document controls, and risk management.

21 CFR Part 211: Current Good Manufacturing Practice (cGMP) regulations for drugs ensure the quality of pharmaceutical products, encompassing everything from production processes to quality control.

FDA Guidance Documents: The FDA has issued various guidance documents, including “Software as a Medical Device (SaMD): Clinical Evaluation” and “Artificial Intelligence/Machine Learning (AI/ML)-Based Software as a Medical Device (SaMD),” which provide recommendations on the evaluation and oversight of AI/ML technologies.

Additionally, the International Council for Harmonisation (ICH) guidelines provide standards for the design and conduct of clinical trials that also address the use of AI in research settings.

Documentation

Effective documentation is essential when integrating AI/ML into GxP quality systems. Key documentation elements include:

• Validation Protocols: Document how the AI/ML system is validated to ensure reliability and compliance with applicable regulations.
• Risk Management Files: Conduct a thorough risk assessment to identify potential risks associated with AI/ML deployment and outline mitigation strategies.
• Training Records: Provide training documentation for personnel involved in operating and overseeing AI/ML systems to ensure proper use.
• Change Control Records: Manage and document modifications to AI systems meticulously to maintain compliance throughout the life cycle of the product.

Review/Approval Flow

The process of regulatory review and approval of AI/ML technologies in GxP environments typically involves several key stages:

1. Pre-Submission Communication: Engage with the FDA early in the development process, utilizing tools such as the Pre-Submission meeting to gain insight into regulatory expectations.
2. Submission Preparation: Prepare the necessary documentation, including data supporting the safety and efficacy of the AI/ML application, alongside details of the quality systems in place.
3. Regulatory Submission: Submit appropriate applications (e.g., 510(k) for medical devices incorporating AI/ML or New Drug Applications for novel drug products) to the FDA.
4. FDA Review: The FDA will conduct a comprehensive review, assessing the data submitted, including clinical evaluations, validation efforts, and risk management plans.
5. Post-Market Surveillance: Upon approval, utilize post-market data collection to monitor the AI/ML application’s performance and report any issues as per FDA requirements.

Common Deficiencies

Despite best efforts, companies may encounter deficiencies during FDA review. Common deficiencies related to AI/ML implementations include:

• Lack of Validation Evidence: Insufficient documentation demonstrating that an AI/ML system performs reliably under applicable conditions.
• Poor Change Management: Failure to adequately document and manage changes to the AI/ML algorithms and their implications on product quality.
• Incomplete Risk Assessments: Not fully identifying potential risks associated with algorithm bias or model performance variability.
• Insufficient User Training: Lack of documented training procedures for personnel on the proper use and limitations of AI tools.

Regulatory Affairs-Specific Decision Points

Filing Applications: Variation vs. New Application

When AI/ML systems impact existing products, regulatory professionals must determine whether to file as a variation (minor change) or a new application. Consider the following:

• If the AI/ML system significantly affects the product’s safety, efficacy, or use, a new application may be warranted.
• For minor updates that don’t alter the risk-benefit profile, a variation might suffice. Document justifications for these decisions as part of the change control process.

Justifying Bridging Data

In circumstances where historical data is unavailable or cannot be used due to the nature of AI development, companies might need to justify bridging data:

• Explain how existing data are relevant and sufficient to support the proposed use of AI/ML technologies.
• Outline the rationale for data selection and how it supports regulatory compliance and product safety.

Conclusion

As AI and ML technologies become more predominant in GxP quality systems, regulatory professionals must stay informed about FDA expectations, ensuring compliance and quality assurance throughout the integration process. By meticulously documenting, understanding the regulatory landscape, and preparing for common deficiencies, companies will be better positioned to leverage AI/ML tools effectively in their operations.

For further insights into FDA expectations regarding AI and machine learning, industry professionals are encouraged to refer to the FDA’s guidance documents.