The changing landscape of medical technology and the increasingly digital nature of healthcare has created both novel opportunities and new legal problems. Where artificial intelligence and machine-learning computers were once science fiction, they are now a necessity to the growth and profitability of many companies operating in the life sciences sector. Artificial intelligence in the healthcare industry alone is projected to grow to approximately $120 billion in revenues by 2028. Most of this growth is likely to be concentrated in artificial intelligence and machine learning-based software as a medical device (AI/ML-based SaMD).

There are numerous benefits conferred by AI technology, such as near constant tracking of health metrics provided by wearables, as well as surgical robotics that have consistently outperformed their human counterpart. Additionally, the enormous advantage conferred by the software’s ability to learn from real-world use and improve itself while delivering healthcare is revolutionary in the field of healthcare, bioinformatics and medical technology. With the rise of new technologies, the assessment and mitigation of risk, compliance, and quality assurance is becoming more important than ever.

Modern technology has given rise to new legal questions. How does FDA regulate machine-learning computers that are changing so rapidly—given that the approved product may be drastically different than the product that ends up on the market? These questions arise from a lack of understanding of the complex nature of AI/ML-based SaMD, the opaqueness of the regulatory framework, and a dearth of relevant case law. However, with the recent FDA authorization for marketing the first cardiac ultrasound software that uses artificial intelligence to guide the user, the legal community is inching closer to grappling with this complex technology much sooner than imagined.

What Is AI/ML-based SaMD?

Two major uses of medical device software include software as a medical device (SaMD) and software in a medical device (SiMD). While software in a medical device is simply software that helps a medical device function to diagnose, treat or cure a disease, software as a medical device means that the software is, itself, diagnosing, treating or curing a disease. An insulin pump or an MRI machine that has software in the medical device to assist the device in functioning is categorized as SiMD. However, a smartwatch that functions as a blood pressure monitor, wherein the software is the medical device, would be categorized as SaMD. A further wrinkle in typology is the differentiation between the distinct types of algorithms that can be used in SaMD.¹

The use of software as part of a medical device is not novel. In fact, “locked” algorithms have been used in FDA-approved software for many years. Regulation of these locked algorithms is relatively uncomplicated. A locked algorithm is unchanging. Regardless of the availability of new data, the algorithm remains unaffected. However, this is not the case for “adaptive” algorithms. Some AI/ML-based SaMD can use adaptive algorithms to increase the precision of outputted determinations. This means the algorithm and, therefore, the SaMD is constantly changing.

The AI technique utilized in AI/ML-based SaMD is called “machine learning.” It allows a computer program to generate an algorithm and to further adapt that algorithm as more data becomes available. The revolutionary aspect of this type of AI/ML-based SaMD is centered on the fact that the original algorithm will function as part of the software, and through everyday use, the computer program will continuously apply the algorithm to new and larger sets of data. This changes the algorithm over time and so, in theory, these algorithms can make increasingly accurate decisions. An example of this is an adaptive algorithm that was trained using data from approximately 3000 patients. It was then tested on nearly 8000 patients with suspected myocardial infarction. The algorithm surpassed physician performance in correct diagnosis of myocardial infarction.² As the algorithm “learns” and evolves, this creates a moving target as respects its “intended use” which produces enormous problems for regulators.

FDA Regulation of AI/ML-based SaMD

When software is used to treat, diagnose, or cure a person in any way, it falls under the purview of the FDA. Given the complexity of SaMD, the International Medical Device Regulators Forum (IMDRF), which is a consortium of global medical device regulators focused on harmonization of medical device regulations, has produced multiple documents to provide guidance on the regulation of SaMD. The rapid development of AI/ML-based SaMD is apparent by the number of approval applications submitted in recent years to FDA’s CDRH, the unit within FDA that evaluates and approves medical devices before they can be marketed legally in the United States. However, the regulation of a constantly changing algorithm presents a novel challenge for FDA’s current regulatory scheme, which was built for “static” technology, or technology that does not evolve or change its fundamental operation and/or function until it is redesigned by the manufacturer.

Traditionally, manufacturers have had the option to submit their applications to FDA and classify their devices based on predetermined risk categories, using one of agency’s regulatory pathways such as 510(k), De Novo review, or premarket approval (PMA).

In practice, the 510(k) process does not apply to these AI/ML-based SaMD using adaptive algorithms because the technology is novel. The 510(k) process is used to approve medical devices for which there is a “predicate” or similar device already on the market. Further, AI/ML-based SaMD is not a Class III device, which is one that “support[s] or sustain[s] human life” and is “of substantial importance in preventing impairment of human health, or which present[s] a potential, unreasonable risk of illness or injury.” Accordingly, approval through PMA is not possible. This leaves these medical devices with the use of the De Novo process for FDA approval. The De Novo process is a risk-based process of approval used by FDA for medical devices that do not fall into a previously classified category. Once a device is approved through the De Novo process, it may be used for the approval of future devices through the 510(k) pathway. To date, FDA has not approved AI/ML-based SaMD that uses adaptive algorithms because the current regulatory pathways do not allow for approval of a device that constantly improves itself in real-time. On January 21, 2021, FDA published a proposed regulatory framework for regulating locked and unlocked AI/ML-based SaMD. This framework takes a “total product life cycle approach” to regulation to effectively monitor new and improved algorithms.

The framework titled “Artificial Intelligence/Machine Learning (AI/ML)-Based Software as a Medical Device (SaMD) Action Plan” has five parts. It focuses on modifications made to the algorithm after approval and sets out the pathway to premarket review for these modifications. The proposed regulatory framework addresses the constant change of AI/ML-based SaMD through FDA’s “Predetermined Change Control Plan” and “Algorithm Change Protocol,” together which spell out the required disclosures that will facilitate FDA oversight of changes to device algorithms. The manufacturer can pre-specify modifications and describe how the algorithm will change over time along with any safety implications. Once this guidance is published, it will allow manufacturers to identify the type of modification being made, lay out the submission and review process, and it will inform manufacturers of the required information for submission. It will also address monitoring of real-world performance and good machine learning practice (GMLP).

Key to the new regulation will be the manufacturer’s responsibility to explain how the algorithm may change over time as part of the submission to FDA. A point of contention that may arise is the requirement for near constant monitoring and reporting of the device’s performance. As there currently is no statutory requirement or authorization for this type of data disclosure, it will be interesting to see how this proposed regulatory practice will play out.

References

1. Arsene, C. (June 29, 2020). “SaMD vs SiMD: What’s the Difference?” Healthcare Technology.
2. Than, M.P., et al. (August 16, 2019). “Machine Learning to Predict the Likelihood of Acute Myocardial Infarction.” Circulation, vol. 140, no. 11, 2019, pp. 899–909., doi:10.1161/circulationaha.119.041980.