FDA Clinical AI Rules for Health Systems

Key Takeaways

·Section 520(o)(1)(E) of the Federal Food, Drug, and Cosmetic Act excludes certain decision support software from the definition of a device. FDA reads it as four criteria, and the exclusion is written around recommendations to a health care professional.
·FDA's revised Clinical Decision Support Software guidance, issued January 29, 2026, added enforcement discretion for software that gives a single recommendation where only one option is clinically appropriate, as long as the software meets the other criteria. Enforcement discretion is a policy FDA can change. It doesn't change what the statute defines as a device.
·FDA's public list of AI-enabled medical devices had 1,614 entries when we checked it in September 2026. It doesn't yet identify which devices use large language models.
·On August 18, 2026 FDA published a discussion paper on regulating generative AI-enabled medical devices and asked for comments by October 19, 2026. It has not issued guidance specific to generative AI.
·FDA authorization isn't local validation. In a JAMA Network Open review of 950 FDA-authorized AI devices, 97% came through the 510(k) pathway, and among radiology devices with documentation, 5% reported prospective testing.
·AI devices can change after authorization under a predetermined change control plan. Ask vendors how you'll learn about model updates, and put it in the contract.

The short answer

FDA's requirements fall on the companies that make software, not on the health systems that buy it. What a governance committee needs from FDA's framework is narrower: a clear record of each vendor's stated regulatory position for each tool, an understanding that FDA status says little about how a tool performs on your patients, and a plan for model updates. The legal question of whether a given tool is a device belongs to the vendor's regulatory team and to your counsel.

How FDA Sorts Clinical Software

FDA's own clinical decision support FAQ describes three groups. Its guidances describe "software functions that are excluded from the definition of a device, are functions for which FDA intends to exercise enforcement discretion, or are functions that continue to meet the definition of a device and are the focus of FDA's regulatory oversight."

Excluded from the device definition

Congress wrote this group into the statute in the 21st Century Cures Act. Software that meets the criteria isn't a device, so FDA's device requirements don't apply to it.

A device, under enforcement discretion

The software meets the definition of a device, and FDA has said it doesn't intend to enforce device requirements against it. This is a policy position. FDA can revise it, as it did in January 2026.

A device that is the focus of FDA oversight

The software goes through a marketing pathway such as 510(k), De Novo or premarket approval, and the manufacturer carries ongoing obligations.

The difference between the first two groups matters more than it looks. People often call both "exempt," and they aren't the same thing. FDA also cautions that its clinical decision support guidance "is one of several guidances that can help determine whether or not a software function meets the definition of a device and should not be used as the sole reference."

The Four Criteria, in the Statute's Words

The exclusion is in 21 U.S.C. 360j(o)(1)(E), section 520(o)(1)(E) of the Act. FDA reads it as four criteria. A software function is excluded from the device definition when all four are met.

The function is not "intended to acquire, process, or analyze a medical image or a signal from an in vitro diagnostic device or a pattern or signal from a signal acquisition system."

It is for the purpose of "displaying, analyzing, or printing medical information about a patient or other medical information (such as peer-reviewed clinical studies and clinical practice guidelines)."

It is for the purpose of "supporting or providing recommendations to a health care professional about prevention, diagnosis, or treatment of a disease or condition."

It is for the purpose of "enabling such health care professional to independently review the basis for such recommendations that such software presents so that it is not the intent that such health care professional rely primarily on any of such recommendations to make a clinical diagnosis or treatment decision regarding an individual patient."

Two things in that text are easy to miss. The third and fourth criteria are written around a health care professional. FDA's guidance says software functions that support or provide recommendations to patients or caregivers "meet the definition of a device," and that its "existing digital health policies continue to apply" to them. And the fourth criterion turns on whether the professional can review the basis for a recommendation, which is a harder question for a tool whose reasoning isn't visible. The guidance ties this to a risk governance committees will recognize: "Automation bias is the propensity of humans to over-rely on a suggestion from an automated system." How either point applies to a specific product is a question for counsel.

What Changed in January 2026

FDA's current Clinical Decision Support Software guidance is a final guidance issued on January 29, 2026. Its cover says it supersedes a version issued on January 6, 2026, which had replaced the 2022 guidance. Like all FDA guidance it carries the header "Contains Nonbinding Recommendations," and it is addressed to software developers.

