FDA AI/ML Software as Medical Device Guidance

Applies To

Overview

The US Food and Drug Administration's (FDA's) AI/ML Software as a Medical Device (SaMD) guidance framework addresses a unique challenge. Adaptive AI and machine learning (ML) algorithms can keep learning and change their behavior after they are in use. This sits uneasily with traditional premarket submissions, which review a device once before it goes on sale. The foundational document is the January 2021 'Artificial Intelligence/Machine Learning (AI/ML)-Based Software as a Medical Device (SaMD) Action Plan.' It outlined five areas: a tailored regulatory framework, good machine learning practice (GMLP, standards for building and testing models), and a patient-centered approach including transparency. The other two are methods for assessing algorithm bias and robustness, and real-world performance. This action plan was preceded by a 2019 discussion paper. FDA finalized its guidance on predetermined change control plans (PCCPs) for AI-enabled devices in December 2024. Draft guidance on life cycle management and marketing submissions for AI-enabled devices followed in January 2025. The total product lifecycle (TPLC) approach requires manufacturers to show that a device performs safely at the time of clearance or approval. They must also show that later changes, particularly updates to the AI model based on real-world data, stay within prespecified and FDA-accepted limits. The PCCP mechanism lets manufacturers describe planned modifications in advance, along with the validation methods (testing) that will govern them. This reduces the need for a new premarket submission for each algorithm update. The framework draws heavily on the International Medical Device Regulators Forum (IMDRF) SaMD framework. It categorizes software by the significance of the information it provides and the healthcare situation or condition it addresses. Enterprises in digital health, medical imaging, clinical decision support, and diagnostics must navigate this framework when developing or commercializing AI/ML-enabled devices intended for U.S. market access. The guidance also aligns with the 21st Century Cures Act's clinical decision support provisions, which carve out certain lower-risk software from device regulation entirely.

Key Requirements

• •Consider including a Predetermined Change Control Plan (PCCP) in premarket submissions to pre-authorize planned algorithm changes; it is optional
• •Adhere to Good Machine Learning Practices (GMLP) encompassing data management, model training, testing, documentation, and bias assessment
• •Implement a Total Product Lifecycle (TPLC) approach with post-market performance monitoring and deviation reporting
• •Ensure transparency to users and patients regarding AI/ML model capabilities, limitations, and intended use
• •Characterize and disclose training and test dataset composition, including demographic representation, to support bias and generalizability evaluation
• •Conduct analytical and clinical validation studies appropriate to the device's IMDRF SaMD risk category
• •Maintain design history files; FDA's January 2025 draft guidance suggests documents such as model cards, though it is not final
• •Report algorithm-related adverse events or deviations through established FDA Medical Device Reporting (MDR) mechanisms
• •Evaluate whether software meets clinical decision support (CDS) carve-out criteria under the 21st Century Cures Act before initiating device regulatory pathway

What Your Organization Must Do

• →Triage each AI tool against the 21st Century Cures Act clinical decision support carve-out before choosing an FDA pathway.
• →Consider adding a Predetermined Change Control Plan to premarket submissions so pre-authorized model updates avoid new filings.
• →Document training and test dataset composition, including demographic representation, to support bias and generalizability review.
• →Build post-market monitoring that tracks real-world algorithm performance and triggers deviation reviews and Medical Device Reporting.
• →Track FDA's January 2025 draft guidance on life cycle management, treating suggested model cards as draft, not mandatory.
• →Map products to the IMDRF risk categories to scale analytical and clinical validation to expected review depth.

Playbook Guidance

Step-by-step implementation guidance for compliance teams.

Governance Controls

Operational controls that implement requirements from this regulation.

Frequently Asked Questions

Does the FDA AI/ML SaMD guidance apply to hospital systems that build AI tools internally, not just device manufacturers?

Yes. Hospital systems and integrated delivery networks that develop or acquire AI/ML-enabled clinical tools are considered affected entities under this framework. If the software meets the definition of a medical device, FDA regulatory requirements apply regardless of whether the developer is a traditional manufacturer or a healthcare institution.

What is a Predetermined Change Control Plan and when is it required for an AI/ML device submission?

A PCCP is an optional part of a 510(k), De Novo, or PMA submission that describes planned algorithm changes and their validation. Once authorized, those changes need no new submission. FDA finalized its PCCP guidance in December 2024.

How does the 21st Century Cures Act clinical decision support carve-out affect whether my AI software needs FDA clearance?

Certain lower-risk clinical decision support software is excluded from device regulation under the 21st Century Cures Act. Before pursuing any FDA pathway, manufacturers should assess whether their software meets those carve-out criteria. This triage step should be documented in the design history file and led by your regulatory affairs team.

What does the IMDRF SaMD risk categorization framework mean for the level of clinical validation FDA will expect?

The IMDRF framework categorizes SaMD by the significance of information provided and the severity of the healthcare condition it addresses. Higher-risk categories require more rigorous analytical and clinical validation studies. FDA uses this categorization to calibrate its review expectations for premarket submissions involving AI/ML-enabled devices.

What are the post-market monitoring obligations for adaptive AI/ML medical devices under the FDA framework?

Manufacturers must implement a Total Product Lifecycle monitoring program that tracks real-world algorithm performance against prespecified thresholds. When performance drifts beyond accepted parameters, manufacturers must trigger deviation reviews and report algorithm-related adverse events through the FDA Medical Device Reporting process.

What AI/ML-specific documentation does FDA expect in a design history file for a premarket submission?

FDA's January 2025 draft guidance on AI-enabled device software suggests documents such as a model card and descriptions of training and test data. It is still a draft, and the model card is not mandatory.