FRANCE Law and Practice Contributed by: Liliana Eskenazi, Julie Ernewein and Pauline Lecrenais, Fréget Glaser et Associés
roles of various agencies, fostering coordination in regulatory, technical, and ethical oversight of AI and digital health tools. • Shared evaluation processes – AI medical devices must undergo both technical/clinical evaluation (HAS/ANSM) and data protection impact assess - ments, often reviewed by CNIL. The Authorities may consult each other during these processes to avoid regulatory conflicts and ensure comprehen - sive oversight. 3.2 Pre-Market Requirements Healthcare AI systems classified as “high risk” under the EU AI Act must undergo comprehensive pre- market validation and certification. Key requirements include: • CE marking via a notified body, based on the device’s risk class; and • clinical validation by the HAS and its CNEDiMTS committee. The HAS “descriptive grid for medical devices with machine learning (AI)”, updated in 2022, provides a structured framework detailing device use, data, algorithms and performance. Used by CNEDiMTS, it ensures transparency and consistency in clinical evaluation and reimbursement decisions covering the following: • documentation on algorithm design, data sets used, update procedures, and limitations; • risk assessments addressing cybersecurity, poten - tial bias, and performance; • transparency obligations; and • bias detection and fairness audits, required for sensitive uses like diagnostics. These requirements ensure that AI remains assistive, rather than autonomous, and that its results are trace - able and controllable by health professionals. 3.3 Post-Market Surveillance Both the MDR/IVDR and AIA require manufacturers to establish post-market monitoring and surveillance systems to track the performance and safety of health - care AI systems once on the market. This involves systematically collecting and analysing data on device
performance, risks, adverse events, and other safety concerns, and taking necessary corrective and pre - ventive actions. Manufacturers must also maintain a vigilance system, report adverse events to authori - ties and users, and regularly update their risk, quality management, and compliance processes based on post-market findings and regulatory feedback. In France, the ANSM monitors the safety and per - formance of medical devices post-market, ensuring timely detection of risks and incidents. The ANSM conducts continuous and regular re-evaluations of the benefit-risk balance of health products in actual clinical practice. 3.4 Enforcement Actions Withdrawal and Recall Procedures for AI Systems in Healthcare Under applicable regulations, including the AI Act and MDR, AI systems used in healthcare are subject to stringent withdrawal and recall procedures to safe - guard patient safety and ensure regulatory compli - ance. If the market surveillance authority – eg, the ANSM in France – determines that an AI system fails to meet the required regulatory standards, it will promptly require the responsible operator to implement all nec - essary corrective measures. This may include bringing the system into compliance, withdrawing it from the market, or initiating an immediate recall. Sanctions for Non-Compliance Failure to comply with regulations governing AI sys - tems for medical purposes can result in severe admin - istrative and legal penalties. These include suspension or withdrawal of the CE marking, substantial fines, and bans on marketing the product. Notably, the AI Act imposes fines of up to EUR35 mil - lion or 7% of the global annual turnover. Additionally, the CNIL, responsible for monitoring per - sonal data protection, may impose fines for violations of the GDPR. Measures and sanctions are systematically made public by authorities such as the ANSM and the CNIL,
72
CHAMBERS.COM
Powered by FlippingBook