Six years after its first attempt to update its now 20-year-old guidelines for when modifications to a 510(k)-cleared device require the submission of a new 510(k) notice, the U.S. Food and Drug Administration (FDA or the Agency) issued two final guidance documents addressing this issue on October 25, 2017. The two guidance documents entitled, Deciding When to Submit a 510(k) for a Change to an Existing Device and Deciding When to Submit a 510(k) for a Software Change to an Existing Device, were originally issued in draft form on August 8, 2016. These guidances supersede FDA’s long-standing 1997 guidance, Blue Book Memorandum K97-1 on the same topic.
The overarching regulatory standard—that a new 510(k) notice is required when a modification to a cleared device “could significantly affect the safety or effectiveness” or represents “a major change or modification in the intended use” of the device—remains unchanged. However, the final guidance documents provide a more nuanced discussion of FDA’s expectations for the regulatory framework, policies, and practices underlying such a decision.
The final guidances are largely consistent with the 2016 draft guidances described in our prior alert, with some expansion of the guiding principles. The following overarching principles are outlined for deciding when a new 510(k) notice is required for changes to a cleared device:
- Intent matters! Changes made with an intent to significantly affect safety or effectiveness of a device (e.g., to significantly improve clinical outcomes, to mitigate a known risk, or in response to adverse events) are considered changes that “could significantly affect the safety or effectiveness of the device,” requiring submission of a new 510(k) notice. The guidance cautions, however, that changes not intended to significantly affect safety or effectiveness should still be evaluated for whether they meet the regulatory threshold for submission of a new 510(k) notice.
- Assessment of modifications should be risk based. Newly articulated, this guiding principle requires companies to conduct a risk-based assessment of modifications to determine whether they could significantly affect safety or effectiveness of the device, either positively or negatively. FDA has chosen the term “risk-based assessment” (as opposed to “risk assessment” in the draft) to clarify that the assessment should be based on the potential impact to both safety and effectiveness, not solely harms and effects on safety that are the focus of typical risk assessments.
- Watch out for unintended consequences. Unintended consequences of changes could trigger the need for a 510(k) notice and must be assessed.
- “Catch-all” category for new or significantly modified risks remains. Submission of a new 510(k) notice is required when a risk-based assessment of the changed device identifies any new risks or significantly modified risks, regardless of whether these risks can be mitigated. Thus, the final guidances maintain the drafts’ “catch-all” category of changes described in our prior alert.
- Routine verification and validation (V&V) should confirm that the change could not significantly affect device safety or effectiveness. Initial determinations that submission of a new 510(k) notice is not required should be confirmed through successful, routine verification, and validation activities. However, even if such activities performed to evaluate a change do not yield unexpected results, a new 510(k) is still needed if the risk-based assessment concluded that the change could significantly affect safety or effectiveness4 .
- Evaluate simultaneous changes. When multiple changes are made to a device simultaneously, the impact of the changes must be evaluated individually and in the aggregate.
- Appropriate comparative device and cumulative effect of changes. The changed device should be compared back to the most recently cleared version of the device, which may not be the currently marketed version; when the cumulative effect of changes made since clearance triggers the regulatory threshold, a new 510(k) is required.
The key differences between the draft and final versions of the guidances are summarized below.
Device Modifications Guidance
Labeling Changes. The final Device Modifications Guidance provides an expanded discussion of the types of labeling changes that may trigger the need for a new 510(k) notice by having a major impact on intended use and thus meeting the second prong of the regulatory standard for requiring a new submission. A critical element of this evaluation is the indications for use statement. Seeking to further clarify the distinction between intended use and indications for use, FDA states that while the indications for use statement is a factor in determining intended use, a change in indications for use that requires submission of a new 510(k) does not necessarily result in a new intended use (such that the device could not be found substantially equivalent). The guidance also expounds upon specific types of labeling changes that were mentioned only briefly in the draft, and formally incorporates these into the labeling change flowchart. For example, rather than asking whether a labeling change is a “substantive change in the indications for use,” any change in the indications for use statement triggers several subquestions, e.g., whether the change labels a previously single-use device as re-usable, switches from prescription to over-the-counter use, or solely improves readability or clarity. In addition, FDA emphasizes that changes to labeling could trigger the requirement for a new 510(k) even if they do not alter the indications for use statement (e.g., changes to the directions for use that impact how the device is used in practice).
Technology, Engineering, and Performance Changes. The guidelines for evaluating technology, engineering, and performance changes in the final guidance closely track the draft guidance, with only minor reorganization of information and additions to clarify how the decision-making process should be applied in particular situations.
