Abstract: The authors discuss new updates from the UK’s Medicines and Healthcare products Regulatory Agency on how software and artificial intelligence medical devices will be regulated in the United Kingdom after Brexit.

The UK’s Medicines and Healthcare products Regulatory Agency (MHRA) is continuing to publish details on how software and artificial intelligence (AI) medical devices will be regulated in the United Kingdom after Brexit, with the aim of making the UK an attractive place to launch such products. The MHRA’s recent updates to its “Software and AI as a Medical Device Change Programme” (the Change Program) intend to “deliver bold steps to provide a regulatory framework that provides
a high degree of protection for patients and public, but also makes sure that the UK is recognized globally as a home of responsible innovation for medical device software looking towards a global market.”

The MHRA has also recently announced it will extend the period during which European Union Conformity Assessment (EU CE) marks on medical devices (including for software) will be accepted on the UK market, until July 2024. This article provides an overview of these updates.

The MHRA Change Program

On October 17, 2022, the MHRA published an updated version of its Change Program, setting out a roadmap for the next steps in the reform of the UK regime. The Change Program was first announced in 2021, and builds on wider reforms, including the government’s response to the consultation on the future regulation of medical devices in June 2022 (the Consultation). The recent update sets out further information on each work package under the Change Program, including how it will be implemented. There are 11 work packages across two work streams: one relating to software as a medical device (SaMD) and reforms across the life cycle of such devices, and another relating to AI as a medical device (AIaMD) considering the additional challenges  this may pose.
The update to the Change Program provides the following key points:
• Secondary legislation will form part of the reforms, building on the Consultation; however, much of the reform under the Change Program will be through the publication of guidance, which is notably easier to implement and update, allowing more flexibility to the regulation of SaMD and AIaMD as these areas continue to develop.
• Much of the Change Program has been, and will continue to be, developed in collaboration between the MHRA and other organizations, including the National Institute for Health and Care Excellence (NICE), the Care Quality Commission (CQC), and the Health Research Authority (HRA), ensuring that key principles and approaches align with other areas of regulation.
• The MHRA will work with other organizations in relation to key elements that the MHRA does not directly regulate, such as the Information Commissioner’s Office on data protection issues.
• The implementation of the Change Program will include further engagement with patients, the public, and industry, and build on the MHRA’s existing Patient and the Public Engagement Strategy.
• Further work will be undertaken to examine health inequalities in medical device regulation, specifically relating to SaMD and AIaMD, presumably due, in part, to the higher risk of population and social bias arising from the use of AIaMD in particular.
• There will be an effort to drive harmonization and minimize burden on industry, by working internationally, and through contributions to the International Medical Device Regulators Forum (IMDRF).
• The MHRA intends to work with British Standards Institute (BSI), a leading UK national standards body, to formalize a wide set of standards, mapped against the work packages, to assist manufacturers meet regulatory requirements.

Work Packages

A brief overview of the work packages and the key deliverables is provided below. Some work packages are standalone, while others are included within or spread over multiple work packages, and so do not have discrete deliverables assigned to them and are not set out separately.
The MHRA has stated that the deliverables will be published in a “stepped manner.” It first planned to publish certain work packages (WP1-02, WP4-01, WP9-05, and WP11-01, highlighted with * below), with further deliverables following in tranches.

Qualification

There is currently a lack of clarity on what qualifies as SaMD. This work package will aim to capture a sufficient breadth of software, provide clarity yet flexibility on qualification, and improve the wider regulation of digital health. The following deliverables will be published:
• WP1-01—Regulatory guidance on what qualifies as SaMD, including the distinction between SaMD and other device/ product types;
• WP1-02*—Regulatory guidance on crafting an intended purpose in the context of SaMD, including in relation to “hydra devices”; and
• WP1-03—Regulatory guidance on clarifying the concept of “manufacturer” for SaMD, including in the context of open-source code.

