United States: FDA Efforts To Modernize Medical Software Regulation Continue

Last Updated: March 5 2019
Article by Daniel A. Kracov, Mahnu V. Davar and Bryant M. Godfrey

Consistent with FDA Commissioner Dr. Scott Gottlieb's and CDRH Director Dr. Jeffrey Shuren's efforts to modernize FDA's regulatory framework for medical technology software, on January 7, 2019, the Agency released three new documents which further support the Digital Health Precertification (Pre-Cert) Pilot Program (launched in August 2017). The three documents include (1) an outline of the Regulatory Framework, (2) its Test Plan, and (3) a Working Model for its implementation—focusing on certain Software as a Medical Device (SaMD) (software intended to be used for a medical purpose and is not part of the hardware of a medical device) and manufacturers who have demonstrated a robust culture of quality and organizational excellence.

As noted by FDA in the release of these documents and on FDA's February 7, 2019 webcast,1 these documents represent the next phase2 of Pre-Cert. FDA envisions this "Pre-Cert 1.0" phase as a voluntary pathway that will support the development of new technologies that are frequently updated and will allow developers who have been assessed by the FDA as meeting specific excellence principles to participate in a more tailored premarket submission process appropriate for their specific type of digital device. SaMD products are subject to rapid and frequent updates, which pose a challenge to FDA's conventional case-by-case determinations primarily used for hardware-based medical devices. The new framework seeks to offer greater efficiencies, allowing software developments and evolutions to occur in a timely manner. This pilot, if successful, has the potential to result in a new regulatory paradigm for medical technology and software developers, particularly in the areas of consumer wellness, treatment planning, remote drug delivery, and other areas of digital health.

FDA intends to consider stakeholder comments on this version of the working model by reviewing the public docket approximately every two weeks and incorporating comments into Pre-Cert 1.0 as appropriate. Public feedback will be accepted until March 8, 2019.

Part I of this advisory provides background on the genesis of the Pre-Cert 1.0 proposal and FDA's vision; Part II outlines the Pre-Cert 1.0 Regulatory Framework; Part III discusses FDA's 2019 Test Plan; and Part IV discusses how FDA plans to implement Pre-Cert 1.0's Working Model.

I. Genesis of the Pre-Cert 1.0 Model

History.After completion of the initial Pre-Cert Pilot Program, FDA successfully identified the key elements of a quality software development program and incorporated stakeholder feedback to introduce the next iteration: Pre-Cert 1.0. FDA specified that the de novo classification pathway would be used to implement the proposed streamlined regulatory framework which would evaluate a SaMD manufacturer on five elements of excellence principles (known as the "Excellence Appraisal"): (1) patient safety; (2) product quality; (3) clinical responsibility; (4) cybersecurity; and (5) proactive culture. FDA determined that certain elements (e.g., software design and validation and other aspects of Quality System Regulation (QSR) compliance) for a SaMD can now be evaluated at the organizational level during the "Excellence Appraisal," which could then be leveraged to streamline a manufacturer's de novo submission.

FDA's Vision. Pre-Cert 1.0 embraces the Total Product Lifecycle (TPLC) approach of allowing manufacturers to evaluate SaMD products throughout their lifecycle, enabling the evaluation and monitoring of a software product from its premarket development to postmarket performance, along with a continued demonstration of the organization's excellence. A TPLC approach focuses on sharing information throughout the entire lifecycle of the product. Ultimately, FDA envisions that the precertification program may include all software that meets the definition of a device as defined in section 201(h) of the Federal Food, Drug, and Cosmetic Act (FD&C Act) (21 U.S.C. § 321(h)), including SaMD, Software in a Medical Device (SiMD), and other software that could be considered accessories to the hardware of medical devices. Pre-Cert 1.0's current focus is to establish parameters for certain SaMD technologies, including software functions that use artificial intelligence and machine learning algorithms.

