FDA Regulation of AI Medical Devices and SaMD

AI medical software breaks a core assumption in how medical devices are regulated. Traditional device law expects a product that stays the same once it ships. Software that learns and adapts after it leaves the manufacturer doesn't fit that mold. Understanding how the FDA handles this mismatch tells you what "FDA-authorized" really means on an AI tool you meet in care, and what it doesn't.

Why AI medical software needs a different regulatory approach than traditional devices

Software as a Medical Device, or SaMD, is standalone software meant for medical purposes. It runs on general-purpose platforms like the cloud, a phone, or a desktop, not inside a piece of hardware. The International Medical Device Regulators Forum defined the term, and FDA policy mirrors it.

The regulatory mismatch is the point. Traditional FDA frameworks assume a relatively static device. A surgical stapler does not change how it works after it leaves the factory. AI/ML SaMD may be updated, adapted, or may drift in its behavior after clearance. The agency has explicitly acknowledged that its prior rules were not designed for this.

The difference comes down to locked versus adaptive models. A locked model produces the same output for the same input, every time. An adaptive model can change. That distinction determines which oversight tools apply, and it's the reason FDA's approach has had to change.

The scale of this shift matters. By early 2026, FDA had authorized over 1,350 AI-enabled devices, roughly double the number from 2022. The regulatory gap isn't hypothetical. It's already spread across clinical practice.

For a patient or a clinician, this means "FDA-authorized" on an AI tool doesn't carry the same meaning it does on that stapler. The authorization may have required very different things. What those things are is the subject of everything that follows.

How FDA classifies AI SaMD and which premarket pathway applies

FDA applies its standard Class I to Class III risk classification to AI SaMD, then routes each device to a premarket pathway based on that. But most AI tools clear through the least rigorous of those pathways. Three routes matter. The 510(k) clearance asks a manufacturer to show substantial equivalence to a predicate device already on the market. This is the dominant route for AI SaMD. The De Novo pathway is for novel, low-to-moderate risk devices that have no predicate. It establishes a new device type, which can then become a predicate for later 510(k)s. Premarket Approval, or PMA, is the most rigorous pathway and is required for high-risk Class III devices. Only a small number of AI SaMD have gone through PMA. The agency has not yet created a unique regulatory pathway for AI-enabled devices. Which route applies depends on risk level and whether a predicate exists.

A 2025 snapshot shows how the system works in practice. That year brought 295 FDA clearances of AI/ML medical devices, from 221 unique manufacturers. The median clearance time was 142 days. Roughly three-fifths were SaMD, and roughly three-fifths were diagnostic tools. Radiology dominates the authorized pool, while cardiology, neurology, ophthalmology, anesthesiology, and dermatology-focused tools are expanding. Dermatology still holds a small share of the total.

What does a 510(k) clearance actually establish? It confirms substantial equivalence to a predicate. It is not independent proof of superior efficacy. A tool can be cleared because it works like something else, not because it works better. That distinction matters when you read claims about what an AI diagnostic can do.

There's another boundary, and it determines whether a given tool was reviewed at all. Clinical decision support software now falls outside device regulation if a clinician can independently review and understand the basis for its recommendation. The CDS carve-out gets its own treatment next, because it is the most consequential policy shift for AI tools clinicians meet every day.

Where the January 2026 clinical decision support guidance draws the line

FDA's January 2026 revised guidance on clinical decision support redraws the line between regulated and unregulated software. Where that line sits has direct consequences for what scrutiny an AI tool received before reaching clinical use. The rule as stated is straightforward. Software that provides a recommendation the clinician can independently review and understand may fall outside FDA medical device oversight, or qualify for enforcement discretion, if its AI features meet all four statutory criteria. The reasoning is that human judgment remains the decision point. The stated rationale is reducing unnecessary regulation and accelerating time-to-market for tools positioned as clinical assistants rather than autonomous decision-makers.

