Regulatory Landscape: FDA Process

Regulatory process typically involves two big steps:

1. Submitting a document package - called “510(k)” for Class II medical devices or “PMA” for Class III devices. This document package needs to include engineering artifacts providing evidence that you have followed the process and your process resulted in certain deliverables. For example, a PMA package has to include things like “Design Review notes” or “Software Verification plans”.
2. Establishing a Quality Management System. This system is a set of processes that are designed to ensure that you maintain a level of quality in your engineering and operations that is commensurate with the risk that your device presents to patients and operators. For example, the QMS might define the need for a “post-launch surveillance” process that would ensure that you keep track of usage of the device in the field and have a feedback mechanism that has you reviewing potential risks that have been realized in the field and responding to them.

The former communicates your intent to launch a product to the regulatory body, and the FDA would review your documentation package to ensure that you have followed the prescribed procedures while developing it. The latter establishes certain engineering processes.

Note that the FDA or other agencies do not actually tell you what exactly do you have to produce. The rules are designed to ensure that you have the right process. It is up to you to decide how to apply this process to what you are doing.

An aspect of a QMS that is probably the most relevant to an AI engineer is the validation process. A QMS might define the need to perform product validation before you release a new version of a product, which means that you need to provide evidence that your software indeed performs. If the product has an AI component at its heart, you may need to provide input along the following lines:

• What is the intended use of the product?
• How was the training data collected?
• How did you label your training data?
• How was the performance of the algorithm measured and how was the real-world performance estimated?
• What data will the algorithm perform well in the real world and what data it might not perform well on?

As the owner of an AI algorithm, you would be best positioned to answer these questions and your input would be instrumental.

Further Resources

• FDA actually publishes all clearances that it issues, so you can take a look at how people described their medical devices and what the intended use was. For example, here is Arterys’ submission for their Medical Imaging Cloud AI Platform: https://www.accessdata.fda.gov/cdrh_docs/pdf19/K192437.pdf
• FDA’s Quality Management System requirements are available online as 21 CFR Part 820. European and Canadian regulators require compliance with ISO 13485 standard (which is not publicly available)