II. Summary of the Regulatory Framework

New Use of an Existing Classification Pathway.Drawing on the flexibility of the de novo classification pathway in other innovative medical device clearance/approval contexts, it is no surprise that FDA intends to leverage that existing pathway to implement Pre-Cert 1.0.3 FDA outlines the steps of the pilot as follows:

  1. Pre-Cert 1.0 participants who have a SaMD product eligible for the de novo classification process may submit an application for "Excellence Appraisal," which evaluates an organization based on five elements of excellence principles as discussed above. These elements correspond to certain de novo content, special control, or QSR requirements that FDA collects and records into a master file, which is used to support a de novo request or future premarket submission.
  2. The excellence-appraised manufacturer may choose to submit a "Review Determination Pre-Submission (Pre-Sub)" to discuss whether the SaMD product is appropriate for a de novo request. This discussion may include product-level information that can be referenced during the review of the subsequent de novo request.
  3. The excellence-appraised manufacturer would then submit a streamlined "Pre-Cert De Novo Request" that would incorporate content not received through the "Excellence Appraisal," such as applicable submission elements of a traditional de novo request. These elements, in addition to the content reviewed under the "Excellence Appraisal," provide the required information necessary to determine if the device is of low-to-moderate risk and that general controls or general and special controls can provide a reasonable assurance of safety and effectiveness. This submission would also include a certification that the manufacturer followed the processes and procedures that FDA reviewed under the "Excellence Appraisal."
  4. If FDA finds, after substantive review, that all de novo premarket requirements have been met, FDA would classify the device by written order, and if the device is class II, establish any special controls necessary to provide a reasonable assurance of safety and effectiveness for the device type. Special controls may include the "Excellence Appraisal" elements, requirements for notifying FDA if certain elements have changed after the "Excellence Appraisal" is conducted, or postmarket data collection requirements. Certain special controls may permit device modification without premarket review if such special controls mitigate the risks associated with those modifications.

Postmarketing Changes and Reviews. Importantly, the noted de novo order would establish a device classification that could be referenced for future 510(k) submissions for that same device type. Manufacturers could choose to submit a "Review Determination Pre-Sub" to confirm their SaMD is eligible for a 510(k) under the de novo classification and also discuss which special controls are satisfied by the "Excellence Appraisal." If eligible, the excellence-appraised sponsor would submit a special "Pre-Cert 510(k)" that includes product-specific submission requirements and that could leverage other submission requirements documented during the "Excellence Appraisal" or optional Pre-Sub. FDA believes the review of a "Pre-Cert 510(k)" would be more efficient than the review of traditional 510(k) submissions. Manufacturers that are not excellence-appraised but wish to market a device under the de novo order can still submit a traditional 510(k) submission. Postmarketing modifications made to the device would be treated the same as any other device—changes which significantly affect the safety or effectiveness of the device for the cleared intended use would require a subsequent submission following the Pre-Cert 510(k) pathway outlined earlier.

III. How Will FDA Define Success? Goals of the 2019 Test Plan

Prior to deploying the proposed Pre-Cert 1.0 Pathway as an alternative premarket pathway for SaMD, the Agency will test this model by setting up two parallel review processes using the same de novo submission—one using the Pre-Cert model that will review the sponsor's "Excellence Appraisal" information and proposed streamline submission content, and–for comparison–a traditional de novo review. This will allow FDA to determine whether the "Excellence Appraisal" and "Streamlined Review" components together produce an equivalent basis for determining a reasonable assurance of safety and effectiveness when compared to the traditional review process. Additionally, the results of each submission will provide input into the refinement of the Pre-Cert Program and subsequently be used to confirm the validity of the Pre-Cert framework.

Program Scope. In 2019, the scope of the Pre-Cert 1.0 Test Plan will be limited to selected SaMD products with De Novo Requests. FDA intends to focus testing on cases that represent a broad spectrum of software developers from small and large firms across a range of products (including low and high risk) in the digital health technology space.

