The Food and Drug Administration (FDA or the Agency), the US regulating authority in the sphere of medical devices, has published a guidance document describing how a responsible entity can determine whether a software change to a medical device already placed on the market requires the submission of a new 510(k) notification.
The present document follows the initial guidance on general changes to medical devices and constitutes the final version of the same document issued by the authority previously in August 2016.
Due to its legal nature, the guidance does not introduce any requirements itself but provides additional clarifications to be considered by the parties involved. Additionally, an alternative approach could be applied, provided it complies with the relevant regulatory requirements and is approved by the authority in advance.
Regulatory Background
The present document is dedicated to the way the responsible entity shall determine when a software (including firmware) change to a medical device may require a manufacturer to submit and obtain FDA clearance of a new premarket notification (510(k)). The authority explicitly mentions that the guidance does not amend existing procedures and requirements and is intended solely to improve the legal clarity and predictability of the process in general. The approach described herein is deemed to be the least burdensome.
The document also contains references to the FDA-recognized voluntary consensus standards the medical device manufacturers may use to demonstrate compliance of their products with the applicable regulatory requirements.
According to the provisions of the applicable regulation, which is 21 CFR 807.81(a)(3), significant changes requiring the submission of a new premarket notification include:
- A change or modification in the device that could significantly affect the safety or effectiveness of the device, e.g., a significant change or modification in design, material, chemical composition, energy source, or manufacturing process.
- A major change or modification in the intended use of the device.
The Agency states that in the context of changes to medical devices, an important role should be played by the Quality System (QS) regulation. According to the aforementioned regulation, the medical device manufacturer is obliged to review all the changes made to the medical device, assess their impact on the benefit/risk profile, and duly document the changes themselves and all the associated processes. All processes should be subject to review, evaluation, and revalidation.
Thus, in the case of any changes made to a medical device already placed on the market, the manufacturer shall demonstrate that the modified device still complies with the specifications in terms of safety and effectiveness. As mentioned, all the changes should be duly documented, and such records should be provided to the authority upon request. If the changes do not significantly affect the risks associated with the device, such changes would probably not require submission of a new 510(k) premarket notification.
Under the least burdensome principle, the Agency intends to limit its requests to the information that is necessary to assess the aspects related to the safety and performance of a medical device. According to the guidance, the FDA shall only request the “minimum required information” necessary to support a determination of substantial equivalence.
Scope of Application
The scope of the present FDA guidance covers the regulatory matters related to the “software” as a set of electronic instructions used to control the actions or output of a medical device, to provide input to or output from a medical device, or to provide the actions of a medical device. Thus, the scope of the document covers almost all types of software, including those that are a component or an accessory to a medical device, and also stand-alone software that performs its functions irrespectively of the hardware platform.
The document addresses the changes made to the medical devices placed on the market under the 510(k) framework. Should the impact caused by such changes exceed the appropriate threshold, submission of a new 510(k) notification would be required. In such a case, the medical device in question should not be made available to healthcare professionals and patients before the appropriate approval is granted by the FDA.
It is important to mention that the scope of the guidance does cover medical devices subject to exemptions, nor ones requiring premarket approval (PMA). It also covers only changes made to software. For instance, the changes made to the labeling of the product are addressed in the general guidance. The two documents together constitute a complete set of documents the medical device manufacturers shall refer to when determining whether the changes made to a medical device require a new 510(k) premarket notification to be submitted. If the changes to a medical device already placed on the market include both software and non-software aspects, the manufacturer shall treat them separately as prescribed by the appropriate guidance documents. The Agency also mentions that the scope of the guidance does not cover certain specific types of software, such as mobile medical applications.
The recommendations provided in the present FDA guidance should also be applied in the case of changes made in the context of recalls and corrections. If such a correction results in significant changes to a medical device, a new 510(k) notification would probably be required.
It is also important to mention that changes to combination products fall outside the scope of the document. Nevertheless, the general principles outlined in the guidance could also be applied when determining whether the changes made to the device part of a combination product require a new 510(k) notification.
General Principles
In order to determine whether the changes made to a medical device already placed on the market necessitate 510(k) resubmission, the responsible entity shall follow the general principles described in the present FDA guidance, namely:
- Changes made with intent to significantly affect the safety or effectiveness of a device. In most cases, such changes would require a new 510(k) notification to be submitted. However, any changes made to the software should be rigorously assessed from the impact standpoint. The way they affect the safety and performance of the medical device should be evaluated.
- Initial risk-based assessment. The initial risk-based assessment should be conducted in order to evaluate the actual impact caused by the changes.
- Unintended consequences of changes. In case of changes to the software, it becomes especially important to identify and evaluate unintended consequences of the changes.
- Use of risk management. Due to the specific nature of software, creating certain difficulties in determining the probability of adverse events, the risk assessment should refer to the severity of harm that could be caused.
- The role of testing (i.e., verification and validation activities) in evaluating whether a change could significantly affect safety and effectiveness.
- Evaluating simultaneous changes to determine whether submission of a new 510(k) is required.
- Appropriate comparative device and cumulative effect of changes.
- Documentation required.
- 510(k) submissions for modified devices.
- Substantial equivalence determinations.
The guidance describes in detail each of the principles listed above, as well as the particular way it should be applied in the context of changes made to the software.
In summary, the present FDA guidance describes the approach to be applied by the responsible entity when determining whether the changes made to a software require a new 510(k) notification to be submitted. The document also highlights the main safety and performance-related aspects to be taken into consideration.
Sources:
How Can RegDesk Help?
RegDesk is a next-generation web-based software for medical device and IVD companies. Our cutting-edge platform uses machine learning to provide regulatory intelligence, application preparation, submission, and approvals management globally. Our clients also have access to our network of over 4000 compliance experts worldwide to obtain verification on critical questions. Applications that normally take 6 months to prepare can now be prepared within 6 days using RegDesk Dash(TM). Global expansion has never been this simple.
