The initial Software as a Medical Device (SaMD) and Artificial Intelligence guidance was published in June 2024, while the revised version was published in October 2024, incorporating new requirements for establishment licensing, advertising regulations, and enhanced cybersecurity measures.

Below is an overview of the key aspects of the guidance:

1. Guidelines for Screening Software and Artificial Intelligence Classified as Medical Devices

Examples of Software That Qualify as Medical Devices:

• For Home Use: Software that analyzes self-taken photographs of moles to identify abnormalities or irregularities indicative of an increased risk of skin cancer.
• For Healthcare Professionals:
  • Software to collect and analyze vital signs for triaging or stratifying patients for the risk of major adverse cardiac events (MACE) in emergency departments.
  • Clinical Decision Support Software (CDSS) intended for detection, diagnosis, prevention, monitoring, or management of medical conditions or diseases.

Examples of Software That Do Not Qualify as Medical Devices:

• Basic calculator software for medical calculations (e.g., BMI, water volume).
• Hospital Information Systems (HIS) and Electronic Health Record (EHR) software used solely for displaying or storing patient records.
• Calendar tools for tracking progress through IVF treatment cycles.

2. Guidelines for Risk Assessment and Classification

Key Classification Rules:

• Rule 9 (2): Active devices controlling or monitoring Class 3 active therapeutic devices.
  • Quality assurance software for radiation machines used in cancer treatment, classified as Class 3 devices.
• Rule 10 (1): Active diagnostic devices monitoring vital physiological processes are classified based on the severity of potential risks:
  • Class 2 Devices: For non-serious conditions (e.g., software for detecting early signs of non-serious sleep apnea).
  • Class 3 Devices: For immediate danger situations (e.g., stroke diagnosis software or software detecting critical heart rhythm abnormalities).
• Rule 12: Active medical devices that do not fall into the abovementioned criteria.
  • Intraocular lens calculators are classified as Class 1 devices.

3. Guidelines for Preparing Evidence and Technical Documents

Documents Required for Application:

1. Establishment License: Includes a map of facilities, certificate of registration of a juristic person, and other relevant documents.
2. Class 1 Devices (Listing Medical Devices): Requires label, IFU, device description, declaration of conformity, letter of authorization (for imported medical devices), and marketing history or approval evidence from other countries.
3. Class 2-3 Devices (Notified Medical Devices): Requires the Common Submission Dossier Template (CSDT) and additional cybersecurity documentation if applicable.

Special Considerations:

• Medical devices with connectivity capabilities must provide cybersecurity evidence to ensure the confidentiality, integrity, and availability of the system throughout its lifecycle. This includes addressing cybersecurity risks from cyber threats and vulnerabilities. For devices processing personal data, protection must align with the Personal Data Protection Act B.E. 2562 and the National Health Act B.E. 2550.
• AI/ML devices must disclose datasets used for training and testing, emphasizing fairness and reducing biases. AI/ML devices should not replace clinical judgment in diagnosis or treatment decisions. Once deployed, AI/ML models should not continuously adapt based on new data during usage, as unfiltered data may affect model efficiency. Manufacturers may collect new data or use appropriate datasets to enhance the AI/ML model, but improvements should follow a defined plan or cycle.

4. Guidelines Subject to SaMD Change Notification

Major Change:

• Amendment to approved indications or addition of new indications.
• Changes in the design characteristics of the medical device that impact its functionality.
• Amendment to the specific requirements of the medical device that involves a change in the software version.

Minor Change:

• Amendments that do not impact safety or performance (e.g., bug fixes, minor UI changes, or minor compatibility updates).

5. Criteria and Quality Systems for Manufacturing and Importation Facilities

Mandatory Standards:

• ISO 13485:2016
• Good Manufacturing Practices (GMP)

Key Quality Management Principles:

• Leadership and organizational structure.
• Product lifecycle processes, including design, validation, deployment, and maintenance.
• Documentation, configuration management, and performance evaluation.
• Oversight of outsourced processes, including Commercial Off-the-Shelf (COTS) software integration.

6. Principles for Advertising SaMD and AI

Advertising Categories:

1. Public advertising.
2. Advertising targeted at medical and health professionals.

Requirements:

• Advertisements must align with approved product details.
• Claims inconsistent with registered information (e.g., advertising AI capabilities not listed in the registration) necessitate amendments to product registration before approval.

7. Guidelines for PMS and Risk Management

Responsibilities:

• Ensure corrective actions, such as software patches and cyber alerts, are implemented effectively.
• Conduct recalls and address recurring issues.
• Report defects, malfunctions, and adverse events promptly.

Regulatory Compliance:

• Labels and documentation must adhere to the Ministry of Public Health’s guidelines. Digital screenshots may suffice during inspections.

8. Cybersecurity Requirements

Core Principles:

1. Secure design.
2. Comprehensive security documentation.
3. Risk management.
4. Verification and validation.
5. Cyberattack response measures.

Compliance with Thai Laws:

• Adherence to the Personal Data Protection Act (PDPA) B.E. 2562 and other relevant data privacy laws.
• Manufacturers and distributors must ensure compliance with these regulations to protect patient safety and privacy.

Conclusion:

Thai FDA's revised guidance for SaMD/AI medical devices represents a pivotal change in the regulatory framework for software medical devices in Thailand. Compliance with these updated guidelines is crucial for ensuring smooth registration, marketing, and overall regulatory success. For full details, please consult the Thai FDA’s official guideline (in Thai) here. Should you require professional assistance with SaMD registration, feel free to reach out to us.

Qualtech Consulting Corporation has been a trusted partner for medical device manufacturers for over 20 years. Whether you’re a local startup or an international player, we empower your devices to enhance lives. 

Connect with us today here to unlock your medical device potential.

 

 

References:
Medical Device Control Division: Guidelines for software as a medical device (SaMD). Thai Food and Drug Administration. (In Thai language only)