FDA Unveils Update to Software Precertification Program

The U.S. Food and Drug Administration (FDA) recently updated its software Precertification Program. A working program was originally rolled out in April 2018, but the program was updated in response to requested public input. The FDA expects to roll out a finalized version of the program by December 2018 and to have a pilot test available in 2019.

With the precertification program, the FDA hopes to streamline the certification of “mobile apps” and other software that is used to “treat, diagnose, cure, mitigate, or prevent disease or other conditions,” or so-called software as a medical device (SaMD), according to the updated program description. While software in a medical device (SiMD) is not currently part of the program, the FDA hopes to include SiMD and software that is an accessory to hardware in the future. The program will allow certain organizations that can demonstrate a “culture of quality and organizational excellence” to streamline their oversight of SaMD.

The update clarifies that not all software is subject to regulatory review even if it has some connection to the medical industry. In particular, the update notes that non-device software is exempt, such as software that is intended for (1) for administrative support, (2) for maintaining or encouraging a healthy lifestyle, (3) to serve as electronic patient records, (4) for transferring, storing, converting formats, or for displaying data, or (5) to provide certain limited clinical decision support.

According to the update, organizations “of all sizes” can qualify. The FDA makes clear that startups and smaller companies can apply and receive precertification. Two levels of precertification exist. Level 1 precertification allows an organization to develop and market “lower risk” software without review while also streamlining review of higher risk software. This level would be awarded to an organization that demonstrates excellence in product development but may have a “limited track record” in “developing, delivering, and maintaining” products in the healthcare market. Level 2 precertification allows “lower and moderate risk” software to be developed and marketed without review and allowing streamlined review of other software. This level is awarded to those organizations with a track record in demonstrating high quality software products.

In determining what amount of review is required for “lower risk” and “moderate risk” SaMD, the FDA looks at (1) the risk category of the product, (2) the level of precertification of the organization, and (3) the extent of the changes the software relative to an existing device. Under either level of precertification, “minor changes” require no review by the FDA.

The FDA is looking to update additional aspects of the precertification program, including how it relates to substantially equivalent device review. The FDA is currently requesting comments on the program.