We use cookies to ensure our website works properly and to personalise your experience. Cookies policy
College of Pharmaceutical Sciences, Pravara Institute of Medical Sciences (Deemed to be University), Loni, Tal- Rahata, Dist- Ahilyanagar, Maharashtra, India – 413736.
Objective: This review paper provides an extensive comparative analysis of how the United States Food and Drug Administration (US FDA), European Medicines Agency (EMA), and India's Central Drugs Standard Control Organisation (CDSCO) govern AI-driven Software as a Medical Device (SaMD) algorithms. It focuses specifically on the operational deployment of Generative AI (GenAI) in automated regulatory document compilation, tracking the shift from standard electronic submissions to automated lifecycles. Methods/Approach: A critical evaluation of active global frameworks, guidance updates, pilot programs, and recent technical policy consensus documents published up to 2026 was conducted. Key Findings/Significance: The investigation maps out how global regulatory authorities balance software innovation against algorithmic drift, highlighting the operationalization of Predetermined Change Control Plans (PCCPs) and strict human-in-the-loop oversight to ensure safety and clinical data integrity.
The historical trajectory of medical computing has transitioned rapidly from basic standalone automated calculations to hyper-complex, interconnected software systems capable of direct clinical decision-making. Historically, healthcare software functioned primarily as a back-office repository or basic data logging framework [1]. However, the modern standard demands the evaluation of sophisticated software architectures operating independently of traditional hardware hosts, giving rise to the formal regulatory paradigm known globally as Software as a Medical Device (SaMD) [2]. This clinical evolution introduces unique challenges for international regulatory networks designed around static, non-evolving physical machinery. Unlike conventional hardware devices that possess fixed mechanical lifecycles and highly predictable wear patterns, digital health solutions iterate rapidly via continuous code optimization, hotfixes, and structural data re-training protocols [3]. Consequently, ensuring continuous safety, clinical efficacy, and data traceability requires a profound paradigm shift in how global health agencies validate software safety profiles before and after market entry [4].
Concurrently, the pharmaceutical and medical device manufacturing industries are experiencing an unprecedented operational transformation driven by the integration of Generative Artificial Intelligence (GenAI) across the broader electronic Common Technical Document (eCTD) lifecycle [5]. Traditionally, compilation of global dossier packages for market authorization required thousands of human hours spent aggregating heterogeneous scientific data, manually cross-referencing pre-clinical study results, and painstakingly composing clinical study reports (CSRs) [6]. This manual approach represents a substantial operational bottleneck that slows patient access to life-saving therapeutics and novel biomedical instruments. GenAI engines, underpinned by sophisticated Large Language Models (LLMs) specialized in medical nomenclature, are transforming these tedious operations from manual back-office tasks into highly automated, predictive workflows [7]. These advanced software architectures are now capable of auto-assembling large-scale regulatory documentation, drafting complex cross-lingual labeling materials, and intelligently predicting query trajectories from regulatory inspectors, thereby compressing compilation timelines from months down to hours [8].
Despite these manifest operational efficiencies, a profound regulatory dichotomy persists between product-level oversight and process-level automation [9]. While manufacturers seek to deploy autonomous AI systems to draft submission dossiers rapidly, the underlying software product itself must simultaneously comply with strict legal frameworks governing clinical software safety, risk categorization, and algorithmic drift [10]. Legacy post-market oversight systems are structurally unequipped to monitor adaptive machine learning algorithms that organically evolve their underlying weights and parameters in response to real-world patient data streams [11]. This structural mismatch introduces serious algorithmic risks, such as subtle diagnostic degradation over time, or data hallucination within automated clinical documentation pipelines [12]. Therefore, establishing robust boundary conditions that blend advanced technical verification with reliable human oversight is essential to protect public health and preserve clinical data integrity across the global healthcare ecosystem [13].
The objective and scope of this review paper are specifically structured to bridge the widening analytical gap between product-level AI safety regulation and process-level workflow automation across three major global healthcare jurisdictions [14]. By providing a detailed, multi-tiered comparative assessment of the active frameworks managed by the United States Food and Drug Administration (US FDA), the European Medicines Agency (EMA), and India's Central Drugs Standard Control Organisation (CDSCO), this paper charts the practical trade-offs between technical flexibility and rigid legal compliance [15]. The analysis delineates the operational boundaries of predictive data processing systems while establishing a clear blueprint for unified international harmonization, ensuring that the deployment of advanced software systems remains clinically safe, legally compliant, and thoroughly auditable [16].
