FDA & AI/ML-enabled devices

The FDA’s regulation of AI/ML-enabled devices is the closest thing to gravity in this field. Whether a product can be sold in the U.S., what claims can be made about it, how it gets updated, and how failures are reported — all of it flows through the same regulatory machinery.

The Agency’s public “list of AI/ML-enabled medical devices” is the most-cited artifact in the space. It crossed 1,000 entries in 2026 and grows by dozens each month. But the count is a lagging indicator; the more useful signal is which pathways manufacturers are actually using, how the Agency’s stance on autonomy and change control is evolving, and what the companion rulemaking from HHS and ONC is doing to the operating environment downstream of a clearance.

The pathways, in plain terms

Most AI-enabled devices come to market via one of three pathways:

• 510(k) — Premarket Notification. The default. The manufacturer demonstrates substantial equivalence to a legally marketed predicate device. Nearly all imaging-triage, CADe, and quantification tools have taken this route. It is fast (~3–6 months when the submission is clean) but constrains the claim to what the predicate could plausibly do. 510(k) cannot create a genuinely new intended use; attempting to do so is a common early-stage founder mistake.
• De Novo Classification. For a novel device with low-to-moderate risk that has no valid predicate. Slower and more evidence-intensive than 510(k) but the resulting classification creates a new predicate that later devices can chase. Autonomous diabetic-retinopathy screening (IDx-DR) was a landmark De Novo; the autonomous-colonoscopy De Novo in late 2026 is the latest shift.
• PMA — Premarket Approval. The high-risk pathway. Rare in AI/ML; used when the device makes a Class III claim that materially drives clinical management.

Some AI-enabled clinical-decision-support (CDS) software is not a device at all, thanks to the 21st Century Cures Act exclusion — provided the physician can independently review the basis for the recommendation. That line has been steadily narrowed by FDA guidance over the last five years, and the practical question “is this a device” is now one of the most consequential architecture decisions a vendor makes early.

PCCP: the update problem

The core tension in regulating AI/ML devices is that the “device” is really a model, and models get updated. Under the traditional 510(k) framework a “significant change” required a new submission — which meant vendors either shipped stale models or committed regulatory sleight-of-hand.

The Predetermined Change Control Plan (PCCP), finalized in December 2024 and refined in 2026 guidance, changed that. A manufacturer can now submit, alongside the device, a defined plan describing what post-market model changes they intend to make, how they will validate them, and what performance envelopes will be maintained. The Agency refreshed its PCCP guidance in 2026 — worth reading if you write, buy, or govern any AI-enabled device. In practice PCCPs have become differentiating: enterprise buyers now ask to see a vendor’s PCCP as part of due diligence, and sophisticated vendors wrap their change-management operation around it.

Post-market: MAUDE, MedWatch, RUAIH

Cleared products enter a post-market surveillance regime through:

• MDR reports into the FDA’s MAUDE database.
• MedWatch signals filed by clinicians, patients, and other reporters.
• Institutional safety programs, including the Joint Commission’s Responsible Use of Health AI (RUAIH) certification, which is quickly becoming a de-facto governance standard inside hospitals.

The signal here is starting to sharpen. As deployment volume grows, we expect a small number of high-profile label updates or safety communications — those are healthy, not failures. The real failure mode is a quiet drift that nobody logs because nobody owns the monitoring loop between the vendor and the hospital.

Autonomy, agents, and the next frontier

The 2026 FDA conversation is increasingly about autonomy. The Agency has signaled, through workshops and draft guidance, that fully autonomous AI tools — ones that produce a diagnostic or therapeutic recommendation without a clinician in the immediate loop — face a materially higher evidence bar and a tighter PCCP posture. HHS’s parallel RFI on autonomous AI agents and our deep-dive on autonomous AI agents on the regulatory frontier sketch where this is heading: the current 510(k) framework was never designed for software that takes multi-step actions on behalf of a clinician, and the Agency knows it. Expect more De Novo and more agency-specific guidance before this settles.

Companion rules outside the FDA

A clearance is necessary but no longer sufficient. ONC’s HTI-2 enforcement playbook and the HTI-2 enforcement update place new transparency requirements on predictive decision support regardless of FDA status. CMS reimbursement decisions decide whether a cleared product survives in the field. OIG and DOJ are increasingly interested in the billing-pathway consequences of AI-driven coding. The regulatory story is now a stack, not a single approval.

What we cover

Our reporting in this topic focuses on: notable 510(k) and De Novo clearances, PCCP-enabled product updates, FDA guidance releases, warning letters and safety communications, autonomy and agentic-AI policy, HTI-2 and ONC transparency rules, and how the Cures Act CDS carve-out is being interpreted in practice. Explore related articles and news below.