December 30, 2024

Rather than adhering to the existing approach, where category names (category codes) and classifications are pre-designated based on product characteristics, applicants will now be responsible for generating their product's seven-digit product code with consideration of its primary intended use, technology type and format, etc. Applicants must also independently determine the product's classification based on its intended use, target users, and potential harm due to malfunction (rule-based classification system).

2. Regulations on the Approval, Certification, Notification, Review, and Evaluation of Digital Medical Products

Digital medical devices are categorized into three groups: medical device hardware (including control/operation firmware), embedded digital medical device software (installed/connected to hardware for analysis or processing to fulfill its intended purpose), and standalone digital medical device software. The required submission documents for approval are further detailed for each category.

 

For embedded/standalone digital medical device software, due to the nature of software, the Substantial Equivalence (SE) system will no longer apply, making the submission of clinical trial data (including clinical evaluations and real-world performance data) now mandatory for approval.

 

Additionally, a change control plan submission system, similar to the U.S. FDA’s Predetermined Change Control Plans (PCCP), will be introduced, granting flexibility in managing changes for embedded/standalone digital medical device software.

3. Regulations on the Manufacturing and Quality Management Standards for Digital Medical Devices

The MFDS has adopted three mandatory standards (ISO 13485, IEC 62304, and ISO 42001) as the criteria for quality management compliance for digital medical devices. Manufacturing sites are classified based on the type of digital medical device produced (medical device hardware (including control/operation firmware), embedded or standalone digital medical device software, and AI/ML-enabled software), and the application of quality management standards varies accordingly. For example, manufacturing sites producing AI/ML-enabled software must comply with all three standards to obtain KGMP certification.

 

In contrast, for medical device hardware and non-AI/ML-enabled software (SiMD or SaMD), KGMP certification under the Digital Medical Products Act may be issued to replace the existing KGMP certification under the Medical Devices Act or In Vitro Diagnostic Medical Devices Act. However, manufacturers of AI/ML-enabled software (SiMD or SaMD) must obtain additional KGMP certification under the new Act, regardless of prior KGMP certifications.

 

KGMP certification assessments will primarily involve document reviews and on-site audits. For digital medical device software, on-site inspections may be substituted with "remote inspections."

The MFDS has categorized digital clinical trials based on timing (pre-market/post-market and real-world performance), location (clinical trial institutions or external sites), and subjects (human subject, medical data, or specimens). The requirements for submission, exemptions, MFDS/IRB approval criteria, and special provisions differ depending on the category.

The guidelines outline detailed requirements for manufacturers regarding surveillance and response teams, physical and technical security systems, risk management, responses to cyberattacks, monitor and address vulnerabilities, etc.

The MFDS introduced new evaluation criteria for the Excellent Management Systems Certification of digital medical product manufacturers, which covers quality management, safety management, cybersecurity measures, AI/ML manufacturing practices, etc.