Executive Summary

The integration of artificial intelligence (AI) and machine learning (ML) into Software as a Medical Device (SaMD) has prompted extensive regulatory evolution. Regulators worldwide, led by the U.S. Food and Drug Administration (FDA), are adapting existing frameworks and issuing new guidance to address the unique challenges of AI/ML SaMD. Key developments include FDA’s 2019 Proposed Regulatory Framework for Modifications to AI/ML-Based SaMD, the 2021 AI/ML SaMD Action Plan, and subsequent guidance on predetermined change control plans (PCCPs) and total product lifecycle management. By early 2026, the FDA had authorized over 1,350 AI-enabled devices (about double the number in 2022) (^[1]), illustrating rapid growth in this sector. Notable guidance documents span topics such as bias/transparency, predetermined change protocols, good ML practices, and postmarket performance monitoring (^[2]) (^[3]).

The regulatory shift emphasizes a total product lifecycle (TPLC) approach: focusing not only on initial clearance but on ongoing algorithm updates, performance monitoring, and quality management. FDA’s final August 2025 guidance on PCCPs formalizes a mechanism allowing pre-authorized algorithm modifications without new submissions (^[4]). Draft 2025 guidance envisions comprehensive recommendations for AI SaMD across design, development, and monitoring (including transparency and bias mitigation) (^[5]) (^[2]). Parallel efforts include international alignment (IMDRF and WHO guidance) and forthcoming U.S. Quality Management System Regulation (QMSR) (effective Feb 2026) harmonizing with ISO 13485 (^[6]).

Case studies illustrate both promise and risk. For example, IDx-DR, an autonomous diabetic retinopathy screening tool (FDA-cleared 2018), achieved ~87% sensitivity and ~89% specificity in 900-patient trials (^[7]), showcasing AI’s potential to expand screening. In contrast, J&J/Acclarent’s TruDi ENT Navigation (AI-enhanced image guidance) has been implicated in multiple malfunctions and patient injuries (100+ adverse reports, ~10 injuries from 2021–2025 (^[8])), highlighting the need for vigilant postmarket monitoring. A review of FDA-cleared stroke-triage AI SaMD shows high performance (e.g., Siemens syngo.CT ICH detector achieved 92.8% sensitivity/94.5% specificity) (^[9]), yet also underscores how real-world usage can surface new failure modes.

In conclusion, compliance with FDA’s AI/ML SaMD guidance requires robust quality systems, thorough premarket documentation (data, algorithms, validation), proactive planning for software changes (via PCCPs), and vigilant postmarket surveillance. The regulatory landscape remains dynamic: final guidances from 2024–2026 will solidify best practices, and manufacturers must align with both FDA requirements and emerging frameworks (e.g. the EU’s new AI Act, MDR). Adhering to these comprehensive standards — from total-lifecycle risk management to diversity-aware design — is essential to ensure AI/ML SaMD remain safe, effective, and equitable as they evolve over time (^[10]) (^[11]).

Introduction and Background

Software as a Medical Device (SaMD) refers to software intended for medical purposes that operates independently of any specific hardware device (^[12]). Examples include diagnostic AI algorithms on general-purpose computers or mobile apps that analyze medical data. The International Medical Device Regulators Forum (IMDRF) defines SaMD as “software intended for medical purposes independent of any hardware” (^[12]), a definition mirrored by FDA policy. Crucially, FDA treats SaMD according to the standard medical device classification (Class I/II/III based on risk) (^[12]). When SaMD incorporates AI or ML techniques (often called AI-SaMD), it brings unique considerations: continuous learning/updating algorithms, complex data dependencies, and potential biases.

AI/ML SaMD is rapidly growing. In 2023 the global SaMD market was valued at ~$1.1 billion (projected to reach $5.4 billion by 2032, ~16% CAGR) (^[13]). Use cases span image analysis, signal processing, data-driven decision support, and predictive analytics. AI/ML enables tasks such as autonomous diabetic retinopathy screening, fracture detection in radiographs, ECG interpretation on smartphones, and large-scale data triage. However, these novel capabilities entail regulatory challenges: an adaptive AI-SaMD may change behavior post-clearance, prompting questions about how to ensure continued safety and effectiveness. Traditional FDA frameworks assume a relatively static device; AI/ML’s iterative nature requires new approaches to oversight.

Emerging from these challenges, FDA has committed to a total-product-lifecycle (TPLC) oversight model for AI/ML SaMD (^[3]) (^[14]). This contrasts with a one-time approval approach by integrating continuous real-world monitoring, planned updates, and patient/user considerations. Key FDA strategies include encouraging predetermined change control plans (PCCPs) that pre-specify allowable algorithm modifications, developing good machine learning practices (GMLP) guidance, and requiring transparency on bias and updates. This report analyzes the FDA’s current and forthcoming guidance on AI/ML SaMD, situates it in the global regulatory context, and offers detailed insights on achieving compliance.

Regulatory Framework and Historical Evolution

SaMD Classification and Regulatory Context

Under U.S. law, a medical device includes any product “intended for use in the diagnosis, cure, mitigation, treatment, or prevention of disease” (^[15]). SaMD meets this definition when it performs medical functions via software. Regulations (21 CFR 807, 820, etc.) apply to software if it is not merely a general health app or administrative tool. FDA categorizes devices by risk: Class I (low risk), II (moderate), or III (high) based on intended use and patient impact (^[12]).For SaMD, FDA relies on a risk categorization analogous to the IMDRF SaMD framework (combining the significance of information and clinical context) (^[16]) (^[17]). For example, software that diagnoses or guides treatment for a critical condition falls under Class II/III. The Quality System Regulation (QSR, 21 CFR 820) requires manufacturers to implement a compliant quality management system (QMS) for design, verification, and validation. Notably, a new Quality Management System Regulation (QMSR) will take effect Feb 2, 2026, aligning FDA requirements with ISO 13485:2016 standards and modernizing QMS practices (^[6]). Compliance with QSR/QMSR (document control, risk management per ISO 14971, etc.) provides the foundation for SaMD quality.

