AI/ML in SaMD: What It Actually Takes for an Algorithm to Pass Certification
When an AI model drives a diagnosis or a treatment decision, it's not just a feature of the device. It's the core of what the device does. Regulators treat it that way, and that changes how you need to build it. You can't just train a model, get good accuracy, and then look for a regulatory pathway afterward. By the time you're writing the submission, it's too late to fix what should have been built in from the start.
Good metrics aren't the same as clinical value
A common mistake: assuming strong model performance automatically proves medical value. It doesn't. That's analytical validation, whether the algorithm processes data accurately and produces the right technical output. The IMDRF framework for SaMD asks for two more things alongside it: a valid clinical association (does this actually relate to a real clinical outcome) and clinical validation (does it help the patient in practice). A model can score well on accuracy and still fall short on the other two. All three need to be designed for from the start, not proven one at a time.
What regulators actually want to see
FDA wants a plan, written before the model launches, that explains how it's allowed to change later and what evidence is needed before each change. This is called a Predetermined Change Control Plan (PCCP). Without one, every model update becomes its own regulatory headache.
In the EU, MDR Rule 11 often decides the entire pathway. Clinical decision-support software, especially anything touching diagnosis or treatment, usually lands in Class IIa, IIb, or even III, each with stricter requirements for clinical evidence and notified body involvement. The EU AI Act adds its own layer on top: risk category, human oversight, and the ability to explain what the system is doing and why.
Both regimes boil down to the same thing: know upfront how your model will be tested, watched, and allowed to change.
The documents that matter most
- Where your data came from. Tracked, versioned, checked for bias across patient groups.
- Can you explain the model's decisions? Tools like SHAP or LIME help show why a model reached a conclusion. Adding this after training works, but it's weaker than building it in from day one.
- Have you planned for things going wrong? Drift, unusual inputs, bad training labels — these belong in your risk documentation like any other failure mode.
- Do you have a process for updates? One that treats retraining and version changes as routine, not a reason to resubmit everything.
Missing or incomplete documentation, following the traceability expectations laid out in the EU's MDCG guidance, is one of the most common reasons AI/ML submissions stall with reviewers.
Not every model is the same amount of work
A simple, "frozen" model that never changes after launch is the easiest case. Train it, test it, done.
A model that keeps learning after launch is much harder. You need clear rules for what's allowed to change and a way to catch it if it starts behaving unexpectedly.
Explaining decisions is also easier with simpler models. Traditional statistical models are usually easiest to justify. Classical machine learning sits in the middle. Deep learning models can't explain themselves on their own, so they need extra tooling and more careful bias checking across patient populations.
The model's clinical role matters too. One making a diagnosis directly is held to a higher standard than one just supporting a doctor's decision. Same underlying technology, very different scrutiny, because what matters most is what happens if the model gets it wrong.
The bottom line
The algorithm that gets certified isn't the most accurate one. It's the one built with the full story behind it — where the data came from, why it makes the decisions it makes, and what happens if something goes wrong. Getting through certification is half the job. Keeping the model compliant after launch is the other half.
Thaumatec Techgroup builds AI-enabled SaMD from architecture to submission, with EU AI Act, MDR, and FDA AI/ML Action Plan compliance built in from the start. Get in touch to talk through your model's regulatory pathway.