Program Evaluation.FDA's Pre-Cert 1.0 model will be tested both retrospectively and prospectively:

  • Retrospective tests will involve FDA revisiting previously-reviewed, complete submission packages to identify gaps in the proposed Streamlined Review pathway and Excellence Appraisal evaluation.
  • Prospective tests will involve FDA conducting Excellence Appraisals with sponsors participating in the pilot, followed by a mock Streamlined Review of selected premarket submissions. This review will then be compared to the sponsor's traditional submission.

IV. A Model for the Future? FDA's Working Model for a Software Precertification Program

FDA hopes that the goals and visions of the pilot program will be achieved through TPLC, which puts more emphasis on the role of manufacturers to evaluate a SaMD product throughout its lifecycle, rather than requiring proactive and intrusive ongoing FDA review. The Pre-Cert program concept has been embraced by AdvaMed as a step which, "if implemented correctly, could substantially streamline FDA's capabilities to exercise its regulatory oversight of software technologies while providing manufacturers more appropriately designed pre- and post-market requirements."4

The Pre-Cert Program is divided into four key components in order to satisfy its goals:

  1. Demonstration of a culture of quality and organizational excellence through an "Excellence Appraisal" Precertification
  2. Requiring the review of SaMD products through "Review Determination"
  3. The conducting of a "Streamlined Review," and
  4. Verification of a SaMD product's continued safety, effectiveness, and performance, and the organization's commitment to a culture of quality through a postmarket "Real-World Performance Plan."

Below, we briefly summarize the key attributes of each of these components.

Excellent Appraisal and Precertification

Organizations may obtain pre-certified status by undergoing an Excellence Appraisal, an organization-level analysis designed to identify organizations that demonstrate a "culture of quality and organizational excellence."

The pilot program's appraisal should be based on five excellence principals (patient safety, product quality, clinical responsibility, cybersecurity responsibility, and proactive culture) and the scope of the assessment shall include an evaluation of the processes, activities, systems, tools, and culture of an organization to determine capability and performance of the organization seeking the assessment.

One of the key tenets of the five Excellence Principles is safety, which is evaluated during the "Excellence Appraisal." Organizations are evaluated on their commitment and ability to provide a safe patient experience along with their prioritization of patient safety as a critical factor in their decision-making process. Additionally, the TPLC approach allows continued monitoring of a product's safety so that any patient safety issues that arise can be quickly identified and remedied.

FDA is currently considering two levels of precertification based on both the excellence principals, as well as the organization's track record in delivering safe and effective software products.

Review Pathways Determination

Consistent with its risk-based approach to SaMD regulation, under the pilot, FDA intends to rely on pre-certified organizations to determine the premarket review pathway that is appropriate for their SaMD product based on a risk-based framework that would leverage the International Medical Device Regulators Forum (IMDF) risk categorization. Potentially, pre-certified organizations would be authorized to market low-risk products without an FDA premarket review or after only a streamlined premarket review.

Streamlined Premarket Review Process

Streamlined premarket review would be available to pre-certified organizations who determine that their product meets the requirement for being reviewed by the FDA. FDA envisions an interactive review process where the organization would share information regarding the SaMD's product performance, clinical association between the SaMD output and a clinical condition, and safety measures. Following the review, FDA would make a premarket decision and provide the organization a basis on which the determination was made.

Real-World Performance

FDA would require pre-certified organizations to develop a Real-World Performance Analytics Plan, which would monitor and consistently collect post-launch data regarding the performance of the SaMD product. FDA would be allowed to access the collected analytics on data elements relevant to organizational excellence and product-level safety and effectiveness. Sources of real world performance data would include information about a user's experience with the SaMD, software performance data, and clinical outcomes.


