Latest Developments in FDA's Guidelines for Medical Device Software
The US Food and Drug Administration (FDA) has recently released a new guidance document titled "Content of Premarket Submission for Device Software Functions." This updated guidance aims to provide clearer and more detailed requirements for the documentation of software functions in medical devices, with a strong focus on Software as a Medical Device (SaMD) and AI-enabled functions.
The new guidance differentiates between two types of software used in the medical industry: "Software in a Medical Device" (SiMD) and "Software as a Medical Device" (SaMD). Both SiMD and SaMD are categorized as "device software functions" in the FDA's guidance.
The FDA requires comprehensive documentation on software functions as part of premarket submissions (510(k), De Novo, PMA). This includes software validation, risk analysis, cybersecurity, and functional descriptions to support safety and effectiveness assessments.
For AI and machine learning-based devices, the FDA recommends submitting a Predetermined Change Control Plan (PCCP) describing how modifications to AI algorithms will be managed without needing new approvals for each update. This plan is part of the documentation expectations to maintain ongoing compliance and safety.
General principles of software validation remain essential, requiring thorough testing and verification throughout the device lifecycle, including software used in design and manufacturing.
The FDA guidance also clarifies how to handle devices with mixed software functions (device and non-device) and expectations for documenting the use of off-the-shelf software components, ensuring they do not compromise device safety or effectiveness.
The level of documentation varies by device risk classification and regulatory pathway chosen (510(k), De Novo, or PMA). Higher-risk devices need more rigorous clinical data, quality controls, and detailed software documentation reflecting the increased scrutiny for safety and effectiveness.
The updated FDA guidance tightens and clarifies documentation requirements for regulated medical device software, especially AI-driven functions, to enhance safety, effectiveness, and postmarket oversight while allowing some flexibility for software updates through PCCPs. This affects manufacturers by requiring early FDA engagement, more robust documentation, and tailored plans for software lifecycle management in premarket submissions.
The guidance includes references to legislation like the 21st Century Cures Act (2016) and the 2023 bill which allows the FDA to authorize devices that include Predetermined Change Control Plans (PCCPs) for Artificial Intelligence/Machine Learning updates.
The new FDA software guidance replaces the previous version from 2005 and lists numerous FDA software guidance documents and internationally recognized standards about digital health that should be reviewed when preparing a submission. The guidance also outlines two levels of documentation: Basic and Enhanced, replacing the previous three levels of concern. Enhanced Documentation is required for device software functions that could present a hazardous situation with a probable risk of death or serious injury.
The FDA software guidance covers software that controls medical devices and accessories, firmware, standalone applications, software within general computing platforms, and medical devices with specific hardware and software.
In summary, the updated FDA guidance provides clearer and more detailed requirements for the documentation of software functions in medical devices, with a focus on AI-enabled functions. This affects manufacturers by requiring early FDA engagement, more robust documentation, and tailored plans for software lifecycle management in premarket submissions.
- The FDA's new guidance differentiates between two types of medical software: Software in a Medical Device (SiMD) and Software as a Medical Device (SaMD), both falling under the category of "device software functions."
- The guidance requires extensive documentation on software functions as part of premarket submissions, including software validation, risk analysis, cybersecurity, and functional descriptions to support safety and effectiveness assessments.
- For AI and machine learning-based devices, the FDA recommends submitting a Predetermined Change Control Plan (PCCP) to manage modifications to AI algorithms without requiring new approvals for each update.
- The updated guidance covers various software types used in medical devices, such as those controlling devices and accessories, firmware, standalone applications, and software within general computing platforms, aiming to enhance safety, effectiveness, and postmarket oversight.
