FDA Regulation of AI Medical Devices

A Regulator Built for Static Products, Meeting Software That Learns

The FDA was designed to answer one question about a medical device: does this specific, fixed thing work safely? A stent has a diameter. A pacemaker has a firmware version. Once cleared, the device stays the device — any meaningful change requires going back through review. That model works fine for hardware and even for conventional software, because conventional software doesn't change its own behavior after it ships.

AI models complicate that premise in two ways. First, even a "locked" model is a statistical object trained on a particular dataset, and its behavior on data unlike its training set is genuinely hard to predict in the way a mechanical device's behavior is not. Second, some AI systems are built to keep learning from new data after deployment — which means the thing the FDA cleared on day one is not necessarily the thing running in a hospital on day 400.

The FDA has spent the better part of a decade building a framework to handle this, and by mid-2026 that framework — while still evolving — has real structure to it. This piece walks through how AI medical devices actually get to market in the US, what the agency does and doesn't require, and where the open questions still sit.

What Counts as an "AI Medical Device" in the First Place

Not every piece of AI touching healthcare needs FDA clearance. The trigger is whether the software meets the legal definition of a medical device — broadly, whether it's intended to diagnose, treat, cure, mitigate, or prevent disease, or to affect the structure or function of the body.

The relevant category is Software as a Medical Device (SaMD): software intended for a medical purpose that isn't just running on or controlling a piece of hardware. An algorithm that flags a suspicious mass on a chest X-ray is SaMD. A wellness app that tracks your step count is not, even though both involve software analyzing personal health signals.

Within SaMD, AI-based products generally fall into one of these buckets:

• Computer-aided detection/diagnosis (CAD/CADe/CADx) — flags or characterizes findings in medical images, such as a mammography algorithm marking a region of interest.
• Clinical decision support (CDS) — synthesizes patient data to suggest a diagnosis, risk score, or treatment option, generally intended to inform rather than replace a clinician's judgment.
• Monitoring and triage tools — continuously analyze streams of data (ECG waveforms, vital signs, imaging queues) to flag abnormalities or prioritize cases.
• Autonomous diagnostic systems — render a diagnostic result without a clinician reviewing the underlying image or data, a much smaller and more tightly scrutinized category.

The distinction between the first three and the last one matters enormously for how much scrutiny a product gets, because "human stays in the loop" versus "software makes the call" changes the risk calculus the agency applies.

The Pathways: How AI Devices Actually Get Cleared

Most AI medical devices reach the US market through one of three regulatory pathways, and almost none of them go through the full Premarket Approval (PMA) process that headline-grabbing implantable devices require.

The 510(k) route dominates because AI products often function similarly enough to prior cleared software (or to prior manual clinical workflows) that a predicate can be found. This has drawn sustained criticism: comparing a new AI algorithm to an older, sometimes far less sophisticated predicate can understate how much the underlying technology has actually changed, and 510(k) clearance does not require the kind of prospective clinical trial that a PMA does.

De Novo classification exists partly to address that gap — it lets the FDA establish a new device category (with its own risk controls) for something genuinely novel, which can then itself become a predicate for future 510(k) submissions in the same space.

What a Submission Actually Contains

Regardless of pathway, an AI/ML device submission generally needs to show:

1. Intended use and indications for use — precisely what clinical question the software answers and for whom (e.g., "detects diabetic retinopathy in adults with diabetes from retinal fundus photographs").
2. Algorithm description — architecture, training methodology, and the general nature of the training data (though not necessarily the training data itself).
3. Performance data — sensitivity, specificity, and other accuracy metrics, typically validated on a dataset independent from training data.
4. Bias and generalizability analysis — increasingly expected evidence that the model performs consistently across relevant demographic subgroups, not just in aggregate.
5. Human factors and labeling — how the output is presented to the clinician, what warnings accompany it, and how misuse is guarded against.

A submission that shows strong aggregate accuracy but skips subgroup performance, or that doesn't clearly define the intended patient population, is a common reason for delay.

Timelines vary widely depending on device risk and how much clinical evidence is required. A 510(k) for a well-precedented CAD tool with a clean predicate might move through review in a matter of months. A De Novo submission for a genuinely new category of software, or a device that requires a prospective clinical study to establish performance, can take considerably longer — and the clinical study itself, run before the submission is even filed, often dwarfs the agency review time. Manufacturers that underestimate this front-loaded work are the ones most likely to see their launch timeline slip.

