Join industry experts from ICS and Greenlight Guru to discuss recent updates and changes in SaMD, regulatory and quality considerations in growing technologies including AI, mobile and cloud and three steps to take today to prepare for the future.

1. The Future of Quality and Regulatory for SaMD
Magda Kocot
Regulatory Project Manager
ICS
Wade Schroeder
Medical Device Guru
Greenlight Guru
Geoff Pollard
Regulatory Project Manager
ICS

2. About ICS and Boston UX
Creating Transformative Products That Advance Patient Care
2
www.ics.com/medical
ICS’ design studio
specializes in intuitive
touchscreen and
multimodal interfaces for
high-impact embedded and
connected devices.
Established in 1987, ICS delivers innovative
medtech solutions with a full suite of
services to accelerate development, testing
and certification of successful next-gen
products.
ICS and Boston UX are headquartered in
Waltham, Mass. with offices in California,
Canada and Europe.

3. Delivering a Full Suite of Medtech Services
3
● Human Factors Engineering
● IEC 62366-UX/UI Design
● Custom Frontend and Backend Software Development
● Development with IEC 62304-Compliant Platform
● Low-code Tools that Convert UX Prototype to Product
● Medical Device Cybersecurity
● AWS and Azure Cloud Services and Analytics
● ISO 14971-Compliant Hazard Analysis
● Software Verification Testing
● Complimentary Software Technology Assessment

4. 4

5. Agenda
5
Overview of SaMD
Regulatory and quality considerations in growing technologies:
1. AI/ML based medical devices software in the USA and Europe
2. Mobile medical applications
3. Cloud / Web Applications
3 Steps to Prepare for the Future

6. Overview of SaMD
What is it?
Three Key Distinguishing Features
6

7. Software as a Medical Device
The term Software as a Medical Device is defined by the International Medical
Device Regulators Forum (IMDRF) as
"software intended to be used for one or more medical purposes that
perform these purposes without being part of a hardware medical device."
Software in a Medical Device (SiMD)
“Software that is part of the functioning of a medical product and does not
have a purpose independent of the hardware components of the medical
device”
7

9. www.ics.com
● No manufacturing checks
● Bugs are always present, but
don’t alway show
● Bugs cannot be tested away
● Butterfly effect
● Therefore, quality comes from
the design process
9
1. Software is Different
than Everything Else

10. www.ics.com
● Processes
● Classifications
10
1. Software is Different
than Everything Else
2. Global Regulatory
(In)Consistencies

11. www.ics.com
● MDR Rule 11
● FDA Digital Health Pre-Cert
Program
● New Guidance Documents
○ FDA
○ IMDRF
● IEC 62304 Updates
11
1. Software is Different
than Everything Else
2. Global Regulatory
(In)Consistencies
3. Transitioning
Regulatory
Landscape

12. Agenda
12
1. AI/ML based medical devices software in the USA and Europe
a. The basics of AI medical devices
b. AI based SaMD in the USA
c. AI based SaMD in the EU
d. Overview of approved AI medical devices
2. Mobile medical applications
a. Regulatory approach to MMAs
b. Requirements to consider when developing MMAs
3. Cloud / Web Applications
a. FDA/EU Clearance requirements
b. Additional Risks (Cybersecurity/HIPAA)
c. Web Application risk considerations

13. Integrated Computer Solutions Inc.
Artificial Intelligence in US
13

14. Artificial Intelligence in the US
14

15. AI Risks
15

16. AI - Locked vs Adaptive
16

17. US Adaptive PreCert Program
17

18. www.ics.com
AI - Locked
Data
AI is only as good as the input data
Are there enough data points?
Are the data points representative?
● Patient populations close in
size
Do the data points match Intended
Use?
● Do they include children?
Are they from appropriate sources?
● Are all the data points from one
organization, or workflow?
18

19. Q-Submission
19

20. Integrated Computer Solutions Inc.
Artificial Intelligence in UE
20

21. AI based medical devices in the EU
● No laws/standards specifically
dedicated to AI based medical
devices
● Proposal for a Regulation laying
down harmonised rules on artificial
intelligence (AI Act, AIA)
● Software that qualifies as a medical
device under the MDR with an AI
component is classified as a high
risk AI system under the AIA
21

22. Requirements for high risk AI system
● Risk management system
● Data governance and management
● Technical documentation
● Record management
● Transparency and provision of information to users
● Human oversight
● Accuracy, robustness and cybersecurity
● Quality management system
22

