The Next Act in Regulation of AI/ML - Are you Ready for an EU AI CE-mark?
You can’t scroll through the trade news or a regulatory group online without running into the latest article about regulation of AI/ML in medical devices. Not to be left out of the doom scrolling, here is what I suspect will be my first of many contributions to this topic. The reality is that AI/ML regulation is the Next Big Thing™ in medical device regulatory affairs. Are you ready?
In 2021, FDA released the Artificial Intelligence/Machine Learning (AI/ML)-Based Software as a Medical Device (SaMD) Action Plan, which laid out FDA’s response to stakeholder feedback about the regulation of medical devices that rely on AI/ML algorithms. Since then, FDA has released a draft guidance on creating Predetermined Change Control Plans (PCCPs) for medical devices that rely on AI/ML software. Beyond that, we are still waiting for an established regulatory framework for the evaluation of sophisticated AI/ML medical devices in the U.S.
Not so much in the European Union. I will admit that, until I attended RAPS Convergence this month, I was completely unaware of the pending legislation known as the EU Artificial Intelligence Act that is likely to be enacted as law in the EU in 2024. Originally proposed and drafted in 2021, the Harmonized Rules on Artificial Intelligence (Artificial Intelligence Act) will provide a regulatory framework for the regulation of all AI products, including medical devices. The Artificial Intelligence Act is now under final discussion among member states and will go into effect next year.
Under the framework, medical devices that rely on AI/ML will be automatically classified as High Risk and subject to the regulations thereof. This means AI/ML medical devices will be subject to AI Act compliance and conformity assessment IN ADDITION to those required under EU MDR. Please read that again - just because your AI/ML medical device meets the EU MDR requirements, the AI Act will impose additional requirements and conformity assessments. These include, but are not limited to, data and governance; record keeping; risk management; transparency; and cybersecurity requirements along with lifecycle management of your AI/ML device.
The AI Act is not necessarily written to harmonize with EU MDR. This is important for all AI/ML-enabled medical device sponsors. Furthermore, a decision by the EU Commission on whether conformity under EU MDR can be used to leverage conformity under the EU AI Act is still yet to be determined. It is conceivable, and was openly discussed at RAPS, that economic operators may be required to achieve both a EU AI Act CE-mark and a EU MDR CE-mark for their medical devices.
Manufacturers of AI/ML medical devices need to prepare for imminent global regulation that will increase oversight, documentation, and post-market requirements for these products. PCCPs will be the least of our concerns when it comes to market authorization of these devices. Global concern about the ability of AI/ML to create risk while also addressing the most pressing medical needs of our time will continue to generate diverse and complex regulatory frameworks. Sponsors will benefit from timely intelligence on these issues and quality plans that prepare for the future.
h/t Kenneth Fuh for his presentation at 2023 RAPS Convergence
Image is AI generated using Fotor AI image generator