PMDA and AI Medical Devices — The Practice of Approval and Regulation— Software as a Medical Device (SaMD), review, change plans, and post-market management

01What Software as a Medical Device (SaMD) Is

Most AI medical devices are "software alone," with no dedicated hardware of their own. Japanese law calls this Software as a Medical Device (= SaMD, software that itself functions as a medical device). The 2014 revision of the Pharmaceutical Affairs Act renamed the law the Pharmaceutical and Medical Device Act (= the Act on Securing Quality, Efficacy and Safety of Products Including Pharmaceuticals and Medical Devices), and it was at this point that standalone software was formally brought within the scope of medical devices.

What matters is that not every healthcare app becomes a medical device. The dividing line is: "Is the software used for the diagnosis, treatment, or prevention of disease, and how much does a malfunction affect human life or health?" A record-keeping wellness app falls outside; software that detects lesions from images to support a physician's diagnosis becomes a medical device.

This line is decisive at the very start of development. If the software is a medical device, it cannot be sold until it obtains approval or certification. Concluding that it is not a device when in fact it is — that misclassification is itself a serious problem, amounting to the supply of an unapproved product. So the first task is to determine, with evidence, which side of the line your software sits on.

02Class Classification — Risk Determines the Weight of Review

Medical devices are divided into four classes according to the risk they pose to patients. Which class an AI medical device falls into changes both the pathway it travels and the weight of evidence required. First, the overall picture.

Software that uses AI to detect lesions or to step into treatment decisions often falls in the upper part of Class II through Class III, and faces PMDA review head-on. What is asked here is not "Is the AI smart?" but whether efficacy and safety can be demonstrated within the scope of the intended use. High performance and evidence sufficient for approval are different things, and that has to be understood from the outset.

03The PMDA Review Process

For Class III and above, or for items with no certification standard, approval by the Minister of Health, Labour and Welfare is obtained through PMDA review. Here is the flow, seen along the developer's movements, in four stages.

The spine running through all four stages is to define the "intended use" first and not move it to the end. Depending on its training data, an AI can be made to do any number of other things — but approval rests on the promise of "used for this purpose, in this population." How firmly you can support the scope of that promise with evidence and explanation — that is what the review examines.

04The Change-Plan Confirmation Procedure (IDATEN)

AI medical devices carry a difficulty no other device has: they learn, and their performance changes over time. You want to add training data after launch to raise accuracy — but approval was granted against "performance as of the time of application." Re-obtaining approval from scratch every time you change something would kill the very speed of improvement that is the strength of AI.

What answers this contradiction is the Change-Plan Confirmation Procedure (= IDATEN, Improvement Design within Approval for Timely Evaluation and Notice, a scheme for approving the plan for change in advance). It was introduced in the revised Pharmaceutical and Medical Device Act that took effect in 2020. If you have the range of future performance improvement and its verification method approved in advance as a plan, changes within that plan's scope can be implemented without re-obtaining approval each time.

The crux of IDATEN is to agree with the PMDA, before you change anything, on "what may be changed and how far". It does not make you free to change at will; it places the very scope of change into the review. It is not a scheme that permits unlimited learning — it reconciles speed and safety by promising the path of improvement in advance.

05Post-Market Management — The Real Work Begins After Launch

Approval is not the goal but the start of management. Medical devices require post-market safety management (= surveillance based on standards such as GVP), and for AI medical devices a distinctive task is added on top: watching for changes in performance.

What demands special care is data drift (= the phenomenon where the data at the actual site of use gradually diverges from the assumptions at training time). If the distribution of real patients shifts away from the population used for training, the performance shown at approval may not reproduce in the field. So post-market, you must not only collect malfunction reports but also continually confirm that performance is being maintained as planned.

If a malfunction or a suspected health harm arises post-market, the marketing authorization holder has a duty to report it. This is a safety-assurance mechanism under the Pharmaceutical and Medical Device Act, and being AI-made grants no exemption whatsoever. If anything, because performance can move, the responsibility to keep watch grows heavier.

