FDA & AI/ML-enabled devices

The FDA’s regulation of AI/ML-enabled devices is the closest thing to gravity in this field. Whether a product can be sold in the U.S., what claims can be made about it, how it gets updated, and how failures are reported — all of it flows through the same regulatory machinery.

The Agency’s public “list of AI/ML-enabled medical devices” is the most-cited artifact in the space. It crossed 1,000 entries in 2026 and grows by dozens each month. But the count is a lagging indicator; the more useful signal is which pathways manufacturers are actually using and how the Agency’s stance is evolving.

The pathways, in plain terms

Most AI-enabled devices come to market via one of three pathways:

• 510(k) — Premarket Notification. The default. The manufacturer demonstrates substantial equivalence to a legally marketed predicate device. Nearly all imaging-triage, CADe, and quantification tools have taken this route. It is fast (~3–6 months when the submission is clean) but constrains the claim to what the predicate could plausibly do.
• De Novo Classification. For a novel device with low-to-moderate risk that has no valid predicate. Slower and more evidence-intensive than 510(k) but the resulting classification creates a new predicate that later devices can chase. Autonomous diabetic-retinopathy screening (IDx-DR) was a landmark De Novo.
• PMA — Premarket Approval. The high-risk pathway. Rare in AI/ML; used when the device makes a Class III claim that materially drives clinical management.

Some AI-enabled clinical-decision-support (CDS) software is not a device at all, thanks to the 21st Century Cures Act exclusion — provided the physician can independently review the basis for the recommendation. That line has been steadily narrowed by FDA guidance over the last five years.

PCCP: the update problem

The core tension in regulating AI/ML devices is that the “device” is really a model, and models get updated. Under the traditional 510(k) framework a “significant change” required a new submission — which meant vendors either shipped stale models or committed regulatory sleight-of-hand.

The Predetermined Change Control Plan (PCCP), finalized in December 2024 and refined in 2026 guidance, changed that. A manufacturer can now submit, alongside the device, a defined plan describing what post-market model changes they intend to make, how they will validate them, and what performance envelopes will be maintained. The Agency refreshed its PCCP guidance in 2026 — worth reading if you write, buy, or govern any AI-enabled device.

Post-market: MAUDE, MedWatch, RUAIH

Cleared products enter a post-market surveillance regime through:

• MDR reports into the FDA’s MAUDE database.
• MedWatch signals filed by clinicians, patients, and other reporters.
• Institutional safety programs, including the Joint Commission’s Responsible Use of Health AI (RUAIH) certification, which is quickly becoming a de-facto governance standard inside hospitals.

The signal here is starting to sharpen. As deployment volume grows, we expect a small number of high-profile label updates or safety communications — those are healthy, not failures.

What we cover

Our reporting in this topic focuses on: notable 510(k) and De Novo clearances, PCCP-enabled product updates, FDA guidance releases, warning letters and safety communications, and how the Cures Act CDS carve-out is being interpreted in practice. Explore related articles and news below.