FDA AI Medical Device Regulation: A SaMD Compliance Guide for Health Tech Startups

If you are building an AI-powered health product — a diagnostic assistant, a clinical decision support tool, a predictive risk model, a therapeutic recommendation engine — one of the first questions you need to answer is whether your software is a medical device under FDA regulation. Get this wrong, and you face one of two equally serious consequences: you either deploy a regulated medical device without FDA clearance, risking enforcement action and patient safety, or you over-comply with a regulatory pathway you do not actually need, burning runway and delaying launch by months or years.

FDA AI medical device regulation has evolved significantly. The FDA's AI/ML-Based SaMD Action Plan, released in January 2021, laid out a framework for regulating AI/ML software as a medical device. Since then, the agency has finalized its Predetermined Change Control Plan (PCCP) guidance in August 2025, which allows AI/ML models to iterate post-clearance without requiring new marketing submissions for each update. The FDA has also clarified the critical boundary between Clinical Decision Support (CDS) software that is exempt from device regulation and Software as a Medical Device (SaMD) that requires FDA clearance. For health tech founders, understanding this regulatory perimeter is not just a legal compliance exercise — it directly shapes your product roadmap, your clinical validation strategy, and what investors will ask during diligence.

This guide walks through the decision-tree framework we use with health tech clients: when AI in healthcare triggers FDA oversight, how to distinguish exempt CDS from regulated SaMD, what PCCPs mean for iterative AI model updates, how to choose between 510(k), De Novo, and PMA regulatory pathways, and how the current FDA AI/ML framework affects your startup's fundraising timeline. For related reading on health tech compliance, see our guides on telehealth licensure across state lines and AI product liability and insurance gaps.

What Triggers FDA Oversight? The SaMD Definition

The FDA defines a medical device under section 201(h) of the Federal Food, Drug, and Cosmetic (FD&C) Act as any instrument, apparatus, implement, machine, contrivance, implant, in vitro reagent, or other similar or related article that is intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease. Software as a Medical Device (SaMD) is software that meets this definition and is not part of a hardware medical device. The FDA's regulatory oversight is triggered not by the technology you use — whether it is a rules-based algorithm or a deep neural network — but by the intended use of your software.

According to the FDA's device classification framework, medical devices are categorized into three classes based on risk. Class I devices present minimal potential for harm and are subject to general controls. Class II devices present moderate risk and require general and special controls, typically cleared through the 510(k) process. Class III devices sustain or support life, are implanted, or present potential unreasonable risk of illness or injury, and require Premarket Approval (PMA) — the most stringent regulatory pathway. AI/ML software that meets the device definition falls into one of these classes based on its intended use and risk profile.

The key question for health tech founders is: what does your software do? If your AI is intended to diagnose a condition, recommend a treatment, or guide a clinical decision in a way that goes beyond information display, it likely meets the device definition. If it merely organizes information for a healthcare provider to review independently, it may not. The distinction turns on the CDS framework, which we address next.

Clinical Decision Support vs. SaMD: The Critical Line

The 21st Century Cures Act, enacted in December 2016, amended the FD&C Act to exclude certain Clinical Decision Support software from the definition of a medical device. The FDA's final Clinical Decision Support Software guidance, issued in September 2022, provides the framework for determining whether your software qualifies for this exclusion.

Under section 520(o)(1)(E) of the FD&C Act, software functions are excluded from the device definition if they meet all four of the following criteria:

