The rapid adoption of machine learning-enabled medical devices (MLMDs) is transforming patient care, offering unprecedented opportunities to enhance diagnostics, treatment, and healthcare efficiency. However, the regulatory landscape is evolving to address the novel challenges these technologies introduce, particularly regarding safety, effectiveness, and adaptability.
In response, after releasing draft guidance in August 2023, Health Canada has issued its finalized Pre-Market Guidance for Machine-Learning Enabled Medical Devices (February 2025), providing crucial direction for manufacturers navigating regulatory approvals and demonstrating the safety and efficacy of MLMDs. Understanding this framework, which grew out of work amongst the International Medical Device Regulators Forum (IMDRF) is vital to ensuring compliance while enabling innovation and is for purposes of applying for or amending a Class II, III or IV medical device licence or at any point in the device lifecycle (Class I to Class IV).
1. A risk-based and evidentiary approach to machine learning regulation
Health Canada follows a risk-based approach, classifying MLMDs into Class II, III, and IV under the Medical Devices Regulations. Manufacturers must:
- Explicitly disclose the use of Machine Learning (ML) in their regulatory applications.
- Demonstrate compliance with Good Machine Learning Practices (GMLP) throughout the product lifecycle.
- Provide objective evidence of safety and effectiveness in diverse patient populations, considering sex, gender, and demographic variability.
Health Canada’s risk-based approach requires evidence. Manufacturers should clearly state that the device uses ML in their cover letter for all Class II, III and IV applications for an MLMD. Furthermore, for MLMDs that have a Predetermined Change Control Plan (PCCP), manufacturers should clearly state in their cover letter that their device includes a PCCP. Manufacturers should include a justification for the proposed medical device classification applied to the MLMD. While Health Canada recognizes that manufacturers may use a variety of information, methodologies and evidence to demonstrate that their MLMD is safe and effective, different intended uses or risk profiles may require different types or levels of evidence. This may include: the intended use and/or indications for use of the MLMD; the medical purpose (for example, diagnosis, treatment, monitoring) and the intended conditions, diseases or disorders; the intended patient population and user and use environment; device function information, including: software inputs and outputs, an explanation of how the software output fits into the healthcare workflow, the degree of autonomy, the capacity to perform a clinical function with no or limited user intervention; contraindications and all known limitations.
Further information about the ML methods, training algorithms and architecture of the MLMD should also be provided. This would include:
- ML methods such as supervised learning, unsupervised learning, semi-supervised learning and reinforcement learning.
- ML training algorithm(s) such as convolutional neural networks, logistic regression, support vector machines, generative adversarial networks (GAN), transformers, generative pre-trained transformers.
- ML architecture such as the ML software components, operating parameters, development techniques, training loss functions, model tuning approaches.
- Description of the data used to develop or train the ML system.
- Description of the ML system output, intended users, how the output is intended to be used within the health care workflow and the clinical degree of autonomy.
- The capacity to perform a clinical function with no or limited clinical user intervention.
- Explanation of how the ML system works, the known factors influencing the output and the interpretation of the system behaviour (for example, feature attributions to ML model predictions, how the outputs of the ML model are impacted by changing input properties, saliency maps).
- Descriptions of:
- Required device input parameters, input specifications and source(s) of device input(s).
- All compatible medical devices, including software and hardware versions.
- Hardware requirements (for example: CPU, GPU and RAM requirements; operating system).
2. Language
To promote harmonization and consistency, Health Canada has set out various definitions and has adopted the MLMD terms and definitions used by the International Medical Device Regulators Forum (IMDRF), including:
- Artificial intelligence (AI) is a broad term for a category of algorithms and models that perform tasks and exhibit behaviours such as learning and making decisions and predictions.
- Machine learning (ML) is the subset of AI that allows ML training algorithms to establish ML models when applied to data, rather than models that are explicitly programmed.