The change most relevant to health systems concerns software that gives one recommendation instead of a list. In FDA's words, "if only one option is clinically appropriate and the software function otherwise meets all criteria under section 520(o)(1)(E), FDA intends to exercise enforcement discretion." Covington & Burling's analysis summarizes it this way: "FDA will now exercise enforcement discretion for CDS tools that provide a singular output where only one recommendation is clinically appropriate, as long as the tool meets the other non-device CDS criteria." Covington adds that "FDA has not changed its interpretation of the statute," and that the guidance doesn't define how to decide when a single recommendation is clinically appropriate.

The guidance itself mentions AI once, listing "AI/ML techniques" as one possible basis for a recommendation. It doesn't discuss large language models or generative AI. Covington reads that silence as a sign that FDA "is still grappling with when and how to regulate AI-enabled tools." For a governance committee, the practical effect is that more decision support tools may reach you without FDA review, which puts more weight on your own evaluation.

Generative AI and Patient-Facing Tools

FDA's public list of AI-enabled medical devices had 1,614 entries when we checked it in September 2026. The list doesn't yet show which devices use large language models. FDA says it "will explore methods to identify and tag medical devices that incorporate foundation models" in a future update.

On August 18, 2026 FDA's Digital Health Center of Excellence published "Considerations for the Regulation of Generative AI-Enabled Medical Devices," a discussion paper with a request for feedback (docket FDA-2026-N-7874, comments due October 19, 2026). A discussion paper isn't guidance. It tells you FDA is working on the question and hasn't settled it.

None of this means generative or patient-facing tools sit outside FDA's authority. Software that meets the definition of a device is subject to FDA's existing device framework whatever technology it uses. Whether a particular documentation assistant, chatbot or symptom checker is a device, is under enforcement discretion, or falls outside FDA's reach is a fact-specific legal question. Ask the vendor for its written regulatory position and have counsel read it.

What FDA Authorization Does and Doesn't Tell You

Most AI-enabled devices reach the market through the 510(k) pathway, in which FDA finds a device substantially equivalent to one already legally marketed. Novel devices without a predicate use De Novo classification, and the highest-risk devices need premarket approval.

A systematic review in JAMA Network Open (November 2025) looked at 950 AI and machine learning devices authorized by FDA. It found that 924 (97%) were cleared through 510(k), 22 went through De Novo and 4 through premarket approval, and that 723 (76%) were radiology devices. Of the 717 radiology devices with submission documentation, 33 (5%) underwent prospective testing, 56 (8%) included a human in the loop, and 208 (29%) incorporated clinical testing. The authors note that the 510(k) pathway "does not require independent clinical data demonstrating performance or safety."

The point for governance is modest. FDA authorization is a regulatory finding about the device. It doesn't tell you how the tool performs on your patients, which is why we recommend local validation whatever a tool's FDA status.

Model Updates and Predetermined Change Control Plans

FDA's final guidance, "Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions," implements section 515C of the Act, which Congress added in December 2022. The current version was issued on August 18, 2025, and the guidance was originally issued on December 4, 2024. A manufacturer describes planned modifications in its marketing submission, and FDA reviews the plan "without necessitating additional marketing submissions for implementing each modification described in the PCCP."

For a health system this means an authorized AI device can change while you are using it. The guidance speaks to manufacturers, and what it says about telling users runs through device labeling. It recommends that labeling explain the device "has an authorized PCCP so that users are aware" that software updates "may modify the device's performance, inputs, or use," and that it include "a description of how users will be informed of implemented modifications, including, for example, updated instructions for use or a version history." Those are recommendations about labeling. They don't promise your organization advance notice of a change. Ask each vendor whether the device has a predetermined change control plan, how and when customers learn about implemented changes, and whether the contract gives you notice before a material model update. Then decide which updates trigger re-validation on your side.

What to Record in Your AI Tool Inventory

A governance committee shouldn't be deciding which statutory criteria a tool satisfies. It should be keeping the facts straight so that counsel and the committee work from the same record.

The vendor's stated regulatory position

FDA-authorized (with the pathway and the authorization number), claimed to be non-device decision support, claimed to be under enforcement discretion, or not addressed. Ask for it in writing, with the vendor's reasoning.

Whether counsel has reviewed that position

Record the date and any open questions. A vendor's claim that its tool is outside FDA oversight is a legal position, and it deserves a second reader.

Who the tool talks to

Note whether outputs go to clinicians, to patients or caregivers, or both. The statutory exclusion is written around health care professionals.

Whether it uses generative AI

FDA hasn't issued guidance specific to these tools, so your own evaluation and monitoring carry more of the load.

How model updates reach you

Whether the device has a predetermined change control plan, what notice the contract gives you, and what triggers re-validation.

