Clinical Decision Support Software Approach Updated in the U.S. but Still Confused in Europe

The U.S. has issued final guidance on clinical decision support (CDS) software but, in the EU, the treatment is less nuanced and needs clarifying. Ioana Ratescu of Novartis and Eva von Mühlenen, Deeona Gaskin, and Zina Chatzidimitriadou of Sidley explain.

Last autumn, the U.S. Food and Drug Administration (FDA) finalized its guidance on CDS software systems. The guidance interprets the criteria that describe the types of CDS software which are considered to be medical devices by the FDA, and gives examples of how the FDA views different kinds of CDS software.

The updated U.S. guidance takes an interesting, unexpected approach which in some ways narrows the exclusions from the medical device definition set out in section 520(o) of the Federal Food, Drug, and Cosmetic Act. As a result, many types of CDS software will be considered to be medical devices in the U.S., though some will not. Additionally, the final guidance removed the enforcement discretion approach described in the draft guidance.

Therefore, in the U.S., CDS software that is intended for the purpose of supporting or providing recommendations about, inter alia, diagnosis to a healthcare professional (HCP) may be excluded from the definition of a medical device. In order for this to happen, certain other criteria will need to be met. These include (but are not limited to) the CDS software not being intended for time-critical decisions or to replace the judgment of an HCP.

However, in the EU, CDS software that is intended to provide information which is used to take decisions with diagnosis or therapeutic purposes is considered to be a class IIa medical device. As such, it needs to undergo an assessment by an EU-notified body, as stipulated in the EU Medical Devices Regulation (MDR).

The U.S. guidance on CDS software was hotly anticipated by the industry. However, it has been met with mixed reactions and some questions. Nevertheless, European manufacturers of CDS software are aware that the EU’s treatment of medical devices lags behind its Anglo-American counterparts in terms of clarity.

Both the U.S. and the UK regulators are becoming increasingly nuanced in how they regard software as a medical device (SaMD)/ medical device software (MDSW). They take into consideration questions such as who is the intended user, what type of recommendations the software makes, and if the user — whether an HCP or a patient — is able to independently review the basis for the software’s recommendations.

UK regulator the Medicines and Healthcare products Regulatory Agency uses a rule-based classification that hinges on whether an HCP is able to follow the software’s entire decision pathway and review the raw data themselves.

However, in the EU, the draft AI Act has created a great deal of uncertainty for medical devices that contain AI systems. CDS software manufacturers do not yet know how the AI Act will be able to marry the requirements of the AI Act to those of the EU’s MDR. The MDR’s famous Rule 11 — which classifies medical devices depending on the level of risk that they bring and the severity of the conditions on which they provide recommendations — seems to classify the majority of all MDSW as ‘medium to high-risk systems’.

However, there is divergence in risk classification with respect to MDSW, between the MDR and the AI Act on the one hand and the International Medical Device Regulators Forum (IMDRF) on the other hand. This divergence will require some clarification in future. Based on the classification as ‘high-risk’, the AI Act places then additional obligations on MDSW manufacturers, distributors, and even users of AI systems. These obligations include a requirement that a CDS software system containing an AI system needs to be amenable to human oversight and monitoring, which rather goes against the idea that it ought to be capable of performing tasks faster than a human.

Ultimately, the added value of such systems compared to human decision-making will have to be weighed against their risks and a clear recommendation needs to be drawn to clearly preserve the benefits.

This post is as of the posting date stated above. Sidley Austin LLP assumes no duty to update this post or post about any subsequent developments having a bearing on this post.