FDA's Regulatory Pathway for AI/ML-Based Medical Devices

Ask a founder building an AI diagnostic tool which FDA pathway their product needs, and a surprising number answer with something like "the AI approval process" — as if artificial intelligence triggered its own review track the way a new drug class does. It doesn't. The FDA regulates AI- and machine-learning-based Software as a Medical Device (SaMD) through the exact same three pathways it uses for a syringe pump or a hip implant: 510(k) clearance, De Novo classification, or premarket approval. What's different about AI isn't the pathway — it's a submission tool built for software that keeps changing after it ships, and a real, live question of whether a given piece of AI software counts as a regulated device at all.

That second question has gotten more consequential, not less, since FDA loosened its posture toward certain AI clinical tools at the start of 2026. Getting the classification right — device or not, which pathway, whether a change-control plan applies — now determines both what a product needs before launch and how much it can evolve afterward without going back through review.

510(k), De Novo, and PMA: how AI/ML SaMD actually gets sorted

The FD&C Act's device-classification scheme predates machine learning by decades, and FDA has applied it to AI/ML SaMD without amendment. A device seeking clearance through 510(k) has to show substantial equivalence to a legally marketed predicate device — same intended use, same or equivalently safe technological characteristics. This is the route the overwhelming majority of AI/ML-enabled devices take, because most new AI diagnostic and monitoring tools are iterating on an established category (image analysis, signal interpretation, risk scoring) rather than creating one from nothing.

De Novo classification exists for genuinely novel low-to-moderate-risk devices that have no predicate to compare against — the manufacturer has to make the case for a new risk-based classification from scratch, which typically means more original evidence than a 510(k) but less than a PMA. Premarket approval (PMA) is reserved for the highest-risk Class III devices, and demands the most extensive clinical evidence of safety and effectiveness of the three routes; it shows up far less often in the AI/ML device population than the other two.

FDA's own public list of AI/ML-enabled medical devices — first published in 2021 and updated periodically — makes the pathway skew visible at scale. The list has grown past a thousand authorized devices, radiology accounts for a large majority of them, and 510(k) clearance accounts for the large majority of authorizations across specialties. A company assuming its imaging or diagnostic AI needs PMA-level evidence because "it's AI" is usually overbuilding for the wrong bar; the relevant question is risk classification and predicate availability, the same as it would be for a non-AI device in the same category.

When AI software isn't a "device" at all

Before any of those three pathways matter, there's a threshold question: does the software meet the legal definition of a medical device in the first place? Section 520(o)(1)(E) of the FD&C Act, added by the 21st Century Cures Act, carves out a category of Clinical Decision Support (CDS) software that Congress decided shouldn't be regulated as a device — provided it meets four criteria, one of which is doing most of the analytical work: the software has to be intended to let a healthcare provider independently review the basis for its recommendations, rather than intended for the provider to rely on those recommendations primarily to make a diagnosis or treatment decision. FDA finalized guidance clarifying this Non-Device CDS test in September 2022.

In January 2026, under Commissioner Marty Makary, FDA expanded enforcement discretion within that same framework rather than rewriting it. Software that surfaces a single, clinically appropriate recommendation now qualifies for enforcement discretion — including certain generative-AI tools — as long as a clinician can independently review the logic, data, and guidelines behind the output, satisfying the Non-Device CDS criteria. FDA paired that with a broader "general wellness" policy for non-invasive consumer wearables reporting metrics like blood pressure, oxygen saturation, or glucose-related signals, so long as they're marketed for wellness rather than diagnosis or treatment.

It's tempting to read that as FDA stepping back from AI medical devices generally. That reading is wrong in the way that matters for a compliance decision: FDA has been explicit that it still asserts authority over opaque models, time-critical decision tools, and any software that substitutes for a clinician's own judgment rather than supporting it. The boundary moved; it didn't disappear. A tool that fails any one of the four CDS criteria — most commonly, a tool whose logic a clinician can't actually inspect, or one designed to be relied on directly — is still squarely a device, still needs a pathway, and gets none of the benefit of the 2026 update.

The Predetermined Change Control Plan: regulating a model that keeps changing

A static device gets cleared once and stays the same until the manufacturer files a new submission for a material change. Many AI/ML models aren't built that way — they're designed to be retrained on new data, recalibrated, or otherwise updated after they're already on the market, which under the traditional framework would mean a fresh submission for every meaningful update.

