Modern medical devices would be impossible without regulation. From pacemakers to syringes, officials are vital to ensuring that products function as intended. If nothing else, the importance of this work is reflected in how much funding bodies receive, with 2022’s FDA budget hitting the $6bn mark. Examine the bewildering variety of the regulator’s in-tray, and this munificence makes sense: last year, after all, the FDA approved dozens of distinct medical products, galloping everywhere from bone growth stimulators to cochlear implants. It goes without saying that their British and European counterparts are just as busy – hardly surprising when the global medical devices market is expected to reach $718bn in 2029. Yet in a world where regulators are crucial middlemen in a device’s journey from factory to clinic – and critical, of course, in keeping patients safe – recent years have seen officials face a new phenomenon: SaMD.

Short for ‘Software as a Medical Device’, it speaks to a rising trend where medical devices are no longer mere physical objects – or even software wrapped within a hardware case. They encompass, for instance, the algorithms used to understand a patient’s medical data, or else the video recordings showing their condition. They clearly don’t fit into an analogue world of hip replacements and stents. Yet, speak to the experts, and it’s equally obvious that SaMD can be vital to a patient’s wellbeing. “The analysis provided by the software helps to identify abnormalities and assists physicians in diagnosis and treatment decisions, in monitoring patient progress and response to treatment, and in predicting the risk of developing diseases,” is how Dr Sonja Marjanovic, director for healthcare innovation, industry and policy at RAND Europe puts it – a reasonable point when you recall that the robust use of big data can cut the average ER stay by up to 40%. Yet, whatever its rising authority, it’s equally clear that regulators have traditionally battled to fit the SaMD peg into a hole long shaped by physical medical devices – a problem that’s long stymied how insiders have been able to actually use medical software in practice. Now, however, with new, flexible regulation appearing on the horizon, SaMD could soon take a spot alongside more old-fashioned medical devices – with potentially revolutionary consequences for patients.

Software, hard work

It’s hard to overstate how quickly SaMD – as a medical concept, if not a regulatory reality – has developed over recent years. Boasting a global market expected to reach $86bn by 2027, it’s increasingly proving its usefulness everywhere from MRIs to CT scans. Understand the proliferation of medical information over recent years and this jump makes sense; with around 30% of the world’s data now being generated by the healthcare industry, it was probably inevitable that insiders would seek to exploit it for the benefit of patients. In practice, SaMD includes a wide variety of different technologies. At the simpler end, an example could involve a piece of software that sends images from an MRI machine to a doctor’s smartphone. A more sophisticated use case might be software that collects data from X-rays and CT scans to create 3D models, which can then be used to develop a patient treatment plan. Yet for all the usefulness of SaMDs in theory – it’s not for nothing that industry leaders like Pfizer are investing heavily in medical software – regulation has typically been a barrier to their versatility. In large part, this can be understood by the very name ‘Software as a Medical Device’. Sometimes framed by regulators as fundamentally similar to their physical cousins, Dr Zuzanna Marciniak-Nuqui, an analyst at RAND Europe, suggests that this unsubtle approach has left SaMD providers struggling to exploit the inherent benefits software can offer. And despite being what Nick Fahy, a third RAND expert, calls a “moving target” – meaning they can easily be updated, hardly news to anyone who’s used an app before – older regulations have tended to treat software as rigidly as a hip replacement. Combined with other challenges, notably around trying to squeeze software into the long-standing regulatory frameworks initially developed for hardware, it’s perhaps unsurprising that Stephen Gilbert, professor of Medical Device Regulatory Science at the Else Kröner Fresenius Center, Dresden Technical University, should say that older SaMD regulations are less “flexible” than they might be. All the same, it’d be wrong to imply that SaMDs don’t need any regulatory oversight whatsoever. As Marciniak- Nuqui says, some researchers argue that software errors relate to many preventable health problems. This intuitively makes sense: lose a patient’s data, or code an algorithm in such a way that it recommends the wrong dosage, and the consequences could be serious. Nor is this merely a hunch. In a 2017 study, five electronic medical record systems were recalled in the US after it was uncovered that they displayed the medical information of the wrong patients, among other errors.

Flexibility and security

Given these twin tensions – unleashing the power of SaMDs while preserving patient safety – how should regulators proceed? The FDA’s so-called Digital Health Software Precertification (Pre-Cert) programme may offer an answer. First announced in 2019, the FDA released its final report on their clinical decision support software in September 2022 – and Gilbert is clearly pleased with the results. “There’s an interesting and nuanced position,” he argues, suggesting that it’s “pro-innovation and certainly pro-development.” What, then, does the Pre-Cert programme offer SaMDs? In effect, it removes the ‘medical device’ label from many medical software products – along the way freeing them from the excruciating regulatory rules developers have had to follow until now.

How the FDA decides which medical software comes under their classification of ‘non-device’ speaks elegantly to the way in which regulators are balancing flexibility and security. For one thing, the software can’t be used in an emergency, but must rather provide supportive advice – which may enhance doctors’ decision making, and therefore patient’s health, but isn’t strictly necessary to take lifesaving actions. From there, the ‘non-device’ software can’t use AI to analyse images, nor should it create a situation where a doctor unthinkingly follows what the technology says as gospel. While this category of ‘non-device’ frees relevant software from the fiercer rules still present across the Atlantic – as Gilbert says, EU manufacturers must follow “about 150 separate norms, depending on the complexity of the device” – non-devices are not free from rules altogether.

Rather, Gilbert characterises the FDA guidelines as broader “standards” – high-level rules for software manufacturers to follow. In the UK, regulators are moving in a similar direction, notes Marciniak-Nuqui, “launching a new, post-Brexit regulatory framework this year, which is due to be in force in July 2024.” This UK model might be even more open-minded than its American equivalent, with officials potentially allowing software coded by people to be deregulated. In America, conversely, regulators have their scopes primed mainly at AI-generated software. Whatever the approach, the potential of the new rules is clear. “SaMD will likely play an increasing role in the medical field and in supporting wider healthcare systems in the future,” Marciniak-Nuqui notes.

A clever device

It would be wrong to suggest that the future of SaMD is necessarily secure. One problem, Gilbert argues, is resistance from medical device traditionalists – who might be “quite scared” of loosening the rules around software classification and development. That’s as the FDA has been working on other major innovations, notably their approach to regulating medical device software (as opposed to their ‘non-device’ cousins). And as Gilbert points out, certain questions around how the FDA measures the real-world performance of apps remain unresolved. Given the subtlety of the FDA’s rulings so far, he’s confident future guidance will be “pretty good when it comes out.”

To be fair, there are other, more substantive worries around SaMD as well. One particular challenge involves the data AI algorithms use to train. “Training software only using hypothetical cancer cases rather than reallife data can result in privileging treatment preferences of the people who designed that software – rather than an AI-driven analysis of actual patient data,” Marciniak- Nuqui notes. Then there’s the issue of the rules themselves. She emphasises that the Pre-Cert pilot programme was only open to firms that demonstrated a ‘robust culture’ and ‘organisational excellence’ – and which were committed to carefully monitoring their products once they’re out in a field. Certainly, this approach potentially made sense in such a sensitive field. Yet, warns Marciniak-Nuqui, it ultimately risks creating a situation where smaller SaMD innovators fall behind the industry giants. Given how transformative medical software can be, that would be a pity.