The practical consequence is the part worth pausing on. A clinician using an AI-assisted note summarizer or a differential-diagnosis suggester may be using a product that received no premarket FDA review. Not because it was exempted from a process it went through, but because the process never applied. This sits inside a broader direction. FDA Commissioner Makary previewed cutting digital health guidance documents substantially and moving toward a risk-based AI framework that relies more on post-marketing monitoring than premarket gatekeeping.

The objection worth stating: when a tool operates outside the device pathway, there is no premarket review of whether it actually works as claimed. What "independently reviewable" means in fast-paced clinical workflows remains contested. The CDS carve-out hinges on whether a clinician can independently review and understand an AI recommendation. A telehealth platform may operate outside premarket device review altogether if it uses AI to guide symptom intake but routes the final diagnosis and prescription decision to a licensed clinician, not an autonomous model. That distinction reshapes how different AI-assisted care tools are evaluated. Which raises the next question: for tools that do go through premarket review, what does that review now require?

What the January 2025 draft guidance and August 2025 PCCP guidance require manufacturers to document

Two major 2025 guidance documents define what manufacturers must show, and plan for, before an AI SaMD reaches clinical use. The January 7, 2025 draft guidance on AI-enabled device software functions covers lifecycle management and marketing submission recommendations. It requires documentation of training data composition, model architecture, and development details, including model inputs and outputs, features, feature selection, and loss functions. It also requires validation methodology. Transparency in labeling is called for: manufacturers must provide clear, user-facing explanations of AI functionality, known limitations, and instructions for use. The guidance also addresses bias mitigation as a required element. Devices must be validated with study populations appropriate to their intended use, and diversity of training data must be disclosed.

The second document is the December 2024 final guidance, revised August 2025, on Predetermined Change Control Plans, or PCCPs. A PCCP is a pre-authorized plan that specifies which algorithm modifications a manufacturer may make after clearance without filing a new submission. It formalizes the mechanism that addresses the locked and adaptive distinction. A manufacturer who wants to update a model after clearance must plan and disclose the nature and boundaries of those updates upfront. Changes that fall outside the PCCP require a new submission. That makes the PCCP both an enabler of iteration and a constraint on unauthorized drift. It is the regulatory answer to the adaptive AI problem. Instead of a binary "cleared once, frozen forever" model, it creates a structured, pre-authorized update pathway.

Cybersecurity documentation also applies. Manufacturers must demonstrate "secure by design" principles and submit a Software Bill of Materials, an SBOM, which is a complete inventory of software components. This enables ongoing vulnerability tracking.

What these requirements still don't guarantee is worth stating plainly. An ArXiv analysis of FDA summary reports between 2021 and 2025 found that nearly a quarter, 24.7%, provided no evidence for any of six core trustworthy-AI principles. No report documented evidence across all six. Explainability and Traceability were the most pronounced gaps. Clearance may not mean what a careful reader assumes it means.

Why the Total Product Lifecycle approach changes what "ongoing oversight" means

The FDA's Total Product Lifecycle framework treats clearance as the beginning of regulatory oversight rather than its conclusion. The infrastructure for enforcing postmarket performance commitments is still catching up to the volume of authorized devices. TPLC means something specific. Rather than evaluating a device once at the premarket stage, it integrates continuous real-world monitoring, planned algorithm updates through PCCPs, and quality management across the entire product lifespan. In practice, manufacturers are expected to monitor for performance drift, adverse events, and new failure modes surfaced by real-world use patterns that lab validation did not anticipate.

But there is an adverse-event reporting gap. Reporting transparency gaps in FDA regulatory documentation are substantial and persistent. Traceability, the ability to audit a device's behavior and decisions, is documented in fewer than one in ten cleared AI devices. That is a problem when the framework's whole point is ongoing visibility.

A concrete case shows what the gap leaves undetected at scale. J&J/Acclarent's TruDi ENT Navigation is an electromagnetic image guidance system with AI-enhanced software. Between 2021 and 2025 it accumulated more than 100 adverse event reports and roughly ten patient injuries. The TPLC framework is designed to catch exactly these cases. The gap between what it requires and what manufacturers currently report is the unresolved tension at the center of AI SaMD oversight.

