FDA Issues Draft Predetermined Change Control Plan for Machine-Learning-Enabled Device Software Functions

Data Sets

In the draft guidance, FDA differentiates the terms “training data,” “tuning data” and “testing data”:

• Training data is data used to build an ML model, including to define weights, connections and components. These should be representative of the proposed intended use populations.
• Tuning data (also known as validation data) is data used to evaluate a small number of trained ML-DSFs to explore, e.g., different architectures or parameters. FDA chose the term “tuning” rather than “validation” because the term, as it is used in the ML community, is not consistent with FDA’s definition of “validation” in the device quality system regulation (i.e., “confirmation by examination and provision of objective evidence that the particular requirements for a specific intended use can be consistently fulfilled”).
• Testing data is data used to establish a reasonable assurance of safety or effectiveness (performance). This data should be independent of training and tuning data and should come from multiple sites different from the training and tuning data.

Authorized PCCPs

By including and having a PCCP approved as part of a marketing submission, manufacturers can avoid the need to submit a premarket approval supplement, new de novo submission or new 510(k) for certain planned or expected device modifications that would otherwise normally necessitate such submissions under applicable regulations. For example, modifications to quantitative measures of ML-DSF performance specifications (e.g., improvements to analytical and clinical performance resulting from retraining based on a new or broader set of data), modifications related to device inputs to the ML-DSF (e.g., new models or versions of a data acquisition system), or limited modifications to the device’s use and performance (e.g., for use within specific subpopulations, such as by retraining on a larger data set) may be appropriate for a PCCP.

Changes that deviate from the PCCP or are not implemented in accordance with the methods and specifications described in the PCCP’s modification protocol would require a new marketing submission. Additionally, modifications that alter the original intended use and indications for use would require a new marketing submission. FDA includes a flowchart to assess whether modifications to a device fit within an authorized PCCP. Modifications to an authorized PCCP itself would necessitate a new marketing submission. For 510(k) submissions, any determinations of substantial equivalence will be made against the version of the device cleared or approved prior to any changes made under a PCCP.

A PCCP, which should be a standalone section within the marketing submission, should include the following:

• A range of FDA-authorized specifications for the characteristics and performance of the planned modifications (i.e., description of modifications)
• Associated verification and validation testing and acceptance criteria to ensure the device remains safe and effective when modified in accordance with the PCCP based on identified test methods, data and statistical analyses (i.e., the modification protocol)
• Documentation of the assessment of the benefits and risks of implementing a proposed PCCP (i.e., the impact assessment).

FDA notes that the PCCP should be described in sufficient detail and in the public-facing portions of the submission (e.g., 510(k) summary, de novo decision summary, premarket approval summary of safety and effectiveness or approval order) in order to support transparency. The PCCP should also comply with the quality system regulation at 21 CFR Part 820, particularly design controls (21 CFR § 820.30), nonconforming products (21 CFR § 820.90), and corrective and preventive action (21 CFR § 820.100).

As discussed below, the draft guidance includes additional information on what applicants should include within their description of modifications, modification protocol and impact assessment sections.

Description of Modifications

FDA expects a PCCP’s description of modification to identify the modifications to the ML-DSF that the manufacturer intends to implement. FDA recommends that a PCCP include only a limited number of modifications that are specific, can be verified and validated, and are described in sufficient detail to permit understanding of such modifications. This recommendation is consistent with the NIST AI Risk Management Framework’s emphasis on explainable and interpretable AI. The description of modifications should also clearly state the following:

• If the manufacturer intends to implement the proposed modification automatically (i.e., the modification will be implemented automatically by the software as in the case of self-supervised ML processes) or manually (i.e., the modification requires human input, action, review and/or decision-making before implementation, a technique known as reinforcement learning from human feedback)
• Whether the proposed modifications will be implemented uniformly across all devices on the market, or implemented differently on different products because of, for example, unique characteristics of a specific clinical site or individual patients.

Modification Protocol

The modification protocol section of the PCCP should describe the methods that will be followed when developing, validating and implementing the modifications described in the description of modifications section. FDA lists four primary components that should be included in the modification protocol:

• Data management practices (e.g., how input data and reference data will be collected, annotated, curated, stored, retained, controlled and used for the modifications)
• Retraining practices (e.g., the objective of the retraining process, a description of the ML model and components that may be modified, the practices that will be followed and triggers for retraining)
• Performance evaluation protocols (e.g., triggers for performance evaluation, application of sequestered test data for testing, performance metrics to be computed, the statistical analysis plans that will be used to test performance objectives for each modification, and confirmation that failures in performance evaluation will be recorded and the modification will not be implemented)
• Update procedures (e.g., confirmation that the verification and validation plans for modified devices are the same as those performed on the prior version of the device, a description of how software updates will be implemented, a description of how legacy users will be affected by the software update, and a description of how modifications will be communicated to users).

FDA recommends that each of the four primary components be addressed for each modification described in the description of modifications, and that the manufacturer include a description of how the proposed methods are different from or similar to other methods used elsewhere in the marketing submission.

Impact Assessment

The impact assessment section of the PCCP is intended to document the manufacturer’s assessment of the benefits and risks of implementing a PCCP for the ML-DSF, and the mitigations of those risks, using the manufacturer’s existing quality system as the framework to conduct the impact assessment. FDA expects the impact assessment to do the following:

• Compare the version of the device with each modification implemented to the version of the device without any modifications implemented
• Discuss the benefits and risks, including risks of social harm, of each modification
• Discuss how the activities proposed within the modification protocol continue to reasonably ensure the safety and effectiveness of the device
• Discuss how the implementation of one modification impacts the implementation of another
• Discuss the collective impact of implementing all modifications.

In addition to discussing the specific impacts of the modifications on the ML-DSF itself, FDA expects the impact assessment to discuss how each modification included in the PCCP impacts the overall functionality of the device (e.g., other device software functions and the device hardware). FDA notes that for some devices, it may be least burdensome to include the content of the impact assessment within the modification protocol section rather than as an independent section of the PCCP.

The draft guidance includes examples scenarios of ML-DSFs that employ PCCPs.

Takeaways

This long-awaited draft guidance provides a useful framework for manufacturers and developers to address anticipated modifications to AL/ML SaMDs. However, it also introduces potential implementation challenges that will require manufacturers to assess the impact of these recommendations on existing quality system processes such as design control, data management practices, risk management plans, adverse event reporting and labeling. The draft guidance also adds to a growing superset of perspectives on the ethical and appropriate design, development and deployment of AI/ML technologies in healthcare from industry coalitions, the World Health Organization, the European Union and the United Kingdom. These evolving frameworks and regulatory approaches suggest an imminent paradigm shift from oversight processes intended for AI/ML-enabled tools that were retrained and updated only occasionally to an approach that accounts for ML models that learn from data in real time or near real time.

Device manufacturers incorporating ML-DSFs into their medical devices should consider submitting comments to the draft guidance. FDA recommends that the public submit comments to the draft guidance (Docket No. FDA-2022-D-2628) within 90 days of publication in the Federal Register, by July 3, 2023.