1. The software does not acquire, process, or analyze a medical image or a signal from an in vitro diagnostic or a signal acquisition system. If your AI processes MRI scans, ECG waveforms, or laboratory test results from an automated analyzer, it fails this criterion and is likely a regulated device.
2. The software displays, analyzes, or prints medical information about a patient (or a group of patients) that was previously processed by a healthcare provider. The information must already exist in the medical record or be known to the provider — the software is organizing and presenting it, not generating new diagnostic information.
3. The software provides recommendations (information or options) to a healthcare provider rather than a specific directive or output. This is the most critical and most contested criterion. If your AI provides a single, specific clinical recommendation — "this patient has diabetic retinopathy" or "initiate this medication at this dose" — rather than presenting options for the provider to consider, it fails this criterion. The FDA's CDS FAQ clarifies that software providing "only one clinically appropriate recommendation" does not qualify as Non-Device CDS.
4. The software enables the healthcare provider to independently review the basis for the recommendation. The provider must be able to understand why the software is suggesting what it suggests, without relying solely on the software's output. This means your AI cannot be a black box. If the provider cannot trace the recommendation back to the underlying clinical data and reasoning, the software does not qualify for the CDS exclusion.

If your AI meets all four criteria, it is Non-Device CDS and is not subject to FDA regulation. If it fails any single criterion — particularly criterion 1 (image/signal processing) or criterion 3 (specific directive) — it is likely regulated SaMD and requires FDA clearance before marketing.

The practical implication for AI health tech startups is significant. Many founders assume that because their product "supports" clinical decisions, it qualifies for the CDS exclusion. But if the AI processes medical images, generates a specific diagnosis, or produces an autonomous output that the provider cannot meaningfully override, the CDS exclusion does not apply. The FDA's FAQ is explicit: software that supports "time-critical decision making" does not meet the definition of Non-Device CDS, because in time-sensitive situations, providers cannot independently review the basis for the recommendation.

Predetermined Change Control Plans (PCCPs): Iterating AI Post-Clearance

One of the fundamental tensions in AI/ML medical device regulation is that AI models are designed to learn and improve over time, but FDA clearance is traditionally tied to a specific version of a device. Every material change to a cleared device historically required a new marketing submission — a process that can take months and cost hundreds of thousands of dollars. For AI startups that need to retrain models on new data continuously, this regulatory friction is a business model killer.

The FDA's final PCCP guidance, issued in August 2025, addresses this tension directly. A PCCP is a plan included in your marketing submission that describes the types of modifications you plan to make to your AI-enabled device, the methodology you will use to develop, validate, and implement those modifications, and an assessment of the impact of those modifications. When the FDA reviews and approves your PCCP as part of your 510(k), De Novo, or PMA submission, you can implement the described modifications without filing a new marketing submission for each change.

The PCCP guidance applies to AI-enabled devices reviewed through all three major regulatory pathways: 510(k), De Novo, and PMA. This is significant because it means even moderate-risk AI devices cleared through the 510(k) pathway can benefit from pre-approved model iteration, not just high-risk devices that go through PMA.

For health tech startups, the PCCP framework has three practical implications:

• Plan your model evolution roadmap before submission. The PCCP must describe the specific types of modifications you anticipate — retraining with new data, algorithm parameter adjustments, expansion to new patient populations. You cannot add modifications to your PCCP after clearance without a new submission. This means your regulatory strategy must anticipate your product roadmap months or years in advance.
• Define validation methodology for each modification type. The PCCP must include the methodology you will use to validate that each planned modification maintains the device's safety and effectiveness. This typically involves predefined performance metrics, testing protocols, and acceptance criteria that you commit to before the FDA reviews your plan.
• Modifications outside the PCCP still require new submissions. If you make changes to your AI model that are not described in your approved PCCP — for example, adding a new diagnostic capability or expanding to a new clinical specialty — you must file a new marketing submission. The PCCP is not a blanket authorization to change your device however you want.

Choosing Your Pathway: 510(k) vs. De Novo vs. PMA

Once you determine that your AI software is regulated SaMD, you need to select the appropriate regulatory pathway. The FDA's device classification framework provides the baseline: your pathway depends on your device's risk class and whether a predicate device exists.

510(k): Premarket Notification

The 510(k) pathway is available for Class II devices (and some Class I devices) where you can demonstrate that your device is "substantially equivalent" to a legally marketed predicate device. Substantial equivalence means your device has the same intended use and similar technological characteristics as the predicate, or if the technological characteristics differ, the differences do not raise new safety or effectiveness questions.