23. Challenges related to the new regulation
Overlaps
23
Overregulation
Conflicting
requirements

24. Overview of the approved AI medical device
24
Source: Lancet Digit Health 2021; 3: e195–203

25. Overview of the approved AI medical device -
medical speciality
25
Source: Lancet Digit Health 2021; 3: e195–203

26. Overview of the approved AI medical device -
regulatory pathway
26
Source: Lancet Digit Health 2021; 3: e195–203

27. Integrated Computer Solutions Inc.
Mobile medical applications (MMA)
27

28. Mobile applications used in the healthcare industry
● More than 400 000 healthcare apps
available in app stores
● Over 200 health apps added each
day
● The regulatory bodies do not intend
to regulate all applications used
within a healthcare industry
28

29. Mobile applications used in the healthcare industry
29
● Life-style applications
● Well-being applications
● Applications for patient
management
● Application for medical
data organization
● Analyse medical data, provide
diagnosis
● Control medical devices
(infusion pumps, stimulators
etc.)
● Use a mobile built-in features
to perform medical device
functions
NOT A MEDICAL DEVICE
OUTSIDE OF REGULATORY
OVERSIGHT
MEDICAL DEVICE
REGULATORY OVERSIGHT

30. Mobile applications used in the healthcare industry
30
● Life-style applications
● Well-being applications
● Applications for patient
management
● Application for medical
data organization
● Analyse medical data, provide
diagnosis
● Control medical devices
(infusion pumps, stimulators
etc.)
● Use a mobile built-in features
to perform medical device
functions
NOT A MEDICAL DEVICE
OUTSIDE OF REGULATORY
OVERSIGHT
MEDICAL DEVICE
REGULATORY OVERSIGHT

31. “
For many software functions that meet the regulatory
definition of a "device" but pose minimal risk to patients and
consumers, the FDA will exercise enforcement discretion and
will not expect manufacturers to submit premarket review
applications or to register and list their software with the
FDA.
Policy for Device Software Functions and Mobile Medical Applications
31
FDA approach

32. MMA outside of FDA regulatory oversight
● Mental health applications
● Applications that provide a list of possible medical conditions based on common
signs and symptoms
● Keep track of medications and provide user-configured reminders
● Use a patient’s diagnosis to provide a clinician with best practice treatment
guidelines for common illnesses or conditions
● Software functions that are drug-drug interaction or drug-allergy look-up tools
The whole list - Policy for Device Software Functions and Mobile Medical
Applications, Appendix B
32

33. What to consider when developing MMA
● Interoperability
● Operating systems
● Mobile models
● SOUP
● Cybersecurity
● Data storage
33

34. Integrated Computer Solutions Inc.
Cloud
34

35. www.ics.com
Cloud
FDA clearance implications
○
35

36. www.ics.com
Cloud
FDA clearance implications
None!
● Does not affect patient safety
○ No different that data stored
locally
○ No different than desktop
applications
● FDA is not HIPAA police
(Office for Civil Rights)
● Additional Risks to consider
○ Cloud as a data store
○ Cloud as a web application
36

37. www.ics.com
Cloud
Risks to consider as a data store
US
FDA - Cybersecurity guidance
PHI-HIPAA
● Business Associate
Agreements
EU
General Data Protection Regulation
37

38. Business Associate Agreement (BAA)
38

39. www.ics.com
Cloud
Risks to consider as a web app
Everything for mobile devices
AND desktop devices
● Browser support
○ Whitelisting browsers
○ Validating browser updates
● To CDN or not to CDN
● Hosting the web application
Does it need clearance?
39

40. Resources
https://eur-lex.europa.eu/resource.html?uri=cellar:e0649735-a372-11eb-9585-01aa75ed71a1.0001.02/DOC_1&format=PDF
https://medicaldeviceslegal.com/2021/05/03/the-new-eu-ai-regulation-proposal-medical-devices-and-ivds/
https://www.thelancet.com/pdfs/journals/landig/PIIS2589-7500(20)30292-2.pdf
https://www.fda.gov/regulatory-information/search-fda-guidance-documents/policy-device-software-functions-and-mobile-
medical-applications
https://www.cypressdatadefense.com/blog/mobile-app-security-risks/
40

41. 3 Steps to Prepare
for the Future
41

42. www.ics.com
● Software Development
Planning
● Architecture Design
● Development Tools
● Design Control and Risk
Management Framework
42
1. Establish a
Foundation: Software
Development Process

43. www.ics.com
● Source Code
● Requirements
● Testing
● Risk
● Architecture
43
1. Establish a
Foundation: Software
Development Process
2. Ensure Traceability

44. www.ics.com
● Guidance Documents
● ICS
● Greenlight Guru
44
1. Establish a
Foundation: Software
Development Process
2. Ensure Traceability
3. Consult the Experts