The Software Precertification Program and its support of a new streamlined regulatory framework represents FDA's continued commitment to reimagine FDA's traditional regulatory approach to medical software products. The program's design is an important policy shift and is expected to receive much stakeholder feedback and consideration as a precedent for other areas of device regulation. Currently, the industry has been far more receptive than critical of the Pre-Cert proposal; however, uncertainty has also arisen as to how FDA would ultimately implement such a program and under what statutory authorities. As discussed, FDA will, for now, use the de novo pathway but it hopes that in the future the regulatory framework tested in Pre-Cert will receive specific statutory authority. Companies throughout the life sciences and healthcare industries that develop and utilize both SaMD and SiMD products should carefully consider the opportunities presented by this important policy shift.

*Atiq Chowdhury contributed to this Advisory. Mr. Chowdhury is a graduate of the George Washington University Law School and is employed at Arnold & Porter's Washington, DC office. He is not admitted to the practice of law in Washington, DC.

*Alana Reid contributed to this Advisory. Ms. Reid is a graduate of the University of Virginia School of Law and is employed at Arnold & Porter's Washington, DC office. She is not admitted to the practice of law in Washington, DC.

*Ira Stup contributed to this Advisory. Mr. Stup is a graduate of the University of Michigan Law School and is employed at Arnold & Porter's Washington, DC office. He is admitted to practice in New York. He is not admitted to the practice of law in Washington, DC.


1 FDA hosted an interactive user session/webcast on Thursday, February 7, 2019, to help clarify stakeholder questions about the Software Pre-Cert Pilot Program, including the Pre-Cert Working Model Version 1.0. The webcast included a presentation detailing the 2019 Test Phase for the Pre-Cert pilot, followed by a question and answer session. During the event, FDA emphasized its intention to work with stakeholders over the course of the year to collect metrics and other data to assist in the development of the regulatory standards on which the framework will rely. A recording of the presentation and question and answer session, as well as a transcript of the event is available here.

2  Pre-Cert 1.0 builds on the FDA Digital Health Innovation Plan announced in July 2017, which outlined the Agency's efforts to ensure that Americans have timely access to high-quality safe and effective digital health products. FDA recognized that a distinctive regulatory framework would need to be developed in order to accommodate and keep pace with software products that are continuously updated. Subsequently, the initial Pre-Cert Pilot was launched in August 2017, with the goal of shortening the premarket review cycle time for certain digital health products by shifting the focus from product reviews to manufacturer reviews. In FDA's view, a company which consistently and reliably engages in high-quality software design and testing is more likely to develop safe and effective products and, thus, would benefit from a streamlined, less burdensome FDA premarket review for new or updated products. In order to identify the key elements of a robust, high quality software development program, FDA selected nine companies out of 100 applicants to be a part of its Pre-Cert Pilot program. These include: Apple, Fitbit, Johnson & Johnson, Pear Therapeutics, Phosphorus, Roche, Samsung, Tidepool, and Verily.

3 De novo classification is authorized under 513(f)(2) of the FD&C Act (21 U.S.C. § 360c(f)(2)(ii)) and allows FDA classification of novel types of low to moderate-risk medical devices, with no legally-marketed predicate, to obtain market authorization via premarket notification (i.e., a "510k") rather than them being automatically designated as class III, which would require premarket approval.

4 See Zachary A Rothstein, Re: Docket No. FDA-2017-N-4301: Fostering Medical Innovation: A Plan for Digital Health Devices; Software Precertification Pilot Program (April 6, 2018).

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

To print this article, all you need is to be registered on Mondaq.com.

Click to Login as an existing user or Register so you can print this article.

