Regulatory Environment For AI Software In Healthcare

From Clinfowiki
Jump to: navigation, search


Existing regulations for medical device software are mainly focusing on software that is embedded in hardware medical devices. Today, artificial intelligence and machine learning medical device softwares are able to attain intended medical purposes without hardware medical devices. Traditionally, the FDA reviews medical devices through Premarket clearance (510(k)), De Novo classification, or Premarket approval [1]. Depending on the impact or risk posed to patients, the FDA also reviews modifications to medical devices, including software as a medical device (SaMD). Modern days artificial intelligence and machine learning SaMD should not be evaluated by FDA’s traditional medical device regulation. The FDA created a framework for new development and modifications to AI-based SaMD based on IMDRF category principals. International Medical Device Regulators Forum (IMDRF) is a voluntary workgroup composed of AI regulators that developed a path for standardized AI regulations. Software as a Medical Device (SaMD) is Software for one or more medical purposes that perform these purposes without a hardware medical device [2].

Framework: SaMD can be described in 3 components: SaMD inputs, such as patient data; SaMD algorithms such as inference engine, equations, and analysis engine model based logic; SaMD outputs, such as inform, drive, diagnose, and treat [2]. The FDA’s regulatory framework starts with a Market Application, which includes a definition statement and category (I, II, III, or IV) based on IMDRF principles. The category is based on the risk associated with the use of the proposed AI solution. Depending on the category defined, data requirements necessary for regulation may include: Premarket notification (or 510(k)); De Novo request (no similar product exists on the market for comparison); Premarket Application, which is reserved for high risk AI applications.

Definition Statement Definition Statement is required for every SaMD application and is used to identify the submission category. The definition statement defines risk and subsequent data requirements. The goal is to clearly identify the intended medical purpose of the model and include the intended population for the application. Also to identify the intended users of the SaMD model.


The SaMD Category is defined based on a risk framework developed by the IMDRF. In the framework, risk is set by the intended use of the SaMD and the health situation it targets. SaMD regulations place devices into four categories. The four categories are based on the levels of impact on the patient or public health. Category I has the lowest impact and Category IV has the highest.

-Category I devices have the lowest impact and risk.

-Category II devices are medium to moderate risk.

-Category III and IV applications require pre-market approval which is the strictest regulatory category. These are applications with high risk, such as life-supporting, life-sustaining AI software. All of the above categories require general controls. General controls require that all AI software comply with three components: Quality system regulations; Good manufacturing practices; Properly labeled under FDA regulation.

Clinical Evaluation Process

All AI applications require regulatory approval and must include general controls. Clinical Evaluation Process is part of general controls. The IMDRF defines the clinical evaluation process as ongoing activities to assess, analyze, and monitor a SaMD’s clinical safety, effectiveness and performance. The Clinical Evaluation Process includes three components: Valid Clinical Association, Analytical Validation, and Clinical Validation.

-Valid Clinical Association: Evaluate the extent to which the SaMD’s output is clinically accepted or well-founded, and accurately corresponds to the healthcare situation and condition identified in a real-world setting.

-Analytical Validation: Evaluates whether the AI solution correctly processes input data to generate accurate and reliable data.

-Clinical Validation: Measures the ability of a SaMD to create a meaningful result associated with the target use of SaMD in the healthcare situation or condition that the software targets. Clinical validity is evaluated and determined by the manufacturer from the development of a SaMD, which is the pre-market development, to after the distribution of the SaMD, which is the post market performance. The IMDRF identifies that the clinical validation process is a necessary component of regulation. The process can be done by referencing existing data from studies conducted for the same intended use;. referencing existing data from studies conducted for a different intended use, where extrapolation of such data can be justified; generating new clinical data for a specific intended use[4].

Summary Under this framework, the FDA can monitor the performance of the artificial intelligence and machine learning-based SaMD. The manufacturers will also be transparent of their software. Any adverse event associated with the AI solution must be reported. This regulatory environment enables the FDA and manufacturers to assess and track AI software products throughout pre-market development to post-market performance [3]. This framework allows the FDA’s regulation to embrace the new development of artificial intelligence and machine learning-based SaMD, while assuring patient safety.


1. Center for Devices and Radiological Health. Artificial Intelligence and Machine Learning in Software [Internet]. U.S. Food and Drug Administration. FDA; [cited 2020Oct27]. Available from:

2. US FDA artificial intelligence and machine learning discussion paper [Internet]. [cited 2020 Oct 27]. Available from:

3.Final Document. Device Regulators Forum [Internet]. [cited 2020 Oct 27]. Available from:

4. [cited 2020b Oct 27]. Available from:

Submitted by (Sherwin Kuo)