For AI/ML SaMD, the 510(k) pathway is viable when a similar AI diagnostic or therapeutic tool has already been cleared. For example, if you are building an AI tool for detecting diabetic retinopathy and a predicate retinal screening algorithm has already received 510(k) clearance, you may be able to leverage that pathway. The 510(k) process is generally faster and less expensive than De Novo or PMA, but it requires finding a suitable predicate — and for novel AI applications, predicates may not exist.

De Novo Classification Request

The De Novo pathway is for novel medical devices of low to moderate risk for which there is no legally marketed predicate. This is often the most appropriate pathway for AI health tech startups building first-of-their-kind diagnostic tools. The De Novo process allows the FDA to classify your device into Class I or Class II, establishing it as a new regulatory category that future 510(k) submissions can use as a predicate.

The landmark example is IDx-DR, the first AI-based autonomous diagnostic device cleared by the FDA. In 2018, the FDA granted De Novo clearance to IDx-DR (DEN180001), an AI system that autonomously detects diabetic retinopathy in retinal images without requiring a physician to interpret the results. Because no predicate device existed for an autonomous AI diagnostic, the De Novo pathway was the only viable route. IDx-DR's clearance established a regulatory precedent that has since enabled other AI diagnostic tools to pursue 510(k) clearance using IDx-DR as a predicate.

For startups, the De Novo pathway is powerful but demanding. You must demonstrate that general controls alone, or general and special controls, provide reasonable assurance of safety and effectiveness. This typically requires robust clinical validation data, and the review timeline is longer than a 510(k) — but the payoff is that your clearance can establish the regulatory category for your entire product space.

PMA: Premarket Approval

The PMA pathway is required for Class III devices — those that sustain or support life, are implanted, or present potential unreasonable risk of illness or injury. PMA is the most stringent premarket submission, requiring valid scientific evidence — typically from clinical trials — demonstrating reasonable assurance of safety and effectiveness. For AI/ML SaMD, PMA is rarely the starting pathway because most software-only diagnostic tools are Class II. However, if your AI software is embedded in an implantable device, makes life-sustaining treatment decisions autonomously, or presents a high risk of patient harm if it fails, PMA may be required.

Clinical Validation Evidence: What FDA Expects

Regardless of which pathway you pursue, the FDA expects clinical validation evidence that demonstrates your AI/ML model performs as intended in the real world. The level of evidence scales with the device's risk class and the novelty of the application.

For a 510(k) submission, clinical validation typically involves a clinical performance study comparing your AI tool's outputs to the predicate device or to a recognized reference standard (such as expert physician interpretation). For De Novo submissions, the evidence bar is higher because you are establishing a new regulatory category — you may need prospective, multi-site clinical studies demonstrating sensitivity, specificity, and clinical utility across diverse patient populations.

Key validation considerations for AI/ML SaMD include:

• Representativeness of training and test data: The FDA will scrutinize whether your training data reflects the patient populations where the device will be used. If your model was trained primarily on data from one demographic or clinical setting, you may face questions about generalizability.
• Performance across subgroups: The FDA expects performance data stratified by relevant subgroups (age, race, sex, comorbidities) to ensure the model does not perform inequitably across populations.
• Failure mode analysis: You need to characterize what happens when the model is wrong — false positives, false negatives, and edge cases — and demonstrate that the clinical consequences of these failures are acceptable.
• PCCP validation: If you include a PCCP, your validation methodology must be defined prospectively, with clear acceptance criteria for when a model update can be deployed without a new submission.

How FDA AI/ML Guidance Affects Your Startup Roadmap and Fundraising

For health tech founders, FDA AI medical device regulation is not a legal checkbox — it is a business planning variable that affects everything from product development timelines to investor diligence. Here is how the current regulatory landscape intersects with startup operations:

Product roadmap alignment. The PCCP framework means you need to plan your AI model's evolution before you submit for FDA clearance. This requires coordination between your engineering, clinical, and regulatory teams well before launch. If your product roadmap includes expanding to new clinical use cases, those expansions may require separate regulatory submissions — budget the time and cost accordingly.