FDA's answer, finalized in guidance in December 2024, is the Predetermined Change Control Plan (PCCP). A manufacturer includes a PCCP in its original 510(k), De Novo, or PMA submission, describing exactly what future modifications it plans to make to the AI-enabled function — what data will be used to retrain it, what performance it has to maintain, and how the change will be validated — and FDA reviews and authorizes that plan alongside the device itself. Once cleared, changes that stay inside the PCCP's pre-specified boundaries don't require a new submission; changes that fall outside it do. This builds directly on the total-product-lifecycle approach FDA first described in its January 2021 AI/ML SaMD Action Plan, and on the joint Good Machine Learning Practice guiding principles FDA published with Health Canada and the UK's MHRA later that year — both aimed at the same underlying problem: a model's behavior isn't fixed the way a physical device's is, so the regulatory tool has to account for planned drift, not just a one-time snapshot.

Two products, two outcomes: Briarcliff Critical Care's sepsis tool and Solene Imaging's triage engine

Picture Briarcliff Critical Care, a hospital system building an in-house AI tool that flags ICU patients at elevated sepsis risk. The tool surfaces a single alert — "elevated sepsis risk, review now" — alongside the specific vital-sign trends, lab values, and time-series data that drove it, displayed directly to the bedside nurse and covering physician. Nobody's asked to act on the flag alone; the underlying data is right there for them to check. That design plausibly clears the Non-Device CDS bar: a single, clinically appropriate recommendation, with the basis visible enough for a clinician to independently assess it rather than defer to it. If Briarcliff's design genuinely holds up against all four statutory criteria, the tool may need no FDA marketing submission at all.

Now picture Solene Imaging, a vendor building an AI tool that analyzes CT scans directly and reorders a radiologist's worklist by estimated likelihood of a critical finding. This tool fails the CDS test on its first criterion alone — software intended to acquire, process, or analyze a medical image is excluded from the Non-Device CDS carve-out by definition, full stop, regardless of how transparent its output is. Solene's product is a device, needs 510(k) clearance against an existing image-triage predicate if one is available, and — because the company plans to retrain the underlying model periodically on new scanner and hospital-site data — is a realistic candidate for a PCCP filed alongside that 510(k), so routine retraining within pre-specified bounds doesn't force a new submission every quarter.

The difference isn't that one company is more careful than the other. It's that one product's function (surfacing a reviewable flag from data a clinician can independently check) sits inside a specific statutory carve-out, and the other's function (directly analyzing image data) is written out of that carve-out by name. A single design choice — does the tool interpret the image itself, or does it interpret already-structured clinical data for a clinician who still sees the underlying evidence — determines which of these two very different regulatory paths a product is on, and that determination has to happen before development finishes, not after.

What's still unsettled

Not everything about FDA's AI framework is stable. A broader draft guidance — "Artificial Intelligence-Enabled Device Software Functions: Lifecycle Management and Marketing Submission Recommendations," published in January 2025 — proposes total-product-lifecycle recommendations that would consolidate and extend the PCCP and prior AI-specific guidance, but it remains in draft, not final, as of this writing. Executive Order 14179's deregulatory direction, signed days after that draft guidance came out, has visibly shaped FDA's posture since — the January 2026 CDS and wellness-wearables expansion is a direct product of that same push. None of it touches the underlying 510(k)/De Novo/PMA structure for anything that's squarely a device.

The practical implication for a team scoping a submission today: run the four-criteria CDS test and the risk classification analysis before locking product design, not after, because a small interface decision — whether a clinician sees the underlying data or just a conclusion — can be the difference between no FDA submission and a full 510(k). And treat a favorable enforcement-discretion posture as FDA's current priority, not a permanent statutory guarantee; it's already moved once inside a single presidential term, the same way the EEOC's own guidance moved without the underlying statute changing under it, and it can move again. For the wider federal landscape AI products have to navigate beyond FDA — FTC, EEOC, CFPB, and SEC all applying existing law to AI without new legislation — see our overview of US federal AI regulation. Teams documenting their model validation and change-control process for a PCCP-ready submission will also find real overlap with the evidence trail an ISO/IEC 42001 gap assessment expects, even though the two processes serve different regulators.