What Is the FDA's Current Regulatory Stance on Clinical Decision Support Software and How Does It Affect Our AI Tools?

The January 6, 2026 CDS Guidance: What Changed

The FDA issued its revised final Clinical Decision Support guidance on January 6, 2026, superseding the 2022 version. For health systems, the most operationally significant change involves single-output recommendations. Under the 2022 guidance, a CDS tool generally needed to offer multiple recommendation outputs to qualify as a non-device under enforcement discretion. The 2026 revision extends that discretion to single-output recommendations where only one option is clinically appropriate — for example, a tool that recommends dose adjustment for renal failure when that's the only clinically defensible course of action.

The 2026 guidance also removes language around automation bias that appeared in the 2022 version, repositions time-critical decision scenarios, and clarifies the non-device examples that apply to common EHR-embedded tools. The net effect is a modestly more permissive regulatory posture for certain categories of CDS — more tools may qualify for non-device status than under the prior guidance.

One gap the 2026 guidance explicitly does not fill: it is silent on AI. The document doesn't address LLM-based or generative AI systems, and it doesn't address patient-facing AI tools. Those gaps remain open regulatory questions.

The Software as a Medical Device Framework

The FDA's primary regulatory category for clinical AI software is Software as a Medical Device. A tool qualifies as SaMD when it's intended to diagnose, treat, mitigate, cure, or prevent a disease or condition, or to affect the structure or function of the body, and when it functions independently of the hardware it runs on. Most clinical decision support tools that influence specific treatment or diagnostic decisions fall within this definition.

As of early 2026, the FDA has authorized more than 1,250 AI-enabled medical devices. The distribution is heavily concentrated: approximately 97% were cleared through the 510(k) pathway, which evaluates whether a new device is substantially equivalent to a legally marketed predicate device, and around 80% are concentrated in radiology and imaging. That concentration reflects where AI tools reached clinical maturity first, but it also means the regulatory experience base is narrow relative to the breadth of AI tools now entering clinical use.

The 510(k) clearance process doesn't require a clinical trial. It requires demonstrating substantial equivalence to a predicate device — a lower bar than the premarket approval process used for novel high-risk devices. A 2025 JAMA study found that only 28% of cleared radiology AI devices were prospectively validated prior to approval. For health systems using FDA clearance as a governance proxy, this is a significant data point: clearance tells you the FDA determined the device is substantially equivalent to something that existed before, not that it was independently validated for clinical efficacy in diverse settings.

The Clinical Decision Support Exemption: Four Criteria

Not all clinical decision support software is subject to FDA oversight. The 21st Century Cures Act established an exemption for tools that meet four specific statutory criteria. All four must be satisfied for a tool to qualify — and the first criterion is the threshold test most often relevant for imaging AI and laboratory tools.

The practical scope of the exemption matters for health systems because many AI tools embedded in EHR platforms satisfy all four criteria. A tool that surfaces relevant clinical guidelines based on patient data, makes the basis visible, and leaves the treatment decision entirely to the clinician may not require FDA review. The governance implication of the exemption is important: tools that don't undergo FDA review have received no federal assessment of their clinical performance. The oversight burden falls entirely on health systems for these tools — which means they need the same internal governance rigor as cleared devices, even without regulatory documentation to point to.

The PCCP Framework and What It Means for Governance

The Predetermined Change Control Plan framework, finalized by the FDA in December 2024, allows AI vendors to execute pre-approved algorithm modification plans without submitting a new application for each update. It's worth being precise about how the framework actually works, because it's commonly mischaracterized as eliminating FDA oversight.

PCCPs are submitted and reviewed by FDA at the time of initial marketing authorization. The agency reviews and approves the plan upfront, defining a specific modification envelope — the categories and types of updates the vendor is permitted to make without new submissions. When a vendor updates an algorithm within that pre-approved envelope, they're operating within FDA-reviewed boundaries, not acting without oversight. The PCCP framework is oversight with pre-defined parameters, not an absence of oversight.

The governance gap for health systems is real but more narrow than sometimes described. The framework doesn't require vendors to notify deploying organizations about which specific updates they made within the approved envelope. The tool you approved may be running a materially different model than the one you validated, and you won't know unless your contract requires notification. That's the argument for explicit model change notification clauses in AI vendor agreements — not that FDA is absent, but that the FDA framework doesn't include a mechanism to notify the organizations actually deploying the tool.

The FDA's August 2025 guidance on AI-enabled medical devices and the January 2025 draft guidance on AI-Enabled Device Software Functions both elaborate on a Total Product Lifecycle approach: design, validation, monitoring, and post-market surveillance as a continuous process rather than a one-time clearance event. The TPLC guidance is non-binding and not yet finalized, but it signals where federal expectations are moving. Organizations building governance programs that incorporate ongoing monitoring and post-deployment performance review are aligned with that direction, even before it becomes a binding requirement.

How to Apply This to Your AI Tool Inventory

Understanding where each AI tool in your environment falls in the current regulatory framework is a basic governance exercise. For each tool, your AI inventory should document: whether the tool is FDA-cleared as a medical device or subject to the CDS exemption (and which of the four criteria it satisfies), what the vendor's regulatory status claims are and what documentation supports them, what the PCCP status is if cleared, and what local validation and monitoring processes apply given the tool's regulatory category.

The regulatory category affects governance in specific ways. For FDA-cleared tools, clearance documentation and any known safety communications are inputs to your governance review — but they don't replace local validation. For exempt tools, the absence of federal review means your governance committee's assessment of clinical performance and bias risk carries more weight. For generative AI and patient-facing tools, the absence of any applicable regulatory framework means internal governance is effectively the only accountability mechanism that exists.

Frequently Asked Questions

Common questions from health system leaders navigating FDA regulatory requirements for clinical AI tools.