Medical device regulation was built for objects that behave identically after approval as before it. A model that updates as data accumulates breaks that assumption, and the response has been to regulate the change process rather than the change.
Approval attaches to a specific version
Clearance is granted for a device as tested, and a material modification requires a new submission.
Applied literally to software, every retraining is a modification, and the approval process is far slower than the retraining cycle.
Manufacturers responded by locking their models at release, which meant the deployed system never improved from the data it generated.
The change plan is the mechanism that resolved it
Regulators now accept a submitted plan describing what modifications are anticipated, how they will be validated, and what performance bounds must hold.
Changes falling inside the agreed plan proceed without a new submission, while anything outside it requires one.
This shifts the object of approval from the model to the procedure that governs it, which is a substantial conceptual change in how devices are cleared.
Continuous learning in the field is still rare
Even under such plans, most systems retrain centrally on curated data and deploy validated versions.
Updating from local data at each site would produce a different device at every hospital, with no way to establish what any of them do.
The failure being avoided is a model that drifts to match local recording habits rather than local disease, and neither the manufacturer nor the site would detect it.
Post-market monitoring carries the weight
Because pre-approval testing cannot cover conditions that do not yet exist, obligations have moved toward surveillance after deployment.
Manufacturers are expected to track performance in use and report degradation, which requires outcome data that clinical systems do not always capture.
Where the outcome is only known months later, monitoring relies on proxies, and a proxy can look stable while the underlying performance falls.
The obligations do not sit with one party
The manufacturer is responsible for the device and knows nothing about the site where it will run.
The hospital knows its population and equipment and usually cannot inspect the model.
Frameworks are settling on shared duties — the manufacturer supplies the specification and monitoring tools, the institution performs local validation and reports what it sees — and the arrangement only works where the institution has someone whose job it is to look.