0% READ
FULL TEXT
INTRODUCTION
Adaptive artificial intelligence and machine learning are promising for healthcare by enabling continuous improvement through patient data analysis. However, current regulatory methods, such as those from the FDA and EMA, struggle with the speed of updates, requiring extensive documentation and revalidation. To address this, new oversight frameworks aim to balance innovation with patient safety. The article evaluates the regulatory challenges and approaches taken by the U.S., Europe, and Japan to ensure the efficacy and safety of adaptive AI devices. It reviews the regulatory frameworks and methodologies for assessing the safety and effectiveness of Software as a Medical Device (SaMD) (Candelon et al., 2021).
The advent of AI - based technology represents an ongoing fourth industrial revolution, it has brought with it novel issues concerning the regulatory landscape for such innovative products that have yet to be fully comprehended (Hosoda et al., 2020; Hosoda et al., 2020; Stead, 2018; Topol, 2019; Verghese et al., 2018; Aisu et al., 2022). This poses a challenge for global regulatory bodies like the USFDA (USA), EMA (EU), and PMDA (Japan) due to varying needs, socioeconomic factors, and cultural nuances across regions, complicating regulatory harmonization (Reddy, 2024). Collecting, processing, and sharing personal information presents ethical concerns regarding data security and the risk of online attacks. Accountability is important if decisions lead to negative consequences (Cohen et al., 2020), and transparency is necessary because decision tree data is often stored in an inaccessible 'Blackbox'. Aristotle valued reproducibility and empirical verification of the methods of achieving results over the need for explainability, further, bias is also significant impediment while evaluating societal issues (Coeckelbergh, 2019). The regulation of AI-based devices poses challenges for policymakers in making an overarching policy, for instance, AI mammogram analysis requires diverse data sets to address racial differences such as breast density variations (Babic et al., 2019; Cohen et al., 2020). Organizations like the International Medical Device Regulators Forum are at the forefront of efforts to harmonize these standards.
Some commonly used SaMD includes the AI-enabled application Philips’ IntelliVue Guardian solution (Intellivue, n.d.) (interfaces with blood pressure monitors, oximeters, and ECGs to collect data, predict patterns, and issue alerts before emergencies), the Apple ECG app and Apple Irregular Rhythm notifications, (Benjamens et al., 2020; U.S. Food and Drug Administration, 2018) the Glooko’s Diabetes Management Platform (Doyle-Delgado and Chamberlain, 2020; Glooko, 2025), and the Ginger’s Mental Health Care Platform (Ginger, 2025). AiCure is a drug adherence monitoring SaMD which improves medication adherence, in the U.S., medical advice is often ignored, leading to deaths and financial loss when it can be prevented with this aid (Babel et al., 2021; Ebner et al., 2016; AiCure, 2025). Technologies like ingestible sensors with RFID tags and smart pill dispensers can help track adherence anywhere and anytime (Schreier, 2014; Ebner et al., 2016). Nevertheless, the long-term effects of ingestible sensors on patients must be considered.
INTEGRATING AI INTO HEALTHCARE
AI enables devices to predict outcomes using algorithms and mimic human actions (European Commission, 2020). In the pharmaceutical industry, AI solutions are gaining traction for managing vast health data efficiently-from drug discovery to commercialization-thus saving time and money. AI converts unstructured medical data into actionable insights, reduces biases, and automates repetitive tasks, creating increased industry value (Johnson et al., 2018).
There are three categories in which software can be integrated with a medical device and the best way to distinguish between the three software categories is through the terminology used. SiMD is software integrated into a medical device to enhance its performance. In contrast, SaMD functions independently as a medical device. MDSW is a term used in the EU regulatory framework for software intended for use alone or with other software, as specified in the medical device’s regulation or in vitro diagnostic medical devices regulation (Spanou D, 2013).
REGIONAL REGULATORY FRAMEWORKS
Japan: Regulatory Framework For Updating SaMD
Medical devices in Japan are reviewed by PMDA and approved by MHLW. Japan follows IMDRF risk classifications viz: Class 1, Class 2, Class 3, and Class 4. Class 1 devices need notification or self-certification because of the minimal or no risk to patient safety. Class 2 devices need third-party certification. Class 3 and above need review and approval (Aisu et al., 2022). If the certification standards are established, there is no need for review. When it comes to adaptive SaMD, Japan's regulatory framework requires approval for SaMD because of its adaptive nature.
