Artificial Intelligence in Medical Devices: The Regulatory Framework INVIMA Is Building

Over the past three years, the medical device sector has seen an unprecedented acceleration in the adoption of artificial intelligence components: image-based diagnostic algorithms, clinical decision-support systems, predictive software for patient deterioration, and models that learn from real-time data. This technological wave arrived before Colombian regulation was ready to receive it.

Decree 4725 of 2005 — the foundational rule for Colombia's medical device sector — defines a medical device from a hardware paradigm. Software as a Medical Device (SaMD) fits imperfectly into that structure, and AI components that learn and change after market entry raise questions the traditional registration scheme never contemplated.

Where the Regulatory Gap Lies

The Colombian classification system — based on the ISO standard and adopted by INVIMA — classifies medical devices by risk level into four classes (I, IIA, IIB, and III). This classification considers factors such as invasiveness, duration of patient contact, and effect on vital functions.

Diagnostic software can be classified as IIA or IIB depending on the risk of the clinical decision it supports. So far, the framework applies. The problem arises when the software incorporates machine learning models that continue learning after market entry. In this scenario:

• The technical dossier filed with INVIMA describes an algorithm that may change substantially without a new manufacturer notification.
• The clinical and performance validations that supported the original classification may stop representing the system's real behavior.
• The post-market surveillance mechanism —the National Technovigilance Program— has no specific protocol to report "model degradation" as an adverse incident.

This gap is not unique to Colombia. The FDA developed the Predetermined Change Control Plan (PCCP) to manage anticipated post-market changes in AI algorithms. The European Union incorporated specific requirements for SaMD in Regulation 2017/745 (MDR). Colombia, for now, has no explicit equivalent.

What INVIMA Has Signaled

INVIMA has not issued specific guidance on AI in medical devices, but it has sent signals through its participation in forums of the Pan American Network for Drug Regulatory Harmonization (PANDRH) and in working documents of the CAN General Secretariat.

The direction emerging from those signals:

INVIMA considers that AI/ML systems that change after market entry must be treated as changes that require registration modification or notification, depending on the device class. The magnitude of the algorithmic change and its potential impact on safety determine whether a substantial or minor modification is required.

The concept of "intended use" is the regulatory anchor. INVIMA tends to evaluate AI devices based on their declared function, not the technology that implements it. A radiology decision-support system is not "an AI software" for regulatory purposes —it is a device that assists the physician in interpreting images, and its classification depends on the risk of that specific function.

Clinical evidence remains the standard. For Class IIB and III devices with AI components, INVIMA expects clinical evidence that validates the system's performance. Model performance metrics (accuracy, sensitivity, specificity, area under the curve) are relevant technical data but do not replace clinical evidence under real-world conditions of use.

Practical Implications for Manufacturers and Importers

If your portfolio includes devices with AI components or SaMD, there are regulatory decisions that must be made before starting the process with INVIMA:

Define the intended use with surgical precision. The description of the device's function in the dossier determines the classification. "Diagnostic assistance" is not the same as "autonomous diagnosis." "Early alert" is not the same as "treatment recommendation." Every nuance can change the risk class.

Document the algorithm in the state it enters the market. If the model can be updated, the technical dossier must clearly describe which version is registered and what change-control mechanism will apply to future updates. The absence of this documentation is where observations most frequently appear during evaluation.

Establish a post-market performance monitoring protocol. The National Technovigilance Program requires the reporting of adverse incidents. For AI devices, an "adverse incident" can include a degradation of the algorithm's performance that, while not causing immediate harm, represents a latent risk. INVIMA expects the manufacturer to have mechanisms to detect this.

Prepare a roadmap for managing algorithmic changes. Define in advance which types of changes to the model will require notification to INVIMA and which can be managed internally under a documented change-control plan. This gives structure to a process that would otherwise remain a gray area.

The Time Is Now

Experience in other markets —especially the United States with the FDA and Europe with the MDR— shows a consistent pattern: AI regulation in medical devices evolves quickly once regulators take a position. When Colombia formalizes its criteria, it will likely do so with a high entry standard.

Companies that rigorously document their AI systems today —with a clear regulatory justification, solid clinical evidence, and a change-management plan— are building the dossier that will allow them to adapt to the regulation that is coming, not just comply with the one that exists.

---

If your company imports or distributes devices with AI components in Colombia, at Vexpro we assess the specific regulatory strategy for SaMD: classification, technical documentation, required clinical evidence, and post-market change-management protocol.