GN-37 — English — official text

1. INTRODUCTION

1. INTRODUCTION Standalone medical mobile application, (also known as Software as a Medical Device (SaMD)), including those incorporating Machine Learning (ML) technology, plays a crucial role in offering innovative solutions to improve medical diagnosis, treatment, and patient care. SaMD manufacturers are required to adopt a Total Product Life Cycle (TPLC) approach to manage and adapt to the rapidly changing SaMD while ensuring that the software remains relevant, safe and effective throughout its life cycle. However, prevailing regulatory framework may not be suited to accommodate the rapid iterative nature of SaMD. Manufacturers face the challenges of adhering to regulatory requirements, including obtaining regulatory approvals for software changes, which can impact the timeliness of implementing SaMD updates. Hence, adoption of modern regulatory framework that embraces agile methodologies and risk-based assessments is necessary to help to expedite the approval process for certain types of changes, especially those aimed at maintaining and improving the effectiveness and safety of SaMD. To address this, the Health Sciences Authority (HSA) has initiated a new regulatory pathway – Change Management Program (CMP), specifically for SaMD. This program is optional and incorporated into HSA’s existing Premarket Product Registration and Change Notification (CN) processes. CMP streamlines SaMD TPLC-based regulatory framework to facilitate timely implementation of software changes for SaMD registered on the Singapore Medical Device Register (SMDR). CMP also introduces the concept of pre-specified changes, allowing manufacturers to implement anticipated SaMD changes which would otherwise require a new CN submission, to be implemented in a timely manner. MEDICAL DEVICE GUIDANCE DECEMBER 2024 HEALTH SCIENCES AUTHORITY – HEALTH PRODUCTS REGULATION GROUP Page 5 of 21 The pre-specified changes, once approved by HSA, shall be implemented in accordance with the manufacturer’s quality management system. Besides establishing robust quality management system practices, manufacturers shall demonstrate excellent capabilities in SaMD design and development, verification/validation, as well as effective post-market surveillance and vigilance. Hence, conformity with ISO 13485 and IEC 62304 is essential for manufacturers to demonstrate that SaMD changes, including the approved pre-specified changes, are implemented in a manner that maintains the effectiveness and safety of the SaMD. Through this pathway, SaMD manufacturers can have better transparency and predictability in regulatory clearance for future software changes.

sec-1-1

1.1. Intended audience

1.1. Intended audience This document is intended for stakeholders who are involved in SaMD development and /or the Registrant of such devices in Singapore.

sec-1-2

1.2. Objective

1.2. Objective This guidance outlines the regulatory requirements and procedures for submitting a CMP application, either during initial SaMD Product Registration or as part of a Change Notification application.

sec-1-3

1.3. Scope

1.3. Scope This guidance is applicable to all SaMD*, including machine-learning (ML) enabled SaMD (ML-SaMD) with intended use that falls under the definition of a medical device as stipulated in the Health Products Act 2007 (Act). This includes SaMD intended for medical purposes such as investigating, detecting, diagnosing, monitoring, treating or managing of any medical condition, disease, anatomy or physiological process. *NOTE: Not including continuous learning (CL) & generative AI MEDICAL DEVICE GUIDANCE DECEMBER 2024 HEALTH SCIENCES AUTHORITY – HEALTH PRODUCTS REGULATION GROUP Page 6 of 21 Overall, the following topics will be covered in this document: • Eligibility criteria to enrol into CMP • Application process • Pre-specified changes • Submission requirements • Post-CMP approval • Change Notification • Turn-Around-Time (TAT) and fees This document should be read together with the other relevant documents including the Regulatory Guidelines for Software medical Devices – A Life Cycle Approach, other Guidance documents such as GN-15, GN-17, GN-18 and GN-21.

