The UK has reaffirmed its commitment to leading the way in regulatory innovation in software as a medical device (“SaMD”) and artificial intelligence as a medical device (“AIaMD”). On 17 October 2022, the UK Medicines & Healthcare products Regulatory Agency (“MHRA”) published its Guidance on “Software and AI as a Medical Device Change Programme – Roadmap.” It builds on the Government response to consultation on the future regulation of medical devices in the UK and follows on from the Software and AI as a Medical Device Change Programme, which was published in 2021. The MHRA has provided deliverables, which map out a course for change to the regulation of this sector.
The MHRA’s primary aim is “to protect patients and public whilst ensuring that we accelerate responsible innovation.” To achieve this, MHRA places emphasis on (A) safety; (B) clarity and streamlined processes (facilitated through guidance and designated standards); and (C) removing friction through a joined up offering for digital health in the UK and strengthening international convergence.
At its core, the MHRA’s approach to developing the Roadmap is “patient centred” (noting that AIaMD raises broad questions for society) and highlights need for innovation in this sector to be inclusive across all populations. The MHRA also wants to support manufacturers and so wants to provide tools to demonstrate conformity (working with BSI to develop standards and tools) and wants to reduce regulatory burdens on industry by driving international consensus. To achieve this the MHRA intends to update the legislative regulatory framework for SaMD/AIaMD. However, the majority of changes will be introduced through guidance. The MHRA highlights that this approach is supported across the government and it has considered related areas of law when developing this framework for medical devices.
The MHRA sets out a number of work packages (some as standalone packages and others nested within others). Each package includes (i) a problem statement; (ii) the objectives that breakdown the problem; and (iii) specific deliverables that the MHRA will use to meet the objectives. We have not covered them in detail but, in summary, these work packages cover:
- WP 1 Qualification – the MHRA will address the lack of clarity on what qualifies as SaMD and software in a medical device, help manufacturers craft an intended purpose and clarify the concept of “manufacturer” for SaMD.
- WP 2 Classification – reclassify software so the classification rules are proportionate to the risk. The MHRA will reform the classification rules, explore the “airlock process” and provide guidance.
- WP 3 Premarket Requirements – premarket requirements for software will be clarified so the requirements fit software. The MHRA list six deliverables including reviewing the essential requirements, providing “Best practice” for development and deployment plus providing guidance on a number of topics (retrospective non-interventional studies, joint guidance with the Health Research Authority on governance of research and the importance of human-centered SaMD).
- WP 4 Post Market – the MHRA highlights that it needs to obtain stronger safety signals for SaMD. The MHRA will look at adverse incidents for SaMD, change management plus predetermined change control plans/protocols and best practice for expanding the intended purpose of medical devices.
- WP 5 Cyber Secure Medical Devices – the current regulations do not consider cyber security vulnerabilities. The MHRA will consider cyber security requirements, management of unsupported software devices (i.e., when manufacturers exit the market) and reporting of vulnerabilities.
- WP 9 AI RIGOUR – the MHRA notes the lack of clarity on how devices using AI can best meet medical device requirements. The MHRA intends to develop good machine learning guidance to supplement the good machine learning guiding principles published last year (see our previous blog post here). Alongside BSI, it will map out and develop standards. It will also develop best practice guidance and consider experimental work to detect, measure and correct for bias.
- WP 10 Project Glass Box (Interpretability) – current regulatory requirements do not consider adequately interpretability of AIaMD and the impact this has on safety and efficacy. The MHRA will develop best practice guidance on “human-centered SaMD” and will produce standards on the development of trustworthy AI.
- WP 11 – Project Ship of Theseus (Adaptivity) – current systems on the notification and management of change do not fit AIaMD. The MHRA will thus create guiding principles on adaptivity and change management, explore the concept of “drift” and significant/substantial change and set out proposals for predetermined change control plans for SaMD and AIaMD.
The MHRA intends to publish deliverables in a step-wise manner. Industry should expect to see the first sub-set of deliverables by the end of this year.
The UK indicated a potential benefit of leaving the EU was that it could develop a world-leading regulatory framework. However, there has been little in the Government’s response to the Consultation on the future regulation of medical devices in the UK that would make the UK “world-leading.” Arguably, at best many of the suggested changes merely align the UK with other jurisdictions and at worst add additional regulatory hurdles. However, the MHRA’s latest announcements suggests that for the SaMD and AIaMD space the UK Government is committed to being world-leading and supporting innovation in a patient centered way. The MHRA is driving forward the development of practical guidance and standards, the lack of which is often bemoaned by those working in this sector. However, the MHRA seems alive to the issue of creating frameworks/requirements that add burdens and so is emphasizing its aim to align not only with other areas in the UK (including NICE, CQC and HRA) but also internationally. This could be an area in which the UK is able to take a leading role in creating a regulatory system to protect patients and promote innovation.