4. Main Body Paragraphs / Section Headings
4.1 Comparative Regulatory Landscape for AI-Driven SaMD
In the United States, the US FDA has established an advanced regulatory framework for digital health systems by shifting away from rigid desktop evaluations toward an integrated Total Product Lifecycle (TPLC) regulatory approach [17]. Central to this regulatory operational philosophy is the Digital Health Center of Excellence (DHCoE), a dedicated specialized division tasked with setting national policy for software innovations and managing complex algorithmic changes [18]. Recognizing that traditional pre-market notification mechanisms—such as the standard 510 (k) clearance process or the De Novo classification pathway—were not originally designed for rapidly iterative software, the US FDA has introduced specialized guidance documents to govern dynamic, adaptive machine learning models [19]. This strategic framework ensures that changes to software functionality, data inputs, or clinical indications are evaluated continuously, preventing unvalidated code updates from reaching active clinical environments without appropriate administrative clearance [20].
Across the Atlantic, the European Union has taken a fundamentally different approach by integrating its established medical product legislation directly with broader horizontal digital regulations [21]. The European Medicines Agency (EMA), in coordination with national competent authorities, enforces the strict safety and performance mandates outlined in the EU Medical Device Regulation (2017/745 - MDR), which categorizes standalone clinical software into rigorous risk classes based on potential patient harm [22]. This established medical framework is now being overlaid with the strict compliance mandates of the comprehensive European Union Artificial Intelligence Act (EU AI Act), which officially classifies AI-driven diagnostic and therapeutic software as 'High-Risk AI Systems' [23]. This dual-layered regulatory environment forces medical software developers to meet stringent requirements, including absolute data transparency, mandatory continuous human oversight, explicit algorithmic logging, and comprehensive third-party conformity assessments by notified bodies prior to commercial deployment [24].
In India, the Central Drugs Standard Control Organisation (CDSCO) is actively modernizing its digital health governance by updating its foundational legal statutes to accommodate complex software systems [25]. Under the statutory framework of the Medical Device Rules (MDR 2017), the CDSCO has officially recognized software as an independent medical instrument, classifying applications into discrete risk tiers (Classes A through D) based on clinical severity [26]. Despite these positive legislative updates, India’s digital health sector faces distinct challenges regarding its heavy reliance on foreign clinical trial data and the lack of specialized local validation standards for native populations [27]. To resolve these limitations, the CDSCO is forming dedicated expert committees to establish localized clinical validation guidelines, forcing developers to demonstrate algorithmic efficacy within local populations before securing official registration [28].
Table 1: Cross-Jurisdictional Comparison of AI-SaMD Governance
| Evaluation Parameter | US FDA (United States) | EU EMA / Notified Bodies | Indian CDSCO |
|---|---|---|---|
| Primary Legislative Framework | FD&C Act; 21 CFR Parts 800-1050; Food and Drug Omnibus Reform Act [29] | Medical Device Regulation (EU) 2017/745; EU AI Act (Horizontal Law) [30] | Drugs and Cosmetics Act 1940; Medical Device Rules 2017 [31] |
| Tiers / Risk Classification | Class I, II, III; heavily relies on software specific De Novo and 510(k) pathways [32] | Class I, IIa, IIb, III based on Rule 11 MDR; 'High-Risk' under AI Act [33] | Class A, B, C, D based on parameters of inherent risk and invasive nature [34] |
| Requirements for Clinical Evaluation | Rigorous pre-market studies; real-world data collection via NESTcc networks [35] | Mandatory clinical investigation for Class III/implants; strict clinical evaluation reports [36] | Predominantly historical predicate import data; shifting to mandatory local trials [37] |
| Validation / Verification Metrics | Good Machine Learning Practice (GMLP); clear software verification dossiers [38.1] | Conformity assessments; CE marking validation; strict algorithmic traceability [38.2] | ISO 13485 compliance; baseline performance reports; expert committee review [39] |
| Regulatory Sandbox Availability | Digital Health Pre-Cert Program pilots; advanced collaborative communities [40] | AI regulatory sandboxes mandated under the EU AI Act frameworks [41] | No formal sandbox environment; case-by-case specialized single window reviews [42] |
4.2 Generative AI in Regulatory Document Automation
The operational deployment of Generative AI (GenAI) within the global pharmaceutical sector has expanded far beyond simple text generation into complex, automated regulatory data assembly pipelines [43]. Modern regulatory affairs teams leverage customized Large Language Models (LLMs) to automatically compile complex electronic Common Technical Document (eCTD) modules, thereby speeding up global filing timelines [44]. These advanced systems are capable of parsing highly unorganized datasets from pre-clinical lab environments and automatically converting them into structured, submission-ready prose for Module 4 (Nonclinical Reports) [45]. Furthermore, GenAI applications are highly effective at executing cross-lingual labeling updates, ensuring that complex summary of product characteristics (SmPC) documents remain uniform across multiple global markets while accurately reflecting country-specific statutory language variations [46]. By utilizing predictive natural language processing, these platforms can also simulate regulatory query loops, enabling companies to optimize their technical dossiers before formal agency submission [47].