sec-1-4

1.4. Definitions

1.4. Definitions Definitions that do not indicate they are set out in the Act or Health Products (Medical Devices) Regulations 2010 (Regulations) are intended as guidance in this document. These definitions are not taken verbatim from the above legislation and should not be used in any legal context. These definitions are meant to provide guidance in layman terms. ARTIFICIAL INTELLIGENCE (AI): refers to a set of technologies that seek to simulate human traits such as knowledge, reasoning, problem solving, perception, learning and planning. CYBERSECURITY: a state where information and systems are protected from unauthorised activities, such as access, use, disclosure, disruption, modification, or destruction to a degree that the related risks to confidentiality, integrity, and availability are maintained at an acceptable level throughout the life cycle. MEDICAL DEVICE GUIDANCE DECEMBER 2024 HEALTH SCIENCES AUTHORITY – HEALTH PRODUCTS REGULATION GROUP Page 7 of 21 PRODUCT OWNER (as set out in the Regulations): in relation to a health product, means a person who: • supplies the health product under his own name, or under any trademark, design, trade name or other name or mark owned or controlled by him; and • is responsible for designing, manufacturing, assembling, processing, labelling, packaging, refurbishing or modifying the health product, or for assigning to it a purpose, whether those tasks are performed by him or his behalf. INTENDED PURPOSE/INTENDED USE (as set out in the Regulations): in relation to a medical device or its process or service, means the objective intended use or purpose, as reflected in the specifications, instructions and information provided by the product owner of the medical device. MACHINE LEARNING ENABLED SaMD (ML-SaMD): A SaMD that uses machine learning, in part or in whole, to achieve its intended medical purpose. REGISTRANT (as set out in the Act): in relation to a registered health product, means the person who applied for and obtained the registration of the health product under this Act. STANDALONE MEDICAL MOBILE APPLICATION (also known as SOFTWARE AS MEDICAL DEVICE, (SaMD) in IMDRF context): a software and/or mobile application that is intended to function by itself and are not intended for use to control or affect the operation of other hardware medical devices. TEST DATASET: A set of data that is never shown to the machine learning training algorithm during training, that is used to estimate the machine learning model's performance after training. MEDICAL DEVICE GUIDANCE DECEMBER 2024 HEALTH SCIENCES AUTHORITY – HEALTH PRODUCTS REGULATION GROUP Page 8 of 21 TRAINING: Process intended to establish or to improve the parameters of a machine learning model, based on a machine learning training algorithm, by using training data. TRAINING DATASET: A set of data that is used to train the machine learning model, which is not part of the Test Dataset MEDICAL DEVICE GUIDANCE DECEMBER 2024 HEALTH SCIENCES AUTHORITY – HEALTH PRODUCTS REGULATION GROUP Page 9 of 21

sec-2

2. ELIGIBILITY CRITERIA TO ENROL INTO CMP

2. ELIGIBILITY CRITERIA TO ENROL INTO CMP Manufacturers shall possess good quality management system practices with excellent capabilities in SaMD design and development, verification/validation, as well as effective post-market surveillance and vigilance to ensure the safety, effectiveness and cybersecurity of the SaMD throughout their TPLC. With robust quality assurance processes in place, it provides assurance that the SaMD is designed, developed, and maintained in a manner that ensures its safety and effectiveness. Besides, it also instils confidence in the proactive management of changes to the SaMD (as outlined in the pre-specified changes section), ensuring that any updates or alterations are made in a controlled and systematic manner, without compromising its safety or performance. Hence, the pre-requisites to enrol into CMP are as follows: Conformance with the following standards*: Documentary requirement ISO 13485/ MDSAP SaMD product owner shall possess a valid ISO 13485/ MDSAP certificate, with approved scope of activity applicable to the SaMD and related development activities. Note: For Original Equipment Manufacturer (OEM) SaMD, ISO 13485/MDSAP certificate is to be provided by OEM. IEC 62304 SaMD product owner may either possess IEC 62304 certificate issued by accredited third-party certification body or in-house assessed summary report conforming to IEC 62304. * NOTE: SaMD product owners are required to conform to the latest standard version and conformance shall remain valid throughout the SaMD total product life cycle (TPLC). MEDICAL DEVICE GUIDANCE DECEMBER 2024 HEALTH SCIENCES AUTHORITY – HEALTH PRODUCTS REGULATION GROUP Page 10 of 21

sec-3

3. APPLICATION PROCESS

3. APPLICATION PROCESS Registrant can enrol into CMP either through an initial premarket product registration application for the SaMD or as part of a Change Notification (CN)* application for an existing registered medical device. *NOTE: Applicant may select ‘Other Notification Changes (Verified by HSA prior to submission)’ for class B SaMD; or ‘Other Technical (Verified by HSA prior to submission)’ for Class C SaMD. The CMP and product registration/CN application will be reviewed concurrently. Regulatory outcome for product registration/CN and CMP will be determined independently (i.e. the CMP regulatory decision does not affect the outcome of the product registration/CN). Only pre-specified changes which satisfy the prevailing requirements of safety, quality and efficacy for its intended purpose may be approved for implementation. The application process for the assessment of product registration or Change Notification application, with CMP submission is summarised as below: Review of product registration / Change Notification + CMP Product registration / Change Notification CMP + Regulatory decision for product registration / Change Regulatory decision for CMP + MEDICAL DEVICE GUIDANCE DECEMBER 2024 HEALTH SCIENCES AUTHORITY – HEALTH PRODUCTS REGULATION GROUP Page 11 of 21

