The integration of artificial intelligence (AI) has become a must-have for a wide range of medical devices. AI supports diagnostics and offers decision support for therapies and medication to medical professionals. Medical apps often only achieve full functionality through the use of AI.
For manufacturers of AI-based medical devices, the question arises as to which regulatory requirements their medical devices must comply with if they want to use AI, and how the regulatory frameworks of Regulation (EU) 2017/745 on medical devices (MDR) and Regulation (EU) 2017/746 on in vitro diagnostic medical devices (IVDR) in conjunction with the future European Regulation establishing harmonised rules for artificial intelligence (AI Regulation), currently available as a final draft (draft AI Regulation), are to be applied.
No clear definition
Neither MDR nor IVDR include a definition of the term “artificial intelligence” or “AI.” There is also no clear definition of the term “software”. In principle, however, software constitutes a medical device or IVD under the MDR and IVDR if it is intended by the manufacturer to fulfill a specific medical purpose.
The draft AI Regulation, on the other hand, defines the term “artificial intelligence system” or “AI system”, for short, as “software that is developed with one or more of the techniques and approaches listed in Annex I [of the draft AI Regulation] and can, for a given set of human-defined objectives, generate outputs such as content, predictions, recommendations, or decisions influencing the environments they interact with.” Annex I of the draft AI Regulation in turn describes techniques of and approaches to AI, in particular approaches to machine learning including deep learning, logic and knowledge-based approaches as well as statistical approaches and estimation, search and optimisation methods.
Intersection: AI-based medical devices as high-risk AI systems
Overlaps between the Regulations arise in the case of AI-based medical devices, i.e. for software that, according to the manufacturer’s determination, serves the fulfillment of a medical purpose and was developed with one of the approaches and techniques designated in Annex I of the draft AI Regulation in order to achieve certain objectives. With regard to AI-based medical devices, both the MDR/IVDR and the AI Regulation are fundamentally relevant, especially since a large number of AI-based medical devices in the terms of the MDR/IVDR will at the same time have to be qualified as “high-risk AI systems” in the terms of the AI Regulation:
In accordance with Article 6(1) of the draft AI Regulation, “high-risk AI systems” are AI systems that themselves fall as a product under a harmonisation provision listed in Annex II of the AI Regulation or that represent a “security component” of a product that itself falls under the scope of application of a regulation listed in Annex II. Another prerequisite is that a “third-party conformity assessment” is specified in the respective case in accordance with the provisions mentioned there. The MDR and IVDR constitute harmonisation regulations encompassed by Annex II. Thus, if the AI-based medical device is to be assigned to risk class IIa or higher according to Rule 11, and if the involvement of a Notified Body in the conformity assessment procedure is mandatory, the AI-based medical device or the software as a medical device also represents a high-risk AI system in the terms of the draft AI Regulation.
Specific regulatory requirements for high-risk AI systems
The draft AI Regulation describes a plethora of regulatory requirements that will need to be met by manufacturers of AI-based medical devices as well as providers and users, and importers, distributors and authorised representatives. Chapter 2 of the draft AI Regulation contains, among other things, essential requirements regarding
- risk management,
- data governance,
- technical documentation and recording obligations,
- transparency and provision of information to users,
- accuracy, robustness, and cyber security for high-risk AI systems.
What is striking here is that the MDR and IVDR also already provide for detailed requirements on most of these aspects. Maintaining technical documentation or implementing quality or risk management systems is not new. However, in order to meet the requirements of the future AI Regulation as a manufacturer of an AI-based medical device, it is necessary to “think along” with the special aspects of quality assurance of the AI component or the evaluation of the specific risk potential in the context of a conformity assessment and to include them from development through manufacturing and product/user information to product monitoring.
Recommendation for action for manufacturers of AI-based medical devices
- Ensure that the AI technology used complies with MDR or IVDR requirements for software.
- Learn about the requirements of the AI Regulation for high-risk AI systems that go beyond the requirements of the MDR and IVDR.
- Conduct comprehensive risk assessments to ensure that the use of AI in your medical devices is safe and does not cause adverse effects.
- Add explanations to the technical documentation on the use of AI in your medical devices, including the exact nature of the technology used and its performance characteristics.
- Work closely with accredited Notified Bodies or Notified Bodies that have the expertise to guide the conformity assessment of AI-based medical devices.
- Stay abreast of the latest developments regarding AI and medical devices – especially with regard to the evolution of the liability régime – and adapt your products and processes accordingly.