FDA Unveils Software Pre-Cert Update

Dive Insight:

FDA is developing the precertification program based on the idea that the unique nature and frequent updating of software calls for an alternative regulatory approach than traditional devices. The answer, the agency says, is to shift scrutiny from software products to their manufacturers. If a software developer meets certain standards, their products should be reliable, the thinking goes.

“This program is intended to extend beyond consideration of organizations’ traditional Quality Management Systems and incorporate recognition of excellence in clinical responsibility and cybersecurity practices,” FDA said. “We believe that this approach would provide patient access to critical evolutions of software technology.”

The first draft described two levels of precertification. Level 1 is for firms that demonstrate the culture, processes and systems to create safe and effective software, but don’t have the experience marketing and maintaining software as a medical device. Level 2 is for firms that show the ability to create safe and effective software and have an established track record delivering software as a medical device.

The updated version includes a number of changes and clarifications, drawn from public comments from the first draft. Among them:

• The FDA makes clear that precertification applies to small companies and startups, not just large, established technology and software firms.
• The long-term plan is to precertify not just software as a medical device but software in a device.
• The agency is attempting to align its definition of SAMD with the International Medical Device Regulators Forum, a group that works to harmonize global device regulations. Elements of demonstrated excellence include leadership and organizational support, transparency, people, infrastructure and work environment, risk management with a patient safety focus, configuration management and change control, measurement analysis and continuous improvement of processes and products, managing outsourced activities, requirements management, design and development, verification and validation and deployment and maintenance.
• The program does away with the need for a predicate device, which paves the way for a simpler 510(k) review of traditional devices. FDA says it wants to “streamline” this process, but does not explain how it would do so.

Epstein Becker Green lawyer Bradley Merrill Thompson likes the idea of a program tailored to software and the collaborative approach the agency is taking, but questions FDA’s legal standing to conduct the pilot.

“The 510(k) regulation is pretty specific, and based on a pretty specific statute,” Thompson wrote. “None of the stuff that they are talking about doing in this precertification program is within the 510(k) regulation. Further, we have an elaborate medical device classification system rooted in the statute as well as implementing regulations. The new risk-based stratification for software has no basis in the existing classification scheme at FDA.”

Thompson said FDA needs to answer other questions as well, such as how it will handle inspections and what the appraisal process will entail, since the program calls for a basic shift from appraising technology to appraising organizations.

“So far the project of developing the precertification program has been fun, because it’s been creative and in a sense everything’s been possible,” Thompson wrote, noting the tough issues around FDA’s enforcement role versus industry’s need to innovate still need to be hammered out.