Last week, the U.S. Food and Drug Administration (FDA or the Agency) released updates to its Software Precertification (Pre-Cert) Pilot Program, including release of a working model reflecting the Agency's vision of the pilot and outlining its most critical components. The Pre-Cert Program is an effort by FDA to develop a regulatory framework for software medical device products through which a company is deemed to have good internal design, development and production processes/practice, and is given a streamlined (or exemption from) pre-market review for future software products.

FDA's working model envisions the program to be a voluntary pathway that is more tailored than the current regulatory paradigm for assessing safety and effectiveness of software technologies, without inhibiting patient access to these technologies. The program will be built on trust in organizations that have demonstrated a culture of quality and organizational excellence to develop high quality products and a commitment to monitoring real-world performance, and will leverage transparency of an organization's excellence and its product's performance across the entire lifecycle. While many of the details are still in development, the emerging framework is a much needed response to the limitations presented by applying traditional medical device approaches to digital health and software products.

For the time being, development of the Pre-Cert Program is limited to software as a medical device (SaMD) (i.e., software only) products. Given the updated program plans, the precertification program has four key components: (1) excellence appraisal and precertification, (2) review pathway determination, (3) streamlined premarket review, and (4) real world performance, i.e., postmarket surveillance and feedback. As mentioned repeatedly throughout the paper, FDA recognizes and identifies areas that it believes require further development work and which will be informed by the learnings from the pilot program and public comments. To that end, for each key component, the agency has included a number of challenge questions for public input to aid it in developing and further refining the model.

Component one: Excellence appraisal and precertification

The program will be broadly open to "any organization that intends to develop or market a regulated SaMD in the United States." For large organizations that include multiple business units, FDA will be precertifying at the business unit level rather than at a corporate level. Precertification will be based on demonstration of five excellence principles: (1) product quality, (2) patient safety, (3) clinical responsibility, (4) cybersecurity, and (5) proactive culture with respect to surveillance, assessing user needs, and continuous learning.

While FDA has not yet settled on a mechanism for conducting the precertification, its initial thoughts envision submission of an application, appraisal of information provided therein, and a determination by FDA of approval and the level of precertification; following this, there will be a mechanism for monitoring and maintaining the precertification.

The Pre-Cert Program will distinguish between two levels of excellence and experience in developing, maintaining, and marketing safe and effective SaMDs. To obtain precertification, companies must embody the five excellence principles. Precertified companies will also be assigned a pre-cert level based on whether they have a track record in delivering SaMDs--Level 1 are companies with no or limited track record and Level 2 are companies with established track record.

Component two: Review pathway determination

The level of precertification, in turn, determines whether the company must participate in a streamlined premarket review for certain risk categories of SaMD. FDA's current proposal leverages the risk-category framework for SaMD developed by the International Medical Device Regulatory Forum (IMDRF) to inform the risk category. FDA has developed a framework for determining premarket review pathway for SaMD from precertified companies that depends on (1) the IMDRF risk category of the SaMD, (2) the level of precertification of the organization, and (3) whether the SaMD is a new device or an iteration of an existing device. For certain medium risk categories of SaMD products or changes to SaMD products, Level 1 Pre-Cert companies will be required to undergo streamlined premarket review while Level 2 Pre-Cert companies will be exempt from premarket review.

Component three: Streamlined premarket review

The streamlined premarket review pathway is expected to be more interactive and to provide a decision within a shorter timeline than the standard premarket review processes. The Agency anticipates reviewing the company's clinical evaluation results and risk management for safety of the device's intended use. FDA expects to be able to conduct its interactive review, supported by automated analysis tools, where appropriate. Notably, if the Agency does not authorize marketing of a product by a precertified company, FDA and the company will complete an after-action review to identify gaps and establish a plan for future submissions. Following repeated unsuccessful reviews, reassessment of the company's precertification may be triggered.

Component four: Real world performance

FDA intends to use real world performance data (RWPD) for monitoring and feedback at product, organizational, and program levels. RWPD will include real world health data, user experience data, and product performance data. FDA has identified four key objectives for use of RWPD, and within each has identified elements that it believes require further development work:

1. monitoring ongoing safety, effectiveness, and performance of marketed SaMD products

2. supporting modifications of clinical and performance claims for safety and effectiveness

3. providing input to initial precertification and changes to precertification status

4. providing feedback to FDA to further refine the Pre-Cert Program appraisal model and streamlined review process

All precertified companies will be required to conduct ongoing monitoring and analysis of RWPD and to provide FDA with access to such data on a regular basis and upon request. FDA will access RWPD to inform its decision on both individual products and the precertification status of SaMD manufacturers.

In September of last year, FDA selected nine companies to participate in the development of the Software Pre-Cert Pilot Program, which included: Apple, Fitbit, Johnson & Johnson, Pear Therapeutics, Phosphorus, Roche, Samsung, Tidepool, and Verily. According to the Agency's timeline, an initial pilot of the program will be launched later this fall followed by a full launch by the end of the calendar year. The Agency is seeking public comment on the working model briefly described here as part of its continued development of the program. Additionally, the Agency continues to evaluate whether new statutory authority is needed or whether it can implement the program under its existing authority.

FDA will also be hosting an interactive user session on Thursday, May 10, 2018, to discuss progress with the Software Precertification Pilot Program, the working model, and public input received to date.