Last reviewed: April 27, 2026
Key Takeaways
- The FDA has authorized more than 1,451 AI-enabled medical devices as of December 2025, up from 1,016 a year earlier and 6 in 2015. 2025 was a record year with 295 new authorizations, almost all via the 510(k) pathway. Roughly 76% of AI device authorizations are radiology.
- The most consequential 2024-2025 development is the Predetermined Change Control Plan (PCCP) final guidance for AI-enabled devices (“Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions,” docket FDA-2022-D-2628, finalized December 3, 2024, with implementation guidance issued August 18, 2025). It allows manufacturers to pre-authorize specified future modifications within the original marketing submission — a structural change for adaptive AI that was previously incompatible with FDA’s “locked algorithm” expectation.
- A PCCP must contain three components: a Description of Modifications, a Modification Protocol, and an Impact Assessment. Twenty-six devices had authorized PCCPs as of May 2025.
- The FDA’s framework is the most mature US sector-specific AI regulation. Unlike state laws (Colorado, Texas) and most federal sector regulators (FTC, EEOC), the FDA pre-authorizes AI devices before market entry through a structured submission and review process — closer in mechanism to the EU AI Act’s conformity assessment than to typical US ex post enforcement.
- For dual-jurisdiction medical AI manufacturers, FDA + EU AI Act + EU MDR (Regulation 2017/745) form a three-layer overlay. The EU AI Act’s Annex III Area 2 (medical devices as safety components) imposes risk-management and conformity-assessment duties on top of the existing MDR compliance pathway. A well-built FDA submission can supply most of the EU AI Act technical documentation, but conformity assessment and EU database registration require separate work.
What Is the FDA’s AI Medical Device Framework?
The FDA regulates medical devices under the Federal Food, Drug, and Cosmetic Act (FD&C Act). AI-enabled medical devices are a subset — they enter the same regulatory pathways, but their software-driven, data-dependent, often adaptive nature has produced a parallel set of evolving FDA guidance documents specific to AI/ML.
The framework rests on three statutory and conceptual pillars:
Software as a Medical Device (SaMD). When AI software functions as a medical device on its own (without being part of a hardware device), it is “Software as a Medical Device” — a designation harmonized with the International Medical Device Regulators Forum (IMDRF). Most authorized AI medical devices are SaMD; in the 2025 cohort, approximately 62% were classified as SaMD and 63% as diagnostic.
The traditional submission pathways. AI medical devices use the existing pathways: 510(k) (substantial equivalence to a legally marketed predicate device, ~90% of AI clearances), De Novo (novel devices of low-to-moderate risk that lack a predicate), and PMA / Premarket Approval (high-risk Class III devices requiring clinical evidence; rare for AI).
Predetermined Change Control Plans (PCCPs). Added by FDORA (the Food and Drug Omnibus Reform Act, December 2022) under Section 515C of the FD&C Act, PCCPs are the structural innovation that makes adaptive AI compatible with FDA’s traditional model. The final FDA guidance was published December 3, 2024 with implementation recommendations issued August 18, 2025.
The combination of these three pillars produces a regulatory pathway that pre-authorizes both the device and a defined set of future updates, allowing manufacturers to iterate without filing a new submission for every model change.
How Does the FDA Classify AI Medical Devices?
FDA classification of medical devices uses three risk-based classes, established under Section 513 of the FD&C Act:
| Class | Risk level | Typical pathway | AI examples |
|---|---|---|---|
| Class I | Low risk | 510(k) exempt or 510(k) | Most AI-enabled software with low-impact decision support; e.g., basic image enhancement |
| Class II | Moderate risk | 510(k) | Most AI/ML medical imaging tools, clinical decision support, image analysis algorithms |
| Class III | High risk | PMA | Rare for AI; high-risk diagnostics where false negatives could be life-threatening |
For SaMD specifically, the FDA has historically used the IMDRF risk framework, which combines the “significance of information provided to the healthcare decision” with “state of the healthcare situation/condition” to produce a four-tier risk categorization. Higher-risk SaMD typically requires more rigorous validation evidence in the marketing submission.
Locked vs. Adaptive Algorithms
Until the PCCP framework took shape, FDA expected AI/ML algorithms to be “locked” at the time of marketing authorization — frozen in the configuration cleared by FDA. Any subsequent change required a new 510(k) submission or, at minimum, a determination that the change did not require a new submission under 21 CFR 807.81.
