NEU!! Entwickelt SxMDs mit einem strukturierten eQMS, einschließlich auditfähriger SxMD-Vorlagen, die an EU- und US-Standards angepasst sind. Mehr Erfahren!
Europe moves ahead on AI regulation, Medical Device companies need to keep up
In January, we published our first article on the AI Act and its impact on the Medical Device field. It's important to note that crafting legislation to regulate a groundbreaking technology like AI is a complex and time-consuming process, involving various stages. Given the substantial efforts dedicated to this field and most recent updates we are here to provide you with a comprehensive update on the latest developments on AI and how it could impact Medical Device development.
AI Act: Timeline and Regulations
Artificial Intelligence (AI) and Machine Learning (ML) are relatively new technologies with diverse applications, including their use in Medical Devices and In-Vitro Diagnostics. These applications are subject to stringent regulations. In Europe, the EU 2017/745 Medical Device Regulation (MDR) and the EU 2017/746 In-Vitro Diagnostics Regulation (IVDR) serve as sector-specific regulations governing such medical devices.
Europe has taken the initiative to establish a legislative framework for the use of Artificial Intelligence in general, the so called AI Act (AIA). The aim of this legislation is to control the use of this technology, prevent the misuse of technology and create trust and reassurance about it's application. It's important to note that the AIA is a horizontal legislation, not a sectorial one. It does not provide requirements for specific types of applications such as Medical Devices or IVDs. It covers general requirements for the use of AI, regardless of what the application will be.
The current status of the AIA
In 2021, the European Commission released the draft AIA.
In December 2022, the European Council finished their proposal on the text.
On June 14th 2023, the European Parliament voted on their amendments of the text.
Now the trilogue negotiations can start. At this moment (June 16th 2023), there is no finalized text yet, meaning there may still be changes from what is known and understood today.
What happens next?
If all goes well, a final text could be voted by the end of 2023. If that is the case, there will be a publication in the Official Journal of Europe early 2024. 20 days after this publication, the law will enter into force.
However, it's important to note that there is a potential challenge on the horizon. The ongoing negotiations regarding the AI Act may face a time constraint, as they must be concluded before the European elections scheduled for June 2024. As a result, there will be a temporary halt in the approval and publication of new legislations early in 2024. This places a sense of urgency on regulators to expedite the process and ensure timely implementation of the AI Act. Failure to meet this deadline would result in a delay until after the elections. It seems they're facing the same pressure as many Medical Device companies in getting their solution to market.
Assuming the AIA enters into force early 2024, the requirements for Notified Bodies and Authorities will apply 3 to 12 months after (Timelines to be negotiated and confirmed).
The Date of Applicability will be 24-36 months after the law enters into force (The council proposes a 36 months transition period, the Parliament proposes a 24 months transtition period, the final conclusion will come after the trilogues).
AI Act: What do we know today?
Based on the current text, the AIA uses a "risk-based approach". That means that the requirements are stricter for high-risk applications compared to low-risk applications.
Taken from the slide deck of BSI's webinar: EU AI Act Explained: Navigating the new legislation with BSI - AM
Are Medical devices considered to be high-risk AI systems under the AIA?
Yes! The fact that they need to undergo third party review because of the MDR, makes the High-risk systems under the AIA.
Only Class I devices seem to be still a bit of a grey area as they are within scope of the MDR, but do not need NB involvement. Voluntary assessments by a NB could be a solution to show compliance in this case.
What does that mean practically in terms of audits and certifications?
Medical Devices with an AI component will need to comply to both the MDR and the AIA. However, the sectorial legislation, being the MDR in this case, takes "priority". This means the conformity assessment is done by a Notified Body for the MDR requirements. The compliance of those AI systems to the requirements of the AIA will be assessed as part of the conformity assessment under the MDR.
As a result, a unified conformity assessment process will be implemented, integrating the requirements of both the MDR and the AIA. This streamlined approach eliminates the need for a separate issuance of a secondary CE mark, consolidating the certification process. Consequently, a singular Declaration of Conformity will serve as the comprehensive documentation to validate compliance with the MDR and the AIA.
Your Notified Body will also assess the compliance with the AIA. It is their responsibility to make sure they can. If you have an AI system as part of your Medical Device, get in touch with your NB to ensure they will have the expertise to do a proper assessment.
What can you do today?
At this moment, a lot of the information is still in flux. We can assume not everything in the proposed texts will change, however, there may be amendments, both major and minor. Deadlines need to be confirmed, common specifications and harmonized standards still need to be released.
Prepare and maintain your TF according to the MDR
If you have an AI component in your Medical Device, you have to comply to the MDR, IEC 62304, IEC 82304 and all other applicable standards. This is true today and this will be true when the AIA has entered into force. It's important to not lose view on the bigger picture, being that you are bringing a medical device to the market that needs to comply to all the relevant requirements, not only those related to AI.
Monitor standards
Currently, you cannot include any specific AIA requirements.
However, standards and documents are being published. So it's key to follow up on what is out there and what is applicable to your device.
There are some guidance texts published on how to apply risk management principles to devices with AI. This might be interesting to analyse and evaluate if and how you could update your risk management file.
It is important to know what will be the requirements coming from standards. It's key to follow up on the development of standards to make sure you can show compliance with the applicable ones.
Within the ISO organization, it's the ISO/IEC JTC1/SC42 Technical Committee that is in charge of developing standards related to AI.
Currently, there are 17 standards published related to Artificial Intelligence by ISO, 30 more are under development. Even though the published standards might not be only focussing on the medical device industry, it's worthwhile evaluating if some could be interesting and applicable to your situation. If so, you can already do a gap analysis against those standards.
Other standards worth following:
BS EN 63450 Ed.1.0 Testing of Artificial Intelligence / Machine Learning-enabled Medical Devices (draft start date 21/02/2023)
BS/AAMI 34971:2023 Application of ISO 14971 to machine learning in artificial intelligence. Guide (published 30/05/2023)
The above list is not exhaustive. Depending on what exactly are the claims and the intended use of your device, other standards might also be applicable.
As soon as applicable standards for your product or organization are being released, you can start making a gap analysis to evaluate what needs to change and start updating your documentation.
Get in touch with your Notified Body
The Notified Body that is in charge of evaluating your Technical File (TF) for MDR compliance will also assess the AIA compliance. It is interesting to get in touch with them to hear how they are planning to approach this topic. Maybe they won't be able to give you a full vision yet today, but over time they should be able to provide you how they will go about reviewing your TF, if voluntary assessments will be possible and if they will have any specific requirements towards the format in which the AI related documentation would need to appear in the TF.