Consultation outcome

Chapter 10: Software as a Medical Device

Updated 26 June 2022

This was published under the 2019 to 2022 Johnson Conservative government

Section 57. General background

Background

57.1. Software as a medical device (SaMD, being standalone software and software included in wider hardware) (including AI as a medical device (AIaMD)) has grown in market share and complexity. Increasingly it has applications in health and social care that could not have been envisioned when existing regulations around medical devices were developed.

57.2. The current medical device regulations contain few provisions specifically aimed at regulating SaMD or AIaMD. Our proposal is that the UK medical devices regulations be amended in order to both protect patients and support responsible innovation in digital health. Our proposals aim to ensure the regulation of SaMD is clear, effective, and proportionate to the risks these medical devices present. MHRA is considering what changes to The UK Medical Devices Regulations 2002 (SI 2002 No 618, as amended) (UK medical devices regulations) and related guidance could help achieve this. The majority of change required is likely to be in the form of guidance rather than legislation.

57.3. As a type of general medical device, other possible changes to the UK medical devices regulations outlined in this consultation would apply to SaMD. This chapter sets out changes that would be specific to or have implications for SaMD in particular.

Section 58. Scope and definitions

Possible Changes and Questions

58.1. To clarify the meaning and scope of term “software” we propose adding a new definition to the UK medical device regulations. In that context we propose adding the following definition of ‘software’ to the UK medical devices regulations: “a set of instructions that processes input data and creates output data”. This definition is consistent with the definition in this Guidance document Medical Devices - Scope, field of application, definition - Qualification and Classification of stand alone software - MEDDEV 2.1/6.

Q58.1. Do you think that we should introduce the definition of software set out above? (‘Yes’ / ’No’ / ’Don’t Know/No Opinion’)

Q58.2. Do you think there are any other definitions that need to be added to, or changed in, the UK medical devices regulations to further clarify what requirements apply to placing SaMD on the UK market? (‘Yes’ / ’No’ / ’Don’t Know/No Opinion’)

Q58.3. If you have answered ‘yes’ to question 58.2, please outline what additions / modifications are required.

Q58.4. Please provide your reasoning to support your answers to questions 58.1-58.3, including any impacts on you or other stakeholder groups and any available relevant evidence.

See Chapter 1, Section 1 to share your thoughts on expanding the definition of IVDs to explicitly include software.

Section 59. Distance sales

Possible Changes and Questions

59.1. SaMD can be deployed to UK by websites, app stores and via other electronic means including deployment from websites hosted in other jurisdictions. We are considering whether regulatory change is needed to clarify or add to the requirements for placing SaMD on the market in these circumstances. In particular we are proposing that the definition of “placing on the market” could be modified to clarify when SaMD deployed on websites, app stores (for example Google Play and Apple stores) and via other electronic means accessible in the UK amounts to ‘placing on the market’.

59.2. Please note that under the UK medical devices regulations, devices placed on the market must be registered with the MHRA. For further information please see Chapter 4.

Q59.1. SaMD can be deployed in the UK by websites hosted in other jurisdictions. Is there any need for greater / clearer requirements in such deployment? (‘Yes’ / ’No’ / ’Don’t Know/No Opinion’)

Q59.2. Do you think that the definition of placing on the market should be revised as set out above? (‘Yes’ / ’No’ / ’Don’t Know/No Opinion’)

Q59.3. Please provide your reasoning to support your answers to questions 59.1-59.2, including any impacts on you or other stakeholder groups and any available relevant evidence.

See also Chapter 3, Section 9 regarding distance sales requirements for medical devices more broadly.

Section 60. Classification: Risk categorisation

Possible Changes and Questions

60.1. We propose to change the classification of SaMD to ensure the scrutiny applied to these medical devices is more commensurate with their level of risk and more closely harmonised with international practice. We propose to follow (with minimal adaptations to suit the UK context) the risk categorisation (and associated definitions) in the IMDRF Software as a Medical Device: Possible Framework for Risk Categorization and Corresponding Considerations.

60.2. We anticipate this will require updating the IMDRF SaMD category numbering (I, II, III, IV) to reflect the classification numbering for medical devices under the UK medical devices regulations (I, IIA, IIB, III), adding classification implementation rules, and definitions of the following terms: a) critical b) serious c) non-serious d) treat or diagnose e) drive clinical management, and f) inform clinical management.

Q60.1. Do you think we should amend the classification rules in UK medical devices regulations to include the IMDRF SaMD classification rule (with supporting definitions and implementing rules) as set out in paragraph 60.2? (‘Yes’ / ’No’ / ’Don’t Know/No Opinion’)

Q60.2. Please set out your rationale and any impact you expect this change would have.

Section 61. Classification: Airlock classification rule

Possible Changes and Questions

61.1 We are also considering introducing an ‘airlock classification rule’. This is a provision that would allow for a temporary classification to be applied to some SaMD (which is likely to involve monitoring and restricting the SaMD as if it were a high-risk device) where the risk profile is unclear. This could allow early access to market for novel and innovative SaMD whilst ensuring the safety of users and patients until the risks of the device are properly understood.