The “locked algorithm” expectation was incompatible with the operational reality of modern ML systems, which improve with retraining on new data. The PCCP framework resolves this tension by allowing manufacturers to pre-authorize a defined set of modifications — algorithm retraining, performance improvements, expansion to new patient populations — within boundaries specified in the original submission.
What Are the Submission Pathways?
510(k) — the dominant AI pathway
The 510(k) (premarket notification) requires the manufacturer to demonstrate substantial equivalence to a legally marketed predicate device that is not subject to PMA. About 90% of AI medical device authorizations have come through this pathway because deep-learning-based imaging tools can typically point to a non-AI predicate (e.g., a manual radiology workflow tool) and demonstrate that the AI achieves equivalent or better performance.
The median 510(k) clearance time for AI software fell below six months in 2025, roughly 25% faster than in 2022. Reviewers have gained experience, and sponsors are providing more structured validation packages.
De Novo — for first-in-class AI
When an AI device has no suitable predicate (which is common for novel applications — e.g., the first AI-driven retinopathy screener), the manufacturer can request De Novo classification. De Novo creates a new regulatory category and produces a predicate for future 510(k) submissions. De Novo authorizations have included many of the most significant first-in-class AI devices.
PMA — rare for AI
PMA applies to Class III high-risk devices and requires substantial clinical evidence. AI medical devices rarely use this pathway because most AI applications are classified as Class II.
Q-Submission — pre-submission engagement
The FDA’s Q-Submission program allows manufacturers to engage with FDA before formally submitting a marketing application. For AI/ML devices and especially for novel architectures or PCCP designs, early Q-Sub engagement is the most efficient way to surface FDA concerns before they cost a full review cycle. Industry guidance consistently recommends Q-Sub for any AI device with a PCCP or any first-in-class AI application.
What Does the 2024-2025 PCCP Guidance Require?
The FDA’s December 3, 2024 final guidance, “Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions” (docket FDA-2022-D-2628, with implementation guidance issued August 18, 2025), is the centerpiece of the modern AI medical device framework.
A PCCP is a documented plan describing what modifications will be made to an AI-enabled device software function (AI-DSF), how those modifications will be assessed, and what their impact is expected to be. If the FDA authorizes the PCCP as part of the marketing submission, the manufacturer can implement modifications described in the plan without filing a new application — provided the implementation follows the authorized plan exactly.
The three required PCCP components
| Component | What it covers | Typical content |
|---|---|---|
| 1. Description of Modifications | Specific, planned changes | Algorithm retraining schedule, dataset additions, performance threshold updates, indication expansions, new device platforms |
| 2. Modification Protocol | How each change will be developed, validated, and implemented | Test datasets, statistical methods, acceptance criteria, validation procedures, version-control workflows |
| 3. Impact Assessment | Risk/benefit analysis of the planned changes | Effect on device safety and effectiveness, residual risks, mitigations, labeling implications, post-market monitoring plan |
Authorization scope
The final guidance applies to AI-DSFs across all three marketing pathways: 510(k), De Novo, and PMA. The earlier September 2024 draft guidance (“Predetermined Change Control Plans for Medical Devices,” docket FDA-2024-D-2338) covers PCCPs for all medical devices (not limited to AI) and remains in draft form as of April 2026.
The legal authority is Section 515C of the FD&C Act, added by FDORA (December 2022). It provides explicit statutory backing for the FDA to authorize pre-defined modifications — closing the gap between FDA’s traditional “locked algorithm” model and the operational reality of adaptive AI.
Adoption status
Twenty-six devices had authorized PCCPs as of May 2025, all through the 510(k) and De Novo pathways. The number is growing as manufacturers learn the format and FDA reviewers gain experience evaluating PCCP-bearing submissions. Industry expectation is that PCCPs will become standard practice for AI medical device submissions over the next 24-36 months.
Practical implications
For manufacturers, the PCCP framework changes how AI submission strategy is built. Three concrete shifts:
One: identify foreseeable modifications at submission time rather than after. Algorithm retraining cadence, dataset expansion, and performance threshold tightening are all candidates for pre-authorization. Submissions that under-specify modifications constrain post-market iteration.
Two: invest in validation infrastructure that can support iterative re-validation. The PCCP requires the manufacturer to demonstrate, before each modification, that the change conforms to the authorized Modification Protocol. Without robust ML-Ops infrastructure, the PCCP turns into a paper plan that the manufacturer cannot operationally execute.
Three: plan the post-market monitoring in detail. The Impact Assessment must address performance degradation in the field — model drift, distribution shifts, real-world data quality issues. This is where many manufacturers under-invest, then face FDA scrutiny when a flagged issue triggers a corrective action.
