The FDA issued two new, highly anticipated draft guidance documents to instruct manufacturers as to the requirements of when to submit a new premarket notification (510(k)) following a change to an existing device. Under FDA regulations, a device manufacturer must submit a new 510(k) when a modification "could significantly affect the safety or effectiveness of the device" or represents a "major change or modification" in the intended use of the device.1 The FDA and manufacturers often reach different conclusions as to what qualifies as a change to a legally marketed device. The new draft guidance documents, "Deciding When to Submit a 510(k) for a Change to an Existing Device"2 and "Deciding When to Submit a 510(k) for a Software Change to an Existing Device"3, intend to create a standard for manufacturers and the FDA to interpret what qualifies as a modification to an existing device.
The first draft guidance document "Deciding When to Submit a 510(k) for a Change to an Existing Device" is a revision to the FDA's 1997 final guidance for existing devices.4 The flowcharts for decision-making have been updated significantly in the general guidance. Consistent with the 1997 policy, flowcharts are available for each type of change, including labeling changes; technology, engineering, and performance changes; materials changes; technology, engineering, performance and materials changes for in-vitro diagnostic devices; and considerations for risk assessments of modified devices.5 The flowcharts for decision-making have been updated to include a number of new questions for industry in assessing changes to their devices.
The guidance provides principles for deciding whether to submit a new 510(k). These principles include:6
- Modifications made with the intent to significantly improve safety or effectiveness of a device. If a modification is made with the intent to significantly improve the safety or effectiveness of the device, a new 510(k) is likely required.
- "Could significantly affect" evaluation and the role of testing. A risk-based assessment should be conducted by the manufacturer to determine whether a change could significantly affect the device's safety or effectiveness, either positively or negatively. This assessment should identify and analyze the new risks and changes to the known risks resulting from the modification.
- Unintended consequences of changes. Manufacturers should consider whether there are any unintended consequences or effects associated with the modification.
- Use of risk management. There are multiple risk factors to consider, including hazards and hazardous situations, risk estimation, risk acceptability, risk control, risk/benefit analysis, and overall risk evaluation.
- Evaluating simultaneous changes. Simultaneous changes are typically considered at once; therefore, each change must be assessed separately and in the aggregate.
- Appropriate comparative device and cumulative effect of changes. The risk-based assessment includes an evaluation of the cumulative impact of all changes as compared to their most recently cleared device.
- Documentation requirement. When changes are made to a device, a manufacturer must submit documentation in compliance with the FDA's Quality System Regulation (QSR).
- 510(k) submissions for modified devices. "When a new 510(k) is submitted for a device with multiple modifications, that 510(k) should describe all changes that trigger the requirement for a new 510(k). That 510(k) should also describe other modifications since the last cleared 510(k) (i.e., those that did not require a new 510(k) that would have been documented as part of the original 510(k) for that device."
- Substantial equivalence determination. A substantially equivalent determination is not assured even if all of the guidance principles are followed.
The FDA intends that the software draft guidance document will work in conjunction with the broader guidance discussed above. This software-specific guidance is meant to address cybersecurity issues. A new 510(k) is typically not required when software changes are made solely to strengthen cybersecurity, protect information, and reduce disruption in service without impacting the performance of the device. Software changes that introduce a new or alter an existing cause or type of hazardous situation that is not mitigated in the most recently cleared device likely will require a new 510(k). For instance, a hazardous situation exists when there is a potential for exposure to physical injury or damage to health. The guidance also addresses the interaction between software and other device elements, for instance in considering whether a software change could affect performance specifications associated with a device's intended use.
What It Means to You
The FDA's guidance remains in draft form. On August 25, 2016, the FDA held a webinar to discuss these documents.7 These draft recommendations are intended to provide guiding principles to help manufacturers determine when an intended change to a legally marketed medical device subject to premarket notification (510(k)) requirements is significant enough to warrant FDA review. Once these documents are finalized, the draft guidance documents will replace the FDA's longstanding 1997 guidance. The guidance documents are open for comment until November 7, 2016.