Q61.1. Do you think we should introduce an ‘airlock classification rule’ for SaMD with a risk profile that is not well understood? (‘Yes’ / ’No’ / ’Don’t Know/No Opinion’)

Q61.2. Please provide your reasoning to support your answer to question 61.1 and, including any expected impacts on you or other stakeholder groups and any available relevant evidence.

Section 62. Pre-market requirements

Possible Changes and Questions

62.1. SaMD is subject to essential requirements that apply to medical devices more broadly. We want to ensure software as a medical device (SaMD) receives adequate pre-market scrutiny to assure its safety, quality and performance and ensure the essential requirements in place meet this need.

Q62.1. Do you consider additional essential requirements should be in place to assure the safety and performance of SaMD specifically? (‘Yes’ / ’No’ / ’Don’t Know/No Opinion’)

Q62.2. Please set out, and explain your rationale for, any additions and outline any expected impacts.

Q62.3. Do you consider regulations should set out SaMD essential requirements separate from those for other general medical device types? (‘Yes’ / ’No’ / ’Don’t Know/No Opinion’)

Q62.4. Please provide your reasoning (including any available relevant evidence) to support your answers to questions 62.1-62.2, including any impacts on you or other stakeholder groups.

Please note that there is a separate Chapter 4 on device registration requirements where you might want to indicate points relating to registration of SaMD.

Section 63 - Post-market requirements

Possible Changes and Questions

63.1 We are proposing:

a. that, in order to allow accurate and swift reporting via the Digital Yellow Card Scheme, SaMD should have a hyperlink to MHRA endorsed websites where a person can ‘report an adverse incident with a medical device’ where appropriate, and

b. that certain SaMD change management processes such as ‘predetermined change control plans’ should be provided for.

Q63.1 Do you think the UK medical devices regulations should mandate a ‘report adverse incident’ link as set out above? (‘Yes’ / ’No’ / ’Don’t Know/No Opinion’)

Q63.2 Please set out your rationale and any expected impact and any available relevant evidence to support your answer to question 63.1.

Q63.3 Do you think that regulations should enable predetermined change control plans? (‘Yes’ / ’No’ / ’Don’t Know/No Opinion’)

Q63.4 If you answered ‘yes’ to question 63.3, what should these entail? Please set out your rationale, any expected impact and any available relevant evidence.

Section 64 - SaMD Cyber Security

Possible Changes and Questions

64.1 We want to ensure SaMD has sufficient cyber security and information security both for the purposes of the direct safety of the device (from the perspective of, for example, whether its functioning could be tampered with) and also the security of personal data held on or in relation to the device. We are therefore proposing that manufacturers of SaMD be required to meet certain minimum requirements relating to security measures and protection against unauthorised access.

Q64.1 Do you consider existing UK medical devices regulations need to include cyber security and/or information security requirements? (‘Yes’ / ’No’ / ’Don’t Know/No Opinion’)

Q64.2 If you have answered ‘yes’ to question 64.1, what should this entail and why? What would be the expected impacts?

Q64.3 Please provide your reasoning (including any available relevant evidence) to support your answers to questions 64.1-64.2, including any impacts on you or other stakeholder groups.

Section 65 - Artificial intelligence as a/in a medical device (AIaMD)

Possible Changes and Questions

65.1 AIaMD is a subset of software as a medical device. Given this, MHRA views the changes noted above as also having benefits for the regulation of AIaMD. In addition, we are considering other changes to the Regulations specific to AIaMD. For example, we propose amending the Regulations to require performance evaluation methods for diagnostic AI which would take a comparable approach to performance evaluation methods used for in vitro diagnostic medical devices in terms of requiring demonstration similar to that of scientific validity along with analytical and clinical performance. This approach would build upon IMDRF’s Software as a Medical Device (SaMD): Clinical Evaluation.

Q65.1 Are there other statutory changes required to effectively regulate AIaMD over and above the changes detailed for SaMD above? (‘Yes’ / ’No’ / ’Don’t Know/No Opinion’)

Q65.2 If you have answered ‘yes’ to question 65.1, please outline what additional changes you consider are required.

Q65.3 Do you consider the use of IVDR-type performance evaluation methods (akin to scientific validity, analytical performance, and clinical performance) for diagnostic software but especially AI (even where no IVD data is used) to be appropriate? (‘Yes’ / ’No’ / ’Don’t Know/No Opinion’)

Q65.4 If yes, do you think the UK medical devices regulations should be amended to require this? (‘Yes’ / ’No’ / ’Don’t Know/No Opinion’)

Q65.5 Should the UK medical devices regulations mandate logging of outputs of further auditability requirements for all SaMD or just AlaMD for traceability purposes? (‘Yes’ / ’No’ / ’Don’t Know/No Opinion’)

Q65.6 Please provide your reasoning (including any available relevant evidence) to support your answers to questions 65.1-65.5, including any impacts on you or other stakeholder groups, including how burdensome would further requirements along these lines be?