Materials Changes. Similarly, for changes in device materials, the final Device Modifications Guidance asks the same questions and presents the same analysis as the draft guidance. This section flows with the rest of the guidance in adding emphasis on the use of risk assessment to determine whether a change is significant such that submission of a new 510(k) is required.
IVD Devices. With respect to technology, engineering, performance, or materials changes for an in vitro diagnostic (IVD) device, the final flowchart and assessment questions mirror those in the draft. Echoing language in the draft, the final guidance emphasizes that if test methods or acceptance criteria other than those previously established for evaluation of the specific (cleared) device are necessary to verify and validate the modification, a new 510(k) is likely required.
Finally, the Device Modifications Guidance includes a number of examples to illustrate how changes in the categories above should be assessed, many of which are taken directly from the draft guidance. The new or updated examples are consistent with the principles previously set forth and designed to incorporate the updated flowchart for assessing labeling changes (i.e., with a more detailed evaluation of how a change affects the directions for use) and emphasize the riskbased assessment step.
Software Modifications Guidance
The Software Modifications Guidance is intended to clarify how to assess changes to software in particular, given the increasing number of software-based medical devices marketed today. This guidance covers only changes to software (including firmware)5 that is contained within or constitutes a medical device, with non-software changes to devices containing or consisting of software (e.g., labeling updates) covered by the general Device Modifications Guidance discussed above. It also does not apply to software that is subject to FDA enforcement discretion (e.g., mobile medical apps for which FDA has stated it does not intend to enforce compliance). FDA categorizes all software changes—regardless of their specifics—as design changes. Where the manufacturer determines that a new regulatory submission is not required, it must still ensure compliance with the Quality System Regulation (21 C.F.R. Part 820), which includes appropriate documentation of the change.
As in the draft, the final guidance presents the flow of questions that should be posed in assessing a software change to a previously cleared device, with discussion of each consideration:
- Is the change made solely to strengthen cybersecurity and has no other impact on the software or the device? The final guidance clarifies that if such a change does not impact the safety or effectiveness of the device, a 510(k) is unlikely to be required.
- Is the change made solely to return the system into specification? If so, the change is unlikely to require a new 510(k). This analysis also applies to changes that add new features that appeared in the specifications of the cleared device but had not yet been implemented.
- Does the change (a) introduce a new risk or modifies an existing risk that could result in significant harm or is not effectively mitigated in the cleared device, or (b) create or necessitate a new risk control measure or a modification of an existing measure for a hazardous situation that could result in significant harm? The final guidance clarifies that the identity and severity of the hazard/risk and if/how it is handled for the cleared device determine whether a new 510(k) is needed. It differs from the draft in stating that if changes to risk controls are necessary to prevent significant harm, a 510(k) should be filed—even if the risk itself is not new. It also simplifies this part of the evaluation by merging similar terms and linking the related assessments of creation/aggravation of risk and creation/modification of risk control measures.
- Could the change significantly affect clinical functionality or performance specifications that are directly associated with the intended use of the device? As indicated in the draft, a new 510(k) is likely required if the answer to this question is yes.
The final guidance also addresses additional factors that may affect the decision of whether to file for or document a software change, discussing examples of common software changes very similarly to the draft; consistent with the general Device Modifications Guidance, though, it further emphasizes the role of risk evaluation in assessing whether a new 510(k) is needed.
In sum, the final guidance on assessing software changes to previously cleared devices is very similar to the draft issued in August 2016; the primary differences are for clarification and to emphasize the role of the “could significantly affect safety or effectiveness” standard in making these decisions. At the same time, the Agency is trying to assuage software developers’ concerns about having to surmount stringent regulatory hurdles for every iterative change to their products, for instance through the new pre-certification pilot program (see our prior alert here). It remains to be seen how the now-final guidance will be applied in practice as more companies enter or enhance their presence in the medical device software space.
With its release of the final Device Modifications Guidance and Software Modifications Guidance, FDA has concluded its six-year effort to update its 510(k) modifications policy. Although the final guidance documents may be viewed by some as a “ratcheting-up” of the requirements for submission of a new 510(k) notice in comparison to the agency’s long-standing 1997 guidance, in our experience they do not differ substantially from FDA’s expectations in recent years. Most significantly, FDA and industry can expect the new guidances to increase the predictability, consistency, and transparency of the “when to submit” decision-making process, which has been so controversial over the past decade.