On June 14, 2023, FDA finalized its “Content of Premarket Submissions for Device Software Functions: Guidance for Industry and Food and Drug Administration Staff” (the “2023 Final Guidance”). The Final Guidance replaces the 2005 guidance document, “Guidance for the Content of Premarket Submissions for Software Contained in Medical Devices” (the “2005 Guidance”).

King & Spalding provided an overview of this guidance in its November 4, 2021 draft form (the “2021 Draft Guidance”) shortly after it was published ( “FDA Makes First Significant Changes to Premarket Medical Device Software Guidance in 16 Years”). Similar to the 2021 Draft Guidance, The 2023 Final Guidance contains significant changes from the 2005 Guidance, and these changes have the potential to substantially impact submission documentation for software in a medical device (SiMD) and software as a medical device (SaMD) and Design History Files (DHFs) subject to FDA site inspection.

The primary change from the 2005 Guidance is the elimination of documentation requirements segregated by Major, Moderate, or Minor Levels of Concern in favor of Basic and Enhanced documentation requirements. Both approaches are risk-based. In the 2005 Guidance, a Major Level of Concern resulted from a “failure or latent flaw” that could directly or indirectly result in death or serious injury. A Moderate Level of Concern resulted from a “failure or latent flaw” that could directly or indirectly result in minor injury, and a Minor Level of Concern was applied where no injury could occur either directly or indirectly. The 2023 Final Guidance effectively takes the former Major Level of Concern (i.e., death or serious injury), emphasizes that the determination of injury should be applied before any risk controls are applied, and labels this category as Enhanced Documentation. Any software function not meeting this criteria drops to the level of Basic Documentation and would incorporate the 2005 Moderate and Minor Levels of Concern.

The 2023 Final Guidance is largely consistent with the 2021 Draft Guidance. Many of the differences are clarifying in nature, but those that may require additional or altered approaches than those from the 2021 Draft Guidance are discussed in this Client Alert. We refer to our previous Client Alert for a detailed overview of the updated guidance and will focus this Alert on important differences between the 2021 Draft Guidance and the 2023 Final Guidance.

CONNECTION TO INTERNATIONAL STANDARD IEC 62304

The 2023 Final Guidance continues to put forward a model based on international standard IEC 62304 (“Medical device software – Software life cycle processes”), which FDA recognizes as a consensus standard. The 2023 Final Guidance does, however, remove the section “Comparison of Guidance to IEC 62304 and ANSI/AAMI/IEC 62304” from the 2021 Draft Guidance although we do not see this as having an impact on the way IEC 62304 can be used to meet FDA’s software design controls requirements.

One point of deviation from IEC 62304 in the 2023 Final Guidance, which is also a change from the 2021 Draft Guidance, is the requirement for the Software Design Specification (equivalent to Software Detailed Design in IEC 62304) to be established for both Basic and Enhanced documentation levels. Although the Software Design Specification is not part of the submission package for the Basic Documentation Level, FDA will expects to see it in the DHF during site inspections.

ADDRESSING ARTIFICIAL INTELLIGENCE (AI) AND MACHINE LEARNING (ML)

Since the 2021 Draft Guidance was issued, FDA released an April 2023 draft guidance “Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence/Machine Learning (AI/ML)-Enabled Device Software Functions.” The 2023 Final Guidance does not directly reference this draft guidance, but there is a reference to Section 3308 of the Food and Drug Omnibus Reform Act of 2022, which authorized FDA to approve or clear Predetermined Change Control Plans (PCCPs) and allows changes that might otherwise require submission to be implemented in a device without a submission.

FDA encourages use of the pre-submission process if a firm wishes to include PCCPs in its submissions.

PROSPECTIVE VS. RETROSPECTIVE SOFTWARE DOCUMENTATION

In two places, the 2023 Final Guidance clarifies that software documentation should be established (i.e., defined, documented, and implemented) prospectively and not retrospectively. Section III of the 2023 Final Guidance applies this expectation to the full DHF, and section VI reiterates that software documentation should be developed in proper sequence throughout the software development lifecycle and should not be established retrospectively (i.e., after completion of the work it is intended to define).

CLINICAL DECISION SUPPORT SYSTEMS

Although not addressed at length, the 2023 Final Guidance adds a reference in Section VII to FDA’s final Clinical Decision Support Software guidance released September 28, 2022.

OFF-THE-SHELF (OTS) SOFTWARE

The 2023 Final Guidance removes the language in Section VII of the 2021 Draft Guidance that converted documentation requirements for OTS software (see FDA’s guidance “Off-The-Shelf Software Use in Medical Devices”) from those based on Level of Concern to the Basic and Enhanced documentation levels in this guidance. Although the 2023 Final Guidance maintains the reference to the OTS guidance, there is no longer a direct translation of the requirements of that guidance to those of the 2023 Final Guidance.

FDA confirmed in its announcement of the release of the 2023 Final Guidance the Agency’s intent to update the OTS software guidance, and we assume the Agency will close the gap during the revision process. In the meantime, we recommend that sponsors consider using the mapping from Section VII (B) of the 2021 Draft Guidance to ensure the appropriate level of documentation for OTS software is provided in submission packages.