Beyond U.S. borders, global harmonization is evolving. The IMDRF’s 2013 SaMD definitions and guidance (e.g. SaMD: Clinical Evaluation) set international standards. The European Union’s Medical Device Regulation (MDR 2017/745, effective 2021) explicitly covers SaMD and requires CE marking. Under MDR, SaMD presenting a high risk is classified at least Class IIa or higher. Post-Brexit, the UK Medical Device Regulations similarly regulate software. Additionally, new AI-specific laws are emerging: notably the EU’s new AI Act (Regulation 2024/1689) (in force Aug 2024, full effect in 2026) explicitly classifies any AI-enabled medical device as a “high-risk” AI system (^[18]). Thus AI-SaMD must satisfy both MDR (safety/effectiveness per ISO 13485/IEC 62304, clinical evaluation, technical documentation) and AI Act obligations (e.g. detailed data governance, transparency, bias mitigation, human oversight). A recent review notes that under AI Act Annex III, AI used in any CE-marked device is automatically high-risk, requiring comprehensive compliance (^[18]). Similar harmonization is seen in guidance: e.g., the FDA’s 2023 AI/ML glossary adopts definitions aligned with the US AI Initiative and international standards (^[19]). In summary, manufacturers of AI/ML SaMD must navigate a multi-layered regulatory framework, ensuring both device-specific compliance (e.g. premarket clearance) and AI-specific safeguards (rigorous data and algorithm governance).

Evolution of FDA’s AI/ML Guidance

Recognizing AI’s transformative potential, FDA has progressively issued policy documents for AI/ML SaMD. Key milestones include:

• April 2019 – Proposed AI/ML Framework (Discussion Paper): FDA released a discussion paper with proposed principles for AI/ML-based SaMD modifications (^[20]). It distinguished “locked” algorithms (static post-clearance) from continuously learning ones (^[21]) and introduced the concept of SaMD Pre-Specifications (SPS) and an Algorithm Change Protocol (ACP) – the precursors to PCCPs (^[22]). The proposal laid out that device changes could fall into (a) performance improvements, (b) changes in inputs, or (c) intended-use changes, each with different regulatory implications (^[23]). It also outlined four TPLC principles: (1) good ML practices within a QMS, (2) SPS and ACP concept, (3) adaptation rules for when new submissions are needed vs record-keeping, and (4) transparency and real-world performance monitoring (^[24]) (^[25]). Notably, Commissioner Gottlieb endorsed engaging with organizational excellence (pre-certification) and a risk-based TPLC approach (^[26]) (^[27]). This paper formed the basis for stakeholder comments and set the agenda for subsequent guidance development. (^[22]) (^[25])

• January 2021 – FDA AI/ML SaMD Action Plan: Based on the 2019 feedback, FDA published its first comprehensive action plan for AI/ML SaMD (^[3]). It outlined five major actions: (1) Develop the regulatory framework – including issuing draft guidance on predetermined change control plans for software learning over time; (2) Support Good Machine Learning Practices (GMLP) for SaMD; (3) Promote a patient-centered, transparent approach (e.g. clear labeling); (4) Advance methods to evaluate AI/ML algorithms; and (5) Pilot real-world performance monitoring of AI SaMD (^[3]). The Plan explicitly ties these steps to a TPLC oversight model. It emphasized that FDA would “continue to see exciting developments” in AI and must adapt its oversight to ensure safety while encouraging innovation (^[28]) (^[29]). The Action Plan also noted FDA’s existing track record: by Jan 2021 FDA had already authorized over 1,000 AI-enabled devices through standard pathways (^[28]). After the Action Plan, FDA accelerated work on specific guidances (e.g. PCCP guidance, GMLP documents) and piloted collaboration (e.g. the Digital Health Center of Excellence launched Sept 2020 (^[30])).

• 2022 – Final and Draft Guidances: The Food and Drug Omnibus Reform Act (FDORA 2022) gave FDA explicit authority to accept predetermined change plans (PCCPs) for device modifications. In late 2022, FDA released several related documents:

• Guiding Principles for PCCPs (Oct 2023), a joint international (FDA-Canada-MHRA) statement outlining fundamentals of safe preplanned updates (^[31]). Key principles include focusing on risk-based, evidence-based, transparent lifecycle management (^[32]).

• Final guidance on Predetermined Change Control Plans (AI/ML-specific): In January 2023 FDA published a draft guidance on PCCPs for AI/ML device software (later finalized in late 2024) (^[4]). This guidance instructed sponsors how to submit a PCCP in premarket applications – describing planned updates (pre-specifications), the validation/testing of updates (change protocol), and impact assessments to assure ongoing safety. (The final version was released Dec 4, 2024 (^[33]) and retains the same core approach.) Overall, 2022–2023 saw FDA moving from conceptual frameworks toward concrete requirements for AI-SaMD updates and assurance.

• 2023 – AI/ML Glossary and Editorial: In September 2023 FDA issued a Digital Health and Artificial Intelligence Glossary – an educational resource defining AI/ML terms for stakeholders (AIT, ML, continuous learning, etc.) (^[34]) (^[35]). While non-binding, it signals FDA’s intent to harmonize language (e.g. FDA-respects the definition of “AI” per the 2020 U.S. National Security Commission (^[36])).

