The new regulatory requirements for software-based medical devices

The demand for, and availability of, medical and health software has seen regulators worldwide compelled to evolve the way in which they approach Software as a Medical Device (SaMD). In December 2019, the therapeutic goods regulatory framework for SaMDs in Australia (SaMD Framework) was amended to align the framework with international approaches, reducing or removing unnecessary regulatory burdens for low risk SaMDs.

After some COVID-19 related delay, these amendments for SaMDs came into effect on 25 February 2021.

In brief

• The new SaMD Framework offers greater clarity and reduces the regulatory burden on low-risk software, but there are transitional requirements that existing sponsors and manufacturers of SaMDs should be aware of.
• Sponsors of SaMDs that are already included in the Australian Register of Therapeutic Goods (ARTG) need to determine whether the classification of their devices have changed under the new classification rules. If the SaMDs are reclassified at a higher level, the sponsors must comply with notification, conformity assessment and application requirements.
• Manufacturers (including developers) of SaMDs must ensure they apply the relevant conformity assessment procedures in accordance with any reclassification of the SaMDs and comply with the new and amended Essential Principles.

When is software a medical device?

Software is considered a ‘medical device’ and is required to be included on the ARTG if it is intended to be used for:

• diagnosis, prevention, monitoring, prediction, prognosis, treatment or alleviation of disease
• diagnosis, monitoring, treatment, alleviation of or compensation for an injury or disability
• investigation, replacement or modification of the anatomy or of a physiological or pathological process or state
• control or support of conception, or
• in vitro examination of a specimen derived from the human body for a specific medical purpose.

Software that is part of a device (such as the software in a pacemaker) or software that controls a medical device (such as a mobile app that adjusts a pacemaker) – sometimes referred to as software in a Medical Device (or SiMD) – is regulated as part of the physical medical device.

What has changed?

1. Introduction of excluded and exempted software

Perhaps the most significant development is the introduction of exclusions and exemptions for certain low-risk technologies. This risk-based regulatory approach should reduce the barriers to market entry for low-risk software. This risk-based approach provides a considerably more viable pathway to market for the burgeoning range of health-focussed wearable technology and mobile apps.

The nomenclature ‘excluded software’ and ’exempt software’ is important:

• Excluded software is completely unregulated by the Therapeutic Goods Administration (TGA) and includes, among other software: ^[1]
  • software (in combination with non-invasive hardware) that measures or monitors a physical parameter, such as movement, sleep, heart rate, heart rhythm, temperature, blood pressure or oxygen saturation
  • digital mental health tools (including cognitive behaviour therapy tools) based on established clinical practice guidelines that are referenced and displayed in the software
  • software that is intended to be used for the sole purpose of providing alerts to health professionals about patient care, and that is not intended to replace clinical judgement
  • simple calculators that use relevant published clinical standards or authoritative sources that do not control the administration of a calculated dosage, and
  • electronic patient/health record systems that are intended to be used in clinical practice by healthcare providers to collect, use, disclose and otherwise manage patient clinical data within or between healthcare facilities, and are not intended to be used for diagnostic or prognostic purposes.
• Exempt software is regulated by the TGA, but does not need to be included in the ARTG.

Clinical decision support software (CDSS) that is used to provide or support a recommendation to a health professional, but not directly process or analyse a medical image or signal from another medical device, nor replace clinical judgement, is exempt software.^[2]

Although inclusion on the ARTG is not required, the sponsor of exempt CDSS must still notify the TGA of any supply of the device, and the CDSS remains subject to the TGA’s requirements for advertising and adverse event reporting.

2. Introduction of new classification rules

All medical devices (including software based medical devices) must be classified according to their risk.

The manufacturer’s intended purpose for the SaMD informs its classification which ultimately dictates the level of regulatory oversight for the medical device by the TGA (i.e. the higher the classification, the greater the level of scrutiny).

The new rules classify SaMDs (referred to as ‘programmed or programmable medical devices’ or ‘software that is a medical device’) based on whether the SaMD is for use in relation to:^[1]

• diagnosing or screening a disease or condition
• monitoring the state or progression of a disease or condition, or the parameters of a person with a disease or condition
• specifying or recommending a treatment or intervention, or
• providing therapy to a person through the provision of information.

If the new classification rules result in ‘up-classification’ (i.e. reclassification in a higher risk classification) of an existing SaMD, the sponsor is permitted to continue to supply the device whilst it is undergoing assessment at the higher risk classification under transitional arrangements which expire on 1 November 2024.

3. Amendments to the Essential Principles

The sponsor or manufacturer of the SaMD must demonstrate that the medical device complies with the Essential Principles as part of conformity assessment procedures and during post-market surveillance.^[2] The following Essential Principles have been amended:

• Essential Principle 12.1 was previously narrowly concerned with performance, reliability and repeatability of the programmable systems. The amendments clarify requirements regarding cybersecurity, and the management of data and information.
• Essential Principle 13.2 previously required information to be provided either on the medical device itself or on a leaflet supplied with the device. The amendment accounts for SaMDs, enabling information to be provided electronically rather than on a leaflet.
• Essential Principle 13B sets out a new requirement for SaMDs to have version and build numbers that are accessible by and identifiable to users of the medical device.

Essential Principles 12.1 and 13.2 apply to all SaMDs from 25 February 2021 (without a transitional period). Essential Principle 13B does not apply to medical devices that are currently included or have applied for inclusion in the ARTG until 1 November 2024.

See the TGA’s guidance material for more information about the new regulatory requirements for software-based medical devices.

^{[1] Therapeutic Goods (Excluded Goods) Amendment (Software-based Products) Determination 2021 (Cth) introduces the exclusions into Schedule 1 of the Therapeutic Goods (Excluded Goods) Determination 2018 (Cth).}

^{[2] Regulation 7.1 of the Therapeutic Goods (Medical Devices) Regulations 2002.}

^{[3] Regulation 3.2, clauses 4.5 to 4.8 of Schedule 2 and item 2.15 of Schedule 4, Part 2 of the Therapeutic Goods (Medical Devices) Regulations 2002.}

^{[4] Schedule 1 of the Therapeutic Goods (Medical Devices) Regulations 2002.}