Medical AI · Regulation, ethics & governance · Lesson 2 of 7

US FDA: AI-enabled devices and change-control plans

Reviewed by Dr. Ram Kumar G, MBBS, MD (Internal Medicine), MPH (USA), on 2026-10-18 · Last updated 2026-10-18

Intermediate
Clinical focus
About 30 minutes
Includes exercise

Before this lesson: Software as a Medical Device (SaMD)

In short

In the United States, most AI-enabled medical devices reach the market through the FDA's 510(k) pathway by showing substantial equivalence to an existing device; novel lower-risk devices use De Novo, and the highest-risk ones need premarket approval. Some clinical decision support software is excluded from device regulation if clinicians can independently review the basis of its recommendations. Predetermined change control plans let manufacturers update AI devices within limits approved in advance. As of 2026, the FDA has authorised more than 1,600 AI-enabled devices and is developing its approach to generative AI.

You will learn to

Describe the 510(k), De Novo and PMA pathways and when each applies
Apply the four criteria that exclude some clinical decision support software from device regulation
Explain predetermined change control plans and why they matter for AI
Summarise the FDA's evolving position on generative AI devices

Pathways to market

The FDA's public list of AI-enabled medical devices contained more than 1,600 devices as of September 2026. The large majority were cleared through 510(k), and most are in radiology. The first autonomous AI diagnostic system, for diabetic retinopathy screening in primary care, was authorised through De Novo in 2018.

Because 510(k) relies on equivalence, many AI devices reach the market without prospective clinical trials. That is lawful, but it is one reason local validation matters before adopting a device.

Pathway	Used for	Evidence basis
510(k) clearance	Devices substantially equivalent to a legally marketed 'predicate' device	Comparison with the predicate, usually performance testing
De Novo classification	Novel devices of low to moderate risk with no predicate	Evidence of safety and effectiveness; creates a new device type that others can use as a predicate
Premarket approval (PMA)	Class III, highest-risk devices	Valid scientific evidence, often clinical studies

Clinical decision support that is not a device

The 21st Century Cures Act (2016) excluded some clinical decision support (CDS) software from the definition of a device. The FDA explains its interpretation in guidance, last revised on 6 January 2026; the revision relaxed its earlier concern about software offering a single recommendation, while keeping the emphasis on transparency.

Is this decision support software excluded from device regulation? (simplified)

Does it analyse medical images, signals or patterns (for example ECG waveforms, CT scans)?
- If Yes
  1. Not excluded: likely a device
- If No
  1. Is it for health professionals, and can they independently review the basis of its recommendations?
    If No
    Not excluded: likely a device
    If Yes
    May meet the non-device CDS criteria; check the full guidance

The statute has four criteria: not analysing images or signals; displaying or analysing medical information; supporting a health professional's decision; and allowing independent review of the basis. Simplified for learning.

Changing an AI device: predetermined change control plans

AI models are often retrained or improved. Normally, significant changes to a cleared device need a new submission. A predetermined change control plan (PCCP), described in final FDA guidance issued on 4 December 2024, lets a manufacturer include planned modifications in its original submission.

Changes within an authorised PCCP can be made without a new submission; changes outside it still need one.
The FDA's January 2025 draft guidance on lifecycle management of AI-enabled device software functions sets out broader expectations for submissions, transparency and monitoring. It was still in draft as of mid-2026; check its current status.

PCCP component	What it contains
Description of modifications	The specific changes planned, such as retraining with new data or adjusting thresholds
Modification protocol	How each change will be developed, validated and implemented, with acceptance criteria
Impact assessment	The benefits and risks of the changes and how risks will be controlled

Generative AI and the FDA

The FDA's Digital Health Advisory Committee discussed generative AI-enabled devices at its first meeting in November 2024.
In December 2025 the FDA cleared, through 510(k), a prescription app for insulin management in adults with type 2 diabetes that uses a patient-facing large language model, described as the first such clearance.
In August 2026 the FDA's Digital Health Center of Excellence released a discussion paper on regulating generative-AI-enabled devices for public comment.
General-purpose chatbots that are not intended for medical use are not regulated as devices, but products built on them for medical purposes can be.

Not legal or regulatory advice

This lesson explains regulation for learning purposes, as of October 2026. Rules and guidance change; whether a real product is a medical device, and how it is classified, depends on its intended purpose and needs qualified regulatory advice and the current official texts.

Exercise

Read FDA device records critically and apply the CDS criteria and PCCP concepts.

Data: The FDA's public AI-enabled device list (download) and fictional product descriptions (US government public information; course materials)

Download the FDA AI-enabled device list and count devices by review panel and pathway; how many are in radiology?
Open the decision summaries of two diabetes-related devices and note what evidence supported clearance.
Apply the four CDS criteria to five fictional decision-support tools and explain each conclusion.
Write a short PCCP outline for a fictional retinopathy model that will be retrained yearly on new images.

The runnable notebook and worked solution will be published soon. You can work through the steps with the code on this page in the meantime.

Key takeaways

Most US AI devices are cleared through 510(k) by equivalence, often without prospective trials.
Some clinician-facing decision support is excluded from device rules if its basis can be independently reviewed.
PCCPs let AI devices change within limits authorised in advance.
The FDA's approach to generative AI is developing; the first patient-facing LLM device was cleared in 2025.

Terms used: Intended purpose (intended use), Predetermined change control plan (PCCP), SaMD (Software as a Medical Device)

FAQ

Is FDA clearance the same as FDA approval?

No. Clearance (510(k)) means the device was found substantially equivalent to a predicate. Approval (PMA) is for the highest-risk devices and requires more extensive evidence. De Novo grants marketing authorisation for novel devices.

How many AI devices has the FDA authorised?

More than 1,600 AI-enabled devices were on the FDA's list as of September 2026, most of them in radiology.

What is a predetermined change control plan?

A plan, included in a device's marketing submission, that describes future modifications, how they will be validated and their impact, so that those changes can be made without a new submission.

Is clinical decision support software regulated by the FDA?

Some is and some is not. Software that analyses images or signals, or whose basis clinicians cannot independently review, is generally a device. The FDA's CDS guidance, revised in January 2026, explains the criteria.

Does the FDA regulate ChatGPT-style tools?

Not general-purpose tools without a medical intended use. Products built on such models for medical purposes can be regulated as devices, and the FDA cleared its first patient-facing LLM device in December 2025.

Sources

Educational content only. This material teaches methods; it is not clinical advice. Code, models and examples here are not validated medical devices and must not be used to make decisions about real patients without proper clinical validation, governance and any required regulatory approval. Examples use synthetic or openly licensed de-identified data only. Never paste identifiable patient information into public AI tools. Mentions of models, tools or vendors are for identification, not endorsement.