• January 2025 – Draft TPLC Guidance: On Jan 6, 2025, FDA released a Draft Guidance on Total Product Lifecycle (TPLC) Management of AI/ML SaMD (^[5]). This guidance is unprecedented in scope: it compiles recommendations for safe/effective development and monitoring of AI SaMD throughout the product lifecycle. It calls for, among other things, describing postmarket performance monitoring plans in submissions (^[10]), addressing algorithmic bias/transparency (^[2]), and engaging early with FDA. It also explicitly complements the FDA’s recently finalized Predetermined Change Plan guidance. This ongoing draft (comments due April 2025) embodies FDA’s vision of a holistic AI compliance strategy. The core expectation is that sponsors will integrate design controls, testing, risk management, and real-world surveillance into a continuous development cycle (rather than one-off premarket clearance) (^[5]) (^[10]).

• 2024/2025 – Final Guidance Publication: Building on these drafts, FDA has progressively finalized key guidance. Notably, on Dec 4, 2024, FDA issued the “Marketing Submission Recommendations for a Predetermined Change Control Plan for AI-Enabled Device Software Functions” Guidance (^[33]) (often called the PCCP final guidance). This document formalized how companies can pre-authorize iterative algorithm updates. It applies to AI-enabled device software functions (AI-DSFs) in 510(k), De Novo, and PMA submissions (^[4]). The guidance details required elements of a PCCP (e.g. modification descriptions, frequency, protocols, testing plans, impact assessment) and specifies labeling and documentation changes after updates (^[37]) (^[38]). Significantly, the final PCCP guidance widened its scope: it applies to all AI-enabled devices (not just ML) (^[39]) (^[40]), and it incorporates new definitions of “AI” and “test data” in line with FDA’s own AI Glossary (^[41]) (^[42]). FDA also issued a Public Workshop and webinar (Jan 2025) to explain the PCCP guidance (reflecting FDA’s emphasis on stakeholder engagement).

• Future Directions: As of 2026, draft guidance is in place for total-lifecycle AI SaMD (awaiting finalization) and FDA continues to update policy. For example, FDA is exploring ways to identify devices using foundation AI models (LLMs) and plans to update its publicly available AI-enabled devices list to tag such devices (^[43]). FDA also proposed (Jan 2025) a framework for AI/ML model credibility in drug/biologic applications (distinct from SaMD) (^[44]), reflecting a broader agency focus on AI across product types. Meanwhile, global regulators harmonize efforts: in January 2025, the IMDRF released its final Good Machine Learning Practice (GMLP) Guiding Principles for medical device development (^[45]), building on prior tri-agency standards (FDA/HC/MHRA) (^[46]). These international principles emphasize robust training data, validation, transparency, and equity. Collectively, this history shows the FDA evolving from a “case-by-case” approach to an explicitly AI-focused regulatory regime, issuing authoritative guidance on every stage from development design to post-market monitoring.

Table 1 below summarizes key FDA and international regulatory documents relevant to AI/ML SaMD. These include major guidances, drafts, and laws, with links to source material for each:

Table 1. Key regulatory milestones and guidance for AI/ML-enabled SaMD (programmatic references to source materials are given).

FDA Guidance on AI/ML SaMD: Requirements and Best Practices

This section details FDA’s current recommendations for developing, submitting, and monitoring AI/ML-based SaMD. Because the regulatory landscape is evolving, we highlight both established rules and emerging guidance, with emphasis on compliance steps (secure system quality, performance evidence, change management, etc.).

Premarket Submission and Documentation

Regulatory Pathways. AI/ML SaMD, like other medical devices, must go through FDA review before marketing. Typical pathways include 510(k) clearance, De Novo classification, or Premarket Approval (PMA), depending on risk and novelty. The decision (e.g. requiring 510(k) vs De Novo) follows existing FDA rules on device classification based on intended use and risk (^[12]). For instance, a diagnostic algorithm for cancer screening may be Class II requiring 510(k), whereas a life-supporting autonomous AI (if ever allowed) could be Class III. For De Novo and PMA pathways, more rigorous clinical evidence or bench testing may be required.

Submission Content. FDA expects comprehensive technical documentation for AI/ML SaMD. While no single “AI guidance” exists for all submissions, sponsors should follow general device submission guidelines plus AI-specific elements gleaned from FDA recommendations and best practices. Key expectations include:

• Device Description and Algorithm Details. Clearly describe the software’s intended use, underlying AI/ML algorithm (type of model, inputs/outputs, training method), and software specifications. For example, FDA’s draft lifecycle guidance encourages sponsors to report algorithmic functioning and any “continuous learning” features (algorithms adapt based on new data) (^[5]) (^[37]). Provide versions of the model, including how parameters are set. If the algorithm is adaptive, detail the planned adaptation mechanism (e.g. thresholds, retraining triggers). Under the final PCCP guidance, FDA renamed “Machine Learning Device Software Functions (ML-DSFs)” to AI-Enabled Device Software Functions (AI-DSFs) and introduced new definitions from its AI Glossary (^[41]) (^[39]). These definitions can be cited in submissions to explain AI technology.

• Training and Validation Data. Document data sources used for model development. FDA strongly emphasizes representative and unbiased data. For each dataset (training, tuning/validation, test), specify characteristics (population demographics, collection methods, etc.). The FDA PCCP final guidance explicitly recommends including detailed descriptive statistics (e.g. covariate means/ranges) for each dataset and confirming they reflect the intended use population (^[48]). FDA’s glossary defines test data as independent, withheld data used to establish clinical performance (^[49]). In practice, sponsors should demonstrate that test/validation data come from multiple institutions/populations distinct from training data, covering the diversity of real-world use. Some guidances note inclusion of edge cases (varied ages, disease subtypes, etc.) and procedures to evaluate bias. For instance, FDA’s draft calls for transparency about how bias is evaluated and mitigated (^[2]).

