How the regulatory landscape in the UK and EU is shaping the medical devices industry

The EU Medical Device Coordination Group estimate that one in four medical devices already either incorporate medical device software or are medical device software in their own right.  Industry groups have forecast well over 50% of medical imaging will use AI to detect diseases and guide treatment by 2026. The rapid growth and significant investment in the sector means that these trends will only accelerate over the coming years. 

The ability of software to augment, streamline and/or triage healthcare delivery however has led to uncertainty about how these systems should be classified and regulated. There are also important questions around clinical performance, human oversight and patient safety.  In this article we look at some of the ways in which the regulatory landscape in the UK and across the EU is shifting to deal with the challenges posed by the coming AI healthcare revolution.

AI applications for medical devices

• Analyse imaging data (X-rays, MRIs, and CT scans) to assist in the detection and diagnosis of diseases. 
• Analyse patient data and medical history to develop personalised treatment.
• Remote patient monitoring in real-time and early intervention.
• AI-powered virtual assistants and chatbots.
• Disease and infection forecasting outbreaks.

The UK regulatory landscape 

Medical devices are regulated in the UK under the Medical Device Regulations 2002/618 (“UK MDR”) and Council Directive 93/42/EEC of 14 June 1993 (“MDD”).  Where the manufacturer intends for it to be used for a medical purpose, software as a medical device (“SaMD”) and AI as a medical device (“AIaMD”) fall within the statutory definition of “medical device” and are therefore also subject to these.

In order to address some of the recent advancements in the technology including AI, the UK laws on Medical Devices are changing with introduction of a “Change Programme” to ensure patient protection and bring clarity on applicable requirements.  It seeks to make the UK the “home of responsible innovation for medical device software”.  To this end the UK government is taking a flexible and light-touch approach, introducing some secondary legislation but largely relying on existing regulators issuing new guidance, standards and processes to fill the gaps in current legislation.  It aims to streamline requirements of domestic and international regulators to “strengthen international convergence and software and AI products”, avoiding products having to comply with different requirements in different territories.

The UK government is working through a number of phases of its Change Programme including:

• introducing a new definition of software “a set of instructions that processes input data and creates output data” to the MDD (this is consistent with the EU definition)
• establishing what qualifies as SaMD (the MHRA has issued a flowchart)
• producing guidance on adequately defining the intended purpose of Medical Devices
• clarifying the concept of "manufacturer" (which can be blurred where SaMD is involved)
• classifying SaMD proportionate to the risk it might pose (to align with the International Medical Device Regulators Forum Possible Framework for Risk Categorization and Corresponding Considerations and NICE Evidence Standards Framework)
• introducing the regulatory sandbox AI-Airlock which will allow developers to generate evidence through use of AIaMD in NHS settings ahead of obtaining regulatory approval to better understand the risk profile and classification of the device, due to be launched in April 2024
• improving post-market surveillance and the capture and reporting of adverse incidents
• dealing with changes to SaMD including expansions of intended purpose
• imposing additional cyber security requirements

AIaMD will not be defined, and no legal requirements other than those for SaMD will be imposed, however work packages 9 – 11 of the Change Programme detailed below in the ‘Clinical Performance/Evaluation’ paragraph focus on some issues raised by AI. Numerous stakeholder discussions are due to take place throughout 2024 with core aspects of the Change Programme intended to come into force on 1 July 2025.

In addition to the regulatory overhaul, to support the med-tech sector the MHRA and other bodies have launched the Innovative Devices Access Pathway (IDAP).  The ambition is “to support the rapid development of innovative technologies that can be introduced into the National Health Service (NHS) to address unmet clinical needs for patients and healthcare professionals at the earliest opportunity, without compromising on standards of safety, quality, and effectiveness”.  Under this pilot applicants with uncertified Medical Devices can apply to receive targeted support.

The EU regulatory landscape

Medical devices are regulated in the EU under the Medical Devices Regulation EU 2017/745 (“MDR”) and Invitro Diagnostic Medical Devices Regulation EU 2017/746 (“IVDR”).  Where the manufacturer intends for a device to be used for a medical purpose, SaMD and AIaMD fall within the statutory definition of “medical device” and are therefore also subject to the above.

