Current Trends in Regulated Industries
By: Neal Bhattacharya
Tags: Regulatory Compliance, Organizational Culture, Development, Cloud Transformation, Digital Transformation

IBM Garage enables large enterprises to accelerate, breakthrough, and work more like startups.

Traditionally software development is not a core function in many regulated sectors such as food, aviation, medical devices, pharmaceutical, financial services, and railways. However, as these industries grow their digital capabilities, the software is increasingly playing a more significant role in regulatory compliance. Nowadays, cloud-based emerging technologies and rapid scaling of digital innovations through DevSecOps influence standard business architectures in all industries in every sector and pave new ways of working for regulatory bodies and the industries they regulate.

In the first part of this blog series, I discussed various product development challenges in the regulated sectors from the perspective of software development and introduced the readers to IBM Garage Method.

In this (second) part of the series, I will review the current trends in various regulated industries that are reshaping the regulatory landscape and how the IBM Garage Methodology can help organizations identify and prioritize innovation opportunities throughout the enterprise to take advantage of the industry trends.

Fourth Industrial Revolution

The convergence of emerging technologies and societal needs has ushered in a new era — Fourth Industrial Revolution (4IR)[1] — through innovative business models using disruptive technologies. Artificial intelligence (AI), Machine learning (ML), Blockchain, Automation, Internet of Things, 5G, and Edge computing are becoming pervasive in many industries and yield better ways to serve consumer needs and disrupt industry value chains. Increased technology usage in everyday life introduces changes in consumer behavioral patterns and prompts businesses to rethink how they engage with their consumers.

A key trend of 4IR is the emergence of technology-enabled platforms that combine both demand and supply to disrupt existing industry structures through sharing or on-demand economy (1). These platforms bring people, assets, and data together to allow new ways to offer and consume products and services. Market entrants challenge industry incumbents and influence consumer behavior by bringing new products and services quicker through better technologies on connected digital platforms.

Increased adoption of emerging technologies is putting more emphasis on consumer experience, privacy, and security. For example, in the healthcare industry, the topline value drivers are customer satisfaction, increased customer retention, and reduced customer acquisition cost (2). Modern AI-driven data platforms help healthcare organizations define policies by providing useful insights into customer trends (2) (3).

Technology adoption is traversing industries because businesses are trying to take advantage of the latest technological innovations in other industries to meet the consumer demands in theirs. For example, in the automotive industry, consumer data security and privacy are becoming critical differentiators because vehicles are becoming more autonomous and bringing personalized experiences to their users from multiple sources (4).

Current public policy and decision-making systems that follow linear and mechanistic processes to develop regulatory frameworks cannot keep up with 4IR’s rapid pace of change and broad impacts (1). As industries innovate, regulators are also taking more human-centric, collaborative, and agile approaches to protect the consumers while supporting innovation by allowing safe use of technological advancement. For example, relatively new legislations such as General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), and Brazilian General Data Protection Law (LGPD) govern the collection and use of consumer data to protect their privacy and security.

Iterative Risk-based Regulation

Connected digital platforms are launching new digital products and augmenting physical devices with new digital capabilities rapidly. Digital products need to be updated frequently to stay relevant and secure. Embedded Software in physical devices also needs continual updates to ensure the proper function of these devices. FDA’s Center for Devices and Radiological Health (CDRH) adopted a risk-based approach towards regulating digital health technology because the traditional approach to moderate higher-risk hardware-based medical devices was not practical for the faster iterative development approach used to adopt software-based medical technologies (5). FDA also noted that digital health products that leverage connectivity could continually improve their safety and effectiveness through frequent modifications and updates (5).

Emphasis on the Quality Culture

In recent years, regulatory organizations are focusing more on organization culture than just end products. For example, FDA’s CDRH pre-certifies eligible digital health vendors who demonstrate quality culture and organizational excellence based on specific objective criteria (5). Organizations that nurture a culture of quality are essentially customer-centric, where leaders are quality advocates, and empowered employees work in a collaborative culture utilizing organizational systems and structures that promote continual improvement in their products and services.

For organizations that focus on quality and transparency, FDA also proposed a total product lifecycle-based regulatory framework for AI/ML-based technologies that would allow for software modifications in medical devices to be made from real-world learning and adaptation. The proposed regulatory framework (6) could enable the FDA and device manufacturers to track and react to a digital health product’s premarket development and postmarket performance. This potential framework allows for the regulatory oversight to embrace the iterative improvement power of AI/ML-based software as a medical device while assuring patient safety.

Various health authorities included quality culture in guidance documents and inspection protocols such as PIC/S Data Integrity Guidance, FDA New Inspection Protocol Project (NIPP), and MHRA Data Integrity Guideline (7).

Increased Experimentation

In the financial services industry, many regulators set up sandboxes for both startups and incumbents to experiment with new ideas and technologies with some exemption from regulatory requirements. This framework aims to encourage businesses to build innovative products and services while protecting their consumers. Sandboxes have become essential vehicles for regulatory monitoring and incremental innovation in the industry.

For example,

United Kingdom’s Financial Conduct Authority (FCA) created the first formal regulatory sandbox and propagated the concept throughout the world. It helped over 175 innovative businesses within a year to operate (8) (9).

In the United States, Consumer Financial Protection Bureau (CFPB) created a Disclosure sandbox for companies to iteratively test, improve disclosure content, format, and delivery mechanisms (10).

Canadian Securities Administrators (CSA) offers a regulatory sandbox to better understand how technology innovations impact capital markets and regulate fintech (11).

