Risk Management System (RMS)
This compliance category contains requirements concerning the Risk Management System to be in place for AI based SaMD.
US FDA AI/ML-based SaMD guidance documents are based on the ideas delineated in the discussion paper leveraged practices from our current premarket programs and relied on the International Medical Device Regulators Forum’s risk categorisation principles, the FDA’s benefit-risk framework, risk management principles described in the software modifications guidance, and the organization-based total product lifecycle approach also envisioned in the Digital Health Software Precertification (Pre-Cert) Pilot Program.
According to the IMDRF/SaMD N23, section 7.2 Risk Management: A Patient Safety Focused Process:
Risk management process should be integrated across the entire lifecycle of SaMD.
Organizations that engage in general software development continuously monitor and manage schedules and budget risks of a software project. Similarly, a SaMD organization should also monitor and manage risks to patients and users across all lifecycle processes.
For SaMD, product risk should be informed by the intended purpose; the normal use and reasonably foreseeable misuse; and the understood and defined socio-technical environment of use of the SaMD. Some general considerations associated with SaMD patient safety risk include the ease with which a SaMD may be updated, duplicated, and distributed due to its non-physical nature, and where these updates, made available by the SaMD organization, may be installed by others.
Risk management in the context of this document, outlines a risk-based approach to patient safety. Specifically, related to QMS, some points that should be considered include:
Identification of hazards;
Estimation and evaluation of associated risks;
Actions to control risks; and
Methods to monitor effectiveness of the actions implemented to control risks.
Similarly, in the US FDA Good Machine Learning Practice (GMLP) guiding principles:
Principle 1. Multi-Disciplinary Expertise Is Leveraged Throughout the Total Product Life Cycle: In-depth understanding of a model’s intended integration into clinical workflow, and the desired benefits and associated patient risks, can help ensure that ML-enabled medical devices are safe and effective and address clinically meaningful needs over the lifecycle of the device.
Principle 2. Good Software Engineering and Security Practices Are Implemented: Model design is implemented with attention to the “fundamentals”: good software engineering practices, data quality assurance, data management, and robust cybersecurity practices. These practices include methodical risk management and design process that can appropriately capture and communicate design, implementation, and risk management decisions and rationale, as well as ensure data authenticity and integrity.
Principle 6. Model Design Is Tailored to the Available Data and Reflects the Intended Use of the Device: Model design is suited to the available data and supports the active mitigation of known risks, like overfitting, performance degradation, and security risks. The clinical benefits and risks related to the product are well understood, used to derive clinically meaningful performance goals for testing, and support that the product can safely and effectively achieve its intended use. Considerations include the impact of both global and local performance and uncertainty/variability in the device inputs, outputs, intended patient populations, and clinical use conditions.
Principle 10. Deployed Models Are Monitored for Performance and Re-training Risks Are Managed: Deployed models have the capability to be monitored in “real world” use with a focus on maintained or improved safety and performance. Additionally, when models are periodically or continually trained after deployment, there are appropriate controls in place to manage risks of overfitting, unintended bias, or degradation of the model (for example, dataset drift) that may impact the safety and performance of the model as it is used by the Human-AI team.
Below is the list of the controls that are part of this compliance category:
Last updated