06International Alignment — Don't Look at Japan Alone

Regulation of AI medical devices does not conclude within Japan. If you try to release the same product in multiple countries, you face each one's regulations. What helps here is a set of internationally shared ways of thinking.

• IMDRF (= the International Medical Device Regulators Forum, a body where national regulators align their regulatory thinking) — the SaMD framework itself grew out of IMDRF discussions. The risk-based classification approach has become a common foundation across countries.
• The U.S. FDA's approach — the idea of presenting a change plan in advance for a continuously learning AI (= the Predetermined Change Control Plan) stands on the same problem awareness as Japan's IDATEN.
• The European MDR (= Medical Device Regulation) — it sets out software classification and post-market surveillance strictly, and a European rollout requires conformity with this framework.

The details differ by country, but the root question is shared: demonstrate efficacy and safety within the scope of the intended use, and how do you manage performance that keeps changing? Designing with international alignment in mind reduces the need to rebuild evidence when delivering one product to multiple markets. Building only around Japanese approval can make a later global rollout difficult.

07Corporate Practice — What Development and Medical Affairs Do First

Now we translate all of the above into a form the field of a pharmaceutical or medical-device company can act on. If you handle AI medical devices, there are four things to decide early in development.

What the four share is the stance of turning "decide later" into "decide first." Regulation of AI medical devices is not cosmetics applied once development is done. Intended use, evidence, change plan, and post-market surveillance are built into the very skeleton of the design. Only then can the speed of AI and the safety of a medical device coexist within one product.

08The Fences of Advertising and Information Provision — The Same Yardstick for AI Medical Devices

After obtaining approval, how do you describe and communicate the product? Here too there are fences that do not move. The advertising provisions of the Pharmaceutical and Medical Device Act reach not only drugs but medical devices. The core is these three.

Mistaking which article applies itself damages trust. Exaggerated advertising is Article 66, unapproved advertising is Article 68, and information provision is Article 68-2 — this is a foundation worth memorizing outright. For sales-information-provision activities on prescription drugs there is the Sales Information Provision Activity Guideline (= HanteiG, the Guideline on Sales Information Provision Activities for Prescription Drugs, notice of the Director-General of the Pharmaceutical Safety and Environmental Health Bureau, MHLW, 2018), and for the yardstick of advertising expression there is the Standards for Fair Advertising of Drugs and the Like (= the standards issued as a notice of the Director of the Surveillance and Guidance / Narcotics Control Division, Pharmaceutical Safety and Environmental Health Bureau, MHLW). When communicating an AI medical device, the guiding thinking is no different. Rather than speaking to an impression that "it's smart because it's AI," communicate within the scope of the approved intended use, faithful to the facts. That is the way to stay inside the fence.

09Connections to Other Chapters on This Site

This installment gains depth when read together with the following chapters.

• AI Medical Vol. 7 — The Ethics of AI Medicine — the questions of fairness, explainability, and consent that lie beyond approval. How to build ethics on top of the foundation regulation protects.
• Material Review series — who examines post-approval explanatory materials, and how. The practice of advertising regulation made concrete.
• Diary — essays that portray regulation as the work of people among people.

An AI medical device cannot reach the market merely by being "smart software." It is classified by risk as Software as a Medical Device (SaMD), demonstrates efficacy and safety within the scope of the intended use, and is approved following PMDA review — only through this path does it reach patients. And to the difficulty distinctive to AI — its "keep-learning, keep-changing" nature — the Change-Plan Confirmation Procedure (IDATEN) responds. By promising the path of improvement in advance, it reconciles speed and safety.

Approval is not the goal but the start of post-market management. Keep watch on the danger of performance quietly declining through data drift, and decide the response to degradation before launch. The fences of advertising and information provision — Article 66 on exaggeration, Article 68 on the unapproved, Article 68-2 on information provision — reach AI medical devices just the same. Build regulation into the skeleton of the design, not as cosmetics applied after development. In doing so, tie the speed of AI and the trust of a medical device together within one product. Next time we move to the ethics that lie beyond — fairness, explainability, and consent.