(a) Identification. An interoperable automated glycemic controller is a device intended to automatically calculate drug doses based on inputs such as glucose and other relevant physiological parameters, and to command the delivery of such drug doses from a connected infusion pump. Interoperable automated glycemic controllers are designed to reliably and securely communicate with digitally connected devices to allow drug delivery commands to be sent, received, executed, and confirmed. Interoperable automated glycemic controllers are intended to be used in conjunction with digitally connected devices for the purpose of maintaining glycemic control.

(b) Classification. Class II (special controls). The special controls for this device are:

(1) Design verification and validation must include:

(i) An appropriate, as determined by FDA, clinical implementation strategy, including data demonstrating appropriate, as determined by FDA, clinical performance of the device for its intended use, including all of its indications for use.

(A) The clinical data must be representative of the performance of the device in the intended use population and in clinically relevant use scenarios and sufficient to demonstrate appropriate, as determined by FDA, clinical performance of the device for its intended use, including all of its indications for use.

(B) For devices indicated for use with multiple therapeutic agents for the same therapeutic effect (e.g., more than one type of insulin), data demonstrating performance with each product or, alternatively, an appropriate, as determined by FDA, clinical justification for why such data are not needed.

(C) When determined to be necessary by FDA, the strategy must include postmarket data collection to confirm safe real-world use and monitor for rare adverse events.

(ii) Results obtained through a human factors study that demonstrates that an intended user can safely use the device for its intended use.

(iii) A detailed and appropriate, as determined by FDA, strategy to ensure secure and reliable means of data transmission with other intended connected devices.

(iv) Specifications that are appropriate, as determined by FDA, for connected devices that shall be eligible to provide input to (e.g., specification of glucose sensor performance) or accept commands from (e.g., specifications for drug infusion pump performance) the controller, and a detailed strategy for ensuring that connected devices meet these specifications.

(v) Specifications for devices responsible for hosting the controller, and a detailed and appropriate, as determined by FDA, strategy for ensuring that the specifications are met by the hosting devices.

(vi) Documentation demonstrating that appropriate, as determined by FDA, measures are in place (e.g., validated device design features) to ensure that safe therapy is maintained when communication with digitally connected devices is interrupted, lost, or re-established after an interruption. Validation testing results must demonstrate that critical events that occur during a loss of communications (e.g., commands, device malfunctions, occlusions, etc.) are handled and logged appropriately during and after the interruption to maintain patient safety.

(vii) A detailed plan and procedure for assigning postmarket responsibilities including adverse event reporting, complaint handling, and investigations with the manufacturers of devices that are digitally connected to the controller.

(2) Design verification and validation documentation must include appropriate design inputs and design outputs that are essential for the proper functioning of the device that have been documented and include the following:

(i) Risk control measures to address device system hazards;

(ii) Design decisions related to how the risk control measures impact essential performance; and

(iii) A traceability analysis demonstrating that all hazards are adequately controlled and that all controls have been validated in the final device design.

(3) The device shall include appropriate, as determined by FDA, and validated interface specifications for digitally connected devices. These interface specifications shall, at a minimum, provide for the following:

(i) Secure authentication (pairing) to connected devices;

(ii) Secure, accurate, and reliable means of data transmission between the controller and connected devices;

(iii) Sharing of necessary state information between the controller and any connected devices (e.g., battery level, reservoir level, sensor use life, pump status, error conditions);

(iv) Ensuring that the controller continues to operate safely when data is received in a manner outside the bounds of the parameters specified;

(v) A detailed process and procedures for sharing the controller's interface specification with connected devices and for validating the correct implementation of that protocol; and

(vi) A mechanism for updating the controller software, including any software that is required for operation of the controller in a manner that ensures its safety and performance.

(4) The device design must ensure that a record of critical events is stored and accessible for an adequate period to allow for auditing of communications between digitally connected devices, and to facilitate the sharing of pertinent information with the responsible parties for those connected devices. Critical events to be stored by the controller must, at a minimum, include:

(i) Commands issued by the controller, and associated confirmations the controller receives from digitally connected devices;

(ii) Malfunctions of the controller and malfunctions reported to the controller by digitally connected devices (e.g., infusion pump occlusion, glucose sensor shut down);

(iii) Alarms and alerts and associated acknowledgements from the controller as well as those reported to the controller by digitally connected devices; and

(iv) Connectivity events (e.g., establishment or loss of communications).

(5) The device must only receive glucose input from devices cleared under § 862.1355 (integrated continuous glucose monitoring system), unless FDA determines an alternate type of glucose input device is designed appropriately to allow the controller to meet the special controls contained within this section.

(6) The device must only command drug delivery from devices cleared under § 880.5730 of this chapter (alternate controller enabled infusion pump), unless FDA determines an alternate type of drug infusion pump device is designed appropriately to allow the controller to meet the special controls contained within this section.

(7) An appropriate, as determined by FDA, training plan must be established for users and healthcare providers to assure the safety and performance of the device when used. This may include, but not be limited to, training on device contraindications, situations in which the device should not be used, notable differences in device functionality or features compared to similar alternative therapies, and information to help prescribers identify suitable candidate patients, as applicable.

(8) The labeling required under § 809.10(b) of this chapter must include:

(i) A contraindication for use in pediatric populations except to the extent clinical performance data or other available information demonstrates that it can be safely used in pediatric populations in whole or in part.

(ii) A prominent statement identifying any populations for which use of this device has been determined to be unsafe.

(iii) A prominent statement identifying by name the therapeutic agents that are compatible with the controller, including their identity and concentration, as appropriate.

(iv) The identity of those digitally connected devices with which the controller can be used, including descriptions of the specific system configurations that can be used, per the detailed strategy submitted under paragraph (b)(1)(iii) of this section.

(v) A comprehensive description of representative clinical performance in the hands of the intended user, including information specific to use in the pediatric use population, as appropriate.

(vi) A comprehensive description of safety of the device, including, for example, the incidence of severe hypoglycemia, diabetic ketoacidosis, and other relevant adverse events observed in a study conducted to satisfy paragraph (b)(1)(i) of this section.

(vii) For wireless connection enabled devices, a description of the wireless quality of service required for proper use of the device.

(viii) For any controller with hardware components intended for multiple patient reuse, instructions for safely reprocessing the hardware components between uses.

[87 FR 14172, Mar. 14, 2022]