• Performance Evaluation. Provide evidence of safety and effectiveness through analytical and clinical validation. Performance metrics should align with the intended use: e.g. sensitivity, specificity, area under ROC, predictive values. Include confusion matrices if applicable. It is critical to report expected error modes and confidence intervals or error rates. For standalone AI (no human review), primary endpoints might be positive/negative predictions (as with IDx-DR’s two-tier output (^[50])). For clinician-aided AI, focus on improvements in diagnostic speed/accuracy. Detailed results from pivotal studies should be submitted. (By example, IDx-DR’s 900-patient study yielded sensitivity 87.4% and specificity 89.5% (^[7]), data that FDA used to authorize it without a clinician in the loop.) The stroke-triage review [85] shows many FDA-cleared algorithms: e.g. Siemens syngo.CT Brain Hemorrhage achieved 92.8% sensitivity/94.5% specificity (^[9]). These high-performance figures are often included in 510(k) summaries or PMA Summary of Safety and Effectiveness (SSEDs) for transparency. FDA may request details on how performance was measured, including case definitions of positives/negatives (Table 1 shows clear definitions used for stroke) (^[9]).

• Software Verification and Validation. Comply with standard medical software lifecycle processes (e.g. per FDA guidance on software development). Although no FDA guidance is specific to AI/ML, general FDA guidance on software validation and clinical evaluation apply. Sponsors should demonstrate a robust software development process (requirements, design, coding standards, testing) and verifying each code module. Validating the final product involves testing under simulated clinical conditions as well as bench testing. For AI/ML, validation includes showing that the software performs as intended on test datasets (sensitivity/PPV of predictions, vs comparator, etc.). FDA often expects both quantitative analysis and human factors/usability testing. Document safety measures: alarm thresholds, fail-safes, and how users interact with the AI output.

• Quality Management System (QMS). As with all medical devices, AI/ML SaMD manufacturers must have a quality system complying with 21 CFR 820 (QSR) or the emerging QMSR (which will incorporate ISO 13485) (^[6]). The QMS must cover design controls, risk management (including for software risks), and changes management. Specifically, any plan to modify the algorithm post-market (as in a PCCP) should be integrated into the QMS. As the Ropes & Gray alert notes, FDA guidance focuses on marketing submissions and does not fully explain how each algorithm update under a PCCP fits into the QMS design control process (^[51]). Nevertheless, manufacturers should ensure that each update is designed and verified under 820.30 (design controls) so that the device continues to meet its requirements. FDA’s emphasis on “good machine learning practices” inherently ties to quality systems (^[27]): sponsors should treat their algorithm development activities with the same rigor as any medical device design, including audit trails for data, verification of code changes, and traceability matrices.

• Premarket communications with FDA. Given novelty, FDA strongly encourages pre-submission interactions (Q-Sub) to clarify requirements for AI/ML submissions. The PCCP final guidance particularly advises sponsors to use Q-Sub meetings to discuss contentious points (e.g. including changes to intended use in a PCCP) (^[52]) (^[47]). Early dialogue can cover data requirements, PCCP scope, or any unique device features. Companies should prepare detailed questions and device descriptions for these meetings. Failure to engage can lead to misunderstandings and delays.

Good Machine Learning Practices and Bias Control

A core pillar of FDA’s approach is adherence to sound Good Machine Learning Practices (GMLP). While FDA’s own GMLP guidance is part of the international tri-agency and IMDRF effort, regulators have already made clear expectations: every AI/ML device should maintain a high-quality engineering and data process. The FDA draft framework (2019) explicitly states “Every medical device manufacturer is expected to have an established quality system and follow good machine learning practices… to support the development, delivery, and maintenance of high-quality products throughout the lifecycle” (^[27]). This reflects a belief that traditional QSR alone is insufficient; GMLPs extend quality principles into data and algorithm realms.

Key GMLP concepts include: data management (curation, annotation, balancing cohorts, security), model training practices (avoiding overfitting, documenting hyperparameters), validation/test rigor, and documentation/transparency. The IMDRF’s final 2025 GMLP principles (10 total) encourage, among other things, ensuring training data are representative of intended use populations, rigorously testing models on independent datasets, explaining model limitations, and monitoring model performance over time. FDA’s January 2025 news release highlights these GMLPs will help “ensure safe, effective, and high-quality medical devices that use AI/ML (^[45]).” Sponsors should thus treat their ML workflow analogously to any risk control: for example, implement processes for labeling data, segregating validation sets, calculating and reporting clinical validation metrics, and documenting known failure modes.

Bias and Transparency. AI algorithms trained on skewed data can harm certain patient groups. FDA has signaled that addressing bias and ensuring transparency is mandatory. The aforementioned draft TPLC guidance explicitly includes strategies to address “transparency and bias throughout the life cycle” (^[2]). In practice, submissions should include analyses of algorithmic equity: for instance, demonstrating performance across demographic subgroups (race, age, gender) if relevant to intended use (^[11]). The final PCCP guidance even counsels that developers “should consider the intended use populations … so that the device continues to reflect these populations… as the device is modified” (^[11]). This aligns with FDA’s broader 2022-2025 strategic priority on health equity. Transparency also means informing users: FDA expects labeling to clearly state an AI component exists and that updates may change performance (^[38]). Providing summaries of the algorithm’s logic (when possible), and documenting datasets used (or at least their source/nature) helps end-users and regulators evaluate trustworthiness.

Overall, compliance with GMLP means embedding ML best practices into the device’s quality culture. Manufacturers are advised to consult the IMDRF/FDA GMLP guidance documents directly, and to build traceability in their documentation – essentially producing an “ML Design History File” that covers data provenance, model design, validation results, and update processes.