In the ever-evolving landscape of healthcare technology, the EU has taken steps to regulate the burgeoning field of AI systems, and in January 2024 published the final draft of regulations on Artificial Intelligence ("EU AI Act"). It represents a pioneering effort, aimed at ensuring the safety and compliance of AI systems with existing laws, legality, and ethical use of AI systems within the EU market. Both data-driven machine learning techniques and human-programmed approaches are subject to the EU AI Act.

Under the EU AI Act, AI systems that fall under the MDR or IVDR and require a third-party conformity assessment (i.e. are of a higher class than Class I under MDR/IVDR) are considered high risk (Article 6 (1)). As SaMD and AIaMD are regularly classified of higher risk (Class IIa or III) under MDR/IVDR they require a conformity assessment procedure with a Notified Body. As such, many AI systems in/as medical devices (whether SaMD or AIaMD) are likely to be categorised as high-risk under the EU AI Act.

Key regulatory challenges for AI powered innovations

AI powered innovations in the healthcare setting often raise a number of unique and complex considerations from a regulatory perspective. 

Qualification of software and AI as Medical Devices

It can be difficult to determine whether some products are Medical Devices; this ultimately comes down to intended purpose and principal mode of action (i.e. what it does and how).  Until the products have been classified they are known as borderline products and can include cosmetics, food supplements, PPE and machinery/laboratory equipment.  Medical Devices have a “medical purpose” assigned to them by the manufacturer and their principal intended action will primarily be fulfilled by physical or mechanical means.  The flowchart issued by the MHRA as well as the EU MDCG 2021-24 Guidance on classification of medical devices and the MDCG 2019-11 Guidance on Qualification and Classification of Software in the MDR/IVDR provide much needed guidance on qualification, however this is still a complex area where legal advice should be sought.  Using the wrong terminology in the manufacturer’s description of software could result in it being perceived as a Medical Device by the responsible authority, a competitor or a consumer, subjecting it to rigorous conformity assessment procedures.

Classification 

Classification of risk categories of SaMD and AIaMD products (from Class I lowest risk to Class III highest risk) depends on their purpose and decision making capabilities.  If the decisions made may cause death or irreversible deterioration in a person’s health, they will be Class III.  Arguably this applies to all SaMD as false results could lead to patients not receiving the treatment they need, making Class I SaMD virtually non-existent.  This leads to problems with conformity assessments outlined below.

There are similar considerations with far reaching consequences under the EU AI Act.  Since the EU AI Act covers medical devices subject to the MDR and IVDR but of a class higher than Class I only, health-related SaMD like lifestyle and health apps are unlikely to be covered by the MDR or IVDR or of Class I under the MDR orIVDR, therefore falling outside the scope of the EU AI Act.  In addition, the MDR and IVDR are not fully adapted to the risks posed by AI. While both the EU AI Act, the MDR and the IVDR are risk-based, they differ in the criteria used to determine such risk. The EU AI Act provides improvements for fundamental rights but lacks specifications to fill the gaps left by the MDR and the IVDR.

Conformity assessment procedure

The conformity assessments required under the UK MDR before a Medical Device can be marked with a CE (EU) or UKCA (UK) mark and placed on the market depends on its risk category, with certification by an Approved Body* required for higher risk products through to Class I products being self-certified.  If all SaMD is effectively Class III, then Approved Bodies will face a huge number of products requiring conformity assessments, leading to delays in products reaching the market.  There is some respite for existing SaMD and AIaMD assessed under the old framework as these can stay on the market under the transitional provisions (for dates see here), but if changes to the design/purpose are made the protection of the transitional period will be lost.  This is particularly likely to affect AIaMD which in many cases is constantly evolving.

