A 5 minute summary of 5 recent FDA guidance documents - May 2023
Understanding FDA's expectations and linkages to risk management.
The US FDA frequently issues guidance documents1 for the industry and its own staff to clarify expectations and approach to regulatory decision making. In theory, these guidance documents are not legally binding. However, it is smart to follow all applicable guidance documents if you want to do business with the FDA and achieve a favorable outcome for your medical device!
Here is a brief summary of 5 recently issued guidance documents and how they link to risk management.
1. A risk-based approach to monitoring of clinical investigations
FDA is mainly concerned with patient safety during a clinical investigation2 and the integrity of the data generated to support the claim of safety and effectiveness of a medical device. Risks to both patient safety and data integrity must be identified and managed during the clinical investigation.
This guidance document released in April 2023 expands on the 2013 guidance for industry Oversight of Clinical Investigations - A Risk-Based Approach to Monitoring. Using a Q&A approach, this guidance provides specific recommendations for the monitoring approach , monitoring plan contents and follow up communication of monitoring results from clinical investigations.
As an example, a risk-based approach should be used to build “quality into the design and execution” of clinical investigations. In practice, this should be done through a clinical investigation procedure that is consistent with the overall risk management procedure and policies. Planning for potential risks to patient safety and data integrity, and taking timely action when new risks are identified during a clinical investigation, is essential.
Download the FDA guidance here.
2. Recommendations for AI/ML enabled medical device software functions
Use of artificial intelligence/machine learning (AI/ML) in medical device applications is increasing rapidly3. Since software applications based on AI/ML are "learning models", frequent changes throughout the device lifecycle are expected.
In this draft guidance, FDA is providing recommendations for a predetermined change control plan (PCCP) for AI/ML enabled devices to support planned changes without the need for a new submission. It is an example of a “forward thinking” regulatory approach to support the development and continued improvement of AI/ML enabled medical devices.
As a best practice, a proposed PCCP should be reviewed with the FDA early in the development process. Early feedback from the FDA can help develop a robust and comprehensive PCCP to include sufficient details about the types of modifications that are anticipated after approval or clearance. A detailed modification protocol which outlines data management and model re-training practices, performance evaluation and update procedures is required. Finally, an impact assessment of anticipated changes needs to be included in the PCCP.
FDA is naturally concerned about safety and effectiveness when planned changes are implemented. It is important to carefully consider the benefit-risk of these changes and document them in sufficient detail in the marketing submission. This is where an effective risk management process can help with the analysis and benefit-risk assessment of each modification.
This guidance also provides examples of elements of the modification protocol components (Appendix A) and different scenarios employing PCCPs (Appendix B).
Download the draft guidance here.
3. Conformance with IEC standards for medical x-ray imaging devices
Medical x-ray imaging devices are subject to regulations for both medical devices4 and electronic product radiation control5. Specifically, section 534 of Subchapter C requires that performance standards be prescribed by the FDA through regulation to control radiation from electronic products for the protection of public health and safety.
In this guidance, the FDA is proposing to harmonize the performance standards per section 534 with applicable IEC6 standards to ensure more efficient and consistent regulatory review of these products. Harmonizing these standards will help to avoid duplication of effort in demonstrating compliance to overlapping regulatory requirements.
Most diagnostic x-ray imaging systems and components are classified as Class I or Class II medical devices. This guidance provides a list of 8 different IEC standards and a correspondence table showing applicability of each standard to specific device type. As an example, device codes EHD and MUH classified under 21 CFR 872.18007 are mapped to IEC 60601-1-38, IEC 60601-2-639 and IEC 60601-2-6510.
In the context of risk management, when applicable requirements of recognized standards are effectively implemented, risk is considered to be reduced to as far as possible. By harmonizing the performance standards with specific IEC standards, the FDA is providing a clear and least-burdensome pathway to demonstrate safety and effectiveness according to regulatory requirements.
Download the full guidance here.
4. Criteria for safety and performance based pathway for soft (hydrophilic) daily wear contact lenses
The safety and performance based pathway11 offers a more streamlined path to receiving a FDA clearance through the 510(k) premarket notification process. FDA is creating a set of performance criteria for certain well understood devices that can be used to establish substantial equivalence without having to conduct comparative testing against a predicate device. This lowers the testing and documentation burden for a new medical device during the regulatory decision making progress.
This specific guidance establishes performance criteria for soft (hydrophilic) daily-wear contact lenses made from three specific materials - polymacon, etafilcon A and hioxifilcon D. Only the spherical and toric designs, similar to currently marketed products are included in the scope.
Performance criteria are defined for each of these 3 materials based on standards. As an example, spectral transmittance for a polymacon based soft contact lens is specified at 93% +/- 5% when tested according to ISO 18369-3 or ANSI Z80.20. Other performance criteria are specified under different categories such as physicochemical and optical properties, mechanical properties, packaging solution properties, sterilization and biocompatibility.
This type of specific guidance accelerates new product innovation by simplifying the testing requirements for regulatory purposes. Evidence of safety and effectiveness can be easily generated using standardized test methods specified in the guidance. When a device meets these performance requirements with adequate statistical confidence, these results can also be used as evidence of effectiveness of risk control measures.
Download the guidance here.
5. Refuse to accept policy for cyber devices and related systems
FDA now has the regulatory authority to require certain information in the premarket submissions to ensure cybersecurity of a medical device throughout the lifecycle12. This guidance outlines the FDA's policy for premarket submissions after March 29, 2023.
These requirements include:
post-market plans for monitoring, identifying and addressing cybersecurity vulnerabilities and exploits,
processes and procedures to ensure reasonable assurance that devices and related systems remain cybersecure,
provide timely updates and patches to address known unacceptable vulnerabilities and critical vulnerabilities that could cause uncontrolled risks,
provide a software bill of materials
FDA is indicating flexibility in implementing this refuse to accept (RTA) policy for submissions submitted before October 1, 2023.
As a result, identifying risks related to cybersecurity vulnerabilities is now expected to be an essential part of the risk management system.
Download the full guidance here.
The term “Clinical investigation” is defined in 21 CFR 50.3 (c). Generally it refers to a clinical study or a clinical trial involving human subjects.
To date, the FDA has approved or cleared more than 500 AI/ML enabled medical device applications. Review the complete list here.
FDA regulates medical devices under section 201(h) of the Food Drug & Cosmetics Act (FD&C).
Electronic product radiation control regulations are covered in section 531 through 542 of the FD&C Act.
IEC: International Electrochemical Commission
21 CFR 872.1800: Extraoral source x-ray system
IEC 60601-1-3: Medical electrical equipment – Part 1-3: General requirements for basic safety and essential performance – Collateral Standard: Radiation protection in diagnostic X-ray equipment
IEC 60601-2-63: Medical electrical equipment – Part 2-63: Particular requirements for the basic safety and essential performance of dental extra-oral X-ray equipment
IEC 60601-2-65: Medical electrical equipment – Part 2-65: Particular requirements for the basic safety and essential performance of dental intra-oral X-ray equipment
See FDA guidance Safety and Performance Based Pathway issued in Sep 2019
The Consolidated Appropriations Act, 2023 was signed into law on Dec 29, 2022, which added Section 524B to the Food Drug and Cosmetics (FD&C) Act to ensure cybersecurity of medical devices.