FDA's Evolving Regulation of Artificial Intelligence in Digital Health Products

In Short

The Situation: FDA has been grappling with regulation of rapidly advancing digital products, including artificial intelligence. While Congress and FDA have provided recent clarifications, regulatory questions remain.

The Result: Both the 21st Century Cures Act and recent FDA activities provide important, but incomplete, insight regarding regulation of health products utilizing artificial intelligence.

Looking Ahead: Digital health product manufacturers should recognize how recent regulatory changes may affect them, and that FDA is engaging industry to further refine its oversight approach.

Artificial intelligence ("AI") can be broadly defined as a device or product that can imitate intelligent behavior. In the health care space, this could include a machine learning algorithm that evolves and improves as new data inputs are entered. This type of adaptive algorithm can provide physicians with diagnostic information for numerous medical conditions.

While AI-based medical products hold tremendous potential, the question of their regulation has challenged the U.S. Food and Drug Administration ("FDA"). At issue are the medical device provisions of the Federal Food, Drug, and Cosmetic Act ("FDCA"), which were initially crafted to address medical devices existing in the mid-1970s when the Medical Device Amendments were enacted. These types of products were mostly hardware based, and iterative technology design changes were relatively infrequent.

The current device landscape looks quite different. While traditional device hardware still plays a prominent role in our health care, advances in computational power and new digital platforms are redefining the way modern care is accessed and administered. From mobile medical applications and "software as a medical device" to advanced analytics and artificial intelligence, digital products now make up a sizeable portion of the device economy. These products have brought new market participants, who have in turn brought innovation and new manufacturing processes that don't fit neatly into existing regulatory boxes.

Recent Regulatory Activity

Recently, both FDA and Congress have taken steps to address industry concerns about regulation of the digital sector. FDA created a Digital Health Program tasked with developing and implementing a new regulatory model for digital health technology. Over the last five years, the program has issued several enforcement discretion guidance documents (e.g., the Mobile Medical Applications Guidance) explaining FDA's oversight approach.

While these guidance documents are certainly helpful, FDA guidance is not law, and the products addressed by these documents only scratch the surface of digital health. Because of continuing regulatory uncertainty, industry persistently has asked for more precise, binding guidance. Industry received a modicum of satisfaction when Congress enacted the 21st Century Cures Act ("Cures Act") in December 2016, which contains provisions clarifying FDA's jurisdiction over digital health products. Specifically, Section 3060 of the Cures Act excludes certain types of "medical software" from the "device" definition. While most excluded categories are relatively noncontroversial (and already within enforcement discretion policies), one category is of particular importance: software intended for:

(E)(i) displaying, analyzing, or printing medical information about a patient or other medical information (such as peer-reviewed clinical studies and clinical practice guidelines);

(ii) supporting or providing recommendations to a health care professional about prevention, diagnosis, or treatment of a disease or condition; and

(iii) enabling such health care professional to independently review the basis for such recommendations that such software presents so that it is not the intent that such health care professional rely primarily on any of such recommendations to make a clinical diagnosis or treatment decision regarding an individual patient.

unless the function is intended to acquire, process, or analyze a medical image or a signal from an in vitro diagnostic device or a pattern or signal from a signal acquisition system.

This type of software is generally referred to as "clinical decision support" ("CDS") software. "CDS software" is loosely defined as an application that analyzes data to help health care providers make clinical decisions. Artificial intelligence, such as machine learning algorithms, may fall into this category when used for a health purpose. Per the Cures Act, whether CDS software is excluded from FDA's jurisdiction depends on, among other things, the ability of the health care professional using the software to independently review the basis for a clinical recommendation.

To clarify this provision, FDA issued a draft guidance on December 8, 2017. The guidance discusses each prong of the exclusion and provides some interpretive clarity regarding how software might allow independent review by a health care professional. FDA says this prong will be met if the software clearly explains:

1. The purpose or intended use of the software function;
2. The intended user (e.g., ultrasound technicians, vascular surgeons);
3. The inputs used to generate the recommendation (e.g., patient age and gender); and
4. The rationale or support for the recommendation.

The guidance says that, in order to be excluded from the device definition, the user should be able to reach the same recommendation without relying primarily on the software. Further, the sources supporting the recommendation should be identified, easily accessible to and understandable by the intended user, and publicly available. However, in the context of AI-based software, it's difficult to predict how FDA might interpret this requirement, especially where the recommendation is being produced by a machine learning algorithm that may be proprietary. Considering the above, it seems likely that AI health products will exist on both sides of this newly drawn regulatory line, and uncertainty remains regarding how FDA intends to regulate products remaining under its purview.

Looking Forward

In the recently released Digital Health Innovation Action Plan, FDA acknowledges its traditional approach to hardware-based medical devices is not well suited for the faster iterative design, development, and validation used for software-based medical technologies. The report notes that the traditional premarket requirements for devices may impede or delay patient access to critical software technology, particularly those presenting a lower risk to patients. Finally, it states that "an efficient, risk-based approach to regulating digital health technology will foster innovation of digital health products." But what does that mean, and how flexible can FDA be within the existing statutory scheme?

FDA's Digital Health Software Precertification ("Pre-Cert") Pilot Program offers insight into a possible regulatory approach. According to FDA, the voluntary program is intended to help the Agency design a tailored approach to regulating software by looking at the developer of the product rather than primarily at the product, which is how FDA evaluates all other medical devices. As such, if adopted by FDA, this developer-targeted review would be a significant departure from FDA's historic approach. While promising, the Agency has yet to explain how this approach would comport with the existing statutory provisions governing devices, making one wonder whether a legislative fix may be needed prior to implementation.

The program is already underway, and pilot participants, including Apple, Fitbit, and Verily, have been selected. The participants will provide FDA access to measures they use to develop, test, and maintain software products, including ways they collect post-market data. To help build its software expertise, FDA is also conducting on-site visits. The program's stated goals are:

• Enabling a modern and tailored approach that allows software iterations and changes to occur in a timely fashion;
• Ensuring high-quality medical software throughout the product's life by enabling companies to demonstrate their embedded culture of quality and organization excellence; and
• Being a program that learns and adapts and can adjust key elements and measure based on the program's effectiveness.

In addition to the Pre-Cert Program, FDA is also bolstering its software expertise through a Digital Health-Entrepreneur-in-Residence Program and has elsewhere stated it is seeking people knowledgeable in software design and business processes to work with the Agency on digital health. Finally, FDA maintains an open docket, regularly soliciting stakeholder feedback.

The upshot: The recent FDA activity demonstrates the regulatory landscape for digital health products is evolving. Presently, the Agency seems open to stakeholder input regarding software regulation. To the extent that regulated parties may have insight, thoughts, or advice to impart to FDA, now is a perfect time to do so. The Agency has been engaged and listening to stakeholders, and it has shown through its recent guidance documents a willingness to be flexible. This period of transition provides a great opportunity to engage FDA to help shape the future of digital health.

Three Key Takeaways

1. The Cures Act recently amended the FDCA to exclude certain types of medical software from the definition of "device."
2. Artificial intelligence-based health products may fall within an excluded category if, among other things, the software enables the health care practitioner to independently review any clinical recommendations it provides.
3. For software remaining under FDA's purview, the Agency is activity working with industry and other stakeholders to develop a new, more efficient regulatory paradigm.