Predetermined Change Control Plans (PCCPs) and Algorithm Updates

A signature feature of the FDA’s AI/ML SaMD strategy is the Predetermined Change Control Plan (PCCP) concept. Under traditional regulations, each significant software change often requires a new submission. PCCPs allow sponsors to pre-define a set of permissible changes and the process for implementing them, so that those changes can occur without separate FDA review each time, provided they adhere to the plan. This flexibility is key for adaptive AI products.

The PCCP guidance (final, Dec 2024) specifies three main sections of a PCCP: (I) Description of Modifications, (II) Device Modification Protocol, and (III) Impact Assessment (^[37]) (^[53]). In the premarket submission (510(k)/De Novo/PMA), the sponsor would include the PCCP document. Highlights from the guidance include:

• Scope of PCCP. The final guidance applies to AI-enabled devices and allows for iterative updates of AI algorithms as described in the plan. Some changes are explicitly excluded: notably, changes that alter the device’s intended use or fundamental claims should generally still trigger a new submission. But FDA has softened previous language: it notes that some indication changes (e.g. supporting a new imaging modality) might be considered in a PCCP if appropriately justified, with FDA engagement. (^[54]) (^[55]). Importantly, FDA clarified that for 510(k) devices, a PCCP can only be authorized via a traditional or abbreviated 510(k), not a Special 510(k) (^[56]).

• Description of Modifications (Section I). Here, the sponsor lists classes of changes the algorithm may undergo (e.g. routine retraining with new data, adding support for a new sensor input). The final guidance requires specifying the expected frequency or conditions of updates (guardrails on how often and how much the algorithm may change) (^[57]) (^[47]). It also introduces the term “continuous learning” to describe automatically implemented updates (^[58]). If updates will be automatic (device updates itself from new data), FDA recommends discussing the approach via a Q-Submission. The Description of Modifications should also detail whether any changes to outputs or performance metrics are anticipated.

• Device Modification Protocol (Section II). This is the methodology for how each update will be carried out. It must cover data management practices (how new data are collected, stored, and used; specification of reference standards for model validation) (^[48]), performance evaluation (testing plans to verify each update meets safety/effectiveness criteria), and update procedures (including how a user is notified of an update or can revert to a previous version if needed). The final guidance adds new items: e.g. it now explicitly asks for a plan outlining how users will be trained or informed about updates (^[59]), how data sets will have descriptive stats provided (^[48]), and how roll-back will occur if an update fails (^[60]). Notably, it requires that devices with Unique Device Identifiers (UDI) generate new UDIs upon version changes (^[61]), ensuring traceability of specific algorithm versions.

• Impact Assessment (Section III). After implementation of an update, the sponsor must assess the effect on safety/effectiveness. This includes demonstrating that the updated algorithm still meets intended use claims. The final FDA guidance added a recommendation that combination products explain how changes to the device component affect the drug/biologic component (^[62]) (for drug-device combos). For stand-alone AI SaMD, this section documents any changes in risk profile or clinical performance post-update. It also ensures accountability: updates should be logged, and deviations from expected outcomes should trigger appropriate action.

The fundamental benefit of a PCCP is that if approved, a sponsor can deploy the described updates without submitting a new 510(k)/PMA each time. In effect, the FDA has pre-reviewed the “envelope” of changes. As one legal analysis notes, PCCPs are intended to reduce regulatory burdens on industry while maintaining safety (^[63]). For compliance, companies must prepare the PCCP thoroughly in the initial submission. This can be a substantial upfront effort, as noted by experts (^[37]). But it streamlines future updates. After any actual update is deployed, the sponsor must amend labeling and public summaries: labeling must explicitly state the device has an authorized PCCP (^[38]), and any Summary of Safety and Effectiveness (or 510(k) summary) should be updated to reflect modifications made. The change to labeling is crucial – users must be aware their device may change over time.

Table 2 below highlights several updates between the draft (Apr 2023) and final PCCP guidance (Dec 2024), illustrating the progression of FDA’s thinking:

Table 2. Comparison of FDA’s 2023 Draft vs. 2024 Final PCCP Guidance (see cited sources for details).

In practice, implementing a PCCP means establishing robust internal processes for deploying updates. The FDA guidance underscores the role of the manufacturer’s Quality Management System: each update must be executed under design controls. The final guidance explicitly notes that compliance with QSR (soon QMSR/ISO 13485) is expected for every change described in a PCCP (^[6]). For compliance, developers must integrate PCCP updates into their QMS documentation (e.g. design history records).

Continuous Learning: The PCCP policy does not currently allow fully unsupervised AI that continuously learns in the field without human oversight. FDA still requires a predetermined protocol; after a modification is implemented, it must be validated before release. The guidance’s nuanced stance on “continuous learning” suggests FDA will not wholly accommodate algorithms that self-update outside a predefined plan (^[68]). Companies aiming for such adaptivity must work closely with FDA and clearly define their continuous learning safeguards (and likely seek new guidance).

Post-Market Performance Monitoring

Given AI models can degrade when deployed (data drift, changed populations), FDA expects ongoing vigilance. The 2021 Action Plan and TPLC guidance both stress real-world performance monitoring. Manufacturers should collect and analyze postmarket data on device performance, risk signals, and user feedback. The draft lifecycle guidance calls for describing postmarket performance monitoring plans in submissions (^[10]): for instance, specifying metrics to track (false positive rate, calibration drift), data sources (registry, electronic health records), and reporting schedules. FDA suggests that real-world data (RWD) be used as a risk mitigation strategy (^[69]). While FDA has not mandated a specific format, sponsors might use methods like periodic reporting, registries, or embedded analytics in the device.