sec-4

4. PRE-SPECIFIED CHANGES

4. PRE-SPECIFIED CHANGES Pre-specified changes shall include specific changes that Product Owner intends to implement, that would otherwise require a new CN application. If Product Owner is uncertain about implementing the change, the change should not be included in the pre-specified changes. Pre-specified changes shall fall within the intended use and original indication for use of the SaMD. Such changes should only include those that are intended to maintain or improve the safety and effectiveness of the SaMD, without introducing new safety risks that are not adequately covered in the existing risk management framework of the SaMD. Examples of changes that may qualify to be submitted under CMP are as follows: • Improvement to existing software functions • Addition of new software applications / software functions • Addition or reduction of input data type to generate a same clinical output (for ML-SaMD*) • Change to output results presented which are based on the same input parameters, including changes to how user should interpret the output results (for ML-SaMD*) Changes resulting in the following change types do not qualify to be submitted under CMP: • Change in intended use and/or indication for use, of the original device • Change in method of use (e.g: Existing approved workflow includes a review the final output by a nurse and specialist. New workflow will exclude the review of the result by a specialist), • Changes to device particulars which are published on SMDR • Changes related to field safety corrective action (FSCA) and/or reportable adverse events (AE) MEDICAL DEVICE GUIDANCE DECEMBER 2024 HEALTH SCIENCES AUTHORITY – HEALTH PRODUCTS REGULATION GROUP Page 12 of 21

sec-5

5. SUBMISSION REQUIREMENTS

5. SUBMISSION REQUIREMENTS The following documentations shall be submitted in the product registration or Change Notification application. You may also refer to Annex 1 for the summary of submission requirements.

sec-5-1

5.1. Change Description

5.1. Change Description This section should list the pre-specified changes that manufacturer intends to implement. For each of the planned changes, information provided should include, but not limited to: a) Description of the change, including the rationale / reason for performing this change. b) Specify the corresponding software version on a best effort basis. c) Information on expected update frequency or implementation timeline on a best effort basis. d) For ML-SaMDs: Description on factors or triggers for implementation to take place (e.g: user feedback, performance thresholds, etc)

sec-5-2

5.2. Performance Verification & Validation (V&V) Protocol

5.2. Performance Verification & Validation (V&V) Protocol The protocol should describe the process that will be followed to demonstrate that the changed SaMD meets both the new specifications associated with the specific change, as well as maintains existing specifications (e.g. through regression testing). For each of the planned changes, information provided should include, but not limiting to: a) Description of test methods to support planned changes, including study design, test objective, etc b) Pre-defined acceptance criteria / specifications MEDICAL DEVICE GUIDANCE DECEMBER 2024 HEALTH SCIENCES AUTHORITY – HEALTH PRODUCTS REGULATION GROUP Page 13 of 21

sec-5-2-1

5.2.1. Additional Protocols for ML-SaMD only:

5.2.1. Additional Protocols for ML-SaMD only: 1) Training and test dataset selection / collection. Input data and features/ attributes used to generate the corresponding output. Information should include: a) Data selection / collection protocols including clinical study protocols (as applicable) with inclusion/exclusion criteria; b) Processes related to the data consistency and completeness c) Processes to ensure training and test datasets are independent of one another 2) Re-training protocol. Information should include: a) Description on how the planned re-training protocol is relevant to respective Change. b) Objective of the re-training process c) Plans to ensure the other software functions remain unaffected by the re-training process d) Information on how re-training process is initiated (e.g., planned timeline, when new data reaches a certain size, etc). MEDICAL DEVICE GUIDANCE DECEMBER 2024 HEALTH SCIENCES AUTHORITY – HEALTH PRODUCTS REGULATION GROUP Page 14 of 21