The successful deployment of adaptive SaMD in the market hinges on the quality of input data, as the system learns and evolves through exposure to new patients. To ensure the efficacy and safety of these modified MDs, both the MHLW and PMDA mandate submission of clinical data and post-marketing change plans (partial and minor) for application review. It is worth noting that the MHLW may approve change applications not solely by reviewing clinical data, but also by verifying whether the changes align with the change plan (Ota et al., 2020). It is expected that this approach expedites the process and allows for more timely access to modified MDs for patients. The quality of input data is of paramount importance in frequently updating AI MD. In Japan, there is a well-established system to collect health data from individuals throughout their lives, starting from before birth. This system was set up under the Next Generation Medical Infrastructure Act, which became effective in 2018. With this data available, there are ample opportunities for academic institutions, government bodies, commercial enterprises, and businesses to conduct research. Notably, there are no concerns regarding the privacy and safe use and retention of personal data of individuals (Ota et al., 2020; Yamamoto, 2022). This feature presents a significant advantage if used responsibly. The regulatory process steps for an adaptive SaMD was illustrated in Figure 1.
EUROPEAN UNION COMMISSION DIRECTIVES
The EU Commission has collaborated with the MDCG to regulate SaMD under the EU Medical Device Regulation (MDR; 2017/745) and IVDR (2017/746) (European Medicines Agency, n.d.), focusing on post-marketing surveillance and the EUDAMED database (Chhaya and Khambholig, 2021). A regulatory framework for AI has been proposed, in the view of categorizing risks into four levels: unacceptable risk, high risk, limited risk, and minimal or no risk (Mason Hayes and Curran, n.d.; European Commission, 2020). High-risk AI will be prioritized, and unacceptable risk AI will be removed from the market, aligning with the MDR classification in article 2(1) for MDSW.
The EU’s drafted legislation that mandates the assignment of EU product conformity and CE marking concepts to all "high-risk" AI applications. Notably, AI in medical devices is deemed high-risk by default. The drafted legislation bears considerable resemblance to medical device regulation concerning core approaches, such as product intended use, post-market monitoring systems, and notified bodies (Figure 2) (Decos, 2023).
The EU-specific solutions that the draft legislation calls for are particularly necessary in three domains. Firstly, EU data protection considerations related to the update problem. Secondly, the relatively less established system for RWP monitoring. Thirdly, the EU's public perceptions concerning the role of AI (Gilbert et al., 2021; Petersen et al., 2021). It is noteworthy that, in the EU's healthcare sector, other factors such as EU core values, political influence, and global competition are of paramount importance and must be duly considered. The draft legislation highlights potential trade-offs, such as those between investment and transparency (black box concept), explainability and accuracy, and accountability (Cohen et al., 2020). Also, the path ahead involves collaborating with SMEs in the field and maintaining a complete life cycle of AI systems, including establishing quality data, risk management, and final withdrawal.
THE USFDA
Medical devices in the U.S. are regulated by the CDRH within the FDA. CDRH oversees device regulation, including approval and post-market surveillance. The FDA classifies devices into three categories: Class I (minimum risk), Class II (medium risk), and Class III (high risk) based on IMDRF guidelines. The current approval process for SaMD is similar to the 510(k)-notification process. Low-risk devices are assumed safe and must follow Good Manufacturing Practices. The FDA primarily uses the 510(k) pathway if there’s an equivalent predicate device. Manufacturers need to prove their product's equivalence for approval. If no predicate exists, sponsors can file for PMA or De Novo for entirely new low to moderate-risk devices (U.S. Food and Drug Administration, 2019). The approval process varies by risk classification (Table 1).