What Are the Post-Market Requirements?
FDA-authorized medical devices, including AI devices, are subject to ongoing post-market obligations under 21 CFR Part 803 (Medical Device Reporting), 21 CFR Part 806 (Reports of Corrections and Removals), and 21 CFR Part 820 (Quality System Regulation, transitioning to the Quality Management System Regulation aligned with ISO 13485:2016).
For AI specifically, the post-market layer adds:
| Obligation | Source | Practical content |
|---|---|---|
| Adverse event reporting | 21 CFR 803 | Report device-related deaths, serious injuries, and malfunctions to FDA within 30 days (some incidents within 5 days) |
| Field corrective actions | 21 CFR 806 | Report corrections and removals that may pose health risk |
| Real-world performance monitoring | PCCP Impact Assessment + general QMS | Monitor device performance after deployment; detect drift, distribution shifts, performance degradation |
| Model version control | QMS | Track every model version in production; maintain ability to roll back |
| Cybersecurity | FDA cybersecurity guidance (final 2023, AI-specific updates ongoing) | Pre-market and post-market cybersecurity controls; coordinated vulnerability disclosure |
The FDA’s Center for Devices and Radiological Health (CDRH) increasingly expects AI-specific post-market data — disparate-impact analyses across patient subpopulations, model performance benchmarks against the validation dataset, and real-world deployment data — to be available on request.
How Does the FDA’s Framework Compare to the EU AI Act + MDR?
For dual-jurisdiction medical AI manufacturers, the EU regulatory layer is structurally different and additive. The EU AI Act (Regulation 2024/1689) and the EU Medical Device Regulation (MDR, Regulation 2017/745) operate in parallel for medical AI systems.
Three layers in the EU
| Layer | Source | Scope |
|---|---|---|
| MDR | Regulation 2017/745 (in force May 2021) | All medical devices, including software as medical device (SaMD); risk-based classification; CE marking; conformity assessment via notified body |
| EU AI Act — high-risk Annex III Area 2 | Regulation 2024/1689 (in force August 2024) | AI systems that are safety components of medical devices regulated under Annex I (which includes MDR) — adds risk management, technical documentation, human oversight, accuracy/robustness obligations on top of MDR |
| GDPR | Regulation 2016/679 (in force 2018) | Patient data processing, including AI training and inference data |
A medical AI system must satisfy all three layers — not pick one. The EU AI Act explicitly does not displace MDR; it adds a horizontal layer on top of sectoral regulation.
FDA vs EU comparison — the key dimensions
| Dimension | FDA (US) | EU AI Act + MDR |
|---|---|---|
| Regulatory architecture | Single regulator (FDA / CDRH); risk-based class system; iterative through PCCP | MDR (sectoral) + EU AI Act (horizontal) + GDPR (data); multiple regulators (notified bodies, AI Office, national supervisory authorities) |
| Pre-market approval | 510(k), De Novo, or PMA submission; FDA decision before US market | MDR conformity assessment (Class IIa+ via notified body); EU AI Act conformity assessment for high-risk; CE marking before EU market |
| Adaptive AI handling | PCCP — pre-authorized modifications without new submission | Article 9 + Article 43 — risk management iterates; substantial modifications may trigger reassessment |
| Risk classification | Class I/II/III + IMDRF SaMD framework | MDR Class I/IIa/IIb/III (different criteria) + EU AI Act high-risk |
| Validation evidence | Sponsor’s clinical/technical evidence; substantial equivalence (510(k)) or de novo evidence | MDR clinical evaluation + technical documentation; EU AI Act technical documentation Article 11; data governance Article 10 |
| Post-market monitoring | 21 CFR 803, 806; PCCP Impact Assessment | MDR Article 83 PMS; EU AI Act Article 72 PMS; mandatory serious incident reporting under both |
| Database registration | FDA AI/ML-Enabled Device List (transparency) | EU AI Act Article 71 — high-risk AI registered in EU database |
| Penalty ceiling | FDCA enforcement (warning letters, recalls, civil penalties); criminal under 21 USC 333 for willful violations | EU AI Act fines up to EUR 35M or 7% global turnover; MDR national-level penalties |
| Effective dates | PCCP guidance final Dec 2024; FDA cybersecurity guidance final 2023 | EU AI Act high-risk obligations: August 2, 2026 (proposed delay to Dec 2, 2027 via Digital Omnibus, in trilogue April 2026) |
For the broader EU vs US comparison, including the Digital Omnibus trilogue status, see our EU vs US AI Regulation: The Definitive Comparison.
