As more medical devices incorporate artificial intelligence, regulators are finding ways to handle frequent software updates.
One new framework is pre-determined change control plans, where companies can pre-specify what changes they intend to make to devices once on the market. This is a departure from the norm, where companies typically have to file a submission with the Food and Drug Administration for changes that could affect a device’s safety or effectiveness. The FDA has already authorized PCCPs after a 2023 draft guidance and issued final guidance clarifying its expectations in December.
In interviews with MedTech Dive, experts said PCCPs could be a bridge to more automated software updates. However, many manufacturers still have not used them, either because they aren’t comfortable with the framework or haven’t planned far enough ahead for their products.
Here are five tips on navigating PCCPs:
1. PCCPs will likely survive regulatory uncertainty
It’s not clear how the FDA will regulate AI in medical devices under President Donald Trump. In the first days of his presidency, Trump issued an executive order revoking previous Biden administration efforts around AI and calling to “sustain and enhance America’s global AI dominance.”
Experts said the administration could roll back some FDA requirements, but they expect the PCCP concept to stay, given the positive reception by the medical technology industry.
Michele Buenafe, an attorney who leads the FDA and healthcare group practice for Morgan Lewis, said the framework was formalized when Congress gave the FDA the authority to clear and approve PCCPs in its 2022 omnibus spending bill.
Megan Robertson, an attorney at Epstein Becker Green, also expects PCCPs are here to stay.
“Given that the whole point of the PCCPs is to make things easier for developers,” Robertson said, “I would be surprised if the new administration severely pulled back on PCCPs or somehow limited the use of PCCPs.”
2. Is a PCCP the right approach?
Beacon Biosignals, a company that makes devices to measure brain activity and sleep, has two PCCPs authorized by the FDA. One is for software to do sleep scoring in a clinic, and the other is for Beacon’s Dreem 3S, a wearable headband for sleep monitoring at home.
Alexander Chan, vice president of analytics and machine learning at Beacon Biosignals, said the plans allow the company to retrain its algorithms to improve performance as it gets more data.
Chan said the company took this approach to ensure its device performs well in subpopulations it is indicated for and to keep up with changes in clinical practice.
“If we do not continue to update our algorithms, then you risk having optimized to some population that might have been what clinicians were treating in the 80s, but it’s no longer relevant now,” Chan said. “That part was really important for us.”
Companies must remember several factors when considering a PCCP. The FDA specifies that changes must be necessary to maintain or improve a product’s safety and effectiveness, and the updates can’t change the intended use of a device. Companies also have to submit a modification protocol to the FDA and follow that same procedure every time, Robertson said.
The framework makes sense for devices where routine changes or modifications would be required, such as calibrating with new operating systems, Robertson said.
“Based on the nature of AI,” Robertson added, “it should be a discussion for most, if not all AI- or ML-enabled device functions.”
3. Have a roadmap
Companies that want to consider a PCCP should plan ahead for updates, experts said.
“You shouldn’t go to the FDA unless you know where your product is going,” said LaDale George, a partner at Perkins Coie, adding that companies should be able to explain why the device is going in that direction.
Ashkon Rasooli, founder and CEO of medical device consulting firm EnGenius Solutions, said the first question a company should ask is if they have a roadmap.
The PCCP framework allows companies to essentially frontload FDA review for changes to a device, Rasooli said, but “often in the industry, companies only have plans … for the next upcoming release.”
As a result, Rasooli said he has seen some uptake, but not widespread use of PCCPs as a regulatory strategy.
4. Details are essential
Beacon Biosignals’ Chan said his main advice to other developers, based on his experience getting two PCCPs through the FDA, is to think through all of the details of the changes they’re proposing. For example, Beacon Biosignals had a validation plan to show how the team would ensure updates are safe and effective, and prove that by having a representative dataset, the results would generalize to real populations.
Similarly, Rasooli said the main concern he hears from the FDA is a lack of detail. Early conversations with the agency can mitigate those critiques. In the final guidance, the FDA also recommended that developers use its Q-submission program to get feedback before submitting a PCCP.
“It’s very difficult for manufacturers to release the secret sauce of their algorithm, if they know it,” said George of Perkins Coie, but providing “some basic level of transparency” to the FDA is important in evaluating changes later.
5. Plan the rollout of changes
Erez Kaminski, founder and CEO of Ketryx, a software development firm, said that PCCPs can be challenging for medical device companies because they’re not used to this type of change management.
“Years ago, people found in medicine that no one wants to release on a daily or weekly or monthly cadence, but now we’re hearing a lot of companies that want to do that,” said Kaminski, who makes software for regulatory compliance.
Developers must be able to answer what they plan to change, how they will manage the life cycle of the data, how they will perform the change, and how they will evaluate if the change went well, Kaminski added. This all should be documented.
Companies should also develop a plan for how they will notify customers about changes after a product is on the market, said Morgan Lewis’ Buenafe. For example, they would need to update the device’s labeling to reflect that an algorithm was faster or had improved sensitivity or specificity.
Buenafe also cautioned that the guidance is not a guarantee the FDA will be comfortable with every application that includes automated changes, which may bring up more complicated issues. However, she said, “I do think that they are intending this to be something that will leave that door open.”
link