FDA Artificial Intelligence & AI/ML Device Rules

Written and maintained byCASRAI Editorial Board

• X
• LinkedIn
• Facebook

FDA artificial intelligence regulation governs how artificial intelligence and machine learning (AI/ML) algorithms used in healthcare—whether deployed as standalone Software as a Medical Device (SaMD) or embedded as Software in a Medical Device (SiMD)—are classified, validated, cleared or approved for marketing, and monitored post-market in the United States. Coordinated by the Center for Devices and Radiological Health (FDA CDRH) and its Digital Health Center of Excellence (DHCoE) alongside CDER and CBER AI regulatory frameworks, the agency regulates clinical AI through risk-based premarket pathways, Good Machine Learning Practice (GMLP) principles, and statutory Clinical Decision Support (CDS) boundaries.

How Does the FDA Regulate AI/ML-Enabled Medical Devices?

Before selecting a premarket submission pathway, developers and clinical investigators must first determine whether an AI algorithm meets the statutory definition of a medical device under Section 201(h) of the Federal Food, Drug, and Cosmetic (FD&C) Act, or whether it qualifies as Non-Device Clinical Decision Support (CDS) under Section 520(o)(1)(E) (enacted by Section 3060 of the 21st Century Cures Act).

1. The Four-Criterion Non-Device CDS Boundary (Section 520(o)(1)(E))

Under the FDA’s final guidance on Clinical Decision Support Software (September 2022), a clinical software function is excluded from FDA device regulation only if it satisfies all four statutory criteria simultaneously:

1. Criterion 1 (Signal/Image Exclusion): It is not intended to acquire, process, or analyze a medical image (such as DICOM CT, MRI, or pathology slides), a signal from an in vitro diagnostic (IVD) device, or a pattern/signal from a physiological signal acquisition system (such as ECG waveforms or continuous telemetry).
2. Criterion 2 (Medical Information Input): It is intended for displaying, analyzing, or printing medical information about a patient or other medical information (such as peer-reviewed clinical studies or clinical practice guidelines).
3. Criterion 3 (HCP Recommendation Scope): It is intended for supporting or providing recommendations to a health care professional (HCP) about prevention, diagnosis, or treatment—rather than outputting a single specific directive or a time-critical emergency alarm that requires immediate action.
4. Criterion 4 (Independent Review of Basis): It enables the health care professional to independently review the basis for the recommendation so that the clinician does not rely primarily on the software output to make a clinical decision for an individual patient.

Any AI/ML model that analyzes medical images or physiological waveforms (failing Criterion 1), targets patients directly rather than HCPs (failing Criterion 3), or operates as an unexplainable “black-box” urgency triage score without transparent clinical logic (failing Criterion 4) is regulated as an AI/ML-enabled medical device (AIaMD).

2. The 10 Good Machine Learning Practice (GMLP) Guiding Principles

Jointly issued by the FDA, Health Canada, and the UK Medicines and Healthcare products Regulatory Agency (MHRA) in October 2021, the 10 GMLP Guiding Principles establish quality expectations across the Total Product Life Cycle (TPLC):

• Representativeness & Independence of Datasets (Principles 3 & 4): Training datasets and clinical validation cohorts must reflect the intended target population across age, sex, race, ethnicity, and scanner hardware, and test datasets must be kept strictly independent from training and tuning datasets to prevent data leakage.
• Reference Standards & Tailored Model Design (Principles 5 & 6): Ground-truth labels must rely on best-available clinical reference standards (such as multi-reader consensus adjudication or biopsy confirmation), and model validation must document subgroup performance and generalizability risks.
• Human–AI Team Performance (Principle 7): Where the AI model assists a clinician, validation studies must evaluate the combined performance of the human clinician plus the AI system, rather than standalone algorithm accuracy in isolation.
• Post-Market Drift Monitoring & Change Control (Principles 9 & 10): Deployed models must be monitored for real-world data drift and managed via Predetermined Change Control Plans (PCCPs) authorized under Section 515C of the FD&C Act.

How Do 510(k), De Novo, and PMA Pathways Apply to Clinical AI Algorithms?

Note that the FDA does not “certify” AI algorithms (why FDA does not certify devices); instead, the agency clears Class II devices, grants marketing authorization

Submissions for 510(k), De Novo, and PMA AI/ML devices are prepared and transmitted electronically using the FDA eSTAR structured submission template and must include premarket cybersecurity documentation under Section 524B (including a Software Bill of Materials and adversarial ML threat modeling).

What Is Included on the FDA List of AI/ML-Enabled Medical Devices?

To provide public transparency across authorized clinical algorithms, the FDA Digital Health Center of Excellence maintains the Artificial Intelligence and Machine Learning (AI/ML)-Enabled Medical Devices database. Each record on the FDA list includes:

• Submission Number & Pathway Prefix: The K number (510(k)), DEN number (De Novo), or P number (PMA), linked directly to the public FDA decision summary;
• Date of Final Decision, Device Name, and Applicant/Company;
• Lead Review Panel (Medical Specialty) and 3-Letter FDA Product Code: Over 75% of all listed AI/ML authorizations fall under Radiology (such as product codes QAS for radiological computer-aided triage and notification, LLZ for medical image management and processing, and QBS/MYN for computer-aided detection), followed by Cardiovascular (approximately 10%, including ambulatory ECG patch analysis and echocardiogram quantification), Neurology, Hematology, Pathology, and Ophthalmology.

For clinical researchers and hospital AI governance committees, the FDA database serves as the primary verificationr Use, target patient age group, and locked versus PCCP-enabled update status before clinical deployment

Sources

• U.S. Food and Drug Administration (FDA), Digital Health Center of Excellence. Artificial Intelligence and Machine Learning (AI/ML)-Enabled Medical Devices Database & Regulatory Overview. https://www.fda.gov/medical-devices/software-medical-device-samd/artificial-intelligence-and-machine-learning-aiml-enabled-medical-devices
• U.S. Food and Drug Administration (FDA), Health Canada, & UK MHRA (2021). Good Machine Learning Practice for Medical Device Development: Guiding Principles. https://www.fda.gov/medical-devices/software-medical-device-samd/good-machine-learning-practice-medical-device-development-guiding-principles
• U.S. Food and Drug Administration (FDA) (2022). Clinical Decision Support Software — Guidance for Industry and Food and Drug Administration Staff. https://www.fda.gov/regulatory-information/search-fda-guidance-documents/clinical-decision-support-software

Research-administration guidance, standards updates and independent tool reviews.