sec-5-3

5.3. Implementation Protocol

5.3. Implementation Protocol This section should describe how each of the changes will be implemented and managed. For each of the planned changes, Information provided should include, but not limited to: a) Deployment plan - description on who and how each change will be implemented (e.g: remotely pushed down or manually implemented by users, service engineers, etc) b) User communication plan - Description of how users will be informed when the change(s) is implemented (e.g: communication note, release note, etc), description of the planned updated user training (if applicable) c) Description of verification instructions (e.g. instructions to determine the current installed software version) for users to verify successful implementation of the updated software d) Draft labelling update plan - Description of expected labelling modifications resulting from the implementation of the change e) Post-update corrective action plan - Description of mechanisms in place to detect and revert / stop the implementation of a change if the SaMD does not perform as intended after change is implemented f) Information on post-implementation surveillance plan, including real world performance monitoring (if applicable) g) Description on management of potential safety risks identified from the post-implementation surveillance, including mitigation processes

sec-5-4

5.4. Post-implementation Impact Analysis (IA)

5.4. Post-implementation Impact Analysis (IA) Analysis of the risks and benefits of implementing the changes according to their respective protocols (as outlined in Section 5.1 – 5.3), as well as the risk controls in place. MEDICAL DEVICE GUIDANCE DECEMBER 2024 HEALTH SCIENCES AUTHORITY – HEALTH PRODUCTS REGULATION GROUP Page 15 of 21 The information should include: a) Description of the impact of the anticipated changes on the device (e.g: comparison between initial baseline device performance vs post-change implementation device performance) b) Assessment of risks and benefits of the respective changes, including how the activities outlined in the performance V&V and implementation protocols (i.e: section 5.2 and 5.3) will reasonably assure the continued safety and effectiveness of the device. c) Assessment of how the implementation of one change impacts the implementation of another change d) Overall collective impact analysis of implementation of all the pre-specified changes.

sec-5-5

5.5. Traceability Table (for multiple pre-specified changes only)

5.5. Traceability Table (for multiple pre-specified changes only) Relevant protocols as described in Sections 5.2 and 5.3 should be traceable to the specific change(s) outlined in the change description. Example: To facilitate the review process, kindly cite the pertinent section or document file name for the corresponding change Change as described in section 5.1 Section 5.2: Performance (V&V) protocol Section 5.2.1 For ML-SaMD only Section 5.3 Implementation protocol Dataset protocol Re-training protocol Change 1 See section W See section X See section Y See section Z Change 2 Change 3 Change 4 MEDICAL DEVICE GUIDANCE DECEMBER 2024 HEALTH SCIENCES AUTHORITY – HEALTH PRODUCTS REGULATION GROUP Page 16 of 21

sec-6

6. POST-CMP APPROVAL

6. POST-CMP APPROVAL Pre-specified changes approved under CMP may be implemented without Change Notification submission. Companies shall implement the changes consistent with the approved CMP, and according to the Implementation Protocol submitted. These changes shall not be implemented if they do not meet pre-defined acceptance criteria / specifications outlined in Section 5.2, as determined by the respective performance verification and validation plans submitted. Approved pre-specified changes are still subject to relevant post-market regulatory oversight. The Registrant shall be required to submit a Declaration on the implementation records within 1 year after approval of CMP application. Subsequent declaration shall be submitted within 1 year from the last declaration submission. Companies are to ensure that appropriate mechanisms are in place to differentiate and identify the changed SaMD from the original version (e.g. through software version, change implementation date, etc), and maintain relevant inventory records on file to ensure traceability of the different SaMD versions, as part of their quality management system (QMS). All relevant records on file shall be made available to the Authority upon request.

sec-7

7. TURN-AROUND TIME (TAT) AND FEES

7. TURN-AROUND TIME (TAT) AND FEES There is no change to target turn-around-time (TAT) for Product registration and Change Notification applications with CMP enrolment. The target TAT for Product registration and Change Notification applications commences from the date of receipt of the application and does not include ‘stop-clock time’ due to input requests for clarifications and additional information. Information on TAT for respective application types can be found on HSA website. MEDICAL DEVICE GUIDANCE DECEMBER 2024 HEALTH SCIENCES AUTHORITY – HEALTH PRODUCTS REGULATION GROUP Page 17 of 21 There is no additional fee chargeable for CMP enrolment. Product registration and Change Notification application fees and evaluation fees can be found on HSA website.

