The U.S. Food and Drug Administration (FDA) recently issued a Warning Letter citing a failure to obtain marketing authorization via a premarket approval (PMA) or 510(k) clearance as well as Good Manufacturing Practice (GMP) violations for an AI-enabled diagnostic medical device. In the letter, FDA provides instructive clarification of its views of the limitations of the 510(k) exemption claimed by the company and also identifies quality management system gaps indicative of a company that has not developed significant portions of the quality management system that is required for most medical devices even if exempt from premarket notification requirements. The Warning Letter is a cautionary tale for companies developing software and AI based applications that screen, diagnose, and treat diseases and the potential for enforcement action where classification is incorrect and quality compliance infrastructure is not adequately developed.
Beyond the device context, the Warning Letter can be instructive and an indication of FDA priorities for AI governance to apply its existing frameworks, as it highlights the need for written procedures for design controls, handling complaints, and corrective actions in response to quality problems. For companies focusing on device use cases and seeking a programmatic approach for compliance, the Warning Letter calls out specific areas that should be integrated as company policies. These include ensuring suppliers are qualified, adequate training on the system and updates, management review, and audits.
We have summarized the letter below, and on April 29-30, Hogan Lovells is hosting its fourth annual AI Health Law & Policy Summit, where panelists will discuss best strategies for AI governance, among other topics.
Exer Labs manufactures the “Exer Scan,” a mobile AI-based screening tool purporting to screen for and diagnose neurological and musculoskeletal disorders. The product was and continues to be listed with FDA as a class II 510(k) exempt device under the product category for measuring exercise equipment; however, an October 2024 FDA inspection found Exer Labs was marketing the product as an artificial intelligence (AI)-based algorithm to “screen, diagnose, and treat musculoskeletal and neurological disorders,” going beyond the bounds of the 510(k) exemption and therefore triggering the need to secure a 510(k) clearance, or in the worst case, a PMA approval for the intended uses for which the product was being marketed. FDA specifically cites, “the use of artificial intelligence-based algorithms to screen, diagnose, and treat musculoskeletal and neurological disorders” as being among the claims that exceed the limitations of the exemption. FDA also references specific claims on the website that the Exer Scan could be used to “screen and treat patients with Parkinson’s, TB, Cerebral Palsy and more using AI and computer vision…”
In addition to the lack of adequate 510(k) clearance, FDA’s WL also found Exer Labs lacked procedures for several of the major subsystems that make up a medical device quality system as required by the Quality System (QS) regulation found at 21 CFR Part 820. The specific QS issues called out by FDA spotlight key compliance concerns for manufacturers of medical devices, whether or not the device includes AI-enabled software. FDA cited the company for needing to adequately establish procedures for:
- design controls.
- evaluating complaints.
- corrective and preventive actions (CAPAs).
- ensuring all purchased or otherwise received product and services conform to specified requirements.
- management review.
- quality audits.
- training and identifying training needs.
In at least one instance, FDA wrote that Exer Labs had changed the design of its product following a complaint but did not perform any formal CAPA evaluation. FDA also admonished Exer Labs for failing to establish purchasing controls for its suppliers; specifically noting that service providers are also considered suppliers and should be encompassed by purchasing controls. In addition, AI-enabled device manufacturers must have in place training procedures, and maintain records of training reported as being provided to staff.
As a result of the WL, FDA required Exer Labs to cease commercial distribution of the device for the uses discussed in the letter, demonstrating the severity of failing adhere to limitations of an exemption and comply with QS regulations and agency rules governing AI-enabled medical devices. We note however that as of the writing of this alert, Exer Lab appears to be continuing to market the Exer Scan but with dramatically scaled back claims that may more closely align with the limitations of the exemption, and scaled back mention of the device’s use of AI, It is unclear where Exer Labs is on implementing improvements to their quality system processes and controls.
The letter also serves as a warning to non-device software manufacturers, such as non-device clinical decision support software that the line between active regulation and limited regulation is nuanced and that it is easy to trip over the line into active regulation. It is not a far stretch that modifying claims, updating software, or enabling new product features may dramatically affect a products’ regulatory classification and leave a company in a situation where it is found to be noncompliant to regulations that it did not appreciate applied to its operations. Moreover, claims or feature updates could cause their device to be viewed as AI-enabled software that requires submission of a 510(k) or even a PMA and implementation of a QS, bringing the product into the highly regulated space of “medical devices.” Finally, the use of AI in software – depending on the role of the AI – is not inherently prohibited and does not trigger active regulation in all instances, but it does often lead to greater scrutiny as FDA seeks to discern the role of the AI and whether it presents risks that require active regulation.
[View source.]