Similar Articles
Relevancy Powered by MondaqAI
Finnegan, Henderson, Farabow, Garrett & Dunner, LLP
Finnegan, Henderson, Farabow, Garrett & Dunner, LLP
Finnegan, Henderson, Farabow, Garrett & Dunner, LLP
In association with
Related Topics
Similar Articles
Relevancy Powered by MondaqAI
Finnegan, Henderson, Farabow, Garrett & Dunner, LLP
Finnegan, Henderson, Farabow, Garrett & Dunner, LLP
Finnegan, Henderson, Farabow, Garrett & Dunner, LLP
Related Articles
Related Video
Up-coming Events Search
Font Size:
Mondaq on Twitter
Mondaq Free Registration
Gain access to Mondaq global archive of over 375,000 articles covering 200 countries with a personalised News Alert and automatic login on this device.
Mondaq News Alert (some suggested topics and region)
Select Topics
Registration (please scroll down to set your data preferences)

Mondaq Ltd requires you to register and provide information that personally identifies you, including your content preferences, for three primary purposes (full details of Mondaq’s use of your personal data can be found in our Privacy and Cookies Notice):

  • To allow you to personalize the Mondaq websites you are visiting to show content ("Content") relevant to your interests.
  • To enable features such as password reminder, news alerts, email a colleague, and linking from Mondaq (and its affiliate sites) to your website.
  • To produce demographic feedback for our content providers ("Contributors") who contribute Content for free for your use.

Mondaq hopes that our registered users will support us in maintaining our free to view business model by consenting to our use of your personal data as described below.

Mondaq has a "free to view" business model. Our services are paid for by Contributors in exchange for Mondaq providing them with access to information about who accesses their content. Once personal data is transferred to our Contributors they become a data controller of this personal data. They use it to measure the response that their articles are receiving, as a form of market research. They may also use it to provide Mondaq users with information about their products and services.

Details of each Contributor to which your personal data will be transferred is clearly stated within the Content that you access. For full details of how this Contributor will use your personal data, you should review the Contributor’s own Privacy Notice.

Please indicate your preference below:

Yes, I am happy to support Mondaq in maintaining its free to view business model by agreeing to allow Mondaq to share my personal data with Contributors whose Content I access
No, I do not want Mondaq to share my personal data with Contributors

Also please let us know whether you are happy to receive communications promoting products and services offered by Mondaq:

Yes, I am happy to received promotional communications from Mondaq
No, please do not send me promotional communications from Mondaq
Terms & Conditions

Mondaq.com (the Website) is owned and managed by Mondaq Ltd (Mondaq). Mondaq grants you a non-exclusive, revocable licence to access the Website and associated services, such as the Mondaq News Alerts (Services), subject to and in consideration of your compliance with the following terms and conditions of use (Terms). Your use of the Website and/or Services constitutes your agreement to the Terms. Mondaq may terminate your use of the Website and Services if you are in breach of these Terms or if Mondaq decides to terminate the licence granted hereunder for any reason whatsoever.

Use of www.mondaq.com

To Use Mondaq.com you must be: eighteen (18) years old or over; legally capable of entering into binding contracts; and not in any way prohibited by the applicable law to enter into these Terms in the jurisdiction which you are currently located.

You may use the Website as an unregistered user, however, you are required to register as a user if you wish to read the full text of the Content or to receive the Services.

You may not modify, publish, transmit, transfer or sell, reproduce, create derivative works from, distribute, perform, link, display, or in any way exploit any of the Content, in whole or in part, except as expressly permitted in these Terms or with the prior written consent of Mondaq. You may not use electronic or other means to extract details or information from the Content. Nor shall you extract information about users or Contributors in order to offer them any services or products.

In your use of the Website and/or Services you shall: comply with all applicable laws, regulations, directives and legislations which apply to your Use of the Website and/or Services in whatever country you are physically located including without limitation any and all consumer law, export control laws and regulations; provide to us true, correct and accurate information and promptly inform us in the event that any information that you have provided to us changes or becomes inaccurate; notify Mondaq immediately of any circumstances where you have reason to believe that any Intellectual Property Rights or any other rights of any third party may have been infringed; co-operate with reasonable security or other checks or requests for information made by Mondaq from time to time; and at all times be fully liable for the breach of any of these Terms by a third party using your login details to access the Website and/or Services

however, you shall not: do anything likely to impair, interfere with or damage or cause harm or distress to any persons, or the network; do anything that will infringe any Intellectual Property Rights or other rights of Mondaq or any third party; or use the Website, Services and/or Content otherwise than in accordance with these Terms; use any trade marks or service marks of Mondaq or the Contributors, or do anything which may be seen to take unfair advantage of the reputation and goodwill of Mondaq or the Contributors, or the Website, Services and/or Content.

