Could a regulator certify the company rather than every product, in software that updates weekly? The FDA tried for five years, ran into the limits of its own legislation, and the model was picked up by regulators in the UK, Singapore and Japan.

The dilemma

By 2017, the FDA was approving a new kind of medical device. It was not a syringe or a scanner. It was software, often an app on a phone, that diagnosed skin conditions, monitored heart rhythms, or guided insulin doses. Unlike traditional devices, this software updated every few weeks, learned from the data flowing through it, and was built by companies whose engineering culture looked nothing like a traditional medical device manufacturer..

The regulatory gap

What was needed was a different question. Instead of asking 'is this version of the product safe?', the regulator would ask 'is this company capable of producing safe software, and of catching problems quickly when they emerge?' That would let regulators evaluate the developer's quality controls, monitoring systems, and track record. Trusted developers could then update their software more freely, without going through full approval every time

The approach

The FDA launched the Digital Health Software Precertification (Pre-Cert) Pilot Program in 2017, working with nine companies — including Apple, Fitbit, Johnson & Johnson, Pear Therapeutics, Roche and Samsung. The pilot tested whether the FDA could assess organisational excellence (culture of quality, monitoring capability, real-world performance) and grant pre-certified firms a faster, less burdensome pathway to market. The intent was that trust in the developer, properly evidenced and continuously monitored, could be a substitute for premarket scrutiny of every release.

Results achieved

The pilot ran until 2022. In its published review, the FDA was unusually candid. The agency concluded it did not have the legal authority, under the existing Food, Drug, and Cosmetic Act, to run Pre-Cert at the scale it had been designed for. A full version of the programme would require new legislation. The pilot closed without becoming permanent.

Its influence, though, has been larger than its formal status suggests. The FDA folded the lessons into a broader approach it now calls the 'Ecosystem of Trust' for digital health. The underlying ideas, assess the company as well as the product, require ongoing evidence after launch, and match the level of oversight to the level of risk, have shaped digital health regulatory experiments at the UK's MHRA, Singapore's HSA and Japan's PMDA. They have also influenced work at the International Medical Device Regulators Forum, the main global body where medical device regulators coordinate.

The transferable lesson

The most useful regulatory pilots are not always the ones that succeed on their original terms. Sometimes they are the ones that show clearly what would need to change for the model to work. Pre-Cert did that. It demonstrated that certifying the company instead of the product is workable in principle but requires new legislation to operate at scale.