The FDA has entered into the federal register a new draft guidance pertaining to "software as a medical device" (SaMD). The guidance is presented as representing the FDA's current thinking on establishing clinical evaluation guidelines for SaMD, but is written by an international organization of device regulators, the International Medical Device Regulators Forum, of which FDA is a member.

The guidance seeks to articulate what's new and different about SaMD (a category which would include mobile medical apps) and provide a stratified guidance on how to regulate different kinds of software and what kind of evidence is needed for each regulatory category. The guidance stratifies devices on two axes: whether the device informs care, drives care, or treats/diagnoses and whether the condition in question is non-serious, serious, or critical. So software that treats or diagnoses a critical condition is in the highest risk category, while software that informs care about a non-serious condition is in the lowest.

The guidelines also call out and address the fact that software development tends to move faster than traditional medical device development and can more easily be influenced by postmarket data.

"SaMD ... is unique in that it operates in a complex highly connected-interactive socio-technical environment in which frequent changes and modifications can be implemented more quickly and efficiently," the guidance says. "Development of SaMD is also heavily influenced by new entrants unfamiliar with medical device regulations and terminology developing a broad spectrum of applications."

The guidance even provides for moving a device from one risk category to another based on postmarket data. 

"For example, the output of a SaMD that is initially in the market to 'inform' a serious healthcare situation or condition can collect evidence and provide the input data set to support claims for the output of the SaMD to either 'drive' or 'diagnose' a serious healthcare situation or condition," the guidance states. "It would be expected that when moving up in significance from 'inform' to either 'drive' or 'diagnose', that the same rigor be applied in evaluating scientific validity, analytical validity and clinical performance where appropriate as recommended [for the higher risk category]. The advantage for the SaMD manufacturer is that they would access the data set that can support the evaluation with real world observational data and a retrospective analysis."

Bradley Merrill Thompson, a partner at Epstein Becker Green who specializes in the FDA and digital health, said there are a few interesting aspects to this guidance, starting with the fact that it was created by an international body and the FDA is adopting it as their own. 

"The International Medical Device Regulators Forum frankly has no authority under US law," he told MobiHealthNews in an email. "So I think there's a problem with saying that this document – when finalized by an international body – will become US law. Honestly I think if FDA wants to adopt the final IMDRF guidance as US policy, the agency will need to publish in the future the final IMDRF guidance and solicit comment on it. I understand why the FDA wanted to solicit comments now, because this is an opportunity to influence the final IMDRF document. So perhaps this will require two different comment periods."

Overall, Thompson said his initial impression is that the approach to risk stratification described in the document could work, but might require some tweaking to line up with existing US regulations and practices. He also thinks comments will bring additional clarity to the 45-page guidance.

"While the document certainly sheds light on the issue, it is still difficult, for example, to discern exactly what validation is required for a particular piece of software," he wrote. "Further, the document acknowledges the value of collecting real-world evidence, but doesn't clearly articulate the circumstances when real-world evidence can replace premarket clinical study."