As discussed in our 2022 FDA Year in Review, FDA’s 2019 Proposed Regulatory Framework for Modifications to Artificial Intelligence/Machine Learning-Based Software as a Medical Device discussion paper introduced the concept of a predetermined change control plan (PCCP). A PCCP identifies anticipated modifications to an AI-based software as a medical device (SaMD) based on an algorithm’s intended use, retraining and model update strategy. Section 3308 of the Consolidated Appropriations Act, 2023, codified this concept by establishing section 515C of the Federal Food, Drug, and Cosmetic Act (FDCA). The new section authorizes FDA to approve a PCCP submitted in a premarket approval, de novo classification order or 510(k) that would describe planned changes that may be made without impacting the device’s safety or effectiveness (i.e., authorized PCCP). Section 515C also authorizes FDA to require that a PCCP include labeling for the safe and effective use of a device as the ML-DSFs change. Under the April 3 draft guidance, a successful PCCP submission may allow device manufacturers to pre-authorize future device modifications, such as to improve ML-DSFs’ performance on specific patient populations or enhance the safety of a device, without additional marketing submissions.
FDA’s approach to PCCPs in the draft guidance leverages public comments and feedback from the 2019 discussion paper, software risk management concepts from the International Medical Device Regulators Forum (IMDRF), and the total lifecycle principles envisioned in the Digital Health Software Precertification (Pre-Cert) Pilot Program. It also incorporates principles outlined in the White House’s Blueprint for an AI Bill of Rights and reflects FDA’s learnings from reviewing various AI/ML SaMD products. The draft guidance presents a comprehensive approach to help manufacturers and FDA navigate the regulatory complexity presented by AL/ML SaMD, and it sets the stage for FDA to address the new wave of rapidly evolving generative AI tools that have medical device functions and capabilities.
In the draft guidance, FDA differentiates the terms “training data,” “tuning data” and “testing data”:
Training data is data used to build an ML model, including to define weights, connections and components. These should be representative of the proposed intended use populations.
Tuning data (also known as validation data) is data used to evaluate a small number of trained ML-DSFs to explore, e.g., different architectures or parameters. FDA chose the term “tuning” rather than “validation” because the term, as it is used in the ML community, is not consistent with FDA’s definition of “validation” in the device quality system regulation (i.e., “confirmation by examination and provision of objective evidence that the particular requirements for a specific intended use can be consistently fulfilled”).
Testing data is data used to establish a reasonable assurance of safety or effectiveness (performance). This data should be independent of training and tuning data and should come from multiple sites different from the training and tuning data.
By including and having a PCCP approved as part of a marketing submission, manufacturers can avoid the need to submit a premarket approval supplement, new de novo submission or new 510(k) for certain planned or expected device modifications that would otherwise normally necessitate such submissions under applicable regulations. For example, modifications to quantitative measures of ML-DSF performance specifications (e.g., improvements to analytical and clinical performance resulting from retraining based on a new or broader set of data), modifications related to device inputs to the ML-DSF (e.g., new models or versions of a data acquisition system), or limited modifications to the device’s use and performance (e.g., for use within specific subpopulations, such as by retraining on a larger data set) may be appropriate for a PCCP.
Changes that deviate from the PCCP or are not implemented in accordance with the methods and specifications described in the PCCP’s modification protocol would require a new marketing submission. Additionally, modifications that alter the original intended use and indications for use would require a new marketing submission. FDA includes a flowchart to assess whether modifications to a device fit within an authorized PCCP. Modifications to an authorized PCCP itself would necessitate a new marketing submission. For 510(k) submissions, any determinations of substantial equivalence will be made against the version of the device cleared or approved prior to any changes made under a PCCP.
A PCCP, which should be a standalone section within the marketing submission, should include the following:
A range of FDA-authorized specifications for the characteristics and performance of the planned modifications (i.e., description of modifications)
Associated verification and validation testing and acceptance criteria to ensure the device remains safe and effective when modified in accordance with the PCCP based on identified test methods, data and statistical analyses (i.e., the modification protocol)
Documentation of the assessment of the benefits and risks of implementing a proposed PCCP (i.e., the impact assessment).