Fundraising diligence. Health tech investors increasingly ask about FDA regulatory strategy during diligence. They want to know: Is your product a medical device or exempt CDS? What pathway are you pursuing? What is your estimated timeline and cost to clearance? Do you have a PCCP strategy for model iteration? A clear, well-reasoned regulatory plan signals operational maturity and reduces investor-perceived risk. Conversely, a founder who cannot articulate whether their AI is SaMD or CDS — or who has not considered the regulatory implications of their model's autonomous outputs — will face harder diligence questions and potentially lower valuations.

Clinical validation costs. The clinical studies required for De Novo or PMA submissions can cost hundreds of thousands to millions of dollars, depending on the number of sites, patients, and endpoints. These costs need to be factored into your fundraising plan. For early-stage startups, a 510(k) pathway with a clear predicate may be strategically preferable if it allows you to reach market faster and at lower cost, even if it limits your initial product claims.

Competitive positioning. FDA clearance is a competitive moat. Once you have cleared a De Novo or 510(k), competitors entering the same space must also navigate the regulatory process. If you are the first to clear a novel AI diagnostic through De Novo, you establish the regulatory category — and the predicate that competitors will need to reference in their own 510(k) submissions. This first-mover regulatory advantage can be as valuable as a patent.

Actionable Next Steps

1. Determine whether your AI is SaMD or exempt CDS. Walk your product through the four CDS exclusion criteria. Does your software process medical images or signals? Does it provide a specific clinical directive or present options? Can the provider independently review the basis for recommendations? If any criterion fails, your software is likely regulated SaMD.
2. Classify your device and identify your pathway. Use the FDA's Product Classification Database to determine your device's risk class. If a predicate exists, 510(k) may be appropriate. If no predicate exists and your device is low-to-moderate risk, plan for De Novo. If your device is high-risk or life-sustaining, prepare for PMA.
3. Develop a PCCP strategy before submission. Map out the modifications you anticipate making to your AI model over the next 18-24 months. Define the validation methodology for each modification type. Include this plan in your marketing submission so you can iterate post-clearance without filing new submissions for each update.
4. Plan your clinical validation study. Identify the reference standard, patient population, study sites, and endpoints you will need. Budget for the cost. For De Novo submissions, plan for prospective multi-site studies. For 510(k), determine what clinical performance data you need to demonstrate substantial equivalence.
5. Build your regulatory timeline into your fundraising plan. FDA clearance timelines vary: 510(k) reviews typically take 90 days (FDA decision), De Novo requests take 150 review days, and PMA reviews can take 180 days or more — but these are FDA review times only, not the total time from project start to clearance. Account for submission preparation, interactive review, and potential additional information requests. Communicate this timeline to investors.
6. Consider the Breakthrough Devices Program. If your AI device provides significant advantages over existing technologies for life-threatening or irreversibly debilitating conditions, you may qualify for the Breakthrough Devices Program, which offers expedited review and interactive engagement with FDA staff.
7. Engage regulatory counsel early. The cost of a pre-submission regulatory strategy assessment is a fraction of the cost of a filing rejection or a product launch delay. If you are building AI-powered health tech, bring counsel into your product development process before you write your first line of clinical validation code — not after you have a product that may or may not be FDA-regulated.

FDA AI medical device regulation is not a barrier to innovation — it is the framework that determines whether your innovation can reach patients safely and legally. The founders who treat regulatory strategy as a core product decision, not a legal afterthought, will reach market faster, raise capital more efficiently, and build competitive moats that last. The ones who skip this analysis will discover, often expensively, that building an AI diagnostic tool without understanding the regulatory perimeter is a mistake that compounds with every model update.