The Food and Drug Administration issued a much-anticipated update on Tuesday detailing how it plans to regulate changes to artificial intelligence-enabled medical devices after the agency has authorized a product.
The agency shared final guidance on what information it wants to see from manufacturers that propose pre-determined change control plans (PCCPs), a new type of regulatory framework that allows for certain modifications to a device after it is on the market.
The FDA first introduced the concept of PCCPs in a 2019 discussion paper about modifications to AI- or machine learning-based devices. Currently, devices on the market that use AI or machine learning are “locked,” meaning the algorithm cannot adapt or change over time.
PCCPs are meant to solve this problem by allowing for performance enhancements through iterative changes, with manufacturers sharing a framework for proposed device modifications as part of premarket submissions to the FDA.
The agency outlined PCCPs for AI-enabled devices in a 2023 draft guidance and expanded the concept to other types of medical devices, such as in-vitro diagnostics, in an August draft guidance.
The final guidance is largely consistent with the 2023 draft but includes a new section on version control and maintenance. The FDA explained that a PCCP may need revisions before the agency can make a determination of safety and effectiveness. The FDA can request additional information through interactive review or deficiency letters, but if the deficiencies remain unresolved, the agency could authorize the device after the PCCP is withdrawn.
So far, the FDA has not authorized any adaptive AI-enabled devices, Jessica Paulsen, associate director of digital health at the FDA’s Office of Product Quality and Evaluation, said during a November digital health advisory committee meeting. However, manufacturers have submitted PCCPs, and the FDA has authorized them for devices across the 510(k), de novo and premarket approval pathways.
Key elements of a PCCP
PCCPs could give device manufacturers more leeway to update AI-enabled devices, but those changes must stay within certain limitations. Any modifications must be consistent with the PCCP authorized by the FDA and must stay within a device’s intended use.
A PCCP should include three components: a description of planned modifications, a modification protocol explaining the criteria for how manufacturers will determine a device remains safe and effective with the planned changes, and an impact assessment that details the benefits and risks of the PCCP as well as risk mitigation plans.
Any planned modifications should be specific and should be able to be verified and validated, the FDA said. Manufacturers should specify if they plan to implement changes automatically or manually. They should also note if the planned modifications will be implemented uniformly across all devices on the market or implemented differently, based on the unique characteristics of a clinical site or individual patients.
The device labeling should explain that it incorporates machine learning and has an authorized PCCP, so users are aware they may need to perform software updates and that the device’s performance may change.
One example shared by the FDA is software used in an intensive care unit that pulls electrocardiogram, blood pressure and pulse oximetry data to detect when a patient is at the onset of physiologic instability and issue an alarm. A manufacturer might propose re-training the AI model with more data to reduce the false alarm rate while maintaining or increasing its sensitivity.
Under a PCCP, that manufacturer could collect data, re-train the AI model and test it to demonstrate that the false alarm was significantly reduced. The company would update the device’s label and communicate the changes to users. Because those changes would be done in concordance with the PCCP, the manufacturer would not need to make a new marketing submission.
However, changes to the AI model to make it predict physiological instability in advance of its onset, which the previous version could not do, would be outside of the scope of a PCCP and would require a new marketing submission.
Changes to a device’s users also fall outside of the scope of a PCCP.
For example, an algorithm that analyzes images of skin lesions to help primary care providers with diagnosis could be updated to work with additional types of cameras under a PCCP, the FDA said. However, a company would need to submit a new premarket application to change the algorithm to be patient-facing.
