FDA Expands on Software
Almost one year ago, I wrote about emerging technologies driving new regulatory pathways, in the context of a “firm-based” authorization for Genetic Health Risk Assessment Systems. The US Food and Drug Administration (FDA) this month, released three documents—a Working Model, a Regulatory Framework, and a Test Plan—to guide and assess the ongoing Software Precertification Pilot Program (“Pilot”) that uses a similar “developer-based” model. In essence, these models establish a shorthand with organizations that have demonstrated competency in their respective markets. It is a hybrid approach that focuses initially on a premarket evaluation of the organization’s ability to produce a safe and effective product instead of focusing on each individual device exclusively. That relationship is then leveraged in subsequent product-specific submissions, so that those regulatory filings, if necessary, may proceed in a streamlined and efficient manner.
The health software ecosystem is particularly amenable to—if not necessitates—this approach due to the faster rate of product innovation/modification and the potential similarities in the underlying iterative process across products. The FDA is attempting to match the digital health industry’s agility with a pragmatic and least-burdensome review process that maximizes transparency to establish and maintain trust over the total product life cycle, through evaluation and monitoring of a software product from its premarket development to post-market performance, underpinned by continued demonstration of the organization’s excellence.
And so, the stage seems set for a subtle shift from premarket product review to post-market surveillance of the product and the pre-certified developer in tandem.
That said, the FDA emphasizes that the bar has not changed. The standard for marketing approval of regulated software remains a reasonable assurance of safety and effectiveness. Moreover, the FDA placed importance on creating efficiency by working within an existing framework, the De Novo pathway (section 513(f)(2) of the FD&C Act), for developer pre-certification. Consequently, the Pilot is applicable to class I and II devices, commensurate with low and moderate risk, where general controls or general and special controls suffice. At this time, the Pilot is also limited to Software as a Medical Device (SaMD), or software intended to be used for one or more medical purposes that perform these purposes without being part of a hardware medical device. This may include functions that use artificial intelligence and machine learning algorithms.
The FDA hopes that the Pilot will give stakeholders a high confidence in pre-certified developers because real-world performance will be used to continuously monitor and improve upon the safety and effectiveness of marketed SaMD products.
Working Model 1.0
The Working Model (“Model”) outlines the four interdependent components:
- Excellence Appraisal—to pre-certify organization
- Review Determination—to determine level of review, with optional pre-submission meeting
- Streamlined Review—to authorize sale of product, if required
- Real-world Performance (RWP)—to monitor organization and product
First, for the Appraisal, a developer seeking precertification must demonstrate a robust culture of quality and organizational excellence (CQOE), which the FDA will evaluate based on five “Excellence Principles:”
- Product Quality
- Patient Safety
- Clinical Responsibility
- Cybersecurity Responsibility
- Proactive Culture
The FDA envisions CQOE to be analyzed over twelve specified domains, further divided into subordinate elements. These elements correspond to certain De Novo request content or special control requirements or Quality System Regulation requirements. Developers must describe how their practices fulfill each element and, also, the Key Performance Indicators (KPIs), either at the organizational or product level, by which those practices are measured and verified.
During the Review Determination, the premarket pathway will be determined by the developer’s precertification status, precertification level as determined by the Appraisal, and the SaMD’s risk category. The FDA envisions leveraging the framework for SaMD risk assessment developed by the International Medical Device Regulators Forum.
Next, the FDA expects that organization-level information collected during the prior two steps will abbreviate and improve subsequent reviews, reducing content the developer would need to submit during the Streamlined Review. In order to establish a reasonable assurance of safety and effectiveness, the Streamlined Review would address the following product-level elements:
- Clinical algorithm
- Clinical performance
- Hazard analysis
- Instructions for use/labeling
- Regulatory specific information (e.g. substantial equivalence for 510(k))
- Product requirements
- Revision history
- Software architecture
Last but not least, the FDA expects pre-certified developers to demonstrate ongoing excellence toward continuous improvement through monitoring and sharing of RWP data related to their SaMD products. Developers will employ data analytics to understand how their products are being used, to identify opportunities for improvement, and to respond quickly and proactively to emerging safety and security signals. Simultaneously, the FDA expects to be in a position to assess safety and security trends in the wider market, which might enable the FDA to identify potential or emerging issues across product classes and to notify developers before product quality is affected.
The RWP analytics (RWPA) framework for post-market product monitoring should provide robust evidence supporting the determination of safety and effectiveness, while retaining sufficient flexibility to accommodate the full range of products and developers capable of demonstrating excellence in digital health. The FDA anticipates RWPA will typically involve three types of analyses, further divided into identified domains and measured through appropriate KPIs. The three analytic types are:
- Real-World Health Analytics (RWHA) – real-world clinical outputs and outcomes related to the intended use of the SaMD product
- User Experience Analytics (UXA) – user experience outputs related to the real-world use of a SaMD product
- Product Performance Analytics (PPA) – outputs and outcomes demonstrating the real-world accuracy, reliability, and security of a SaMD product
At the conclusion of the Pilot, the FDA expects to have confirmed that the evidence collected through the Appraisal, Review Determination, and Streamlined Review of the Pre-cert De Novo request meets the statutory requirements for granting marketing authorization and that excellence at an organizational level is highly correlated to excellence in designing, developing, and testing an individual SaMD product—and maintaining that quality and diligence after the product is on the market.
Success—and projected adoption—ultimately hinges on transparency, both on the part of the FDA in development of the Pilot and reciprocated by organizations to an unprecedented extent in implementation. To this end, there is an ongoing open comment period to solicit feedback, and the FDA has scheduled a webinar to discuss progress on the software precertification program.