Example pilot programs (e.g. for diabetic retinopathy screening) have illustrated how RWD can catch calibration shifts; these experiences inform FDA’s expectation that monitoring is part of the lifecycle controls. Any adverse trends identified (e.g. increased error rate in a subgroup) should trigger corrective action (model retraining, recall, etc.) as governed by recalls/reporting regulations.

Additionally, AI-specific vigilance includes watching for “model performance drift” and biases. This might involve statistical surveillance of prediction outcomes or patient outcomes over time. While the law (21 CFR 803, 21 CFR 806) requires reporting of device malfunctions and injuries, companies should proactively look for safety signals in routine use.

Finally, FDA encourages transparency: for example, on its AI-Enabled Devices list it plans to tag devices using large language models (LLMs), and it asks manufacturers to disclose in public summaries whether LLMs or similarly sophisticated AI are embedded (^[43]). This forward-looking policy recognizes that future AI-SaMD may leverage generative AI or foundation models, which carry new risks (e.g. hallucinations).

Additional Considerations: Cybersecurity, Privacy, and Labeling

While not unique to AI, robust cybersecurity and data privacy are integral for AI/ML SaMD. The guidance emphasizes secure handling of training and patient data; FDA has separate guidance on cybersecurity for devices (final guidance “Content of Premarket Submissions for Management of Cybersecurity in Medical Devices,” 2014), which applies equally to AI software. Developers must ensure data encryption, access controls, and validated software updates. Privacy protections (HIPAA, informed consent for training data) also affect AI, since many models train on patient images or records. Statistical reporting of performance must not compromise patient confidentiality. Compliance with these aspects (though outside the strict AI guidelines) is mandatory.

Labeling and User Communication: The FDA drafts urge clear labeling of AI functions. As noted, labeling should explicitly state that the device “incorporates machine learning and has an authorized PCCP,” so clinicians know the software may update (^[38]). Device instructions should explain what the AI does, its limitations, and how updates are delivered to end users. Any performance changes (e.g. sensitivity improvement) must be documented in updated instructions or labeling. FDA also contemplates electronic labeling for software updates, though final guidance has not yet resolved how dynamic AI products will reflect changes in labeling without confusing users.

Human Factors and Explainability: FDA has long required human factors engineering for device use safety. For AI/ML SaMD, sponsors should evaluate how users interact with AI outputs. For example, if an AI highlights images or gives a risk score, is the clinician trained to understand it? Usability studies should include scenarios with both correct and spurious AI outputs. Explainability (making AI decisions understandable) is recommended but not mandated by FDA, though transparency guidance suggests documenting algorithm logic to the extent possible.

Lastly, the FDA’s guidance on bias and fairness means companies should consider whether their AI could perpetuate health disparities. This could involve, for instance, augmenting training datasets with underrepresented groups or adjusting model thresholds. The FDA has made health equity a strategic priority; compliance may require demonstrable efforts to prevent AI from adversely affecting vulnerable populations (e.g. by misdiagnosing minorities at a higher rate). Planning this into design and validation is expected for a thorough submission.

Data Analysis and Evidence-Based Insights

Multiple data points underline the trajectory of AI/ML SaMD. By late 2024, the FDA’s AI device list tallied over 1,000 cleared products across specialties (radiology, cardiology, neurology, etc.) (^[28]) (^[1]). Reuters reported on Feb 10, 2026 that the FDA had authorized 1,357 AI-enabled devices, roughly double the count in 2022 (^[1]). This explosive growth—averaging several hundred new AI devices annually—reflects both technological innovation and regulatory accommodation. (For comparison, Fig. 1 of an FDA review shows an exponential curve in cumulative AI device authorizations since 2018).

The types of AI SaMD vary widely. In radiology, thousands of image-analysis tools have been cleared. For example, a recent systematic review of stroke care software (^[70]) lists dozens of cleared products: AI that detects intracranial hemorrhage (ICH), large-vessel occlusion (LVO), subdural hematoma (SDH), etc. These tools boast high performance in FDA evaluations (often >90% sensitivity/specificity (^[70])), and speed up diagnosis (time-to-notification often <1–3 minutes). In cardiology, AI ECG apps for atrial fibrillation and cardiac imaging analysis have also gained clearance. Other areas include pathology (tumor detection), ophthalmology (retinopathy screening, e.g. IDx-DR (^[7])), and even mental health (AI-chatbots are not FDA-regulated as devices yet, but this may change). Across these examples, a consistent theme is reliance on large annotated datasets for training and rigorous clinical validation on held-out sets. For instance, IDx-DR’s pivotal study of 900 patients (^[7]) or Viz.ai’s prospective studies for stroke apps, all meet the evidence standards typical of device approvals. These data underpin the safe integration of AI into care.

Regulatory analysis also shows shifts: a 2020 study of public comments on the 2019 discussion paper found industry generally favored flexible approaches (e.g. supporting PCCPs) (^[71]). By 2024, legal analyses [22, 54] note industry stakeholders succeeded in some flexibility (allowing certain indication changes in PCCPs) but FDA remained cautious on unsupervised continuous learning (^[68]). Importantly, tools and frameworks for monitoring real-world AI performance are emerging. FDA’s Action Plan highlighted pilot programs (e.g. in diabetic retinopathy); similarly, private entities have begun using registries of AI outputs to identify drift. These initiatives provide data affirming that premarket-only validation is insufficient for AI. Therefore, compliance will increasingly rely on evidence from post-market as much as from lab testing.

Qualitative feedback from companies and experts highlights challenges: capturing detailed AI development data, ensuring interpretability, and coordinating multi-disciplinary teams (software engineers, data scientists, clinicians). Attaining FDA compliance now involves both established medical device steps and data science best practices. As one review concluded, governing AI-SaMD “requires novel processes to address the dynamic nature of AI models” and will continue to evolve as best practices mature (^[72]).