Mondaq reserves the right, in its sole discretion, to take any action that it deems necessary and appropriate in the event it considers that there is a breach or threatened breach of the Terms.

Mondaq’s Rights and Obligations

Unless otherwise expressly set out to the contrary, nothing in these Terms shall serve to transfer from Mondaq to you, any Intellectual Property Rights owned by and/or licensed to Mondaq and all rights, title and interest in and to such Intellectual Property Rights will remain exclusively with Mondaq and/or its licensors.

Mondaq shall use its reasonable endeavours to make the Website and Services available to you at all times, but we cannot guarantee an uninterrupted and fault free service.

Mondaq reserves the right to make changes to the services and/or the Website or part thereof, from time to time, and we may add, remove, modify and/or vary any elements of features and functionalities of the Website or the services.

Mondaq also reserves the right from time to time to monitor your Use of the Website and/or services.


The Content is general information only. It is not intended to constitute legal advice or seek to be the complete and comprehensive statement of the law, nor is it intended to address your specific requirements or provide advice on which reliance should be placed. Mondaq and/or its Contributors and other suppliers make no representations about the suitability of the information contained in the Content for any purpose. All Content provided "as is" without warranty of any kind. Mondaq and/or its Contributors and other suppliers hereby exclude and disclaim all representations, warranties or guarantees with regard to the Content, including all implied warranties and conditions of merchantability, fitness for a particular purpose, title and non-infringement. To the maximum extent permitted by law, Mondaq expressly excludes all representations, warranties, obligations, and liabilities arising out of or in connection with all Content. In no event shall Mondaq and/or its respective suppliers be liable for any special, indirect or consequential damages or any damages whatsoever resulting from loss of use, data or profits, whether in an action of contract, negligence or other tortious action, arising out of or in connection with the use of the Content or performance of Mondaq’s Services.


Mondaq may alter or amend these Terms by amending them on the Website. By continuing to Use the Services and/or the Website after such amendment, you will be deemed to have accepted any amendment to these Terms.

These Terms shall be governed by and construed in accordance with the laws of England and Wales and you irrevocably submit to the exclusive jurisdiction of the courts of England and Wales to settle any dispute which may arise out of or in connection with these Terms. If you live outside the United Kingdom, English law shall apply only to the extent that English law shall not deprive you of any legal protection accorded in accordance with the law of the place where you are habitually resident ("Local Law"). In the event English law deprives you of any legal protection which is accorded to you under Local Law, then these terms shall be governed by Local Law and any dispute or claim arising out of or in connection with these Terms shall be subject to the non-exclusive jurisdiction of the courts where you are habitually resident.

You may print and keep a copy of these Terms, which form the entire agreement between you and Mondaq and supersede any other communications or advertising in respect of the Service and/or the Website.

No delay in exercising or non-exercise by you and/or Mondaq of any of its rights under or in connection with these Terms shall operate as a waiver or release of each of your or Mondaq’s right. Rather, any such waiver or release must be specifically granted in writing signed by the party granting it.

If any part of these Terms is held unenforceable, that part shall be enforced to the maximum extent permissible so as to give effect to the intent of the parties, and the Terms shall continue in full force and effect.

Mondaq shall not incur any liability to you on account of any loss or damage resulting from any delay or failure to perform all or any part of these Terms if such delay or failure is caused, in whole or in part, by events, occurrences, or causes beyond the control of Mondaq. Such events, occurrences or causes will include, without limitation, acts of God, strikes, lockouts, server and network failure, riots, acts of war, earthquakes, fire and explosions.

By clicking Register you state you have read and agree to our Terms and Conditions