However, implementing these automated generation models introduces severe data compliance and validation challenges within GxP-regulated environments [48]. The 'black-box' nature of deep learning architectures complicates traditional software validation models, which require absolute predictability and deterministic outcomes [49]. In automated document assembly, an unvalidated model can generate plausible-sounding but completely incorrect clinical conclusions, an operational phenomenon known as algorithmic hallucination [50]. If these errors go undetected, they threaten clinical data integrity and can lead to immediate regulatory rejection or severe product liability issues [51]. To mitigate these operational risks, life science enterprises must implement strict compliance guardrails, including rigorous source-data verification protocols, secure localized data boundaries to protect intellectual property, and extensive audit trails to log every generative modification [52].
Table 2: GenAI Integration Across the eCTD Lifecycle
| eCTD Module | Regulatory Workflow | Concrete GenAI Application | Primary Technique | Compliance Challenge |
|---|---|---|---|---|
| Module 2 | Quality Overall Summary (QOS) Drafting | Aggregates chemistry, manufacturing, and control data into unified technical summaries [53] | Retrieval-Augmented Generation (RAG) [54] | Hallucination of technical specs [55] |
| Module 3 | CMC Dossier Generation & Updates | Auto-generates technical stability reports and manufacturing validation logs [56] | Fine-tuned domain-specific Transformers [57] | Lack of absolute deterministic data [58] |
| Module 4 | Nonclinical Study Report Assembly | Synthesizes raw in-vitro and in-vivo pharmacology data into structured study text [59] | Automated tabular data abstraction [60] | Misinterpretation of toxicology logs [61] |
| Module 5 | Clinical Study Report (CSR) Generation | Transforms patient-level data files into extensive, narrative clinical reports [62] | Few-shot structured prompting pipelines [63] | Patient privacy leaks / HIPAA violations [64] |
| Post-Market | Pharmacovigilance Narrative Creation | Parses raw adverse event databases to generate unified safety reports for agencies [65] | Sequence-to-sequence generation agents [66] | Missed signaling of lethal trends [67] |
4.3 Post-Market Surveillance and Dynamic Change Management
Managing software performance after market entry represents a critical challenge for regulators due to the risk of algorithmic drift [68]. Unlike traditional medical instruments that exhibit highly predictable wear patterns, AI-driven SaMD applications can experience performance degradation when deployed across new clinical settings or diverse patient demographics [69]. This degradation, often called data drift, occurs when the real-world clinical data distribution diverges from the baseline dataset used during initial model training [70]. If left unmonitored, an image-analysis algorithm optimized for a specific hospital scanner may deliver lower diagnostic accuracy when deployed on different equipment, compromising patient safety [71]. To prevent these issues, manufacturers must implement continuous post-market surveillance systems that monitor real-world performance metrics in real time [72].
To address the limitations of static regulatory clearance pathways, the US FDA has introduced the Predetermined Change Control Plan (PCCP) framework [73]. A PCCP allows manufacturers to outline anticipated algorithmic modifications, retraining protocols, and updated clinical applications during the initial pre-market review phase [74]. By securing upfront approval for these changes, developers can implement safe, data-driven modifications without undergoing repetitive, time-consuming pre-market notifications [75]. This framework establishes a predictable path for continuous software updates while maintaining strict safety standards through predefined verification and validation metrics [76]. The European Union and India are actively evaluating this model, recognizing that adaptive digital health solutions require flexible regulatory frameworks to support safe, real-time innovation [77].