SOFTWARE DESCRIPTIONS: A COMMONLY OVERLOOKED SUBMISSION ELEMENT

Software descriptions are not part of traditional software design controls and are not typically in a DHF. They are, however, required for submissions, and in our experience they are a common source of deficiencies noted by FDA reviewers.

Section VI.B of the 2023 Final Guidance concerns software descriptions and has been reworked since the 2021 Draft Guidance, with new and changed questions to be answered in the areas of software operation, software specifics, and software inputs and outputs. The inclusion of questions related to AI/ML-enabled functions and interoperability is notable.

SOFTWARE RISK: THE SAME BUT DIFFERENT

FDA revised the Risk Management File section of the 2023 Final Guidance, Section VI.C, to simplify and reorganize the recommendations from the 2021 Draft Guidance. In the 2023 Final Guidance, FDA retained the recommendation to utilize the international standard ISO 14971 (“Medical devices – Application of risk management to medical devices”) to drive risk management. FDA did, however, remove the reference to the International Medical Device Regulators Forum (IMDRF) guidance “Software as a Medical Device: Possible Framework for Risk Categorization and Corresponding Considerations.” We believe FDA’s intent may be to guide sponsors to both the ISO 14971 standard and its accompanying guidance AAMI/ISO TIR24971 (“Medical devices – Guidance on the application of ISO 14971”) to identify and categorize probable risks.

The 2023 Final Guidance’s most significant change regarding the execution of risk management is in the replacement of a single word related to when a benefit-risk analysis is appropriate for otherwise unacceptable risks. The 2021 Draft Guidance states, “If a residual risk is deemed not acceptable according to the acceptability criteria in the risk management plan and further risk control is not practicable, the manufacturer should provide documented evidence to demonstrate that the benefits of the intended use outweigh the residual risk.” (emphasis added) The concept requiring the reduction of risk through risk controls “as low as reasonably practicable” (ALARP) has gone in and out of fashion within the ISO 14971 standard. This approach provides a mechanism for determining when risk controls have reduced risk enough so that no further risk controls are necessary and allows risk acceptability, financial considerations, complexity, and other factors to be incorporated into the decision.

The 2023 Final Guidance changes the word “practicable” to “possible.” Though these words may sound like near synonyms, in the context of risk management, the words carry different meanings and the change in terminology is significant. Introduced in the 2012 revision of ISO 14971, the “as far as possible” (AFAP) approach for risk reduction states that even acceptable risks must be further reduced through additional risk controls until such reduction no longer impacts the benefit-risk ratio. The current revision of ISO 14971 allows either ALARP or AFAP to be used, but the European Union Medical Devices Regulation (EU MDR), and now the FDA, require AFAP to be used in evaluating risk reduction sufficiency.

RELOCATING AND DEMONSTRATING SOFTWARE ARCHITECTURE

Consistent with the sequence in IEC 62304, the 2023 Final Guidance moved the System and Software Architecture Design Chart below Software Requirements Specification, reflecting the role of Software Architectural Design in the standard as a high-level design document.

In response, we believe, to submissions including software architectures that are in a native viewing format generated from modeling packages, FDA reminds sponsors to provide software architectures in a format that aligns with eCopy guidelines and references the “eCopy Program for Medical Device Submissions” guidance.

In the 2023 Final Guidance, Appendix B is still dedicated to providing software architecture diagram chart examples, but it provides just three examples, representing two SiMD and one SaMD device, reduced from the five examples in the 2021 Draft Guidance.

ADDRESSING UNRESOLVED ANOMALIES

Section VI.J of the 2023 Final Guidance largely rewrites the expectations for residual anomalies (i.e., anomalies or defects that remain in the software as intended for use) as compared to the 2021 Draft Guidance. The discussion of residual anomalies now reads very much like a Corrective Action / Preventive Action (CA/PA) process and includes description, investigation (including root cause), impact on safety and effectiveness, risk evaluation, and rationale for anomalies remaining in the software. The 2023 Final Guidance continues to reference ANSI/AAMI SW91 (“Classification of defects in health software”) as a means for categorizing anomalies.

CONCLUSION – A SENSE OF URGENCY

As previously stated, we consider the 2023 Final Guidance to be equivalent to the 2021 Draft Guidance in most respects. Where firms have moved forward with implementing the 2021 Draft Guidance, however, we recommend an analysis of the differences we describe above that are included in the 2023 Final Guidance and how those differences may influence software development and submission processes. Where firms have not yet implemented the 2021 Draft Guidance and are just now evaluating their processes against the guidance, we encourage an expedited gap analysis of the firm’s current software development and submission processes versus the 2023 Final Guidance.

In its announcement of the release of the 2023 Final Guidance, FDA stated the Agency would begin requesting information in submissions consistent with the 2023 Final Guidance on August 13, 2023. We, therefore, encourage a sense of urgency in closing any identified gaps, especially if the firm plans any medical device submissions to FDA as soon as August 13, 2023.