Overview of medical regulatory standards

Putting a new drug or medical device on the market is nothing short of an obstacle course for many companies. I once worked for a medical startup building a disposable endoscope (as co-founder) and more recently helped a client navigate an evolving regulatory environment.

In this short article, I describe some of the major US standards; their scope, what they entail and also briefly talk about the future impact of AI (Artificial Intelligence).

How does "Med" regulation work in the US?

Before you are allowed to put a new device or drug on the market in the US, the powerful FDA (Food and Drug Administration) wants you to prove that the "investigational product" is safe - and we certainly want that watchdog to exist. The FDA needs to weigh the risk of introducing a new medical solution versus whether patients' health will either improve or degrade (this is why side effects must be documented and communicated to patients).

New drugs or devices go through a different auditing process depending on several criteria. For devices for example, 3 classes of devices exist, mostly depending on how invasive they are to humans.

A toothbrush will NOT need FDA approval while implants and pacemakers (class 3) can take multiple years (~5-10 years) before being fully approved notably because class 3 devices are subject to clinical trials. Clinical trials imply recruiting several voluntary patients ("participants") but also hospitals and medical staff and the trial will be subject to a lot of documentation and traceability requirements.

Drug trials are staged in phases and will need thousands of participants throughout the overall process:

Ok, let's review three key standards that will most likely affect the commercialization of any new medical solution.

3 key standards

• "510k" is the process used to initiate and pursue device or software certification. The FDA will clear ~3000 new medical devices per year (the number of annual submissions is x3 to x4 times higher). A 510k submission needs preparation: you'll need to decide on a product class, detail the hazards and risks, and explain how you are going to evaluate and track them. You'll need to submit detailed design plans and feature sets, including if a device uses software outside of a device. If you can demonstrate that your device is significantly similar to a product that was already cleared (called a "syndicate" device), the auditing and certification process will be significantly accelerated. For class 3 devices, the types of materials (plastic, paint, metal, etc...) used in a device entering human flesh will be particularly investigated and most likely tested on animals first during trials.

• IND-NDA: To put a new drug on the market (only 37 "novel" new drugs were authorized in 2022), it often means a 2-stage process: IND (for Investigational New Drug) which is the step that will document the outcome of studies on animal and human clinical trials. This will support an NDA submission (New Drug Application) which the FDA will need to approve before any commercialization. Generic drugs can benefit from an accelerated review.

Before a clinical trial starts, a protocol must be described. It will detail the dosage (volume, frequency, etc...), participant enrollment criteria (age range, gender, disease profile, etc...), placebo strategy, exam strategy, profile of staff required, etc...

CRA (or Clinical Research Associates) will then regularly audit that proper logs are maintained including date/lots of drugs given to participants and also things like proper training of the medical staff and adequate qualification to perform exams, patient privacy, etc... There are ~35000 new trials started every year (and 25k CRA currently active in the US with 95k job openings so there is demand!). Beyond CRA typically employed by third-party companies for neutrality, the FDA will also randomly audit clinical trials (~2%) to ensure application of protocol and overall regulatory conformity.

• ISO 13485: This is a Quality Management Standard (QMS) that affects the production of drugs or devices (similar to ISO 9001 but with a focus on medical safety requirements). Like many QMS standards, it focuses on the documentation and traceability of various design and production steps, including documentation of design changes, documentation of quality protocols and metrics and any deviation. While this standard is more focused on scaling the production of a medical solution, it is more and more imposed as a quality standard that even med startups will not be able to ignore.

Conclusion

Putting a new drug or device on the market is a journey and will cost anything from a couple thousands of dollars to tens of millions. A few dozen drugs and a few thousand new devices are approved in the US every year. When you design a new solution - you have to know the regulatory rules or your chances of success are slim.

A word about AI/ML (Artificial Intelligence/Machine Learning): in the medical space. While you read more and more articles demonstrating the ever-increasing performance of automated health diagnostics over humans, the lack of "explainability" of AI models remains an issue for life-critical applications (similar issues are discussed in the context of self-driving cars for example, where an autopilot may take life-threatening decisions).

Explainability means that given the way current AI techniques work, it is hard to explain why a false-positive (e.g., erroneous detection of a cancer) or a false-negative (e.g., existing cancer that should have been detected).

Diagnostic errors can be due to a lack of AI training data, a lack of proper labelling of the training data, noisy input data, models that are too specific or, on the contrary, failing to generalise new data properly, etc...

In essence, yes, AI/ML are a bit of a black box and if you cannot explain the reason why a diagnostic fails, it can have severe consequences. This is why humans continue to be largely in the loop as way to double-check and validate automated health diagnostics.

One way the automotive industry is proposing to reduce the false detection risks is to have multiple AI algorithms compete with an arbitration system in case they don't agree. We'll see if a similar approach will be used in the medical space.

The FDA is effectively looking into this particular issue (alongside, cybersecurity, data privacy, etc...) but these various topics remain complex to address for future generations of SaMD or "Software as a Medical Device". More information here.

#medicaltrial #medicalregulation #newdrug #newdevice #FDA #510k #ISO13485 #IND #NDA #medtech

As always, feel free to contact me @ [email protected] if you have comments or questions about this article (I am open to providing consulting services).

More at www.lohier.com and also my book. You can subscribe to this free bi-weekly newsletter here and access former editions here.