The Times They are a-Changin’– So are the FDA Rules on AI

The agency recently posted new recommendations for AI developers who want to update their software as a medical device (SAMD). The document offers what we hope will be a less burdensome way to manage the Predetermined Change Control Plan.

By John Halamka, M.D., President, Mayo Clinic Platform, and Paul Cerrato, senior research analyst and communications specialist, Mayo Clinic Platform.

Bob Dylan said it best, the times really are changing. Although he didn't have the Food and Drug Administration (FDA) in mind when he wrote his protest song, the agency realizes it needs to revise its AI-related software guidelines and regulations to keep pace with an ever-evolving AI landscape. Unfortunately, the acronyms that describe the new regulations can get confusing, including SAMD—software as a medical device, PCCP— Predetermined Change Control Plan, and QMS— quality management system. One of the goals of this blog series is to translate such content into plain English.

FDA recently posted its Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence/Machine Learning (AI/ML)-Enabled Device Software Functioning. If you are not familiar with the AI/ML ecosystem and the traditional way in which the agency usually approves medical devices, a few basics need to be clarified. In the past, the agency was accustomed to approving "hard-wired" devices that remain locked. If a manufacturer wanted to make significant changes to its product, it had to submit new documentation and evidence to justify the changes to the agency— a long, expensive process.

The new draft recommendations will likely require significant documentation, as well. Still, according to one legal analyst: "Essentially, they [developers] will have to periodically write what amount to 'submissions,' but they just don't have to file them with FDA. All that documentation must be in their files should the FDA come to inspect." Others suggest that the agency is now willing to give manufacturers the autonomy for specific, authorized modifications to AI/ML devices.

To understand the draft recommendations, we need to look closely at the Predetermined Change Control Plan (PCCP). FDA explains that the PCCP is: "The documentation describing what modifications will be made to the ML-DSF [machine learning-disease software function] and how the modifications will be assessed. The modifications described in the PCCP include device changes that would otherwise require a PMA [Premarket approval] supplement, De Novo submission, or new 510(k) notification. The PCCP includes a Description of Modifications, Modification Protocol, and Impact Assessment." The new FDA guidelines are important because the agency now appreciates the iterative process involved in software development and deployment. 

With changes in modeling technology, updated patient data that can be incorporated into the algorithms, and the availability of data sets that are more representative of marginalized populations, it would be unethical to insist that SAMD products remain locked. Considering these concerns, the new gauidelines allow developers to make certain post-market updates when change protocol and impact assessment can reasonably assure continued safety and efficacy. Of course, vendors will have to be cautious about such changes, limiting them to well-defined ones that can be verified and validated with established methodology.

If, for instance, a company has real-world evidence to show that its new iteration is more representative of the population it serves, including updated sensitivity, specificity, and area under the curve (AUC) statistics, that would be a strong case for post-marketing changes to its software. Similarly, developers could update the make/model of the equipment used to collect data for AI/ML analysis, allowing the algorithm to communicate with new smartphone models or radiology scanners.

Stakeholders can make comments and suggestions to the FDA regarding the draft recommendations until July 3, after which time it will begin working on the final version. You can provide feedback to the agency at www.regulations.gov.

Over the decades, many in the digital health community have found the FDA slow to act, but the new guidelines suggest it is, in fact, recognizing that "the times they are a-changin."