Skip to content
AI in Healthcare

Article

Clinical decision support in 2026: FDA-regulated vs. Cures-Act-exempt — decoding the line

The 21st Century Cures Act CDS exclusion decides whether clinical software is a device. FDA guidance since 2022 has narrowed that line — and clinical LLMs are the wedge.

By AI in Healthcare Editorial Updated
  • clinical-decision-support
  • CDS
  • FDA
  • 21st-Century-Cures-Act
  • regulation
  • SaMD
  • LLM
  • compliance

The 21st Century Cures Act, signed into law in December 2016, quietly rewrote where the FDA draws the boundary of what counts as a medical device. Section 3060 of the act — the “software provisions” — excludes from FDA device regulation certain categories of clinical software, most importantly a class of clinical decision support (CDS) tools that meet four specific criteria. That exclusion is why most rules-based CDS in commercial EHRs operates outside the device framework, and it is the primary reason clinical LLM vendors in 2026 can ship without a 510(k) for most of what they do.

That line has been narrowing since 2022. FDA guidance updates in 2022, 2024, and 2026 have progressively tightened the interpretation of the exclusion — particularly the “the practitioner can independently review the basis” clause, which is doing more work every year. This piece walks through what the exclusion actually says, how FDA guidance has evolved, what it means for LLM-based CDS in 2026, and how vendors and health systems should be thinking about the line.

What the Cures Act CDS exclusion actually says

Section 520(o)(1)(E) of the Food, Drug, and Cosmetic Act — added by Section 3060 of the Cures Act — excludes from the definition of “device” software functions that meet all four of these criteria:

  1. Not intended to acquire, process, or analyze a medical image or a signal from an in vitro diagnostic device or a pattern or signal from a signal-acquisition system. This exclusion is narrower than it sounds; radiology triage, ECG analysis, and continuous-glucose-monitor pattern recognition are excluded from the exclusion — they remain devices.
  2. Intended for the purpose of displaying, analyzing, or printing medical information about a patient or other medical information (such as clinical guidelines). Displaying context and recommendations to a clinician is in scope for the exclusion.
  3. Intended for the purpose of supporting or providing recommendations to a health care professional about prevention, diagnosis, or treatment of a disease or condition. Clinician-facing, not patient-facing.
  4. Intended for the purpose of enabling such health care professional to independently review the basis for such recommendations so that it is not the intent that such health care professional rely primarily on any of such recommendations to make a clinical diagnosis or treatment decision regarding an individual patient.

Criterion 4 is the linchpin. If the clinician can independently review the basis, the software is out of scope. If the clinician can’t — if the recommendation is a black-box output the clinician is expected to trust — the software is a device and the FDA has jurisdiction.

Sources:

How FDA guidance has narrowed the line since 2022

The 2022 final guidance was the FDA’s first serious attempt to interpret Section 520(o)(1)(E) after the Cures Act was signed. It set four features the FDA looks for to conclude a CDS product meets the “independent review” criterion:

  • Purpose and intended use clearly stated in the labeling.
  • Data inputs the clinician can identify.
  • Rationale for the recommendation presented alongside the recommendation itself.
  • Sources for the underlying evidence or model logic that the clinician can inspect.

If a CDS tool provides all four, the FDA considers it plausible that the clinician can independently review the basis and the exclusion applies. If any of the four is missing — particularly the rationale or the sources — the FDA is more likely to treat the product as a device.

The 2024 update tightened this further in a specific direction relevant to AI/ML: it clarified that recommendations from black-box models — where the “rationale” is a post-hoc explanation generated by the model itself rather than a genuine derivation of the underlying logic — do not meet the criterion. Explanation strings are not the same as an explainable model. This landed a real hit on early LLM-based CDS products that shipped with plausible-sounding rationale strings but no way for a clinician to actually inspect what the model relied on.

The 2026 update — published as draft guidance earlier this year and expected to be finalized before year-end — extends the same reasoning to retrieval-augmented LLM systems: if the model retrieves a set of documents and cites them, the clinician can (in principle) inspect the cited documents, and the FDA has signaled that this pattern is much more likely to meet the exclusion criterion than a bare LLM output. But the guidance also introduces language about “meaningful independent review” that leaves room for the FDA to argue in specific cases that a citation to a 200-page document is not, in practice, review the clinician can meaningfully do in the seconds before a treatment decision.

What this means for clinical LLMs in 2026

The practical impact on LLM-based CDS is now well-defined enough that vendors are architecting around it. Three patterns have emerged.

Pattern 1 — Retrieval-augmented, well-cited, clinician-in-the-loop

Most enterprise clinical LLM products in 2026 are architected explicitly to fit the exclusion. The model is retrieval-augmented against a curated knowledge base (usually a mix of guidelines, formulary, health-system protocols, and evidence sources). Every recommendation is presented with citations to the specific source passages. The clinician-facing UI is designed to let the clinician click through to the cited sources. The system does not act autonomously — the clinician reviews the recommendation and makes the decision.