FDA notes that the PCCP should be described in sufficient detail and in the public-facing portions of the submission (e.g., 510(k) summary, de novo decision summary, premarket approval summary of safety and effectiveness or approval order) in order to support transparency. The PCCP should also comply with the quality system regulation at 21 CFR Part 820, particularly design controls (21 CFR § 820.30), nonconforming products (21 CFR § 820.90), and corrective and preventive action (21 CFR § 820.100).
As discussed below, the draft guidance includes additional information on what applicants should include within their description of modifications, modification protocol and impact assessment sections.
Description of Modifications
FDA expects a PCCP’s description of modification to identify the modifications to the ML-DSF that the manufacturer intends to implement. FDA recommends that a PCCP include only a limited number of modifications that are specific, can be verified and validated, and are described in sufficient detail to permit understanding of such modifications. This recommendation is consistent with the NIST AI Risk Management Framework’s emphasis on explainable and interpretable AI. The description of modifications should also clearly state the following:
If the manufacturer intends to implement the proposed modification automatically (i.e., the modification will be implemented automatically by the software as in the case of self-supervised ML processes) or manually (i.e., the modification requires human input, action, review and/or decision-making before implementation, a technique known as reinforcement learning from human feedback)
Whether the proposed modifications will be implemented uniformly across all devices on the market, or implemented differently on different products because of, for example, unique characteristics of a specific clinical site or individual patients.
The modification protocol section of the PCCP should describe the methods that will be followed when developing, validating and implementing the modifications described in the description of modifications section. FDA lists four primary components that should be included in the modification protocol:
Data management practices (e.g., how input data and reference data will be collected, annotated, curated, stored, retained, controlled and used for the modifications)
Retraining practices (e.g., the objective of the retraining process, a description of the ML model and components that may be modified, the practices that will be followed and triggers for retraining)
Performance evaluation protocols (e.g., triggers for performance evaluation, application of sequestered test data for testing, performance metrics to be computed, the statistical analysis plans that will be used to test performance objectives for each modification, and confirmation that failures in performance evaluation will be recorded and the modification will not be implemented)
Update procedures (e.g., confirmation that the verification and validation plans for modified devices are the same as those performed on the prior version of the device, a description of how software updates will be implemented, a description of how legacy users will be affected by the software update, and a description of how modifications will be communicated to users).
FDA recommends that each of the four primary components be addressed for each modification described in the description of modifications, and that the manufacturer include a description of how the proposed methods are different from or similar to other methods used elsewhere in the marketing submission.
The impact assessment section of the PCCP is intended to document the manufacturer’s assessment of the benefits and risks of implementing a PCCP for the ML-DSF, and the mitigations of those risks, using the manufacturer’s existing quality system as the framework to conduct the impact assessment. FDA expects the impact assessment to do the following:
Compare the version of the device with each modification implemented to the version of the device without any modifications implemented
Discuss the benefits and risks, including risks of social harm, of each modification
Discuss how the activities proposed within the modification protocol continue to reasonably ensure the safety and effectiveness of the device
Discuss how the implementation of one modification impacts the implementation of another
Discuss the collective impact of implementing all modifications.
In addition to discussing the specific impacts of the modifications on the ML-DSF itself, FDA expects the impact assessment to discuss how each modification included in the PCCP impacts the overall functionality of the device (e.g., other device software functions and the device hardware). FDA notes that for some devices, it may be least burdensome to include the content of the impact assessment within the modification protocol section rather than as an independent section of the PCCP.
The draft guidance includes examples scenarios of ML-DSFs that employ PCCPs.
This long-awaited draft guidance provides a useful framework for manufacturers and developers to address anticipated modifications to AL/ML SaMDs. However, it also introduces potential implementation challenges that will require manufacturers to assess the impact of these recommendations on existing quality system processes such as design control, data management practices, risk management plans, adverse event reporting and labeling. The draft guidance also adds to a growing superset of perspectives on the ethical and appropriate design, development and deployment of AI/ML technologies in healthcare from industry coalitions, the World Health Organization, the European Union and the United Kingdom. These evolving frameworks and regulatory approaches suggest an imminent paradigm shift from oversight processes intended for AI/ML-enabled tools that were retrained and updated only occasionally to an approach that accounts for ML models that learn from data in real time or near real time.
Device manufacturers incorporating ML-DSFs into their medical devices should consider submitting comments to the draft guidance. FDA recommends that the public submit comments to the draft guidance (Docket No. FDA-2022-D-2628) within 90 days of publication in the Federal Register, by July 3, 2023.