- "ML training algorithm" refers to the software procedure that establishes the parameters of an ML model by analyzing data. The "ML model" represents a mathematical construct that generates an inference or prediction based on new input data and is the result of an ML training algorithm learning from data.
3. The Predetermined Change Control Plan (PCCP): A new mechanism for adaptive AI
One of the most significant regulatory innovations is the Predetermined Change Control Plan (PCCP). Unlike static software, MLMDs evolve over time, necessitating a structured approach to managing updates. A PCCP provides a mechanism for Health Canada to address cases where the regulatory pre-authorization of planned changes to ML systems is needed to address a known risk. The PCCP allows pre-approval for anticipated modifications, including:
- Change Descriptions: Defining the scope and rationale for updates.
- Change Protocols: Establishing systematic procedures for modifications.
- Terms and Conditions: In the face of uncertainties and risks associated with ML and PCCPs, Health Canada sees the ongoing safety and effectiveness of marketed MLMD as being strengthened by including terms and conditions (T&Cs) on medical device licences, which may including: tests to be performed on a device to ensure it continues to meet applicable safety and effectiveness requirements; submission of the results and protocols of any tests performed.
By streamlining regulatory review for iterative improvements, PCCPs facilitate the safe and timely deployment of enhanced ML models without requiring full license amendments for every update.
4. Risk management
Manufacturers should conduct the necessary risk management across the lifecycle of the MLMD and consider providing descriptions of:
- Risks identified for the MLMD and the associated risk controls in place to eliminate or reduce those risks.
- Technique used to perform the initial and ongoing risk assessment, and the system used for risk level categorization and acceptability.
- Results of the risk assessment.
Also to be considered in the risk analysis, are erroneous outputs (such as false positive or false negative results, incorrect information for use in a medical purpose such as diagnosis or treatment, generated outputs that are delusions, confabulated, inappropriate, false or misleading); bias; overfitting and underfitting; degradation of ML system performance; automation bias; alarm fatigue; risks associated with using a PCCP; and impacts of a PCCP on risk management.
5. Addressing bias and transparency: Legal and ethical considerations
Health Canada emphasizes equity in medical AI by integrating Sex and Gender-Based Analysis Plus (SGBA Plus) into risk assessments. Lawyers and manufacturers must consider:
- Data Representativeness: Ensuring MLMDs are trained on datasets reflecting diverse populations.
- Bias Mitigation Strategies: Proactively addressing risks of algorithmic bias, including overfitting, automation bias, and underrepresentation of minority groups.
- Transparency Requirements: Clear communication about device functionality, limitations, and decision-making processes through structured labeling and explainability mechanisms. More specifically, Health Canada see "transparency" describing the degree to which appropriate and clear information about a device (that could impact risks and patient outcomes) is communicated to stakeholders (such as, patients, users, health care providers and regulators). Transparency is an important aspect of the device's safety and effectiveness, and helps stakeholders make informed decisions.
Failure to incorporate these considerations could expose companies to regulatory scrutiny, liability risks, and reputational damage.
6. Strengthening post-market monitoring and legal compliance
With adaptive AI, regulatory oversight doesn’t stop at market approval. Post-market obligations include:
- Continuous performance monitoring to detect degradation or emerging risks.
- Mandatory risk management updates for AI models that evolve over time.
- Compliance with license terms and conditions, ensuring alignment with Health Canada’s safety expectations.
For legal teams, this means crafting robust compliance programs that support manufacturers in meeting real-time regulatory obligations.
Conclusion: Balancing innovation and compliance in AI-driven healthcare
The 2025 Health Canada Guidance represents a pivotal step in modernizing AI regulation, acknowledging the unique challenges of MLMDs while preserving patient safety. For medical device companies, this is both an opportunity and a challenge: navigating regulatory complexities while unlocking the full potential of AI in healthcare.
To stay ahead, proactive engagement with Health Canada, strategic implementation of PCCPs, and a strong regulatory compliance framework will be critical in shaping the future of AI-driven medical technologies in Canada.
