AI Act

Artificial Intelligence (AI) is the buzz word these days. More and more AI gets integrated in our lives. 

When we zoom in on medical devices, AI is also incorporated and brings many new possibilities such as e.g. prediction and identification of diseases, data classification and analysis, optimisation of therapies, diagnostic support, etc.

It is clear that manufacturers need to comply to the regulations set forth by regulators such as the Medical Device Regulation, the In-Vitro Diagnostic Regulation, US FDA legislation, etc. They all require AI-driven medical devices to comply to te state-of-the-art requirements and provide evidence for their safety and performance.

Currently there is a need for more guidance through standards and specific regulations. A few years ago, US FDA started consulting the industry, gathering input about AI and its use in medical devices. This resulted in a set of documents and plans such as their Artificial Intelligence and Machine Learning (AI/ML) Software as a Medical Device Action Plan.

In collaboration with Health Canada and the MHRA, the US FDA also wrote a first guidance on Good Machine Learning Practice for Medical Device Development.

In Europe, a lot of work is done to make sure AI in general is being regulated properly. One of the main legislations that is in the pipeline is the AI act. This is not focussing on the medical device industry alone, but rather on the use of this kind of technology in different applications.

While the European Council has adopted its proposal for a text mid December, the European Parliament is still working on their proposal, so we are not yet at a point that the trilogues can start. This will hopefully be in Q2 2023. In a recent presentation during the DPO Circle conference (8 and 15th of December 2022), Mr. Tudorache and Mr. Zenner, members of the European Parliament gave an insight of where they are in the process of having a formal text adopted. A final vote could happen end of 2023, however the risk is that the negotiations within the European Parliament together with the trilogue discussions will take longer. Due to the European elections in 2024, there is a hard stop for decision making at the end of 2023/early 2024. If the approval process has not been concluded by then, the timelines will be pushed back significantly. 

Once the AI act has been adopted, there will be a transition period. This hasn't been decided yet, but we hear anything between 12 months and 2-3 years.

From the LNE Forum: Intelligence Artificielle / Paris, 6 Dec 2022, we learned a few things that are more focussed on the medical device industry:

• AI in some regulated fields will not have to pursue new certifications, but the auditors will have to look at the AI aspects of the device in the existing certification. 

• For medical devices this means that MDR-context CE marking technical files devices with AI inspections will have to be performed with an AI-certified auditor (remark : in progress ISO/IEC 42006) to look over the AI aspects

• New QMS for AI: (in progress) ISO/IEC42001 

• ISO/IEC 5259 - part 3 - new standard for AI

• It seems that the auditors would have the right to ask for the AI source code, look at the data, etc.

• (new) Standards that AI systems will have to comply to:

  • risk management system for AI systems;

  • governance and quality of datasets used to build AI systems;

  • record keeping - built-in logging capabilities in AI systems;

  • transparency and information to the users of AI systems;

  • human oversight of AI systems;

  • accuracy specifications for AI systems;

  • robustness specifications for AI systems;

  • cybersecurity specifications for AI systems;

  • quality management system for providers of AI system;

  • conformity assessment for AI systems;

As this is all still in flux and can change depending on the negotiations within the European Parliament and during the trilogues, we will have to monitor the news regarding this topic.

We can already feel that this will however bring quite a shift in the regulatory landscape of the manufacturers of medical devices making use of such technology.

We at Matrix Requirements are monitoring this topic so that we can continue to update our product and help manufacturers comply to the changing regulatory landscape. But, in any case, any regulation could be managed inside MatrixQMS, the same way we did for 27001, see for yourself!

Thanks to Salvatore Scalzo and Patric Bezombes / LNE Forum: Intelligence Artificielle / Paris, 6 Dec 2022