The U.S. Food and Drug Administration (FDA) is exploring the development of a new regulatory approach for software as a medical device (SaMD) that the agency believes will promote innovation while still assuring device safety and effectiveness. SaMD is software used for a medical purpose that is not part of a hardware medical device. The new approach is known familiarly as Pre-Cert and relies on a company being certified by FDA as having a culture of quality and organizational excellence.

How Did We Get Here?

When Congress amended the Federal Food, Drug, and Cosmetic Act in 1976 to create a risk-based model for medical device regulation and oversight, the framework was designed for hardware devices that were modified every few months or years and for which clinical and nonclinical data submitted to FDA can provide meaningful information about a device’s safety and effectiveness. Today, software provides diagnoses, therapies, mitigations, and other clinically meaningful information (thus meeting the statutory definition of “device”), and it can be updated to address safety and performance issues in a matter of weeks and days. Further, reviewing software code, unlike reviewing how a hardware device is designed, yields little or no information about the software’s safety and effectiveness. Therefore, FDA believes SaMD is different enough from hardware devices to warrant a different regulatory model.

What is "Pre-Cert"?

The regulatory model that FDA is exploring for SaMD is called “Pre-Cert”—short for precertification. The model is based on a concept familiar to frequent travelers. Just as travelers can be approved by the Transportation Security Administration for expedited screening at airports, FDA envisions some companies being certified as eligible for streamlined premarket review.

How Can a Company Be Precertified?

Precertification is not available yet, and it may be years before the first company can be precertified. Companies who want to be precertified will need to demonstrate they have a culture of quality and organizational excellence. FDA is currently working with nine companies to determine what it means to have a culture of quality and organizational excellence and what requirements should exist for companies seeking precertification. As currently outlined, FDA would evaluate at least the following elements for precertification: product quality, patient safety, clinical responsibility, cybersecurity responsibility, and proactive culture.

Benefits of Precertification

Once precertified, a company would enjoy streamlined (i.e., faster) review of new products or modifications to existing products and a more interactive review experience with FDA staff. In some cases, FDA may determine no premarket review is needed. FDA benefits from not reviewing software, which it does not have the staff capacity or expertise to do, while still having assurance that a company can develop high-quality products. Patients could benefit from access to software for which developers may not have pursued marketing but for the less burdensome regulatory approach. The market is likely to view FDA precertification as confirmation of a company’s sound operations.

Risks of Precertification

The market may reward a company for being precertified by FDA, but patients may not. It is unclear how patients will respond to products that are manufactured by a precertified company compared to products that are reviewed by FDA and determined to be safe and effective. Marketing claims may require additional scrutiny. Further, there may be questions about the applicability of certain legal protections like preemption (which protects manufacturers of some devices from tort claims) if a product is not approved or cleared by FDA. 

What’s Next?

FDA is seeking public feedback on the precertification elements it would evaluate. Some Members of Congress have also expressed skepticism about Pre-Cert, though they acknowledge a new regulatory approach may be necessary to better accommodate SaMD and related products.

We encourage companies to review the precertification materials and consider whether they would want to seek precertification if it moves beyond its current conceptual phase. There may be steps companies can take to improve their likelihood of becoming precertified based on the information available now.