Products in this pattern typically ship under the Cures Act CDS exclusion, without a 510(k) submission. This is where the vast majority of clinician-facing enterprise clinical LLM deployments in 2026 sit. See the clinical LLMs topic for the broader picture.

Pattern 2 — Explicit device pathway

Products that make specific diagnostic or therapeutic claims — where the recommendation is meant to be actionable without further clinician review, or where the intended use is patient-facing rather than clinician-facing — go through the device pathway. UpDoc’s patient-facing LLM clearance in mid-2026 is the current reference point for what a cleared LLM-as-device looks like: De Novo classification, specific intended-use language, and a bounded set of conditions the model is authorized to address.

For vendors in Pattern 2, the FDA’s PCCP framework is essential — LLM model updates are frequent, and a PCCP is what lets those updates happen without re-submitting.

Pattern 3 — The gray zone that will define 2027

There is a growing middle territory: LLM products that are clinician-facing (so not patient-facing) and non-diagnostic in stated intended use (so not explicitly a device claim), but where the clinician’s practical ability to independently review the basis is genuinely limited. Autonomous chart-analysis agents that summarize dozens of pages of history and surface “recommendations for consideration” fall here. Agentic products that draft prior-authorization letters, ambient scribes that suggest coding, and prescription-refill triage tools that recommend approve/deny fall here.

Some of these products ship under the exclusion; some ship as devices; some are the subject of active FDA-vendor conversations about which side of the line they belong on. The 2026 draft guidance is trying to give FDA reviewers language to argue Pattern 3 products are devices, and vendors are trying to argue they are not. Expect FDA warning letters or safety communications in this space through 2027 to publicly define where the line actually is.

The independent-review question in practice

“Can the clinician independently review the basis?” is not a yes/no question in real deployments. It is a spectrum, and the useful frame for procurement and governance discussions is to ask a set of practical questions:

  • Can the clinician see, in the flow, what data the model used? Not a generic “based on the patient’s chart” — the specific facts, notes, labs, medications, and history the model actually pulled in.
  • Can the clinician inspect the cited evidence? For retrieval-augmented systems, do the cited sources actually contain the claim, and can the clinician click through in seconds, not minutes?
  • Is the rationale a real derivation or a plausible-sounding narrative? LLMs are good at generating post-hoc rationales that sound like reasoning. The 2024 FDA update explicitly called this out.
  • Would a competent clinician, given the outputs and the sources, arrive at a different recommendation any meaningful fraction of the time? If not, the “independent review” is theoretical, not practical.

Vendors that can answer all four questions with a strong “yes” are on solid Cures-Act-exclusion ground. Vendors that can answer only the first two are in the gray zone and should be having active FDA conversations. Vendors that can’t answer the first two are almost certainly a device, whether they have filed for clearance yet or not.

What health systems should be doing

For any health-system CMIO, chief AI officer, or governance-committee chair, the operational implications are:

  1. Inventory your CDS products against the four criteria. Every CDS tool in your environment — rules-based, ML-based, LLM-based — should be classifiable. Products that don’t clearly meet the exclusion should have a documented rationale for why not.
  2. Ask vendors for their FDA-status posture in writing. “We operate under the Cures Act CDS exclusion” is a claim the vendor is making; it belongs in the procurement paper trail.
  3. Test the “independent review” claim empirically. Have a panel of clinicians actually try to review the basis for a set of recommendations. If they can’t, in practice, do it in the time available, that is a real finding.
  4. Plan for products to cross the line. A product that ships under the exclusion in 2026 may need to file for clearance in 2027 as guidance tightens. Your procurement contracts should have language covering that transition.

Where this goes next

Three predictions for the 2026–2027 arc:

  • The 2026 draft guidance will be finalized late 2026 or early 2027. The finalized version is expected to explicitly address retrieval-augmented LLM CDS and agentic clinical assistants — the two categories the current draft is aimed at.
  • Warning letters or safety communications on Pattern 3 products. The FDA will publicly stake out the line by acting against specific products it believes have misclassified themselves. Expect one or two high-profile cases through 2027.
  • Vendor architecture converges on retrieval-augmented, citation-heavy patterns. The path of least regulatory resistance is Pattern 1, and vendors that can be there will be. Vendors making stronger diagnostic claims — the ones filing De Novo submissions like UpDoc — are the exception, not the rule.

The Cures Act CDS exclusion is one of the most important lines in AI-in-healthcare regulation, and it is being redrawn in real time. Vendors and health systems that treat it as a stable feature of the landscape are going to be surprised. Vendors and health systems that treat it as an evolving boundary — and architect their products, their governance, and their procurement accordingly — are the ones that will still be shipping in 2027.