| Part | Title | part | Title |
|---|---|---|---|
| 800 | General Provisions | 801 | Labeling Requirements for Unique Device Identification. |
| 803 | Medical Device Reporting | 806 | Reports of Corrections and Removals. |
| 807 | Establishment Registration and Device Listing. | 810 | Medical Device Recall Authority. |
| 809 | In Vitro Diagnostic Products for Human Use. | 814 | Premarket Approval of Medical Devices. |
| 812 | Investigational Device Exemptions | 821 | Medical Device Tracking Requirements. |
| 820 | Quality System Regulation | 830 | Unique Device Identification |
| 822 | Post-market Surveillance | 861 | Procedures for Performance Standards Development. |
| 860 | Medical Device Classification Procedures. | 862 | Clinical Chemistry and Clinical Toxicology Devices. |
The USFDA Proposed a Framework for Modifications to Adaptive SaMD
The US FDA has approved several SaMD products that use AI and ML algorithms, typically requiring these algorithms to remain unchanged before marketing. If modifications extend beyond the original authorization, FDA premarket review is needed. However, some algorithms can adapt and optimize based on real-world experiences, potentially producing different outputs from those initially approved.
Ensuring device safety is crucial after algorithm changes, as these can either enhance or compromise performance. To address this, the US FDA recommends a TPLC approach (U.S. Food and Drug Administration, 2019). In addition, it's important to set boundaries for the evolving scope of AI/ML-based SaMDs. This includes defining SPS, establishing an ACP, following GMLP, ensuring transparency, and conducting real-world performance monitoring. These elements help ensure continued safety and efficacy amid algorithm modifications.
The PCCP: The USFDA has established a review and approval process for the SPS and ACP, with each device being expected to include a two-component PCCP. The SPS outlines permissible changes to the AI, while the ACP provide a process to ensure modifications maintain safety and effectiveness. Real-world performance monitoring is necessary to confirm ongoing safety and efficacy, while any changes outside the PCCP require a regulatory review. Feedback from various stakeholders has resulted in a 5-point action plan designed to address concerns and enhance the proposed framework (U.S. Food and Drug Administration, 2024; U.S. Food and Drug Administration, 2018).
The Final PCCP guidance issued in December 2024 clarifies regulatory expectations for manufacturers, updating terminology to AI-enabled Device Software Function (AI-DSF) and focusing on device-led combination products. It outlines submission types such as Original PMA, Modular PMA, and 510(k) submissions, and emphasizes the importance of version control and maintenance to ensure changes are managed effectively. The guidance also details an interactive review process, allowing the FDA to request further information if necessary (U.S. Food and Drug Administration, 2024). These updates aim to support innovation in AI technologies while ensuring patient safety and device effectiveness.
Major regulators are also adopting international standards such as the software life cycle, software usability testing, validation, release, and update along with their attempts to regulate frequently modifying AI Medical Devices (Babic et al., 2019). This article provides an overview of the most important standards related to the development of SaMD in the coming section.
A Glance at Software Compliance Standards for SaMD
The term "standard" refers to requirements and specifications that ensure materials, products, processes, and services are fit for their intended purpose. The rise in software use in the medical industry has led to frameworks for its development. To ensure medical device software meets these standards, the ISO and the IEC provide guidelines on development, maintenance, and best practices (Table 2) (Decos, 2023; Stead, 2018; Topol, 2019; U.S. Food and Drug Administration, 2018).
| Standard | Description |
|---|---|
| ISO 13485 | To ensure the quality and safety of SaMD, a QMS incorporates ISO 13485 for overall quality management, IEC 62304 for software life cycle processes, ISO 14971 for risk management, and IEC 62366 for usability engineering; this integrated approach addresses design, risk, usability, and maintenance throughout the SaMD lifecycle. |
| IEC 62304 | |
| ISO 14971 | |
| IEC 62366 | |
| IEC 81001 | This standard focuses on cybersecurity in medical devices, including SaMD. It outlines the necessary security measures throughout the software lifecycle, ensuring that SaMD is secure from development to maintenance. |
| IEC 60601 | While primarily for electrical medical equipment, this standard also includes guidelines for programmable electrical medical systems, which can encompass SaMD. |
| IEC 82304 | This is the specific standard for SaMD, covering general requirements for the safety and security of health software products. |
| ISO 10993 | Although this standard is about biocompatibility, it's relevant if the SaMD interacts with patients at the cellular or bodily fluid levels. |
Developers should follow four standards that constitute a quality management system for full lifecycle traceability and broad acceptance. However, ISO and IEC have not adequately addressed procedures for managing adaptive SaMD.
