FDA AI/ML Software as a Medical Device
US Food and Drug Administration - Center for Devices and Radiological Health (CDRH). Works with international counterparts (EU MDR, UK MHRA, Health Canada).
2021 - Action Plan published; PCCP guidance finalized 2023; ongoing enforcement.
Status
Active
Risk Level
Critical
Jurisdiction
United States
Enforcement
2021 - Action Plan published; PCCP guidance finalized 2023; ongoing enforcement.
critical risk framework
Medical device manufacturers, health IT companies, and AI companies whose software is intended to diagnose, treat, or prevent disease.
Overview
The FDA regulatory framework for AI/ML-based Software as a Medical Device (SaMD) addresses how AI models can be continuously updated post-deployment while maintaining safety and effectiveness. Requires pre-market submission for high-risk devices, post-market surveillance, and a Predetermined Change Control Plan for AI updates.
Scope
Software intended to diagnose, treat, prevent, cure, or mitigate disease or injury. AI in diagnostic imaging, clinical decision support, patient monitoring, and therapeutic devices.
Applicability
Who Is Affected
- Medical device manufacturers incorporating AI/ML into devices
- Health IT companies whose software meets the 'medical device' definition
- AI companies whose diagnostic or therapeutic AI targets disease
- Hospital systems developing in-house AI tools for clinical use (may qualify as devices)
Who Is Exempt
- Administrative and operational software not intended for clinical decision-making
- Electronic health records (EHR) software (generally exempt)
- General wellness apps without disease treatment/diagnosis claims
- Clinical decision support software meeting specific CDS exclusion criteria under 21st Century Cures Act
Key Prohibitions
- Marketing a device that meets the SaMD definition without FDA clearance or approval
- Making claims about disease diagnosis/treatment for cleared devices beyond their cleared indication
- Using a PCCP to make changes not covered in the pre-approved plan without new submission
- Distributing AI devices with known performance issues without reporting to FDA
Risk Tier Classification
Class I
minimalLow-risk devices. Most are exempt from pre-market notification.
Examples
- • Wellness monitoring apps without disease claims
- • Basic activity tracking AI
Requirements
- ✓ General controls only
- ✓ Quality System Regulation compliance
- ✓ Registration and listing
Class II
limitedModerate-risk devices. Require 510(k) substantial equivalence or De Novo classification.
Examples
- • AI diagnostic imaging aids
- • Clinical decision support for non-life-critical conditions
- • AI-assisted ECG interpretation
Requirements
- ✓ 510(k) clearance or De Novo
- ✓ Special controls
- ✓ Labeling requirements
- ✓ Performance testing across demographics
Class III
highHigh-risk, life-supporting/sustaining devices. Require Pre-Market Approval with clinical evidence.
Examples
- • AI for autonomous cancer diagnosis
- • AI-driven surgical robot control
- • AI cardiac rhythm management
Requirements
- ✓ PMA with clinical trials
- ✓ Extensive safety and effectiveness data
- ✓ Ongoing annual reports
- ✓ Post-market study requirements
Key Requirements
- Determine device classification: Class I (exempt), Class II (510k/De Novo), Class III (PMA)
- Pre-submission meeting with FDA for AI/ML-based device development plans
- 510(k) or De Novo clearance required for most Class II AI medical devices
- PMA (Pre-Market Approval) for Class III (high-risk) AI devices - clinical trials required
- Predetermined Change Control Plan (PCCP): pre-approved AI update mechanism
- Transparency: device labeling must disclose AI-based functionality and limitations
- Bias assessment: algorithm performance must be validated across diverse patient demographics
- Post-market surveillance: real-world performance monitoring and reporting
Guardrails & Operational Controls
- Training data diversity: demographic representation in training, validation, and test datasets
- Algorithm validation: performance metrics (sensitivity, specificity, AUC) across subgroups
- Predetermined Change Control Plan: pre-approved envelope for model updates without new 510k
- Post-market monitoring: real-world performance compared to pre-market claims
- User training: clinicians must be trained on AI limitations and failure modes
- Fail-safe design: AI must indicate uncertainty rather than forcing a decision
Implementation Guidance
- 1Determine if your AI software meets the FDA medical device definition
- 2Classify device risk and identify appropriate regulatory pathway (510k/De Novo/PMA)
- 3Develop a Predetermined Change Control Plan for planned AI model updates
- 4Conduct clinical validation across diverse patient populations before submission
- 5Engage FDA early via the Pre-Submission (Q-Sub) program to align on pathway
Industry Impact
Radiology AI
Most active FDA AI clearance category. 600+ AI-enabled devices cleared as of 2024.
Cardiology AI
ECG, cardiac imaging, and arrhythmia detection AI: rapidly growing clearance category.
Pathology AI
Digital pathology AI increasingly reviewed under 510k/De Novo pathway.
Mental Health AI
FDA carefully scrutinizing AI in psychiatric diagnosis and mental health monitoring.
Drug Discovery AI
Generally not devices unless embedded in diagnostic output - watch regulatory developments.
Regulatory Timeline
2019
FDA publishes AI/ML Software as Medical Device Discussion Paper
Jan 2021
FDA AI/ML-Based SaMD Action Plan published
Sep 2022
FDA, Health Canada, UK MHRA publish joint 10 guiding principles for SaMD AI
Dec 2023
FDA PCCP guidance finalized - allows AI model updates without full re-submission
2024
600+ AI-enabled medical devices cleared/approved by FDA
2025
Anticipated FDA AI transparency and explainability final guidance
Notable Enforcement Cases
- 1FDA cleared first AI-only medical device in 2018 (IDx-DR for diabetic retinopathy - De Novo)
- 2Paige.AI received first De Novo AI pathology clearance 2021 for prostate cancer detection
- 3Multiple warning letters issued for software claiming diagnostic capabilities without clearance
Penalties for Non-Compliance
Warning letters, import alerts, injunctions, mandatory recalls, criminal prosecution, and civil fines for marketing unapproved devices. Up to $15,000/day civil monetary penalties.
Framework Details
Short Name
FDA AI/ML SaMD
Jurisdiction
United States
Enforcement Date
2021 - Action Plan published; PCCP guidance finalized 2023; ongoing enforcement.
Enforcing Authority
US Food and Drug Administration - Center for Devices and Radiological Health (CDRH). Works with international counterparts (EU MDR, UK MHRA, Health Canada).
Status
Risk Level
Affected Organizations
Medical device manufacturers, health IT companies, and AI companies whose software is intended to diagnose, treat, or prevent disease.
Tags
This is educational guidance only. Always consult qualified legal counsel for compliance decisions affecting your organization.