sec-8

8. CHANGE NOTIFICATION

8. CHANGE NOTIFICATION Changes may be made to the approved pre-specified changes through a Change Notification (CN) submission. Single CN applications consisting of changes across multiple categories (e.g: Notification, Technical changes) shall be classified based on the most stringent category of change in that application and evaluated accordingly. The fees and Turn-Around-Time (TAT) for Change Notification will follow the most stringent change category applicable. The fees and TAT can be found at the HSA website: https://www.hsa.gov.sg/medical-devices/fees All fees are non-refundable once the application has been submitted via HSA Online system. Withdrawal or rejection of the application will result in forfeiture of the fees charged. Flowchart below present guiding principles for identification of the category of change types for changes to the approved CMP are applicable as follows: MEDICAL DEVICE GUIDANCE DECEMBER 2024 HEALTH SCIENCES AUTHORITY – HEALTH PRODUCTS REGULATION GROUP Page 18 of 21 Supporting documents for the respective change types are listed in Annex 1 Summary of CMP submission requirements Note: 1) Applicant shall select the appropriate change type: ‘Other Notification Changes (Verified by HSA prior to submission)’ or ‘Other Technical (Verified by HSA prior to submission)’, on HSA Online system. 2) Changes to a SaMD that are outside of an approved CMP should be assessed using the following documents, to determine whether a Change Notification submission is required. • GN-21: Guidance on Change Notification for Registered Medical Devices; and / or Does the change involve addition of new Pre-specified change? Class C: Technical Class B: Notification Yes Does the change involve an addition of new information in any of the following: i) Performance V&V protocol, ii) Additional protocols for ML-SaMD; iii) Implementation protocol, that introduces new risk(s) to device safety and efficacy (i.e: affecting Post-implementation IA) of the approved Pre-specified change All risk classes: Notification CN not required. To update during submission of annual declaration No All other changes, including deletion of approved Pre-specified change Does the change involve any of the following information: i) Change in software version, and/or ii) Expected update frequency or implementation timeline Class C: Technical Class B: Notification Yes No No Yes Yes MEDICAL DEVICE GUIDANCE DECEMBER 2024 HEALTH SCIENCES AUTHORITY – HEALTH PRODUCTS REGULATION GROUP Page 19 of 21 • Regulatory Guidelines for Software medical Devices – A Life Cycle Approach (specific to ML-SaMD) Notification Changes may be implemented immediately upon receipt of the acknowledgement email from HSA after submission via HSA Online system. Upon the successful submission of the Change Notification application on HSA Online system, no further amendment of the application will be allowed unless otherwise advised by HSA. As application fees and TATs for Change Notification applications are based on a per-application basis, HSA recommends the judicious grouping of different categories of changes that affect each device listing, before submission of each Change Notification. MEDICAL DEVICE GUIDANCE DECEMBER 2024 HEALTH SCIENCES AUTHORITY – HEALTH PRODUCTS REGULATION GROUP Page 20 of 21

Annex 1 — Summary of CMP submission requirements

ANNEX 1: Summary of CMP submission requirements Documentary requirements New CMP application With approved-CMP Annex 2 to GN-21: Summary Table of Change Notification to be completed and submitted for all Change Notification applications Addition of new pre-specified changes# Change of approved pre-specified changes Change involves an addition of new information in any of the following: i) Performance V&V protocol, ii) Additional protocols for ML-SaMD; iii) Implementation protocol, that introduces new risk(s) to device safety and efficacy (i.e: affecting Post-implementation IA) of the approved pre-specified change All other changes, including deletion of approved pre- specified change Class B: Notification Class C: Technical Class B: Notification Class C: Technical All risk classes: Notification Evidence of conformity to ISO 13485 & IEC 62304  Section 5.1 Change description   Summary * (if applicable) Section 5.2 Performance V&V protocol   * (if applicable) * (if applicable) Section 5.2.1: Additional protocols for ML-SaMD  (if applicable)  (if applicable) * (if applicable) * (if applicable) Section 5.3 Implementation protocol   * (if applicable) * (if applicable) Section 5.4 Post- implementation Impact Analysis   * * (if applicable) * With changes highlighted / identified and clean finalised version # Traceability table should be submitted for multiple new pre-specified changes Contact Information: Medical Devices Cluster Health Products Regulation Group Health Sciences Authority 11 Biopolis Way, #11-03 Helios Singapore 138667 www.hsa.gov.sg