Your own validation and monitoring evidence

This belongs in the record whatever the FDA status. FDA clearance, a claimed exclusion and an unanswered question all call for the same local review.

Frequently Asked Questions

Common questions from healthcare leaders trying to understand how FDA oversight applies to the clinical AI tools they buy.

Is the AI built into our EHR regulated by FDA?

It depends on the specific function, and it is a legal question. Some vendors take the position that an embedded tool meets all four statutory criteria and so isn't a device. Others have FDA authorization for particular functions. Ask the vendor for its written regulatory position on each AI feature you use, keep it in your inventory, and have counsel review the ones that matter most clinically.

Does FDA clearance mean a tool has been validated for our patients?

No, and FDA doesn't claim that it does. For 510(k) devices, clearance is a finding that the device is substantially equivalent to one already legally marketed. A November 2025 review in JAMA Network Open found that among FDA-authorized radiology AI devices with documentation, 5% reported prospective testing and 29% reported clinical testing. We recommend local validation whatever a tool's FDA status.

What did the January 2026 guidance change?

The current guidance was issued January 29, 2026. The change most relevant to health systems is that FDA now says it intends to exercise enforcement discretion for decision support software that gives a single recommendation where only one option is clinically appropriate, provided the software otherwise meets all the statutory criteria. According to Covington & Burling's analysis, FDA did not change its reading of the statute, and the guidance doesn't define how to decide when one recommendation is clinically appropriate. Enforcement discretion is a policy position FDA can revise.

Does the decision support exclusion cover tools that talk to patients?

No. The statutory exclusion is written around recommendations to a health care professional, and FDA's guidance says software functions that support or provide recommendations to patients or caregivers meet the definition of a device. FDA's other digital health policies decide how that software is treated. Whether a particular patient-facing tool is an actively regulated device, is under enforcement discretion, or is a general wellness product is a question for counsel.

Are generative AI tools regulated by FDA?

Software that meets the definition of a device is subject to FDA's device framework whatever technology it uses. FDA hasn't issued guidance specific to generative AI. Its public list of AI-enabled devices doesn't yet identify which entries use large language models, and on August 18, 2026 it published a discussion paper asking for public comment by October 19, 2026. Treat the FDA status of any generative tool as a question for the vendor and for counsel, and don't let it stand in for your own review.

What is a predetermined change control plan, and why should we care?

It is a plan, reviewed by FDA as part of a device's marketing submission, that describes modifications the manufacturer intends to make. Changes that follow the authorized plan don't need a new submission. FDA's guidance recommends that device labeling tell users the device has such a plan and describe how they'll be informed of implemented modifications, for example through a version history. For you it means an authorized AI device can change while in use. Ask vendors how customers learn about implemented changes, negotiate notice of material model updates, and decide which updates trigger re-validation.

Sources

Federal Food, Drug, and Cosmetic Act § 520(o)(1)(E), 21 U.S.C. 360j(o)(1)(E), added by the 21st Century Cures Act, Pub. L. 114-255, § 3060(a) (2016).
U.S. Food and Drug Administration. Clinical Decision Support Software, final guidance. Issued January 29, 2026, superseding the version issued January 6, 2026. PDF.
U.S. Food and Drug Administration. Clinical Decision Support Software Frequently Asked Questions. Content current as of June 29, 2026.
U.S. Food and Drug Administration. Artificial Intelligence-Enabled Medical Devices (public list). Content current as of September 4, 2026; 1,614 entries when accessed September 19, 2026.
U.S. Food and Drug Administration. Considerations for the Regulation of Generative AI-Enabled Medical Devices: Discussion Paper and Request for Feedback. August 18, 2026. Docket FDA-2026-N-7874.
U.S. Food and Drug Administration. Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions, final guidance. Issued August 18, 2025; originally issued December 4, 2024. PDF. Implements FD&C Act § 515C, 21 U.S.C. 360e-4.
U.S. Food and Drug Administration. Premarket Notification 510(k). Content current as of August 22, 2024.
Sivakumar R, Lue B, Kundu S. FDA Approval of Artificial Intelligence and Machine Learning Devices in Radiology: A Systematic Review. JAMA Network Open. 2025;8(11):e2542338.
Covington & Burling LLP. 5 Key Takeaways from FDA's Revised Clinical Decision Support (CDS) Software Guidance. January 2026.

What Is the FDA's Current Regulatory Stance on Clinical Decision Support Software and How Does It Affect Our AI Tools?