The Medicines and Health products Regulatory Agency (MHRA) has published a roadmap setting out how it will regulate software and artificial intelligence (AI) medical devices in the UK.
As NHS waiting lists pass 7 million and the CQC’s annual report has warned that the health and care system is ‘gridlocked’ and ‘unable to operate’ with staff struggling to provide good, safe care, hopes are pinned on the MedTech sector to provide solutions.
Software as a medical device (SaMD) and AI as a medical device (AIaMD) are growing in their uptake and complexity. Many products could not have been imagined when existing regulations around medical devices were developed. As MedTech plays an increasingly essential part in health and social care in the UK, the MHRA is seeking to create a regulatory regime that protects patients while also providing certainty to industry.
Building upon the wider reform of the medical device regulatory framework, detailed in the Government response to consultation on the future regulation of medical devices in the United Kingdom, the MHRA announced in September 2021 the Software and AI as a Medical Device Change Programme designed to ensure regulatory requirements for software and AI are clear and patients are kept safe.
The roadmap provides manufacturers with markers for the direction of travel but the substantive guidance documents are still awaited, with the first tranche expected by the end of 2022.
The Roadmap's Objectives
Getting to grips with what medical device requirements mean in the context of software and AI is a challenge for any regulator. The stakes here are high as the aim is for the UK to be recognised internationally as a home of responsible innovation for medical device software that looks towards a global market.
The requirements for software and AI devices must provide assurance that these devices are acceptably safe and function as intended.
The MHRA wants to ensure that the requirements for manufacturers are clear, supported by clarificatory guidance and streamlined processes that work for software, along with tools to enable compliance to be demonstrated. The MHRA is working with British Standards Institute (BSI) in its role as the UK national standards body, to ensure manufacturers can show that their devices meet the requirements.
The MHRA notes that regulatory innovation that departs from international consensus can create an additional burden. With that in mind they are working with other regulators through the International Medical Device Regulators Forum (IMDRF) to strengthen international convergence and consensus on software and AI products. They are also consulting with key partners including the National Institute for Health and Care Excellence (NICE) and NHS England to align requirements domestically.
Certain key elements of SaMD and AIaMD, such as the processing of personal data, are not directly regulated by the MHRA, and so they are also working with the Information Commissioner’s Office and the National Data Guardian to consider these elements.
They will also build on ongoing work taking place to address health inequalities in medical devices, recognising that software and AI must perform across all intended populations and serve the needs of diverse communities.
The Roadmap's Destination
Through a number of work packages, the MHRA describe the problem, the objectives that break down the problem, and the specific deliverables that address the issue.
The work packages include the qualification; classification; pre market requirements; post market surveillance; and cyber security of software devices. The rigour in terms of safety and efficacy, interpretability and adaptivity of AI devices are also to be examined.
Guidance is expected in respect of some key and common issues and a few of these are highlighted below.
- Qualification
There is currently a lack of certainty as to when software qualifies as SaMD which the MHRA will seek to address. Guidance will seek to clarify the distinctions with respect to software including between SaMD versus wellbeing and lifestyle software products; medical devices versus medicines and companion diagnostics; ‘in house’ SaMD; research use only exemption for SaMD; custom made devices; and devices with no medical function.
The MHRA will develop guidance assisting manufacturers to define the intended purpose of their medical device with adequate specificity, identifying what populations are within scope of the intended purpose and understanding how intended purposes link to quality and risk management systems.
The MHRA will also seek to clarify the concept of ‘manufacturer’ for SaMD and the status of those that deploy SaMD via third party websites, an increasingly common practice.
- Classification
The MHRA will ensure classification rules impose safety and performance requirements proportionate to the risk which SaMD applications pose.
Of particular interest is the commitment to explore setting up an ‘airlock process’ for SaMD. It is acknowledged that some manufacturers of innovative products that meet a critical unmet clinical need may struggle to generate evidence in the pre market phase. Accordingly, this process will allow software to generate real world evidence for a limited period of time while being continuously monitored.
- Pre Market Requirements
The MHRA will develop an approach to allow for increased monitoring of a SaMD in the early stages of its lifecycle, ensure SaMD is supported by adequate data on safety, effectiveness, and quality prior to being placed on the market and that requirements are proportionate to the risk the device presents.
- Post Market Surveillance
Manufacturer surveillance systems must ensure safety signals are detected sooner for these products and specific challenges are met, such as the need for change management when rapid updating is required and avoiding degradation in product performance over time.
- Cyber Security
The MHRA will impose cybersecurity and IT requirements to guard against the risks presented by such vulnerabilities and the operational issues presented by legacy devices and systems. Cyber security will be placed in the context of the product’s lifecycle management processes and such issues will be shared responsibilities, most often between the manufacturer, systems manufacturers, and local deploying organisation.
- AI Rigour
There is a lack of clarity on how best to meet medical device requirements for products utilising AI. The MHRA will use existing regulatory frameworks and will develop guidance to better ensure AIaMD placed on the market is supported by robust assurance with respect to safety and effectiveness.
- AI Interpretability
Project Glass Box will develop guidance regarding interpretability of AIaMD to ensure that AI models are sufficiently transparent to be reproducible and testable and that the relationship of human interpretability to usability is made plain.
- AI Adaptivity
Also known as Project Ship of Theseus, this work package will clarify how adaptive AI might fit within existing change management processes required by medical device regulations and, where appropriate, new guidance will be developed.
Conclusions
Software and AI devices could significantly improve patient outcomes and facilitate the transformation to more effective and sustainable models of health and care at a time of urgent need. Ensuring medical device regulation addresses the lifecycle challenges presented by SaMD and AIaMD is particularly difficult when the technology is changing rapidly, covers such a wide spectrum and new applications are constantly coming to market.
Guidance is a sensible vehicle to employ with the advantages of speed, flexibility and the ability to update without always relying on the legislative process. But illustrative examples do not always give the certainty needed and the guidance will need frequent review.
The real test will come when the first drafts are published later this year. The MHRA want to engage patients, the public, healthcare and industry throughout this change programme and most of these work packages will be released first as drafts for wider comment and input before being published.
Please contact us if you wish to discuss the roadmap further.
