The FDA regulates AI-driven medical devices primarily under the Software as a Medical Device (SaMD) framework, in alignment with the International Medical Device Regulators Forum (IMDRF). The key regulatory body is the Center for Devices and Radiological Health (CDRH).
AI/ML-based medical devices are regulated like any other medical device — the pathway depends on risk classification and substantial equivalence to predicate devices.
AI/ML-based SaMD encompasses a broad range of applications including:
FDA evaluates AI/ML-based SaMD based on three key dimensions:
FDA classifies medical devices — including AI-driven devices — into three classes based on risk level and the regulatory controls necessary to provide reasonable assurance of safety and effectiveness.
| Class | Risk Level | Regulatory Control | Common Pathway |
|---|---|---|---|
| Class I | Low | General controls | Exempt or 510(k) |
| Class II | Moderate | General + Special controls | 510(k) or De Novo |
| Class III | High | Premarket approval | PMA |
Device classification depends on:
| AI Device Type | Typical Class | Pathway |
|---|---|---|
| AI-powered radiology image analysis (non-diagnostic aid) | Class II | 510(k) |
| AI-based diabetic retinopathy screening (autonomous diagnosis) | Class II | De Novo |
| AI-driven cardiac monitoring in implantable devices | Class III | PMA |
| AI clinical decision support (physician confirms) | Class I/II | Exempt or 510(k) |
Most common pathway for AI-driven devices. Requires demonstration of substantial equivalence to a legally marketed predicate device.
Used when no predicate exists but device is low-to-moderate risk.
Required for Class III AI devices (high-risk, life-sustaining, or implantable).
Available for AI devices that provide more effective treatment/diagnosis of life-threatening conditions.
| Pathway | Typical Class | Key Requirement | Timeline |
|---|---|---|---|
| 510(k) | Class II | Substantial equivalence to predicate | 90 days |
| De Novo | Class II (new) | No predicate; low-to-moderate risk | ~150 days |
| PMA | Class III | Valid scientific evidence | 180 days |
| Breakthrough | Any class | Life-threatening condition + superior outcome | Priority |
AI-based SaMD is subject to all SaMD regulations. FDA evaluates:
FDA published its "Artificial Intelligence/Machine Learning (AI/ML)-Based Software as a Medical Device Action Plan", outlining 5 pillars:
Introduced in FDA Guidance (2023) — allows manufacturers to pre-specify how an AI algorithm can change without requiring a new 510(k).
PCCP must describe:
Critical for adaptive/learning AI systems.
One of the most important distinctions in AI/ML device regulation is whether the algorithm is "locked" or "adaptive" after deployment.
| Type | Definition | Regulatory Treatment |
|---|---|---|
| Locked | Algorithm does not change after deployment | Standard device review — changes require new submission |
| Adaptive | Algorithm continues to learn/change in production | PCCP required; more complex review process |
The locked vs. adaptive distinction has significant implications for product lifecycle management:
The following primary FDA guidance documents govern AI/ML medical device regulation in the United States:
| # | Guidance Document | Date | Key Content |
|---|---|---|---|
| 1 | Proposed Regulatory Framework for AI/ML-Based SaMD | 2019 | Discussion paper; introduced locked vs. adaptive concepts |
| 2 | AI/ML Action Plan | Jan 2021 | 5-pillar roadmap for AI regulation |
| 3 | Good Machine Learning Practice (GMLP) Guiding Principles | Oct 2021 | Joint FDA/Health Canada/MHRA principles |
| 4 | Marketing Submission Recommendations for AI/ML-Based SaMD (Draft) | Apr 2023 | Practical submission guidance; PCCP details |
| 5 | Transparency for Machine Learning-Enabled Medical Devices (Draft) | Oct 2023 | Labeling requirements for AI devices |
| 6 | AI-Enabled Device Software Functions: Lifecycle Management (Draft) | Dec 2023 | Full lifecycle approach for AI devices |
| Year | Milestone |
|---|---|
| 2019 | FDA Discussion Paper on AI/ML SaMD framework — first formal regulatory thinking |
| 2021 (Jan) | AI/ML Action Plan published — 5-pillar framework established |
| 2021 (Oct) | GMLP Guiding Principles released jointly with Health Canada & MHRA |
| 2023 (Apr) | Draft Marketing Submission Recommendations issued — first detailed submission guidance |
| 2023 (Oct) | Draft Transparency Guidance — AI labeling requirements introduced |
| 2023 (Dec) | Lifecycle Management Draft — full product lifecycle approach for AI |
| 2024 | Updated AI Action Plan; CDRH AI Strategic Plan; foundation model guidance in progress |
The 10 GMLP principles were co-developed by FDA, Health Canada, and UK MHRA to establish international standards for AI/ML medical device development.
| # | GMLP Principle |
|---|---|
| 1 | Multi-disciplinary expertise throughout the total product lifecycle |
| 2 | Good software engineering and security practices |
| 3 | Clinical study participants and datasets representative of intended patient population |
| 4 | Training data independence from test sets |
| 5 | Selected reference datasets based on best available methods |
| 6 | Model designed to ensure performance for intended clinical use |
| 7 | Focus on the needs of the patient/caregiver/provider |
| 8 | Enhance explainability to users |
| 9 | Deployed models perform as intended (real-world monitoring) |
| 10 | Risks from AI/ML addressed proportionally throughout device lifecycle |
The GMLP principles represent a landmark in international regulatory harmonization for AI:
This joint publication signals growing international alignment on AI device standards, complementing the EU AI Act and IMDRF SaMD frameworks.