Table 3: Risk Assessment and Mitigation Matrix for Automation AI
| Regulatory Risk | Technical Root Cause | Proposed Mitigation Framework | Quality Management System (QMS) Link |
|---|---|---|---|
| Data Hallucination in Dossiers | Stochastic decoding variations in language models [78] | Retrieval-Augmented Generation (RAG) cross-checks [79] | ISO 13485: Pre-publication validation logs [80] |
| Intellectual Property Leakage | Use of public cloud APIs for data processing [81] | On-premise deployment of isolated LLM nodes [82] | 21 CFR Part 11: Electronic data boundaries [83] |
| Lack of Audit Traceability | Non-deterministic generation paths [84] | Cryptographic timestamping of all prompt cycles [85] | Good Documentation Practices (GDocP) [86] |
| Algorithmic Drift in Diagnostics | Changes in real-world clinical data distributions [87] | Automated statistical data drift monitoring [88] | Post-Market Clinical Follow-up (PMCF) [89] |
Table 4: PCCP Execution vs. Traditional Post-Approval Change Management
| Lifecycle Metric | Traditional Post-Approval Variation | PCCP-Driven Iterative Update | Manufacturer Accountability Impact |
|---|---|---|---|
| Time-to-Market for Updates | 60 to 180 days per submission [90] | Near real-time deployment after verification [91] | Requires robust internal engineering audits [92] |
| Regulatory Agency Workload | High; requires individual human manual reviews [93] | Low; shifts focus to protocol oversight [94] | Reduces administrative submission bottlenecks [95] |
| Protocol Transparency | Low; updates are submitted after final development [96] | High; validation protocols are approved upfront [97] | Demands complete design history transparency [98] |
| Algorithmic Control | Static; code remains unoptimized between filings [99] | Dynamic; supports continuous model optimization [100] | Requires active real-world data tracking [101] |
5. Discussion & Future Perspectives
The clear divergence among global regulatory frameworks emphasizes the critical need for comprehensive international harmonization in digital health [102]. As software-driven products cross geographic boundaries instantly, managing conflicting local standards becomes a significant administrative barrier for manufacturers [103]. Organizations like the International Medical Device Regulators Forum (IMDRF) are leading efforts to create unified definitions for software risk and validation [104]. True global harmonization requires moving beyond shared definitions to align core validation standards, enabling developers to use unified clinical evaluation datasets across multiple jurisdictions simultaneously [105]. This alignment would streamline market entry, reduce redundant technical testing, and ensure equitable access to digital health innovations worldwide [106].
Concurrently, the integration of generative automation requires a strict commitment to human-in-the-loop (HITL) principles [107]. Automated systems excels at accelerating document generation and parsing large datasets, but they lack the professional judgment needed to evaluate complex clinical data [108]. Over-relying on automated outputs without thorough expert review introduces significant risks, including unnoticed formatting errors or flawed clinical conclusions [109]. This risk highlights the need for clear accountability frameworks within corporate Quality Management Systems (QMS) [110]. Under these frameworks, human experts must review, verify, and sign off on all automated content, ensuring that technology enhances human capability rather than replacing professional accountability [111].
Looking forward, the regulatory landscape will likely transition toward advanced real-world data collection models [112]. Future systems could utilize decentralized federated learning architectures, allowing diagnostic models to train on data from multiple healthcare institutions while keeping sensitive patient information secure within local networks [113]. This approach supports continuous algorithmic improvement while addressing strict data privacy mandates like GDPR and HIPAA [114]. Additionally, health authorities are exploring automated review interfaces that can evaluate software modifications in real time [115]. This evolution would transform regulatory oversight from a series of static pre-market checkpoints into a continuous, dynamic monitoring process, ensuring safety throughout the software lifecycle [116].
CONCLUSION
This critical review demonstrates that regulating AI-driven SaMD and implementing GenAI in document compilation requires balancing technological innovation with strict clinical safety standards. While the US FDA provides flexibility through frameworks like PCCPs, the European Union enforces strict horizontal compliance via the EU AI Act, and India's CDSCO continues to formalize its legal validation paths. These distinct regional approaches highlight the need for international harmonization to streamline software validation globally. Additionally, using generative models to automate eCTD dossiers requires maintaining a human-in-the-loop approach within a validated QMS to prevent data errors and protect clinical integrity. Ultimately, establishing robust, adaptive regulatory frameworks will allow the global healthcare sector to safely adopt AI innovations, protecting public health while accelerating access to advanced medical technologies.
DECLARATION
The authors declare that this manuscript is original, has not been published previously, and is not under consideration elsewhere. The authors also declare that they have no conflicts of interest and have received no financial support for this work.
REFERENCES
Shraddha Jagtap, Atharva Vikhe, Nikita Thorat, Regulating AI-Driven Software as a Medical Device (SaMD) and Generative AI in Regulatory Submission Automation: A Critical Analysis of FDA, EMA, and CDSCO Frameworks, Int. J. of Pharm. Sci., 2026, Vol 4, Issue 11, 667-677. https://doi.org/10.5281/zenodo.23938875
10.5281/zenodo.23938875