Earlier this week, the U.S. Food & Drug Administration (“FDA” or the “Agency”) released its long-anticipated final guidance (the “Guidance”) on predetermined change control plans (“PCCPs”) for devices that utilize artificial intelligence/machine learning (“AI/ML”) software. FDA’s stated goal for the Guidance is to “to provide a forward-thinking approach to promote the development of safe and effective AI-enabled devices,” and it represents notable progress in the Agency’s scramble to keep with – or at least prevent being too far outpaced by – the rapid pace of AI/ML innovation, as used in digital health technology.
A. The AI Challenge
FDA’s primary challenge in regulating AI-enabled device software functions (“AI-DSF”) has been that the self-modifying nature of these functions simply does not fit within the Agency’s long-standing framework for medical devices, including, more specifically, medical device modifications. Since the Medical Device Amendments of 1976, FDA has kept a relatively firm grasp on post-market device modifications by requiring manufacturers of legally-marketed devices that originally required 510(k) clearance, De Novo classification, or premarket approval (“PMA”) to submit a supplemental 510(k) notification, De Novo request, and/or approval application for post-market modifications that significantly change or modify the device design, components, method of manufacture, or intended use (i.e., modifications “that could significantly affect the safety or effectiveness of the device, or major changes or modifications in the intended use of the device”).[1] However, regulating AI-DSF, which are designed to constantly self-modify, clearly requires a different approach. FDA has publicly contemplated such an approach since at least 2019, when it published its first discussion paper on the subject.[2] Now, almost six years later, FDA’s first final guidance is here.
B. New PCCP Framework
The Guidance begins by acknowledging that the development of AI-DSF is an “iterative process” and that its new PCCP framework is designed to provide a “reasonable assurance” of safety and effectiveness. Rather than requiring AI-DSF manufacturers to receive clearance and/or approval for significant modifications after a device is legally marketed, FDA will require that AI-DSF manufacturers include a PCCP with the initial marketing submission (i.e., 510(k) notification, De Novo request, or PMA application). As part of the pre-market review process, FDA will review the PCCP “to ensure the continued safety and effectiveness of the device without necessitating additional marketing submissions for implementing each modification described in the PCCP.” Rather than review each modification as it occurs – which would be impossible to monitor and assess – FDA will review the human-defined objectives (i.e., algorithms) intended to guide the technology’s ongoing self-modifications.
The Guidance outlines FDA’s recommendations on the content of a marketing submission for a AI-DSF PCCP, which generally includes: (i) a detailed description of the specific, planned device modifications (i.e., the “Description of Modifications”); (ii) the associated methodology to develop, validate, and implement those modifications in a manner that ensures the continued safety and effectiveness of the device across the intended use populations (i.e., the “Modification Protocol”); and (iii) the assessment of the benefits and risks of the planned modifications and risk mitigations (i.e., the “Impact Assessment”). At a lengthy 49 pages, the Guidance goes into granular detail on each of the three elements of a PCCP (i.e., Description of Modifications, Modification Protocol, and Impact Assessment) but caveats that manufacturers should not rely on the Guidance for a “a complete description of what may be necessary to include in a marketing submission for an AI-DSF” – that is, FDA is careful to clarify that the PCCP is only one piece of a marketing submission for an AI-DSF.[3]
The PCCP requirement outlined in the Guidance is broad and applies to both automatic AI-DSF modifications (i.e., modifications that are implemented automatically by software, also known as “continuous learning”), and manual AI-DSF modifications (i.e., modifications involving steps that require human input, action, review, and/or decision-making and therefore are not implemented automatically). Although the Guidance does not explicitly state as much, it is presumed to apply to all future marketing submissions, as it does not include any indication that the requirement would apply retroactively.
C. Looking Ahead
There is no doubt that the fate of FDA policy, especially policy that is implemented solely through informal guidance (rather than notice-and-comment rulemaking) is a bit up in the air in the face of the incoming administration, which has promised big changes and is centered on a platform of de-regulation. In what may have been an attempt to insulate its new policy from reversal during the upcoming administration, the Guidance goes to great lengths to detail all of the stakeholder input that FDA received and considered in constructing the proposed framework between 2019 and 2024 – a move that we usually see when the Agency issues a final rulemaking, but is less common in informal guidances.
However, given that FDA’s first discussion paper (addressing the need to regulate AI-DSF in digital health technology) was published during the previous Trump administration, coupled with the greater push to regulate AI across all industries, this is a rare subset of FDA’s regulatory scheme that could enjoy largely bipartisan support. It remains to be seen whether the upcoming administration will memorialize FDA’s PCCP policy via formal rulemaking, or whether regulators and other key stakeholders will, instead, call on Congress to set the policy for AI-DSF. Either way, the policy outlined in the new Guidance stands, at least for now, and manufacturers of medical devices that utilize AI/ML should begin integrating the preparation of Modification Descriptions, Modification Protocols, and Impact Assessments into their overall product development plans.
FOOTNOTES
[1] See 21 CFR 807.81(a)(3).
[2] See Proposed Regulatory Framework for Modifications to Artificial Intelligence/Machine Learning (AI/ML)-Based Software as a Medical Device (SaMD) - Discussion Paper and Request for Feedback.
[3] See, e.g., 21 CFR 807.87, 21 CFR 860.220, 21 CFR 814.20.