AI Assisted Development in MedTech

Introduction

As an innovator in MedTech, it is impossible to avoid the AI hype – with many in the tech industry raving about new developments and productivity gains in software development. Although the evidence is mixed, large language models (LLMs) are rapidly improving as software development agents. Many in MedTech wonder about whether it can streamline their software development.

There’s no doubt that AI coding assistants are effective at rapidly creating prototypes. They are also helpful to those with little to no coding experience – enabling them to turn an idea into software. More recently, with advancements by Anthropic, OpenAI, and Google, they are being adopted by enterprise teams to develop and maintain production software in many industries. The risks of AI generated code, such as performance issues and security vulnerabilities, are being mitigated with every new release by the major AI providers.

In a regulated industry like MedTech, however, there is a catch: the main challenge in MedTech software has never been writing code – it is demonstrating to regulators (and to the public) that it is safe, effective, and cybersecure.

The majority of the tech industry exists outside of regulation. Big Tech primarily exists in the advertising, media, and e-commerce spaces. Because of this, most software developers can use practices that are not suitable for medical device software development:

Liberal use of open source software dependencies
Shipping untested (or minimally tested) code to end users
A lack of, or absence of test code and documentation

Approach Overview

The key to unlocking productivity gains in medical device software development is to build on a foundation of specialized regulatory knowledge and workflows. Best practices involve enhancing workflows through the responsible use of AI, while maintaining compliance with regulatory requirements such as IEC 62304, FDA guidance, and cybersecurity frameworks.

Designing and maintaining safe and secure medical device software requires years of experience and direct engagement with regulators like the FDA. While LLMs are powerful, they lack this accumulated, nuanced regulatory context, limiting their effectiveness when used outside of carefully defined, supervised workflows. Despite these practical limitations, organizations should not shy away from realizing the benefits of AI when properly integrated into established, compliant development processes.

Regulatory Requirements for Medical Device Software

To get medical device software approved by the FDA, you must follow a “robust software development lifecycle”. This is typically done by following the IEC 62304 standard, which is recognized by the FDA and harmonized in Europe. The standard requires documented processes for every step in the software development lifecycle – including defining project requirements, risk assessment, testing, validation, release, and even change control. Depending on the software safety classification, the technical documentation produced from these processes may be more or less extensive.

As of 2023, there have been laws introduced in the US that require all medical devices that contain software to follow a secure software development framework, including baking security into the software design from the very beginning. Similar requirements have been put in place worldwide (i.e., Health Canada, EU MDR).

Adopting best practices for developing medical device software is essential to maximize the likelihood of FDA approval while minimizing regulatory burden. A proven process should include:

a collaborative relationship to ensure the needs of both the user and business are addressed
a lean, IEC 62304-compliant software development process that automates the more burdensome processes (such as CI/CD, configuration management, SBOMs and CVE monitoring)
a secure software design and development process combined with experience preparing required cybersecurity documentation
an ISO 13485-certified QMS

Responsible AI Integration in Medical Device Development

Many industry leaders have extensive experience integrating machine learning into medical software and have developed AI-driven workflows that responsibly accelerate their software development process. Best practices involve enhancing workflows through the responsible use of AI. For example, during code reviews, AI can be used to perform a critical, second-pass review to enhance the human code review process. Another example is smarter analysis of unit test coverage, enabling testing to be more rigorous than what traditional tools alone can offer.

If your organization would like to use AI for software development, keep in mind to:

Carefully choose AI providers to ensure your intellectual property or patient information is not leaked to the public. Most major providers claim this, but we recommend going further and opting for zero data retention. This often requires a Business Associate Agreement (BAA).
Understand that AI generated prototypes may be useful to validate an idea and/or generate investor interest, but that cannot be used for the final product
Mitigate the limitations of LLMs in the specialized workflows required for developing, testing, and documenting medical device software
Engage a trusted partner with experience in FDA approvals for medical device software

Partnering with a trusted expert who understands the regulatory pathways, such as those required by the FDA for device approval, offers more than development services. It provides strategic guidance, enabling MedTech teams to integrate AI into their software development lifecycle compliantly, securely, and in an approval-ready manner, turning regulatory challenges into strategic advantages.