Classification

Current UK law on medical devices does not classify software proportionately to the risk it may pose (and notably the EU Medical Devices Regulation (EU) 2017/745 and In Vitro Diagnostic Medical Devices Regulation (EU) 2017/746 implement additional provisions on the classification of software, with similar provisions having not (yet) been implemented into UK law following Brexit). As such, the aim is to provide classification rules that impose safety and performance requirements on software, while providing flexibility to ensure the innovation of novel devices in not restricted.

The following deliverables will be published:

• WP2-01—Secondary legislation to reform the classification rules for SaMD. This will implement rules that more closely align to the IMDRF Software as a Medical Device: Possible Framework for Risk Categorization and Corresponding Considerations, as previously described in the Consultation;
• WP02-02—Secondary legalization and process on exploration of an “airlock process” for SaMD, allowing for earlier UK market access with heightened monitoring of a device where sufficient evidence in the pre-market phase cannot be generated, but the device meets a critical unmet clinical need; and
• WP02-03—Regulatory guidance on classification rules for SaMD, to ensure sensible and consistent interpretation of the new rules.

Pre-Market Requirements

Clearer pre-market requirements will aim to provide a smoother path to market for manufacturers and afford greater protection for users. This will include providing clarity on how pre-market requirements, including on clinical evidence and clinical investigation, apply to SaMD, and ensuring that adequate data on safety, effectiveness, and quality is generated prior to a market launch, taking into account the risk factors associated with the particular device. The following deliverables will be published:
• WP3-01—Secondary legislation on essential requirements for software. The current essential requirements have already been reviewed and considered as part of the Consultation;
• WP3-02—Best practice guidance on SaMD developments and deployment. The MHRA will work with the BSI, to highlight areas where current best practice may not meet regulatory requirements or regulatory definition of the “state of the art”;
• WP3-03—Regulatory guidance on the position of retrospective non-interventional studies, to indicate when these studies qualify as clinical investigations or an in vitro diagnostic medical device (IVD) undergoing performance evaluations;
• WP3-04—The MHRA will work with the HRA on the development of Joint Regulatory Guidance on data-driven SaMD;
• WP3-05—Regulatory guidance on human-centered SaMD, clarifying the importance of human factors, usability, ergonomic, or behavioral science evidence; and
• WP3-06—Regulatory guidance on registration and nomenclature for SaMD, with the aim to better enable signal detection and post-market trending.

Post-Market

This will focus on a stronger safety signal for SaMD, and the development of a strengthened surveillance system adapted to receive signals, to help mitigate the risk of patient safety incidents. The use of real-world evidence to provide further assurances in relation to SaMD, including functionality and performance, will be considered. Change management requirements will also be reviewed. The following deliverables will be published:
• WP4-01*—Review of adverse incident signal detection for SaMD, with the aim to identify safety signals sooner, distinguish between signal versus noise, and act swiftly in response to signals of concern, improving patient and public safety;
• WP4-02—Regulatory guidance on adverse incidents in the context of use of SaMD, including details on reportable adverse incidents and emphasizing the importance of recognizing “indirect harm” in the context of SaMD;
• WP4-03—Regulatory guidance on changes management for SaMD, including ensuring devices maintain performance over time and how this relates to other factors, such as QMSs and risk management;
• WP4-04—The MHRA will work with Approved Bodies to develop predetermined change control plans and change protocols; and
• WP4-05—Regulatory guidance on expansion of intended purposes of SaMD, including how this should be supported by appropriate evidence, such as clinical, and
proper processes.

Cyber Secure Medical Devices

This concept is not considered under current regulation, and the aim is to explain how cybersecurity issues arise in relation to SaMD and to ensure it is reflected in relevant requirements, including post-market surveillance. The MHRA will work with other bodies, including the Connected Medical Device Security Steering
Group. The following deliverables will be published:
• WP5-01—Secondary legislation on cybersecurity requirements for medical devices and IVDs, to impose cybersecurity and IT requirements as outlined in the Consultation;
• WP5-02—Regulatory guidance on elucidating cybersecurity requirements for medical device and IVDs;
• WP5-03—Best Practice Guidance on management of unsupported software devices, including in the context of unsupported devices still in service but that are no longer maintained by their manufacturer; and
• WP5-04—Processes: report of relevant cybersecurity vulnerabilities.

