Where did all the Risk Class I SaMD go?

There’s good reason to want your SaMD to fall under Risk Class I.  For one thing, the approval process can be super simple – essentially self-certification — both for the EU and the US (in most cases, at least).  Risk Class I gives you the benefits of getting the FDA and MDR “stamp of approval” (i.e., being able to say your device is registered with the FDA or, in the case of MDR, has a CE Mark) while not having to spend the money or time of an actual FDA or Notified Body review.

So what types of SaMD fall into Risk Class I?

Well, none…essentially, anymore.

That’s right.

Under current rules, very few low-risk software products qualify as Class I.

Why?

Both the EU Medical Device Regulation (MDR) and the U.S. FDA’s implementation of the 21st Century Cures Act have dramatically reduced the kinds of software that qualify as Class I medical devices.

• In the EU, the MDR introduced Rule 11, which upclassified most SaMD products

• In the U.S., the FDA effectively deregulated several categories of low-risk SaMD products by removing them from its definition of a “medical device” altogether

This means your “low-risk” SaMD is now likely Class IIa or IIb in the EU—or no longer a regulated medical device at all in the U.S.

Let me break it down a bit further.

The MDR’s upregulation of low-risk SaMD

Under the MDD, SaMD risk classification was determined by applying general risk classification rules for devices, which resulted in too many moderate-risk SaMD being under-classified as Risk Class I.  MDR filled these regulatory gaps with Rule 11, which states that any SaMD that 1) provides information used in making medical decisions or 2) monitors physiological processes is at least Risk Class IIa. This means that clinical decision support software, medical device data systems, and even some general wellness software would now fall under Risk Class IIa.

MDR Rule 11 states, verbatim:
Software intended to provide information which is used to take decisions with diagnosis or therapeutic purposes is classified as class IIa, except if such decisions have an impact that may cause: death or an irreversible deterioration of a person’s state of health, in which case it is in class III; or a serious deterioration of a person’s state of health or a surgical intervention, in which case it is classified as class IIb. Software intended to monitor physiological processes is classified as class IIa, except if it is intended for monitoring of vital physiological parameters, where the nature of variations of those parameters is such that it could result in immediate danger to the patient, in which case it is classified as class IIb. All other software is classified as class I.

FDA’s deregulation of low-risk SaMD

The FDA had the problem of being flooded with reviews for devices, particularly apps that tracked health information and electronic health record systems, starting around the 2010s. The 21st Century Cures Act addressed this by deregulating certain low-risk software devices to allow the FDA to focus its resources on reviewing higher-risk products. The Act effectively changed the definition of a medical device to NOT include the following:

• software that supports health care facility administration, including EHRs, so long as it doesn’t interpret or analyze patient data or images

• healthy lifestyle apps and trackers that don’t diagnose, cure, mitigate, prevent, or treat a disease or medical condition (or general wellness apps)

• software for transferring, storing, converting formats, or displaying clinical information that doesn’t interpret or analyze this information (or devices labeled Medical Device Data Systems or MDDS)

• software that provides limited clinical decision support to health care professionals (or clinical decision support, or CDS, software)

In other words, software that does not interpret or analyze medical information, stays away from actual diseases or medical conditions, and provides information to help clinicians make their own decisions is no longer considered a medical device regulated by the FDA.

There must be exceptions, right?

Of course there are exception, as Class 1 SaMD products do exist, but figuring out why and how they achieved Class I status requires reading between the lines of guidance documents and some creative interpretation. 

MDR Class I Medical Device Software

The infamous Rule 11 does give a nod to the existence of Risk Class I SaMD (note that that the MDR calls SaMD “medical device software,” or MDSW – just as an FYI) in the clause, “all other software is classified at Risk Class 1.” The challenge is in determining what falls into this miscellaneous bucket. A 2019 guidance document provides only one example of a class 1 device –  an app supporting contraception by calculating user inputs based on a validated statistical algorithm. I suppose that this app is technically not analyzing information to inform a disease per se (fertility is not a disease or medical condition) and it’s not monitoring a physiological process (just storing user inputs and then analyzing them), I suppose this doesn’t meet either criteria for being upclassified to Class IIa. You could interpret this app as being high-risk, in that a device failure could lead to an unwanted pregnancy… but anyway.

You can also gather a little more about products that fall in this miscellaneous bucket from reviewing Class 1 SaMD that has been approved following the publication of Rule 11.  One example of an approved MDR Class I SaMD is a medical device data system that captures and stores vital signs in a non-critical setting. While this device is technically storing and recording rather than monitoring physiological processes (i.e., vital signs) in a non-critical setting, I suppose it doesn’t meet either criteria listed in Rule 11. 

Another example of MDR Class I SaMD?  Apps that provide physiotherapeutic training resources for people with knee pain, erectile dysfunction, and chronic pain, as well as apps providing cognitive behavioral therapy (CBT) for managing the symptoms of depression, fatigue related to a particular disease, or even conditions like Tinnitus.  What these examples suggest is that apps oriented around managing symptoms of a disease or condition (rather than treating the disease or condition) through therapies (perhaps even better to describe them as exercises, so no one would confuse your product for actually ‘treating’ these conditions) like physiotherapy and CBT that are considered low risk, may be considered MDR Class I SaMD moving forward. 