| Documentation Element | Required Detail |
|---|---|
| Algorithm description | Architecture, type (CNN, RNN, transformer, etc.), training methodology |
| Dataset characteristics | Size, demographics, geographic origin, inclusion/exclusion criteria |
| Data management | Preprocessing, augmentation, labeling methodology, inter-rater variability |
| Training/validation/test split | Must be independent; no data leakage between sets |
| Performance metrics | Sensitivity, specificity, AUC, F1-score, PPV, NPV |
| Subgroup analysis | Performance across age, sex, race/ethnicity, relevant clinical subgroups |
| Uncertainty quantification | Confidence scores, failure modes, edge cases |
| Cybersecurity | Per FDA's 2023 cybersecurity guidance (21 CFR Part 820) |
FDA expects manufacturers to monitor AI performance in the real world. Significant performance degradation may trigger a recall or field corrective action.
Mandatory for Class II/III devices under 21 CFR Part 822. AI-specific monitoring includes:
AI failures that cause or contribute to serious injury or death must be reported to FDA:
| Event Type | Reporting Deadline | Regulation |
|---|---|---|
| Death or serious injury from device malfunction | 30 days | 21 CFR Part 803 |
| Urgent safety issue requiring immediate remedial action | 5 days | 21 CFR Part 803 |
| Device malfunctions likely to cause serious injury if recurred | 30 days | 21 CFR Part 803 |
| Monitoring Component | Description | Frequency |
|---|---|---|
| Performance metrics tracking | Sensitivity, specificity, AUC vs. baseline | Continuous/quarterly |
| Input data monitoring | Statistical checks for data drift | Ongoing |
| Demographic subgroup analysis | Performance equity across patient groups | Quarterly/annually |
| Adverse event review | AI-attributed complaints and incidents | Ongoing |
| PCCP compliance | Verify changes stay within approved bounds | Per modification |
| Regulatory Pathway | Share of AI Device Authorizations | Trend |
|---|---|---|
| 510(k) — Premarket Notification | ~85% | Dominant, stable |
| De Novo — Novel Classification | ~10% | Growing rapidly |
| PMA — Premarket Approval | ~5% | Minority, high-risk devices |
| Therapeutic Area | Approximate Share | Notes |
|---|---|---|
| Radiology / Imaging | ~75% | Largest category; CT, MRI, X-ray AI analysis |
| Cardiology | ~8% | ECG analysis, arrhythmia detection |
| Pathology | ~5% | Digital pathology, slide analysis |
| Ophthalmology | ~4% | Retinal screening, diabetic retinopathy |
| Other | ~8% | Neurology, oncology, genomics, etc. |
| Development | Date | Key Impact |
|---|---|---|
| Executive Order on AI | Oct 2023 | Directed HHS/FDA to develop standards for AI in healthcare within 365 days |
| FDA's 2024 AI Action Plan | 2024 | Updated roadmap building on 2021 plan; emphasis on foundation models and generative AI |
| CDRH AI Strategic Plan | 2024 | Committed to 10 actions including bias mitigation, transparency, and GMLP enforcement |
| VALID Act (proposed) | Pending | Legislation for new regulatory framework specifically for AI diagnostics; not yet passed as of early 2025 |
| International harmonization | Ongoing | FDA actively aligning with EU AI Act (risk-based approach) and IMDRF SaMD framework |
| # | Source | URL |
|---|---|---|
| 1 | FDA — AI/ML Action Plan (Jan 2021) | fda.gov/media/145022/download |
| 2 | FDA — Proposed Regulatory Framework for AI/ML SaMD (2019) | fda.gov/media/122535/download |
| 3 | FDA — Marketing Submission Recommendations for AI/ML SaMD (Draft, Apr 2023) | fda.gov/media/166703/download |
| 4 | FDA — Transparency for ML-Enabled Devices (Draft, Oct 2023) | fda.gov/media/173971/download |
| 5 | FDA — Lifecycle Management for AI-Enabled Device Software (Draft, Dec 2023) | fda.gov/media/174185/download |
| 6 | FDA/Health Canada/MHRA — Good Machine Learning Practice (Oct 2021) | fda.gov/…/good-machine-learning-practice… |
| 7 | IMDRF — SaMD: Clinical Evaluation (N41, 2017) | imdrf.org/…/samd-clinical-evaluation |
| 8 | FDA — Digital Health Policy Navigator | fda.gov/…/digital-health-policy-navigator |
| 9 | FDA — Predetermined Change Control Plans for AI/ML SaMD | fda.gov/…/predetermined-change-control-plan… |
| 10 | FDA — 510(k) Premarket Notification Overview | fda.gov/…/premarket-notification-510k |
| 11 | FDA — De Novo Classification Request | fda.gov/…/de-novo-classification-request |
| 12 | FDA — Breakthrough Device Designation | fda.gov/…/breakthrough-therapy |
| 13 | FDA — CDRH AI/ML-Based SaMD (tracker) | fda.gov/…/aiml-enabled-medical-devices |
| 14 | White House — Executive Order on AI (Oct 2023) | whitehouse.gov/…/executive-order-on-ai |
| 15 | FDA — Cybersecurity in Medical Devices (Sept 2023) | fda.gov/…/cybersecurity-medical-devices… |
| 16 | 21 CFR Part 820 — Quality System Regulation | ecfr.gov/…/part-820 |
| 17 | 21 CFR Part 822 — Postmarket Surveillance | ecfr.gov/…/part-822 |
| 18 | FDA — Digital Health Center of Excellence (DHCoE) | fda.gov/…/digital-health-center-excellence |