Attorney Questions 510(k) Standard in O.N. Diagnostics Warning Letter
FDA's recent Warning Letter to O.N. Diagnostics raises questions about whether the agency is applying an overly expansive interpretation of when software modifications require a new 510(k), according to a new legal analysis.
In a 10/26 FDA Law Blog article, attorney Jennifer Newberger examines the regulatory implications of FDA's determination that changes to the company's VirtuOst vertebral fracture assessment software required additional premarket clearance.
As FDA Webview reported on 10/7, FDA's 9/1 Warning Letter cited three significant software modifications: introduction of a new machine-learning algorithm, conversion from a desktop application to a web-based platform, and migration of the underlying technology platform.
FDA concluded that the changes could significantly affect the device's safety or effectiveness and therefore required a new 510(k) submission.
Newberger's analysis focuses on the distinction between software modifications that require verification and validation and those that meet the regulatory threshold for a new premarket notification.
Under 21 CFR 807.81(a)(3), manufacturers generally must submit a new 510(k) when modifications could significantly affect a device's safety or effectiveness. FDA's guidance on software modifications provides a framework for evaluating that determination.
However, Newberger questions whether the agency's reasoning in the O.N. Diagnostics letter adequately distinguishes between the need to validate a software change and the separate determination that the change requires new clearance.
FDA specifically cited the potential for a newly trained machine-learning model to perform differently across patient populations, imaging equipment and clinical settings. The agency said inadequate validation could result in missed diagnoses or delayed patient assessments.
The Warning Letter also identified cybersecurity risks associated with moving VirtuOst to a web-based architecture and the need for comprehensive verification and validation following changes to its technology platform. The legal analysis raises the question of whether those concerns, although relevant to software safety and quality, independently establish that a new 510(k) was required.
The issue has broader implications for manufacturers of software as a medical device, particularly developers of artificial intelligence-enabled products that may undergo algorithm updates, platform migrations and other software modifications throughout their commercial life, according to Newberger.
The Warning Letter also illustrates FDA's examination of software-development documentation, including version-control records and release notes, when evaluating whether manufacturers have made changes that require additional regulatory review.
Newberger's analysis suggests that manufacturers should carefully document both their validation activities and their regulatory rationale for determining whether software changes require a new submission.
The central issue is whether FDA's enforcement approach reflects its existing software-change guidance or signals a more demanding interpretation of the 510(k) requirements for evolving software-based medical devices.