Case Studies and Real-World Examples

To illustrate these concepts, consider two real-world AI SaMD examples:

• IDx-DR (Digital Diagnostics): Authorized by FDA in 2018, this tool autonomously detects diabetic retinopathy on retinal fundus images (^[7]). No human reviewer is needed. In its premarket study of 900 patients, it achieved 87.4% sensitivity and 89.5% specificity for “more-than-mild” retinopathy (^[7]). The FDA required clinical validation on a broad population, including diverse retinal images, per its standard review processes. Critically, IDx-DR’s clearance predates extensive AI guidance, yet it exemplifies FDA expectations: clear intended use, analytical validation (algorithms produce only two outcomes), and clinical validation on real patients. Moreover, IDx’s labeling and marketing emphasize it is an autonomous tool, aligning with FDA’s push for transparency. This case shows that even first-generation AI SaMD was able to navigate FDA review successfully when data were robust.

• TruDi Navigation System (Acclarent/Johnson & Johnson): This is an FDA-cleared ENT surgical navigation device, originally a non-AI software. In 2021, J&J announced adding an AI-based visualization “machine learning algorithm” to TruDi (^[73]). However, postmarket surveillance raised concerns: Reuters reports at least 100 reported malfunctions and 10 patient injuries (e.g. surgical errors leading to stroke) after the AI update, in contrast to very few incidents prior (^[8]). Investigations found the AI “misinformed surgeons about instrument location” in some cases (^[8]). Lawsuits allege the AI integration made the device less safe (^[74]). While details remain under review, the FDA has noted these adverse event reports. This case underscores the importance of FDA’s emerging guidance on monitoring and reporting: the AI-equipped device was technically identical in clearance except for a software update, but patient risk changed. Under the new PCCP paradigm, such an update (if pre-approved in a PCCP) would still require rigorous testing. In addition, it highlights FDA’s interest in transparency and labeling: users should be explicitly aware in the device instructions that AI assistance is active and understand potential limitations. The TruDi case serves as a cautionary tale that continued postmarket vigilance (and possibly updated user training) is vital when AI is introduced.

• Stroke-Triage Algorithms: A diverse array of AI SaMD is FDA-cleared for stroke imaging. For example, the Siemens syngo.CT Brain Hemorrhage analyzer (cleared via PMA) automatically detects intracranial hemorrhage on CT scans. It demonstrated 92.8% sensitivity and 94.5% specificity in clinical testing (^[9]). Similarly, Viz.ai’s ContaCT (CTA for blood clot detection) achieved ~87.8%/89.6% (^[9]). These systems exemplify how FDA reviews AI performance metrics and often requires prospective or retrospective clinical data. They are integrated in stroke workflows to speed up diagnosis, aligning with FDA’s stated goal of improving patient care via AI. Stakeholders in these fields have commented that FDA’s expectations for algorithm accuracy are similar to other diagnostic software, but with added scrutiny on updates and bias (e.g. ensuring performance holds for mild strokes or minority populations). Indeed, these tools often come labeled with performance characteristics (as in public 510(k) summaries) to foster transparency.

These case studies, among others, highlight FDA’s balanced stance: it will clear effective AI tools with strong evidence (^[7]) (^[9]), but once on the market it expects continued responsibility. FDA’s AI guidance addresses this balance by allowing iterative improvement (via PCCPs) while requiring controls and user awareness.

Implications and Future Directions

The FDA’s evolving AI/ML SaMD framework carries multiple implications for stakeholders and points toward future developments:

• Lifecycle Focus and Regulatory Adaptability: By conceptually shifting to a TPLC model, FDA acknowledges that software (especially AI) is not static. Manufacturers must adopt agile, quality-centric development cycles: design → validate → deploy → monitor → update. The regulatory system is adapting: the PCCP mechanism codified by FDORA and Final Guidance is a concrete example of flexibility. Still, the requirement for FDA review (even via PCCP) maintains safety oversight. The upcoming QMSR (aligning with ISO 13485) will further embed consistent quality expectations. These changes suggest that in the future, FDA submissions for AI/ML SaMD will routinely include change management plans and monitoring protocols alongside traditional documentation.

• Bias, Equity, and Trust: Recent guidance and announcements stress health equity. The PCCP final guidance explicitly demands that as AI SaMD evolve, they must continue to “reflect” the diversity of intended users (^[11]). In practice, this means requiring evidence that models work well across subgroups. We expect FDA to increasingly scrutinize datasets and performance sliced by demographics. This also ties into patient trust: FDA’s emphasis on clear labeling and summaries (e.g., publicly posting a device’s PCCP plan) aligns with making AI SaMD more understandable to providers and patients. Studies have shown public concern over “black box” AI in healthcare; FDA’s call for transparency aims to mitigate this.

• AI Governance and International Harmonization: FDA’s collaborations (with HC, MHRA, IMDRF) indicate a trend toward global alignment on AI rules. For example, the FDA/HC/MHRA GMLP principles from 2021, and the IMDRF 2025 GMLP final, encourage adoption of unified standards. Similarly, the FDA/International PCCP guidance (Oct 2023) shows consistent thinking. Looking forward, FDA will consider international norms (e.g., AI Act, international standards on AI risk management such as ISO/IEC 22989) when finalizing guidance. Manufacturers planning global distribution must therefore design compliance that satisfies both FDA and regulators abroad.

