness apps: Apps promoting a healthy lifestyle without claims of treating disease (e.g., meditation or fitness apps)

Only MMAs with diagnostic, therapeutic, or monitoring functionalities require FDA oversight.

Clinical Decision Support (CDS) Software:

FDA’s final guidance on CDS software (2022) clarifies whether such software is subject to device regulation. A CDS tool is not regulated if:

• It does not acquire, process, or analyze medical images/signals
• It supports, but does not replace, clinical decision-making
• Its logic and recommendations are transparent to users

Otherwise, the software may be considered a device and subject to regulatory review.

AI/ML-Based Software and FDA’s Evolving Approach:

Artificial Intelligence and Machine Learning tools are increasingly used in diagnostics, imaging, and treatment planning. FDA’s current regulatory position involves:

• Premarket review for locked algorithms
• Use of De Novo pathway or 510(k) where applicable
• Development of a “Predetermined Change Control Plan” for adaptive algorithms

FDA’s AI/ML-Based SaMD Action Plan also emphasizes transparency, real-world performance monitoring, and a lifecycle regulatory approach.

Digital Health Software Precertification (Pre-Cert) Pilot:

Although discontinued in 2022, the FDA’s Pre-Cert Pilot Program provided valuable insights into a modern regulatory framework based on software developer excellence. Learnings from this initiative may inform future models of regulation focused on continuous learning and risk-based reviews.

Cybersecurity and Interoperability Requirements:

FDA requires digital health tools—especially those connected to networks or other devices—to incorporate cybersecurity measures such as:

• Secure data transmission and storage
• User authentication and access control
• Software update mechanisms
• Incident detection and response

Device interoperability and standards compliance are also essential to ensure system-level performance and patient safety. These measures are often aligned with GMP validation practices in traditional device manufacturing.

FDA’s Digital Health Center of Excellence:

The Center of Excellence (CoE), established within the Center for Devices and Radiological Health (CDRH), serves as a hub for digital health innovation, regulatory clarity, and stakeholder engagement. It provides:

• Policy development and guidance interpretation
• Pre-submission consultations
• Coordination with global regulators and standards bodies

Steps to FDA Compliance for Digital Health Developers:

1. Determine if the software meets the definition of a medical device
2. Map intended use and functionalities to risk classification
3. Identify applicable regulatory pathways (510(k), De Novo, PMA)
4. Conduct validation testing, including usability, clinical evaluation, and cybersecurity assessments
5. Prepare comprehensive documentation per FDA expectations
6. Submit for premarket review or claim exemption as applicable

Case Examples of FDA-Approved Digital Health Products:

• Apple Watch ECG app: Cleared as a Class II medical device
• Propeller Health: FDA-cleared inhaler monitoring app
• IDx-DR: First autonomous AI diagnostic tool approved for diabetic retinopathy

FDA Compliance and Postmarket Obligations:

After market entry, developers must ensure continued compliance by:

• Adhering to Quality System Regulation (QSR)
• Monitoring software performance and adverse events
• Maintaining accurate labeling and user documentation
• Updating software with version control and postmarket surveillance plans

Integration with Stability testing protocols may be necessary for devices that interface with medicinal products or biologics.

Challenges and Evolving Landscape:

Digital health developers face several challenges including:

• Uncertainty in classification and enforcement
• Cross-border regulatory inconsistencies
• Balancing innovation speed with compliance
• Ongoing updates in FDA policies for AI/ML

Best Practices for Developers and Sponsors:

1. Engage with FDA early through Q-submission process
2. Document software development lifecycle rigorously
3. Adopt standards like ISO 13485, IEC 62304, and ISO 14971
4. Utilize SOP templates for traceability and audits
5. Establish cross-functional regulatory, cybersecurity, and clinical teams

Conclusion:

FDA’s digital health regulatory framework is designed to foster innovation while ensuring public safety. As digital tools become central to modern healthcare, developers must navigate this evolving landscape with agility and compliance readiness. Leveraging FDA guidance, industry best practices, and strategic planning will be key to successful product development and market adoption in the dynamic field of digital health.