AI Rigor

This aims to provide clarification on how devices that use AI can meet medical device requirements, ensuring that AIaMD placed on the UK market is supported by robust evidence that it is safe and effective. The existing regulatory framework, as well as supplementary guidance, will be utilized and developed accordingly. The following deliverables will be published:
• WP9-01—Guiding principles on good machine learning practice (GMLP) for medical device development. The basic guidelines on GMLP were published in October 2021 and are intended to lay the foundation for developing this area;
• WP9-02—Regulatory guidance on GMLP for medical device development mapping, linking GMLP with existing legal requirements;
• WP9-03—GMLP for medical device development standards mapping, which will be developed with BSI and other international partners, to provide a snapshot of the standards landscape as it relates to meeting the internationally agreed GMLP principles;
• WP9-04—Best practice guidance on AIaMD development and deployment, outlining best practice on assessing the performance of AIaMD across its life cycle;
• WP09-05*—Best practice guidance on AIaMD for all, with a focus on addressing and mitigating bias in AlaMD;
• WP09-06—Standards development, to assist in developing standards, frameworks, and tools to assist with the identification and measurement of bias; and
• WP09-07—Experimental work on bias detection and mitigation, to detect, measure, and correct for bias in datasets. The new approach will identify under- represented features in data and then use synthetic data to oversample the under-represented features, to achieve a better overall distribution of features.

AI Interpretability (Known as Project Glass Box)

The effects of human interpretability on the safety and effectiveness of AIaMD are not covered by current UK regulation, and this work package aims to develop guidance to ensure (1) AI models are sufficiently transparent to be reproducible and testable, and (2) that the relationship of interpretability to usability is made plain and emphasized in relation to safety and effectiveness. The following deliverables will be published:
• WP10-01—Best practice guidance on human-centered AIaMD, and the further challenges that AI can pose, including human uninterpretable AI; and
• WP10-02—Standards development on trustworthy AIaMD.

AI Adaptivity (Known as Project Ship of Theseus)

Existing requirements and processes surrounding the notification and management of change need to fit and be streamlined for AIaMD, including clarification of how adaptive AIaMD might fit in existing change management processes, or the crafting of new guidance for adaptive AIaMD when appropriate.

The following deliverables will be published:
• WP11-01*—Guiding principles on adaptivity and change management in AIaMD;
• WP11-02—Experimental work on concept drift and significant/substantial change in performance. This will focus specifically on methods to detect change, including change outside of the manufacturer’s control, with an aim of developing a methodology to determining significant changes in AIaMD; and
• WP11-03—Pre-determined changes control plans for AIaMD.

The UK government is also continuing to consider the future regulation of AI. In July, the UK government published a policy paper on regulating AI, including when the AI is classed as a medical device. In October, the House of Commons Science and Technology Committee launched an inquiry on the regulation of AI and will also consider the government’s expected White Paper on AI. These various work streams will need to be coordinated to ensure the framework for AIaMD is clear and not overly burdensome.

Extension of UKCA Application Date

In other medical device related news, the MHRA has confirmed in a letter dated October 21, 2022, that it intends to extend the period during which EU CE marking on medical devices will continue to be accepted on the UK market by an additional year, until July 2024. We understand that the applicable transitional periods
will commence from the coming into force of the new UK regulations, also extended to July 2024.

This step is undoubtedly, at least in part, in response to the growing pressures facing the UK medical device industry, including that only a handful of UK Approved Bodies have been accredited to undertake conformity assessments, and the fast-approaching current deadline of July 2023. Further, the new UK legislation, which
was supposed to come into force in July 2023, has not yet been published, even in draft form, meaning it was increasingly unlikely companies, or authorities, would be able to meet the deadline.

This development will be welcome news to the UK medical device industry, though whether the timeframe for implementation of the regulatory reforms is realistic will have to be monitored.