FDA Makes Draft Guidance Available on Lifecycle Management and Marketing Submission Recommendations for AI-Enabled Device Software Functions and Requests Industry Input

At a Glance

• On January 7, 2025, FDA published “Artificial Intelligence-Enabled Device Software Functions: Lifecycle Management and Marketing Submission Recommendations; Draft Guidance for Industry and Food and Drug Administration Staff.”
• The Guidance adds to previous, though less formalized, recommendations sounding in good machine learning practice and emphasizes the importance of demonstrating transparency and patient engagement.
• FDA is requesting specific input from industry on the proposed recommended approaches.

On January 7, 2025, FDA published “Artificial Intelligence-Enabled Device Software Functions: Lifecycle Management and Marketing Submission Recommendations; Draft Guidance for Industry and Food and Drug Administration Staff” (Guidance). In it, the Center for Drug Evaluation and Research, the Center for Biologics Evaluation and Research, the Center for Device and Radiological Health, and the Office of Combination Products in the Office of the Commissions (FDA) jointly lay out proposed recommendations on the documentation that is essential to support an Agency’s determination of safety and effectiveness when reviewing marketing submissions for devices that use artificial intelligence (AI)-enabled software functions. In order to facilitate sponsor creation of this essential documentation, FDA also provides recommendations on the design, development, and implementation of AI-enabled devices throughout the total product lifecycle (TPLC).

FDA is requesting specific input from industry on the proposed recommended approaches:

• Do the recommendations align with the AI lifecycle throughout the TPLC?
• Are the documentation recommendations sufficient for documenting generative AI and other emerging technologies?
• In the context of device performance monitoring, would the contemplated performance monitoring plans serve as effective risk mitigation measures?
• Would the recommended user documentation, such as in model cards, be fit for purpose?

Comments are due 90 days from the Federal Register publication.

The Guidance adds to previous, though less formalized, recommendations sounding in good machine learning practice (GMLP) and emphasizing the importance of demonstrating transparency and patient engagement. (See, e.g., Good Machine Learning Practice for Medical Device Development: Guiding Principles). Among other things, the Guidance firmly couples the transparency imperative to the criticality of unbiased outcomes, at times referring to equity of benefit under the rubric of safety and effectiveness.

The Guidance is lengthy – 67 pages, including 24 pages comprising five appendices. Early on, FDA spends a couple pages parsing through what the Guidance contains as opposed to others that came before it, the main idea being that industry still needs to consult all the applicable guidances. One item that stood out to us in this regard was the encouragement of sponsors to use predetermined change control plans and reference to the Guidance for Industry, “Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions.” (p. 5). Another is the admonition to use the term “validation” only as defined in 21 CFR 820.3(z) and not when referring to the term of art used in AI/ML technical communities more generally to cover data curation, model training, and model selection. (p. 6)

Sections V-XIII cover: device description; user interface and labeling; risk assessment; data management; model description and development; validation; performance monitoring; cybersecurity; and submission summary, respectively. For each, FDA explains the “what,” “why” and “where,” i.e., the recommended documentation, FDA’s rationale for requesting it and where to put the information in the submission. In these sections, FDA appears to be seeking input to help it grapple with the inherent overlap of these topics/categories with the quality systems submission sections. Notable items from these sections include:  

• FDA encourages use of FDA-recognized consensus standards when developing AI-enabled devices and preparing premarket documentation and links to its web posting, FDA Recognized Consensus Standards Database. In fact, the agency goes as far as recommending that sponsors incorporate the considerations outlined in the FDA-recognized voluntary consensus standard of AAMI CR34971 Guidance on the Application of ISO 14971 to Artificial Intelligence and Machine Learning, in risk assessment sections of marketing submissions, and referencing another as an additional resource saying, “ANSI/AAMI HE75 Human factors engineering - Design of medical devices includes recommendations on using information in labeling to help control risks.” (p. 17)
• FDA examines the interplay between user interface and labeling and clarifies where to put which kind of information in a submission. (pp. 10-16)
• FDA explains why data management is important for identifying and mitigating bias, and why sponsors need to include full and accurate characterization of data in marketing submissions to document effective assessment of potential of bias “to produce incorrect results in a systematic, but sometimes unforeseeable, way due to limitations in the training data or erroneous assumptions in the machine learning process.” (p. 18). FDA then proceeds to provide a helpful and lengthy list of factors (and subfactors) sponsors should make sure to cover in submissions, including data collection, cleaning/processing, reference standard, data annotation, data storage, management and independence of data, and representativeness. (See “Section VIII. Data Management,” pp. 18-24)
• In “Section X. Validation,” FDA takes 6 pages to cover software version history and performance validation, including providing specific recommendations, e.g., on how and when performance of the human-device team affects study design and testing choices, what to include when describing study protocols, and how to assess and document study results. (pp. 26-32)
• In Section “XII Cybersecurity,” FDA calls out specific AI risks to be addressed in marketing submissions for “cyber devices” (as defined at Section 524B(c) of the FDCA (21 U.S.C. §360n–2), namely, data poisoning, model inversion/stealing, model evasion, data leakage, overfitting, model bias, and performance drift. (pp. 34-36)

Throughout the Guidance, FDA calls out other resources, e.g., additional applicable guidances, and provides links for easy cross-reference to each. Where needed, FDA also references the varying standards applicable among different submission types. (See, e.g., p. 37, fn 59-62)

Last, but certainly not least, FDA provides helpful appendices containing additional specific recommendations for particular topics as well as ready references and examples. Sponsors should review and be guided by the recommendations in Appendices B, C, and D as additive to the contents of the main body of the guidance. The final 14 pages containing the example model card and example 510(k) summary with model card (Appendices E and F) will be particularly welcomed by sponsors:

Appendix A: Table of Recommended Documentation

Appendix B: Transparency Design Considerations

Appendix C: Performance Validation Considerations

Appendix D: Usability Evaluation Considerations

Appendix E: Example Model Card