If you would like to see a list of MDR Class 1 SaMD, Oliver Eidel from OpenRegulatory has assembled one here. I encourage you to read his whole analysis of MDR Class 1 SaMD – it’s very useful. He also points out variations among the different competent authorities across Germany in their rates of ‘approving’ Class 1 classifications – which is something that has influenced many founders in where they choose to base their businesses.

FDA Class I SaMD

The FDA released guidance documents for each of the deregulated types of SaMD that provide additional rule and clarifying examples of when these software products might fall into the category of medical device again. The challenge with this guidance is that it doesn’t group the exceptions into risk classes, and many of the examples provided fall into higher risk classes. But you can read between the lines for some clarity on what might count as FDA Class I SaMD.

FDA Class I Medical Device Data System

According to the FDA’s 2022 MDDS guidance, software that prioritizes information displayed, triggers alarms, or generates notifications based on interpreted data becomes a regulated medical device once again.

Given this, one way to potentially get a class 1 device is if your software gives an alert in a noncritical context for a non-serious condition. So, for instance, a device intended for at-home use that receives and displays monitoring data and alerts caregivers to take non-urgent action may qualify as Class 1. An example of a FDA Class I SaMD (product code QED, if you want to look it up) is a Pressure Ulcer Management Tool, which measures electrical capacitance and alerts caregivers of the need for possible interventions (without actually diagnosing a pressure ulcer). While not purely SaMD (there’s hardware associated with this device), it does give you a sense of what types of software functions are considered Class I. 

FDA Class I Clinical Decision Support Software

According to CDS Guidance published in 2022, a CDS crosses the line into device territory if it meets any of the following 4 criteria:

1. if the software does any processing or analyzing of images or data

2. if it provides information to support time-critical decision making

3. if the system offers inadequate transparency as to how the software came up with its recommendation

4. if the software is directed at patients or caregivers rather than providers

Given this, an FDA Class 1 CDS might involve the provision of non-urgent information regarding a non-critical condition to a caregiver rather than a healthcare provider, which would break rule 4, making it a low-risk regulated device (the Pressure Ulcer Management Tool may be another good example of this, as it is intended to be used by caregivers, not providers). For these types of devices, it’s also probably a good idea to test it against the IMDRF Risk Classification rubric (which the FDA loosely follows). To sum up what the IMDRF considers a low risk SaMD:  any device that informs clinical management for a non-serious situation or condition is firmly Risk Class I.   

General Wellness Software

This is a tough one, because the FDA has essentially decided not to regulate all Class 1 devices that fall into general wellness territory, even if the software addresses disease instead of wellness and health. In the General Wellness guidance, it even provides examples of software that it acknowledges fall under the rubric of a medical device, but that it “does not intend to enforce requirements” for. For example, in the case of software that reduces the risk of skin cancer by tracking sun exposure, the guidance explains that it uses its discretion not to regulate this device because it uses the wording ‘may help reduce,’ in its labeling, it is based on a very well-established and generally accepted claim about the impact of a lifestyle choice on the disease or condition in question, and that it is an overall low-risk device, in that the device not functioning correctly would not lead to immediate or fatal injuries or life-threatening conditions.

This leads me to wonder: would a simple change in the label from “may help reduce” to “will reduce” bump it up to a device worth regulating? It would still technically be at an IMDRF Risk Class I, as it’s informing an action for a non-serious situation. But it’s still hard to say. I am going to keep my eyes peeled for examples of general wellness products that have been registered with the FDA as Class I.  If you know of any, please share them with me! 

Key Takeaways for Achieving Risk Class 1 Status for your SaMD

1. If you want to be MDR Class 1, focus your product on managing the symptoms of a disease or condition based on techniques like physiotherapy and CBT that are generally considered low-risk, self-help modalities. And you might want to improve your odds for getting a Class I designation by carefully selecting which competent authority you consult with on your device classification.

2. If you want your product to be FDA Class I SaMD, pay attention to the rules laid out in guidance documents related to whether MDDS, CDS, and general wellness products count as regulated devices. Think about how your product might move into device territory based on these rules. 

3. Make sure your software falls into the IMDRF’s parameters of a Class 1 SaMD, namely, that it focuses on non-serious conditions, that it informs treatment decisions rather than directing them, and that a device failure would not have serious repercussions.

A word of caution regarding FDA Class I SaMD

Even if you are convinced you have a Risk Class 1 device, you still may not be able to “self-certify” it with the FDA. The FDA only allows you to register your product without any review (i.e., what I’m calling “self-certifying”) if your product is specifically exempt from the 510(k) path. Most common Class 1 medical devices are exempt from 510(k) notification requirements, but SaMD is new terrain for the FDA, and existing predicates don’t necessarily exist. This means that even though you are Risk Class 1, you may still have to go through a 510(k) (if there is a predicate that is not exempt) or a De Novo application (if there’s no predicate, which is often the case with SaMD) pathway.  While cheaper than the typical MDR Notified Body pathway, the 510(K) and De Novo pathways are still more expensive than the ‘self-certification’ pathway, which is essentially free. It’s confusing, I know, but keep in mind that the FDA doesn’t consider risk class alone in determining an approval pathway (well, unless your device is Risk Class III, in which case you’ll most certainly have to use the PMA pathway). A combination of risk class and whether there are exempt predicates already on the market determines your pathway.