• Foundation Models and AI Act (LLMs, Multimodal AI): FDA is already planning for an era of advanced AI architectures. Its AI-enabled devices list announcement commits to tagging devices using foundation AI models (e.g. large language models) (^[43]). Given the rise of generative AI in medicine (e.g. GPT-like models for clinical documentation or diagnostic suggestions), FDA will likely issue specific guidance. Already, the draft TPLC guidance asked for comments on “emerging technologies such as generative AI” (^[75]). Thus, future guidance may address unique risks of dynamic or unsupervised learning. The EU’s AI Act (decided in 2024) also anticipates foundation models. AI/ML SaMD manufacturers should invest now in mechanisms to manage these risks and to document their AI development at a granular level (training code, data provenance) in anticipation of stricter oversight.

• Data and Security: AI algorithms often rely on cloud or edge computing and large datasets. Cybersecurity is therefore paramount: an FDA cybersecurity breach could not only compromise data but also degrade model integrity. FDA is expected to reinforce its 2014 cybersecurity guidance and encourage “secure by design” practices (encryption, anomaly detection for tampering, etc.) specific to AI. Also, privacy laws (HIPAA, GDPR) will factor into how training and real-world data can be used. For global devices, compliance with HIPAA in the US and GDPR in the EU is essential, especially when handling patient data for AI.

• Post-market Surveillance and Real-World Evidence: As FDA and other agencies continue to develop clearer expectations for performance monitoring, we will likely see formal requirements or frameworks for post-market studies of AI SaMD. This could take the form of mandated registries, periodic reporting of real-world outcomes, or sliders in software updates. For example, the FDA 2025 draft guidance encourages (but does not yet mandate) performance monitoring plans. Over time, we expect this to evolve into either guidance or regulation. The ultimate goal is a feedback loop: real-world data on device use informing the next FDA submission (if major changes) or internal model refinements.

• Industry Readiness and Q-Sub Emphasis: One challenge is variability in FDA feedback. The PCCP final guidance heavily emphasizes the Q-submission process to resolve ambiguities (^[76]). For manufacturers, this means early and frequent communication with FDA will be part of compliance strategy. However, experts caution that reliance on one-off Q-Subs can lead to inconsistent outcomes across companies. We can expect FDA in the future to codify more issues in formal guidance, reducing ad hoc decision-making. In the meantime, companies should invest in regulatory expertise and educate internal teams on the new expectations (e.g. by training on FDA’s AI guidance and the Digital Health expertise).

• Legislative and Policy Factors: Finally, broader policy shifts may influence AI SaMD regulation. The Ropes & Gray alert notes that changes in U.S. administration priorities (e.g. potential rollback of Federal AI coordination efforts) could impact emphasis on AI safety standards (^[77]). However, it also observes FDA’s direction toward flexibility (e.g. PCCP was originally conceived under Trump, continued under Biden). It is likely that despite political swings, the momentum in medical device innovation will drive sustained regulatory attention. Notably, Congress could enact further laws (e.g. strengthening FDA’s authority to regulate clinical decision support) that intersect with AI SaMD oversight. Internationally, as more countries enact AI laws, harmonizing medical AI regulation will become a priority.

In summary, the future of FDA regulation for AI/ML SaMD will center on adaptive yet accountable oversight. Firms must keep abreast of final guidance (expected from 2025–2026 on lifecycle management), prepare to integrate real-world monitoring, and align internal processes with GMLP and QMSR requirements. The FDA’s guidance trajectory suggests an equilibrium: supporting rapid innovation (via PCCPs, less burdensome processes) while enforcing rigorous engineering and clinical evaluation standards to protect patients.

Conclusion

AI and ML are reshaping medical software, offering unprecedented possibilities for diagnosis, treatment optimization, and workflow efficiency. The FDA has responded by developing a comprehensive suite of regulatory guidance to ensure these technologies are both safe and effective. Key elements for compliance include: establishing a robust quality system incorporating good ML practices (^[27]) (^[45]); preparing detailed premarket submissions (algorithm description, diverse training/testing data, validation performance) as per FDA recommendations; and planning carefully for updates via predetermined change control plans (^[4]) (^[33]). Addressing bias and ensuring equitable performance across populations is paramount, as highlighted by FDA guidance (^[2]) (^[11]). Post-market obligations such as performance monitoring and reporting must also be built in, reflecting the agency’s total-product-lifecycle philosophy.

Regulatory authorities are clearly on a trajectory toward harmonized, lifecycle-based oversight. FDA’s recent steps (action plans, final guidances, and future EU AI Act requirements) emphasize transparency, robustness, and patient safety. For example, the FDA’s rollout of PCCPs – now codified in law – is explicitly described as a means “to reduce regulatory burdens on industry” (^[63]) while keeping rigorous safeguards. This balance will continue to define the AI/ML SaMD landscape. Manufacturers that proactively align with these directives – by engaging early with FDA, rigorously documenting their machine learning processes, and designing in auditability and monitoring – will be best positioned to succeed.

Looking ahead, the regulatory environment will continue evolving. Likely areas of development include finalization of the lifecycle guidance, explicit requirements for real-world evidence use, standards for explainable AI, and integration of generative AI models under medical device regulation. Companies should also watch global regulations (e.g. EU’s mandatory high-risk AI rules) that will affect market entry. Ultimately, compliance is not a one-time task but an ongoing commitment: the safe and effective adoption of AI/ML in healthcare relies on continuous quality assurances throughout the device’s life. By following FDA’s guiding principles and adapting to future guidance, developers can harness AI’s benefits while meeting the highest standards of regulatory compliance and patient protection (^[2]) (^[63]).

References: Authoritative sources (FDA press releases, guidance documents, academic reviews, and industry analyses) underlie all claims in this report. Key citations include FDA announcements and guidances (e.g. AI/ML Action Plan (^[3]), draft and final guidance documents (^[5]) (^[33])), IMDRF guidelines (^[12]) (^[45]), and peer-reviewed analyses of AI SaMD cases (^[7]) (^[8]) (^[9]). All factual statements above are traceable to these sources.