DISCUSSION
Major regulators are leveraging existing principles to review and approve adaptive AI Medical Devices, saving time and resources (Table 3). The regulatory frameworks for SaMD in Japan, the EU, and the US show both similarities and differences. All three regions use a risk-based classification system and emphasize post-market surveillance and continuous monitoring of AI/ML-based medical devices. The EU's detailed four-level AI risk categorization (Mason Hayes and Curran, n.d.; European Commission, 2020) contrasts with the US and Japan. Each has defined pathways for SaMD approval, like PMDA reviews in Japan, MDR and IVDR frameworks in the EU, and the 510(k), PMA, and De Novo pathways in the US. They focus on maintaining high standards of quality, safety, and effectiveness, requiring clinical data and real-world performance monitoring. However, the EU emphasizes data protection under GDPR (Gilbert et al., 2021), whereas Japan, with its Next Generation Medical Infrastructure Act, has a more flexible approach (Ota et al., 2020; Yamamoto, 2022). The US has HIPAA but it's less comprehensive compared to GDPR (U.S. Food and Drug Administration, 2019). Regulatory processes also differ with Japan's PMDA and MHLW, the EU's centralized MDCG (Aisu et al., 2022; Chhaya and Khambholig, 2021), and the US FDA's CDRH (U.S. Food and Drug Administration, 2019; U.S. Food and Drug Administration, 2018).
| Aspect | Japan | EU | US FDA |
|---|---|---|---|
| Regulations | -Next Generation Medical Infrastructure Act -Oversight by PMDA and MHLW. | -MDR (2017/745) -IVDR (2017/746) -Proposed AI regulatory framework. | -Oversight by CDRH within the FDA -21st Century Cures Act. |
| Risk Classification | Four- level risk classifications. | Four-level AI risk categorization. | Three-level AI risk categorization. |
| SaMD Classification | Adaptive SaMD requires premarket approval. | Conformity and CE marking to all ‘high-risk’ AI application. | SaMD follows similar pathways as other medical devices (510(k), PMA, De Novo). |
| Pre-Market Requirements | -Clinical data submission. -Post-marketing change plans. | -Conformity assessment -Notified Bodies for high-risk devices. -Technical documentation. | -510(k) for devices with predicates -PMA or De Novo for novel devices. |
| Adaptive SaMD Modifications | -MHLW approval based on alignment with pre-defined change plans. | -Generally requires new conformity assessment if changes impact intended use or safety. | -Total Product Lifecycle approach -PCCP, including SaMD Pre-Specifications and Algorithm Change Protocol. |
| Post-Market Surveillance | Required, with emphasis on change management. | Required, EUDAMED is the central database used for enhanced post-market surveillance. | Required, with Real-World Performance monitoring (RWP). |
| Data Usage | Established system for lifelong health data collection. | Stringent GDPR requirements. | Focus on data integrity and patient privacy under HIPAA. |
| Other Considerations | Expedited approvals, focus on input data quality. | EU core values, political influence, global competition, SME collaboration. | Good Machine Learning Practices, transparency, PCCP review process (Original PMA, Modular PMA, 510(k)), version control. |
The ISO and IEC standards are internationally recognized and widely adopted by major regulatory (U.S. Food and Drug Administration, 2019) bodies such as the USFDA, EMA, and PMDA. These standards form the basis for quality management, risk management, software life cycle processes, and usability engineering in medical devices, ensuring safety, effectiveness, and compliance across global markets (NQA, n.d.; IEC 62366, 2023).
The future prospects might include harmonizing regulations through bodies like IMDRF and WHO (World Health Organization, 2021), evolving AI regulations (U.S. Food and Drug Administration, 2019), securing data utilization, especially in Japan, and building public trust through transparency and stakeholder involvement (Gilbert et al., 2021)
CONCLUSION
A SaMD's behavior may change with real-world data from the next patient encounter, making conventional methods laborious. Regulators are considering 'predefined change plans' to be submitted as part of the submission to manage such adaptations. However, not all valuable modifications can be anticipated from the outset. Harmonizing regulatory requirements is complex due to varying data quality, conditions, socioeconomic, cultural, and epidemiological factors, and legal and ethical considerations, in each region. To address regional differences, establish global considerations with added local specifics for SaMD. This approach ensures the global framework adapts to local nuances, enhancing the effectiveness and safety of SaMD across regions.