For conformity assessment procedures in the EU as required under the MDR, IVDR and the EU AI Act:

• Whether a Medical Device is of a higher risk class (mainly Classes II or III) and can consequently be marked with a CE (EU) mark and placed on the EU market depends on its risk category and the outcome of a conformity assessment procedure conducted by the manufacturer of the medical device and a responsible Notified Body. 
• Notified Bodies in the EU already face a huge number of products requiring conformity assessment procedures given that SaMD and AIaMD under the MDR and IVDR are of higher risk classes than under the EU Directives previously applicable for these kind of products.
• The transitional periods for medical devices already placed on the EU market with CE certification based on the previously applicable EU Directives are to elapse and/or may not apply once changes are made to the design/purpose of a medical device.
• In addition, according to the EU AI Act, a Notified Body designated under the MDR or IVDR shall also be entitled to check the conformity of high-risk AI systems with the requirements of the EU AI Act and may constitute a "Notified Body" within the meaning of the EU AI Act. The enforcement of the EU AI Act however may be jeopardised due to inadequate means provided to Notified Bodies. Investment is required to ensure they have the expertise, capacity, and resources to conduct thorough conformity assessments.
• Since the EU AI Act addresses medical devices subject to MDR/IVDR, there is a doubling of requirements with the EU AI Act. MDR/IVDR already set requirements for cybersecurity, risk management, post-market surveillance, reporting systems, technical documentation, QM systems, etc. Medical devices manufacturers will have to demonstrate compliance with both frameworks, MDR/IVDR and EU AI Act.

Clinical/performance evaluation

This is the process under which a manufacturer generates and analyses clinical data to verify safety and performance, required as part of conformity assessments for Medical Devices.  There are a number of difficulties for SaMD and AIaMD:

• They are prone to bias (if trained using data that does not accurately represent the diversity of the population): work package 9 of the Change Programme seeks to develop standards, frameworks, tools and statistical and machine learning methods to detect, measure, and correct for bias in datasets to combat this.
• The lack of transparency around decisions made by AI (making it difficult to explain why something works): work package 10 will seek to tackle this through best practice guidance with British Standards Institute and Health Research Authority.
• Devising a clinical investigation for an AIaMD diagnostic estimating the likelihood of developing a medical condition: work package 3 of the Change Programme will update essential requirements to reflect SaMDs and AIaMDs and produce guidance around best practice.
• Evaluating AI that is continuously learning and improving: as part of work package 11 of the Change Programme, the MHRA has recently published guiding principles for pre-determined change control plans for AIaMD to attempt to address this.  The principles state that pre-determined change control plans proposed by manufacturers should be focused and bounded; risk-based; evidence-based; transparent and created from a total product lifecycle perspective.
• For the EU, for the purpose of clinical evaluation/performance, the evaluation of a SaMD/AIaMD through demonstrating the equivalence of the medical device with similar products based on the literature may not be sufficient. Manufacturers therefore must consider at the outset whether a prospective clinical performance study for SaMD/AIaMD is required for their medical device, or whether this may be avoided in part or in whole by a retrospective analysis of existing data of sufficient quality and quantity (in particular comparable circumstances, comparable patient groups, sufficient number of cases). The MDCG 2020-5 Guidance on Clinical Evaluation covers the demonstration of equivalence, based on data pertaining to an already existing device on the market.
• For the EU, in terms of SaMD,  the EU MDCG 2020-1 Guidance on Clinical Evaluation (MDR)/Performance Evaluation (IVDR) of Medical Device Software provides a framework for the determination of the appropriate level of clinical evidence required for SaMD.

How can Eversheds Sutherland help?

Whilst a flexible approach to regulating this area will be welcomed by those in the industry, many will hope future guidance will provide more clarity to counter the difficulties outlined above.  As ever, the challenge will be for regulators to keep up with the pace of developing technology to ensure patient safety whilst promoting innovation, and we watch this space with anticipation.  Given the uncertainty and change afoot in relation to SaMD and AIaMD, our experienced team would be happy to provide any assistance you may require in this complex area.

*A “Notified Body” is an independent organisation designated by EU Member State that assesses whether a medical device complies with relevant EU regulations. The same function is performed by an “Approved Body” for products sold in Great Britain.