In Banking, Federal Deposit Insurance Corporation (FDIC) recognized that smaller banks could compete more effectively using AI/ML-based technologies. Banks and regulators have been weighing how fintech can safely play into banking and regulatory activities, such as developing anti-money-laundering controls. FDIC introduced an office of innovation, FDITech, to promote innovative technologies across the financial services sector. On July 20, 2020 the FDIC announced that it was seeking the public’s input on the potential for a public/private standard-setting partnership to promote the efficient and effective adoption of innovative technologies at FDIC-supervised financial institutions.

Incremental Regulations

Regulators are increasingly moving away from regulating processes upfront to avoid the methodological and informational limitations of front-end analysis of impact. They rely on incremental updates to the regulations based on data-driven research, innovation, and process outcomes. For example, the National Highway Traffic Safety Administration (NHTSA) introduced the Federal Automated Vehicles Policy (FAVP) in 2016 to address the lack of steering wheels and drivers in autonomous vehicles. NHTSA subsequently updated the rule to handle new technologies used in autonomous vehicles in 2017 (12).

European Union (EU) rolled out Markets in Financial Instruments Directive II (MiFID II) in January 2018 (13) that updated MiFID I and broadened its scope to improve the competitiveness of financial markets and protect investors. With MiFID II, the range of reporting expanded to include commodities, currencies, and credit products in addition to the equities and bonds from MiFID I. Essentially, the scope of reporting increased to cover almost anything traded on a multilateral trading facility. Organizations that narrowly focused on meeting MiFID I requirements had to rework their solution to address MiFID II compliance requirements. On the other hand, organizations that took an iterative approach to take advantage of technological innovations met the new needs that emerged from incremental MiFID II regulation with relative ease.

COVID-19 Pandemic

As the global workforce moved their offices to their living rooms and kitchens, the pandemic laid bare needs for new and enhanced digital services. The crisis necessitated regulators and businesses to rapidly implement a wide range of measures based on evidence and data-driven predictive models to accommodate consumer behavior changes and overcome financial and operational stress. Regulators reduced regulatory burden on the market operators in both agile and innovative ways that may serve as a basis for a flexible and responsive approach in the post-pandemic world. For example, changes in HIPAA requirements for telehealth (14), easier licensing, and increased reimbursements helped telemedicine practices being adopted rapidly during the pandemic. Network/infrastructure sectors demonstrated resilience in delivering essential services during the global COVID-19 emergency because of adaptive regulatory controls. Responsive regulations, technology adoption using cloud technologies, and digitization of business workflows will define post-pandemic imperatives in almost all industries.

Need for an Innovation Framework

Current trends indicate that the regulators are rethinking traditional regulatory models and taking more iterative and responsive approaches towards regulating new technologies without hampering innovation. Regulators are also collaborating with industries to address opportunities and threats of disruptive technologies that often cross traditional industry barriers. These trend-influenced regulatory changes will also necessitate businesses to rethink governance and development approaches that once allowed them to operate successfully within old policy frameworks.

Novel business models based on disruptive technological innovations benefit from hypothesis-driven experimentation instead of following pre-planned steps to build products or deliver services. Industry incumbents need to become more agile to address challenges that exist within their large complex organizations.

The regulatory landscape will continue to evolve as the digital economy expands through technological innovation and influences both regulators and regulated entities to experiment and adopt emerging cloud-based technologies, API Platforms, and AI at scale. These technologies perform better when adopted iteratively into products and services using a structured problem-solving approach (e.g., design thinking) and introducing incremental culture change towards agility by building a positive attitude towards risk and change management through organizational integration (15).

IBM Garage Method can help organizations identify and prioritize innovation opportunities throughout the enterprise by careful evaluation of risks and uncertainties across horizons against their product roadmaps.

Figure 1: IBM Garage Method helps organizations increase speed to value across four horizons

Using governance as an enabler for innovation, IBM Garage Method separates experimentation from process-driven regulated activities. Once experimentation is successfully validated to be compliant and approved, it is integrated into the target regulated product, process, or service(s) roadmap. This approach has the following benefits:

Each Hypothesis is validated into a proof of concept backed by relevant metrics and artifacts in a system of record that can help establish early evidence of conformance to the applicable standards Target Product can be incrementally enhanced and validated as it progresses through its lifecycle resulting in a possible reduction in cost and effort to obtain final regulatory approval

IBM Garage practices can help organizations evaluate hypothetical business scenarios to make better use of disruptive technologies.

Garage Practices Culture is the heart of the IBM Garage Method that promotes product quality through user-centric design by building a positive attitude towards risk and change management. Discover practices help teams and organizations dig deep into their problem domain, align everyone on common goals, success criteria, and identify potential problems and bottlenecks early. Envision practices provide development teams with a repeatable approach to deliver innovative user experiences through MVP iterations rapidly. Develop practices enable teams to collaborate and produce high-quality code can be confidently delivered to production using continuous integration, continuous delivery, and automation. Reason practices enable organizations to infuse artificial intelligence in a business workflow to make better decisions faster and more accurately. Operate practices focus on building automation that enables high availability and resiliency through continuously monitoring status and performance. Learn practices promote continuous experimentation through learning to develop the right solution and gather metrics to validate initial hypotheses.

IBM Garage Method also puts particular emphasis on data and documentation strategy for regulatory compliance by addressing digital tooling needs at the outset. With repeatable approaches and tools, IBM Garage Method focuses on quality and automation from the conceptual stages of product development. To test a hypothesis, IBM Garage squad(s) rapidly prototype by employing user-centric design techniques and quickly iterate through an MVP or a series of them using a test-centric approach by combining pair programming (PP) with test-driven development (TDD). As IBM Garage Method incorporates continuous verification and validation of code intrinsically through TDD and periodic review of other deliverables, adopting this framework may streamline processes around intermediate regulatory assessments and accelerate final regulatory approvals.

Next...

In the next, and final, part of this blog series I will discuss how organizations can implement the IBM Garage Methodology for software development in regulated sectors.