You can see the locked and adaptive distinction clearly in dermatology. AI tools trained on large labeled datasets, like those powering image-based diagnostic platforms, must clarify whether their outputs remain fixed or can drift after deployment. That clarity is what FDA authorization is meant to establish for clinicians and patients relying on the tool.

How algorithmic bias in training data can persist through regulatory clearance

Regulatory clearance does not guarantee that an AI SaMD performs equitably across the patient populations it will meet in practice. Current validation requirements do not mandate representative training data in all cases. Documented gaps in dermatology show the clinical consequences.

The mechanism is direct. AI models learn from the data they are trained on. If that data underrepresents certain populations, the model's performance on those populations will be worse. A clearance based on a non-representative study population will not catch that gap.

Dermatology is the clearest documented case. The lack of darker skin tones in images used to train dermatology AI models has resulted in documented poorer diagnostic performance on darker skin phenotypes. The Nevisense device, PMA P150046, is approved for use by dermatologists on cutaneous lesions with one or more clinical or historical characteristics of melanoma, when considering biopsy. Its labeling explicitly excludes acral skin and other special anatomic sites. That is a regulatory acknowledgment that the device's validated scope does not extend to all patient presentations.

The January 2025 draft guidance responds by requiring bias assessment and training data disclosure. But this is a draft. And the analysis of cleared devices' existing documentation shows Fairness is among the least-reported dimensions in current summary reports.

The access argument is where this bites. An AI tool that performs well on the majority population but poorly on underserved groups does not improve access equitably. It may entrench existing diagnostic disparities in a faster, more scalable form. What the framework asks of manufacturers going forward is that validation populations be appropriate to the device's intended use, and that demographic composition of training and test data be disclosed. The question is whether that disclosure is enough.

What "FDA-authorized" actually means when a patient or clinician encounters an AI tool in care

FDA authorization is a meaningful but bounded signal. It establishes that a device cleared a defined premarket threshold and is subject to ongoing obligations. It does not, by itself, confirm that the tool works equitably across populations, that its postmarket performance is being actively monitored, or that a clinician's understanding of it has been verified.

What authorization does establish is concrete. For 510(k)-cleared devices, it establishes substantial equivalence to a predicate. The bar is comparability, not demonstrated superiority. For De Novo and PMA devices, it establishes independent safety and effectiveness review appropriate to the risk class. For any AI SaMD with a PCCP, it establishes that the manufacturer has pre-specified the boundaries of allowable post-clearance updates, and that changes outside those boundaries require a new submission. For cybersecurity, it establishes that the device has disclosed its software components and designed against known vulnerability classes.

What authorization does not automatically establish is just as important. It does not establish that the tool was validated on a population that includes the patient in front of the clinician. It does not establish that postmarket performance is actively tracked and reported. The adverse-event reporting gap means real-world failure modes may accumulate before they surface. It does not establish that the AI's reasoning is explainable to the clinician using it. Explainability is the most rarely documented dimension in current FDA summary reports. And it does not establish that the tool was subject to any premarket review at all, if it falls under the CDS carve-out introduced in January 2026.

That leaves certain questions worth asking about any AI tool in care. Is this tool FDA-authorized, and through which pathway? The FDA maintains a public AI-enabled device list. What patient population was it validated on, and does that population match this patient? Does the labeling explain what the AI can and cannot do, including which anatomic sites, presentations, or use cases are excluded? Is there a PCCP, and has the device been updated since clearance?

Clinician oversight is a structural expectation, not a fallback. The FDA explicitly requires manufacturers to assess risks from automation bias. The CDS carve-out is designed around the premise that a clinician will independently review and understand AI recommendations. Human judgment is built into the regulatory logic, not treated as optional. Platforms that pair AI-powered assessments with licensed clinician review, like Nolla, are designed around the same structural premise the FDA treats as foundational. AI in care is most trustworthy when it operates within a supervised, accountable clinical workflow rather than as a standalone decision-maker. That is the standard worth holding every AI tool to, authorized or not.