On 17 October 2022, the MHRA published its “roadmap” for a future regulatory framework for software and AI as medical devices (SaMD and AIaMD, respectively) in Great Britain. The roadmap updates a change programme document published last year to now set out various work packages the MHRA will undertake to develop the new regulatory framework, along with the deliverables from each work package.

The MHRA has designed an approach to regulating SaMD and AIaMD that promises to keep the UK at the cutting edge.

While the work packages and deliverables are wide ranging, certain overarching themes can be identified:

• while some updates to the regulatory framework will be included in the revised legislation (as already noted in the MHRA’s response to its consultation on the new regulatory framework for medical devices (the Consultation Response)), much of the detail will be set out in MHRA guidance and/or designated standards. Providing much of the detail in guidance will allow the MHRA to be nimble and to adapt to the state of the art in this dynamic and fluid field, as changes won’t need to go before Parliament;
• the MHRA aims to provide clarity on how to comply with the regulatory framework and how to demonstrate conformity;
• this detailed approach and integration of AI-specific requirements into the regulatory regime, specifically for medical devices, should negate the need for horizontal, non-sectoral legislation on AI as seen in the EU in the form of the European Commission’s proposal for an AI Act; and
• in many areas, the MHRA looks to harmonise with international best practice like those adopted in the International Medical Devices Regulators Forum (IMDRF), recognising that differing requirements will lead to additional burdens for manufacturers.

The first set of deliverables are expected to be published in draft form by the end of this year. These either relate to post-market surveillance or guidance documents that do not directly deal with interpreting the new medical devices legislation. Therefore, it should still be helpful to see these documents in spite of the MHRA’s announcement that the new medical devices legislation will be delayed meaning we will not have sight of the draft new regulations by that time (see our previous update here)

We discuss below some of the most notable elements of the various work packages.

Qualification and classification of SaMD (Work Package (WP) 1 and WP2)

These will help clarify when software qualifies as a medical device and the appropriate risk classification. This will align with international practice, such as the IMDRF risk classification framework.

The MHRA will also provide much welcome clarification on the challenging issues of:

• who is the “manufacturer” for SaMD; and
• crafting an intended purpose for SaMD.

A draft of the latter is expected by the end of this year and should prove useful to developers defining the intended purpose of a device, which is fundamental to ascertaining the status and classification of the product, the appropriate conformity assessment and what claims can be made about the product.

New “airlock process” for innovative SaMD to meet an unmet clinical need (WP02-02)

The MHRA intends to develop an “airlock process” (akin to a “regulatory sandbox”) for SaMD for unmet clinical needs where it would otherwise be difficult to produce the clinical data to demonstrate the conformity of the SaMD pre-launch. Such a process would allow for a controlled launch of the product with additional monitoring to produce real world evidence that can then be used to demonstrate the safety and performance of the product.

Implementation of this more innovation-friendly approach may allow the MHRA to make Great Britain a more attractive market for early launch of a product to avoid being de-prioritised behind the US and the EEA markets, although we have heard some industry figures question the utility of the airlock process. In particular, these concerns relate to how easy it will be in practice for an SaMD to step “out of the airlock” (i.e. to stop being subject to additional monitoring and to move into a normal risk classification).

Pre-market conformity assessment for SaMD and AIaMD (WP3 and WP10)

In addition to updating the statutory “essential requirements” to better reflect the specific risks and performance requirements for SaMD, as already discussed in the Consultation Response, the MHRA will issue “best practice” guidance on the development and deployment of SaMD. This will draw on principles from both software and medical device development and, in particular, will highlight where compliance with existing standards may not meet regulatory requirements or represent the “state of the art” for the purposes of the regulatory framework.

The MHRA also proposes guidance on “human-centred” design in SaMD to help mitigate the risk that users will misinterpret outputs or suffer other adverse effects. This will emphasise the importance of using human/factors research and behavioural science in developing SaMD products.

MHRA will also produce “best practice” guidance on human-centred AIaMD, acknowledging the specific difficulties regarding transparency and interpretability of AI.

Adverse event detection and reporting (WP04-01 and WP04-02)

The MHRA is of the view that adverse incidents are currently going unreported. In response, it plans to issue guidance on what constitutes a reportable incident. This will emphasise where ‘indirect harms’ are reportable and that harms may be attributable to SaMD due to actions taken or not taken based on the output. This recognises that SaMD is often diagnostic, with the output being a recommendation to take or not take an action, such as seeking further care.

The MHRA will also review its own processes as regards signal detection.

Change management for SaMD and AIaMD (WP4-03 – 05 and WP11)

Change management for SaMD and AIaMD is a key focus in the MHRA’s roadmap. This takes the form of guidance emphasising the importance of change management in ensuring the continued safety and performance of SaMD, as well as updated procedures for change management. Manufacturers will be required to anticipate potential changes through mandatory predetermined change control plans.

Change management is particularly challenging in the context of adaptive AI given its propensity to change itself over time. The MHRA will define different categories of adaptivity in guidance and the specific challenges for each category will be addressed.

SaMD Cybersecurity (WP5)

As well as incorporating cybersecurity-specific essential requirements in the future medical devices legislation as noted in its Consultation Response, the MHRA will publish guidance on cybersecurity to help manufacturers meet relevant essential requirements and understand when cybersecurity vulnerabilities should be reported.

The MHRA will also produce “best practice” guidance on how manufacturers, systems operators and local deploying organisations can manage ‘unsupported devices’ (i.e. SaMD still in use which is no longer maintained and updated by the manufacturer) given the particular cybersecurity risk that such devices pose.

AI Rigour (WP9)

The MHRA commits to undertake a range of actions to ensure that AIaMD can be demonstrated to achieve appropriate levels of safety and performance and that manufacturers understand how the medical device legislation applies. This will include building on the Good Machine Learning Practice (GMLP) guiding principles already developed by the MHRA (in conjunction with the FDA and Health Canada), to produce guidance on how these principles can be applied in meeting applicable essential requirements. The MHRA will also work with standards bodies to map how relevant standards can be used to apply GMLP principles.

Another key focus within this package will be ensuring that data used to train AI is representative and avoids bias in the output. This aims to ensure that AI systems do not perpetuate existing inequalities and can perform in minority or under-represented groups.

The MHRA will need to strike a balance between (a) ensuring data is sufficiently representative and (b) avoiding the unattainably high bars seen in the EU’s proposed AI Act. The draft EU AI Act would require training, validation and testing data to be “…representative, free of errors and complete”, with it being unclear how any data set could truly meet the standard of being “complete”.

Conclusion

The MHRA’s roadmap for its change programme sets out a welcome and ambitious work plan for the creation of the new regulatory framework for SaMD and AIaMD. The aim of giving manufacturers and other stakeholders a package of guidance on interpreting legal requirements will be welcomed by industry, as will the intention to harmonise with international standards