Artificial intelligence-based software as a medical device: regulatory evolution toward continuous oversight
TL;DR
This structured narrative review examines how AI-SaMD regulation is moving beyond single-point premarket evaluation toward continuous and dynamic oversight, and synthesizes five evidence dimensions central to ongoing regulatory assurance: data evidence, algorithm evidence, software and cybersecurity evidence, clinical scenario and human factors evidence, and real-world data/real-world evidence with change management.
Abstract
Abstract Artificial intelligence-based software as a medical device (AI-SaMD) is increasingly used for screening, diagnosis, triage, risk stratification, treatment support, and monitoring. Its regulatory challenge lies not only in algorithmic complexity or software modification, but also in the possibility that safety and effectiveness may be affected after market entry by changing data distributions, model behavior, clinical workflows, user interaction, cybersecurity conditions, and software or model updates. This structured narrative review examines how AI-SaMD regulation is moving beyond single-point premarket evaluation toward continuous and dynamic oversight. We analyze how the international medical device regulators forum (IMDRF) clinical evaluation components, including valid clinical association, analytical validation, and clinical validation, can be operationalized across major AI-SaMD functions, and compare regulatory developments in the United States, European Union, China, Singapore, and the United Kingdom. Building on current evidence gaps, we synthesize five evidence dimensions central to ongoing regulatory assurance: data evidence, algorithm evidence, software and cybersecurity evidence, clinical scenario and human factors evidence, and real-world data/real-world evidence (RWD/RWE) with change management. Comparative analysis of Airdoc-AIFUNDUS, IDx-DR, and EyeArt illustrates how these dimensions operate in practice. Current governance still faces unresolved challenges in predetermined change control plan (PCCP) boundaries, RWE quality, post-update human factors reassessment, and cross-jurisdictional divergence.