Locked Algorithms vs. Adaptive Algorithms

This is the distinction that actually drives most of the regulatory novelty around AI, and it's worth spelling out plainly.

A locked algorithm produces the same output every time given the same input — its parameters are fixed at the time of clearance. It might have been built using machine learning, but once trained and validated, it doesn't change on its own. The vast majority of FDA-cleared AI medical devices to date are locked in this sense. If the manufacturer wants to retrain the model on new data or adjust its behavior, that's treated as a modification requiring a new or supplemental submission, the same way changing a device's materials would.

An adaptive algorithm, by contrast, is designed to update its behavior based on new data it encounters after deployment — the kind of continuous learning that AI research often aspires to. This is where the regulatory model runs into a real conceptual problem: how do you certify the safety of something whose behavior is, by design, not fixed at certification time?

The Predetermined Change Control Plan (PCCP)

The FDA's answer to the adaptive-algorithm problem is a mechanism called the Predetermined Change Control Plan. Instead of forcing a manufacturer back through full review every time they want to update a model, a PCCP lets the manufacturer specify, at the time of initial submission, exactly what kinds of future changes they intend to make, how those changes will be validated, and what the boundaries of acceptable modification are.

A PCCP generally has to define:

• The specific, planned modifications — for example, retraining on an expanded dataset to improve performance on an underrepresented subgroup, not an open-ended "the model will keep learning."
• The modification protocol — the exact methods used to develop, validate, and implement each change, including data management and retraining procedures.
• The impact assessment — an analysis of the benefits and risks of the planned changes, and how the manufacturer will confirm the modified device stays within its cleared indications for use.

If the FDA accepts a PCCP as part of the original clearance, subsequent updates that fall within its defined scope don't require a brand-new submission. Updates that fall outside the plan's scope still do. This is a meaningful shift in regulatory philosophy — from certifying a fixed artifact to certifying a bounded process for change — but it's still early. Uptake has been gradual, and manufacturers have to be genuinely disciplined about scoping their PCCPs narrowly enough that the FDA will accept them, which somewhat limits how much true adaptiveness a cleared PCCP realistically covers in practice.

Why This Matters Right Now for Builders and Health Systems

Interest in AI-enabled clinical tools has moved well past pilot projects into production purchasing decisions at hospitals, radiology groups, and primary care networks. That shift changes who needs to understand this framework and why.

For a startup building a diagnostic or triage tool, the regulatory pathway is not a compliance afterthought bolted on before launch — it shapes the product from the earliest design decisions. Choosing to build a locked model versus pursuing a PCCP for a more adaptive system changes the validation dataset you need, the clinical study design, and the timeline to market by potentially a year or more. Teams that treat regulatory strategy as something to figure out after the model works well in a notebook consistently find themselves re-architecting late in development.

For health systems and clinical buyers, FDA clearance is a floor, not a ceiling. Clearance confirms a device met a bar of safety and effectiveness for its stated indication — it does not confirm the device performs well on your specific patient population, your specific imaging equipment, or your specific workflow. A model validated primarily on one demographic or one type of scanner can underperform when deployed elsewhere, and clearance paperwork alone won't tell a purchasing committee that.

For clinicians, the locked-vs-adaptive distinction matters practically: a locked tool behaves predictably over time (its failure modes today are its failure modes next year, for better or worse), while a tool operating under a PCCP might genuinely improve — or, if something goes wrong in the update process, degrade — without an obvious external signal that anything changed.

There's also a procurement dimension that's easy to overlook. A hospital IT and clinical governance committee evaluating two competing products — one locked, one operating under an approved PCCP — is effectively evaluating two different kinds of ongoing risk exposure, not just two accuracy numbers on a spec sheet. Contracts, monitoring plans, and internal validation cadences increasingly need to account for that difference explicitly rather than treating "FDA cleared" as a single uniform label.

Real Limitations and Open Questions

None of this framework is settled science, and it's worth being direct about where the gaps sit.

