FDA AI/ML Software as Medical Device Guidance

Applies To

Overview

The US Food and Drug Administration's (FDA's) AI/ML Software as a Medical Device (SaMD) guidance framework addresses a unique challenge. Adaptive AI and machine learning (ML) algorithms can keep learning and change their behavior after they are in use. This sits uneasily with traditional premarket submissions, which review a device once before it goes on sale. The foundational document is the January 2021 'Artificial Intelligence/Machine Learning (AI/ML)-Based Software as a Medical Device (SaMD) Action Plan.' It outlined five strategic areas: tailored regulatory framework, good machine learning practices (GMLP, standards for building and testing models), patient-centered approach, transparency, and real-world performance monitoring. This action plan was preceded by a 2019 discussion paper. FDA finalized its guidance on predetermined change control plans (PCCPs) for AI-enabled devices in December 2024. Draft guidance on life cycle management and marketing submissions for AI-enabled devices followed in January 2025. The total product lifecycle (TPLC) approach requires manufacturers to show that a device performs safely at the time of clearance or approval. They must also show that later changes, particularly updates to the AI model based on real-world data, stay within prespecified and FDA-accepted limits. The PCCP mechanism lets manufacturers describe planned modifications in advance, along with the validation methods (testing) that will govern them. This reduces the need for a new premarket submission for each algorithm update. The framework draws heavily on the International Medical Device Regulators Forum (IMDRF) SaMD framework. It categorizes software by the significance of the information it provides and the healthcare situation or condition it addresses. Enterprises in digital health, medical imaging, clinical decision support, and diagnostics must navigate this framework when developing or commercializing AI/ML-enabled devices intended for U.S. market access. The guidance also aligns with the 21st Century Cures Act's clinical decision support provisions, which carve out certain lower-risk software from device regulation entirely.

Key Requirements

• •Submit a Predetermined Change Control Plan (PCCP) with premarket submissions describing anticipated algorithm modifications, their rationale, and associated validation protocols
• •Adhere to Good Machine Learning Practices (GMLP) encompassing data management, model training, testing, documentation, and bias assessment
• •Implement a Total Product Lifecycle (TPLC) approach with post-market performance monitoring and deviation reporting
• •Ensure transparency to users and patients regarding AI/ML model capabilities, limitations, and intended use
• •Characterize and disclose training and test dataset composition, including demographic representation, to support bias and generalizability evaluation
• •Conduct analytical and clinical validation studies appropriate to the device's IMDRF SaMD risk category
• •Maintain device history records and design history files that include AI/ML-specific documentation such as model cards and performance metrics
• •Report algorithm-related adverse events or deviations through established FDA Medical Device Reporting (MDR) mechanisms
• •Evaluate whether software meets clinical decision support (CDS) carve-out criteria under the 21st Century Cures Act before initiating device regulatory pathway

What Your Organization Must Do

• →Determine whether each AI/ML software product meets the 21st Century Cures Act clinical decision support (software that gives recommendations to clinicians) carve-out criteria before starting any FDA regulatory pathway. Assign this triage responsibility to your regulatory affairs lead and document the analysis in the design history file (the required record of how the device was designed).
• →Prepare and submit a Predetermined Change Control Plan (PCCP) with any premarket submission (510(k), De Novo, or premarket approval (PMA)) for adaptive AI/ML devices. Detail anticipated model modifications, retraining triggers (conditions that prompt updating the model with new data), and validation protocols. This avoids separate submissions for each future algorithm update.
• →Establish a Good Machine Learning Practices (GMLP) program covering data governance, documentation of the data used to train and test the model, demographic representation analysis, and bias assessment. Assign ownership to your quality and data science teams and build the requirements into your existing quality management system.
• →Implement a Total Product Lifecycle monitoring program that tracks how the algorithm performs in real-world use against prespecified thresholds. It should trigger deviation reviews when performance drifts (worsens over time as real-world conditions change). Feed findings into your FDA Medical Device Reporting (MDR) process for algorithm-related adverse events.
• →Build AI/ML-specific documentation, including model cards (summaries of what a model does and its limits) and performance metric summaries, into your design history file and device history records. This meets the expectations of reviewers at FDA's Center for Devices and Radiological Health (CDRH) set out in the April 2023 draft marketing submission guidance.
• →Publish clear transparency disclosures to clinical users covering model intended use, known limitations, what data the model was trained on, and demographic generalizability (how well it works across patient groups). Verify these disclosures align with the IMDRF SaMD risk category assigned to each product.

Playbook Guidance

Step-by-step implementation guidance for compliance teams.

Governance Controls

Operational controls that implement requirements from this regulation.

Frequently Asked Questions

Does the FDA AI/ML SaMD guidance apply to hospital systems that build AI tools internally, not just device manufacturers?

Yes. Hospital systems and integrated delivery networks that develop or acquire AI/ML-enabled clinical tools are considered affected entities under this framework. If the software meets the definition of a medical device, FDA regulatory requirements apply regardless of whether the developer is a traditional manufacturer or a healthcare institution.

What is a Predetermined Change Control Plan and when is it required for an AI/ML device submission?

A PCCP is a document submitted alongside a 510(k), De Novo, or PMA that prespecifies anticipated algorithm modifications, retraining triggers, and associated validation protocols. It allows manufacturers to implement approved future updates without filing a new premarket submission for each change, which is critical for adaptive AI/ML models that learn from real-world data.

How does the 21st Century Cures Act clinical decision support carve-out affect whether my AI software needs FDA clearance?

Certain lower-risk clinical decision support software is excluded from device regulation under the 21st Century Cures Act. Before pursuing any FDA pathway, manufacturers should assess whether their software meets those carve-out criteria. This triage step should be documented in the design history file and led by your regulatory affairs team.

What does the IMDRF SaMD risk categorization framework mean for the level of clinical validation FDA will expect?

The IMDRF framework categorizes SaMD by the significance of information provided and the severity of the healthcare condition it addresses. Higher-risk categories require more rigorous analytical and clinical validation studies. FDA uses this categorization to calibrate its review expectations for premarket submissions involving AI/ML-enabled devices.

What are the post-market monitoring obligations for adaptive AI/ML medical devices under the FDA framework?

Manufacturers must implement a Total Product Lifecycle monitoring program that tracks real-world algorithm performance against prespecified thresholds. When performance drifts beyond accepted parameters, manufacturers must trigger deviation reviews and report algorithm-related adverse events through the FDA Medical Device Reporting process.

What AI/ML-specific documentation does FDA expect in a design history file for a premarket submission?

FDA expects artifacts such as model cards, performance metric summaries, training and test dataset descriptions, demographic representation analyses, and bias assessments. The April 2023 draft marketing submission guidance formalized these expectations, and CDRH reviewers will assess whether this documentation supports the safety and effectiveness claims made in the submission.