Developments in 2018

In 2018, FDA focused on executing its 2017 Digital Health Innovation Action Plan, which laid the foundation for the digital health pre-certification pilot program and several cross-cutting guidance documents. The agency presented a “working model” for the pilot Digital Health Software Precertification (Pre-Cert) Program, which is intended to be a voluntary pathway to enable a more streamlined review for software as a medical device (SaMD). The model described proposed criteria to pre-certify companies, the pre-market review process for companies that successfully complete the pre-certification process and post-market surveillance obligations for SaMD under the program. The proposed Pre-Cert Program elements include:

• An “Excellence Appraisal” and determination of the pre-certification level

• Review of pathway determination

• Streamlined pre-market review process

• Monitoring real-world performance

The Excellence Appraisal is among the more forward-thinking aspects of the proposed pre-certification program. It involves a comprehensive assessment of the sponsor’s compliance culture, operations, and infrastructure with respect to five excellence principles: patient safety, product quality, clinical responsibility, cybersecurity responsibility, and proactive culture. FDA proposes to assign one of two pre-certification levels based on how a company or sponsor satisfies the excellence principles and whether it has demonstrated a track record in delivering software products.

The Excellence Appraisal involves a comprehensive assessment of the sponsor's compliance culture, operations and infrastructure.

FDA also plans to rely upon the SaMD risk classification criteria described in the International Medical Device Regulators Forum (IMDRF) risk categorization guidance to determine the pre-certification level and the appropriate review pathway. Review pathways could include streamlined versions of traditional market pathways such as 510(k) review or other approaches. FDA is also developing plans to collect and interpret real-world data about SaMD marketed under the pre-certification program to facilitate post-market surveillance requirements. In 2019, FDA plans to provide a progress update and further details regarding the proposed pre-certification program derived in part on its ongoing collaboration with current pilot program participants.

While the pre-certification pilot program featured heavily in FDA’s 2018 digital health agenda, the agency also issued notable guidance documents on cross-cutting topics for digital health and traditional medical devices. The following is a list of notable guidance and activities in 2018:

• Content of Premarket Submissions for Management of Cybersecurity in Medical Devices draft guidance (Oct. 2018): provides recommendations to sponsors on ways to address cybersecurity in pre-market submissions for medical devices with cybersecurity risks

• Federal Register Notice “Prescription Drug-Use-Related Software” (Nov. 2018): announced the establishment of a docket to seek early input from the public on the agency’s proposed framework for prescription drug-use-related software

• The FDA Memorandum of Agreement (MOA) with the US Department of Homeland Security: implements a framework for greater coordination and information sharing about potential or confirmed medical device cybersecurity vulnerabilities and threats

Looking Ahead to 2019

Data strategy and cybersecurity will continue to be a significant area of regulatory focus for FDA in 2019. Cybersecurity risk management principles and strategies are becoming a key component of quality management for SaMD and traditional medical devices in the wake of hacking incidents and related recalls. FDA will also focus on developing criteria and guidelines for developing and “tuning” algorithms and other tools that incorporate artificial intelligence (AI) or machine learning. FDA may seek input from thought leaders on criteria and processes to assess the safety and effectiveness of AI-driven SaMD prior to launch and to conduct ongoing or predictive risk assessments as the tools “learn” in a post-market environment.     

Read more on FDA 2018 Year in Review.