• Post-market surveillance is thinner than pre-market review. Once a device is cleared, ongoing monitoring of real-world performance is largely left to the manufacturer's own reporting obligations rather than continuous independent oversight. Performance drift — where a model's accuracy degrades as the population or clinical practice it encounters shifts away from its training distribution — is a known risk that current mechanisms only partially address.
• Predicate-based clearance can obscure real technological change. Comparing a new deep learning model to an older, structurally different predicate device (sometimes one that isn't AI-based at all) can allow substantial jumps in underlying technology to clear a lower evidentiary bar than a De Novo or PMA review would demand.
• Bias evaluation standards are still maturing. Expectations around demonstrating subgroup performance have tightened, but there's no single, universally applied standard for what counts as sufficient demographic representation in a validation dataset, and enforcement is uneven across submission types.
• International divergence adds complexity. The EU's Medical Device Regulation and AI Act, the UK's MHRA framework, and FDA requirements are not aligned, which means a device cleared in the US may need separate evidence packages to launch elsewhere — a nontrivial cost for smaller manufacturers.
• The PCCP mechanism itself is still young. It offers a real path toward safely regulating adaptive systems, but there isn't yet a long track record of how the FDA handles edge cases, disagreements over scope, or a manufacturer's PCCP-covered update turning out to have unintended effects.

What to Watch Next

A few threads are worth tracking if you're building or buying in this space:

1. Growth in PCCP-based clearances. As more manufacturers gain experience getting change control plans accepted, expect the proportion of adaptive (versus purely locked) cleared devices to rise gradually.
2. Real-world performance reporting requirements. Pressure is building — from clinicians, researchers, and within the agency itself — for more standardized, possibly public, post-market performance data rather than one-time clearance snapshots.
3. Generative AI in clinical workflows. Tools that summarize clinical notes, draft documentation, or synthesize patient histories using large language models sit in a genuinely ambiguous space: many function as administrative aids outside SaMD's scope, but as their outputs edge closer to clinical decision-making, expect sharper agency guidance on where the line falls.
4. Harmonization efforts across regulators. Ongoing international collaboration (through bodies like the International Medical Device Regulators Forum) aims to reduce duplicate evidence requirements across jurisdictions, though full harmonization remains distant.

FAQ

Does every AI healthcare app need FDA clearance?

No. Only software that meets the legal definition of a medical device — intended to diagnose, treat, prevent, or mitigate disease, or affect body structure or function — needs clearance. General wellness apps, administrative tools, and software that doesn't make or inform a clinical decision typically fall outside FDA's device jurisdiction.

What's the difference between 510(k) and De Novo pathways?

A 510(k) requires showing your device is substantially equivalent to an already-cleared predicate device. De Novo is used when no valid predicate exists for a novel, low-to-moderate risk device; once granted, a De Novo classification can itself become a predicate for future submissions in that category.

Can an FDA-cleared AI model keep learning after it launches?

Only within limits it disclosed at clearance time. A "locked" model can't change its behavior without a new submission. An adaptive model can update within the bounds of a Predetermined Change Control Plan (PCCP) approved as part of its original clearance — changes outside that plan's defined scope still require new FDA review.

How does the FDA evaluate bias in AI medical devices?

Manufacturers are increasingly expected to report how a model performs across relevant demographic subgroups, not just in aggregate, and to describe the composition of their training and validation datasets. There isn't yet a single universal standard for what counts as adequate subgroup representation, so rigor varies by submission.

Is FDA clearance proof that an AI tool works well in my clinic?

Not entirely. Clearance confirms the device met a safety and effectiveness bar for its stated indication, typically validated on a specific dataset and patient population. Performance on your equipment, patient mix, or workflow can differ, which is why many health systems run their own local validation before full deployment.

What happens if a cleared AI device's performance degrades over time?

Post-market surveillance for this kind of "performance drift" currently relies heavily on manufacturer reporting rather than continuous independent monitoring, which is widely viewed as one of the framework's weaker points. If a manufacturer has a PCCP in place, planned retraining can help address drift within the plan's approved scope.

Are large language models used in clinical documentation regulated as medical devices?

It depends on function, not underlying technology. An LLM that drafts clinical notes or summarizes records for a clinician to review is generally treated as an administrative tool outside SaMD's scope; one that generates a diagnosis or treatment recommendation without meaningful clinician review moves much closer to being regulated as a medical device.

Teams building or evaluating AI-enabled clinical software can work through the regulatory strategy and technical validation together with Woyce Technologies.