Where the layers overlap (and what compliance work ports)
A well-built FDA submission for an AI medical device produces most of the documentation the EU AI Act requires:
| EU AI Act requirement | FDA equivalent | Coverage % |
|---|---|---|
| Article 9 — risk management system | FDA risk management plan + PCCP Impact Assessment | ~75% |
| Article 10 — data governance | FDA validation dataset documentation | ~70% |
| Article 11 — technical documentation | FDA marketing submission (510(k)/De Novo/PMA) | ~80% |
| Article 14 — human oversight | FDA labeling + intended use statement | ~60% |
| Article 15 — accuracy, robustness | FDA performance validation evidence | ~80% |
| Article 27 — FRIA (fundamental rights) | (no FDA equivalent) | 0% |
| Article 43 — conformity assessment | (no FDA equivalent — FDA review is the analog) | 0% (separate process) |
| Article 71 — EU database registration | FDA AI/ML list (different) | 0% (separate) |
Practical estimate: FDA submission documentation covers ~70% of EU AI Act technical-documentation requirements. The 30% delta is conformity assessment (a process, not a document set), EU database registration, and FRIA. MDR clinical evaluation and PMS overlap heavily with FDA but require separate notified-body engagement.
For the broader US enforcement landscape and how AI medical device liability fits, see our AI liability in the United States overview. For NIST AI Risk Management Framework governance — increasingly expected to bridge FDA and EU AI Act — see our practitioner’s guide.
What Is the Compliance Roadmap for Medical AI Companies?
1. Determine your device classification early. Class II (510(k) pathway) is the realistic target for most AI medical devices. Engage CDRH via Q-Submission before finalizing your validation plan to confirm classification, predicate selection, and PCCP scope. The Q-Sub interaction is free and reduces full-review surprises.
2. Build the PCCP into your submission. For any AI device that will retrain or evolve post-market, identify foreseeable modifications at submission time. Underspecify the PCCP and you constrain future iteration; overspecify and FDA reviewers may push back. The middle path: cover algorithm retraining cadence, dataset additions, performance threshold updates, and indication-expansion candidates.
3. Invest in ML-Ops validation infrastructure. PCCP requires the manufacturer to demonstrate, for every modification, that the change conforms to the authorized Modification Protocol. Without a CI/CD-style validation pipeline, the PCCP becomes a paper plan you cannot operationally execute.
4. Plan post-market monitoring for drift. The Impact Assessment must address model drift, distribution shifts, and real-world data quality. Allocate engineering time and budget for monitoring infrastructure — not just the deployment of the device itself.
5. Implement NIST AI Risk Management Framework governance. While FDA does not name NIST as a safe harbor, the documentation NIST produces (Govern / Map / Measure / Manage) directly supports both FDA submission requirements and EU AI Act technical-documentation requirements. NIST is also Colorado’s affirmative defense if your product is used in Colorado AI Act consequential decisions (some healthcare AI overlaps with Colorado’s healthcare domain).
6. For dual-jurisdiction (US + EU) products, design for the higher floor. Build the FDA submission to also satisfy EU AI Act Article 9 / 10 / 11 / 15 requirements. Plan separate effort for: MDR clinical evaluation (overlaps with FDA but uses notified body); EU AI Act conformity assessment (separate process); FRIA (Article 27); EU database registration (Article 71). Track the Digital Omnibus trilogue — if it passes before the August 2, 2026 deadline, you gain 16 months on the high-risk obligations side.
7. Track the FTC alongside the FDA. AI medical devices that make claims about clinical performance can attract FTC Section 5 scrutiny on top of FDA marketing review. The SEC’s “AI washing” enforcement focus extends to medical AI when companies overstate performance to investors. See our SEC and AI overview for how AI marketing claims become liability surfaces.
Our recommendation. For first-time AI medical device submissions, plan a 12-18 month runway from validation start to FDA clearance. Front-load the PCCP design — its quality determines how much post-market iteration freedom you have. Treat the EU AI Act layer as additive on top of MDR, not a replacement, and start the EU compliance work concurrent with the FDA submission rather than sequentially.
Sources
Official Sources
- FDA Guidance: Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions (final, December 3, 2024 / implementation August 18, 2025), Docket FDA-2022-D-2628: fda.gov
- FDA Draft Guidance: Predetermined Change Control Plans for Medical Devices (general, August 21, 2024 — draft as of April 2026), Docket FDA-2024-D-2338: fda.gov
- FDA Artificial Intelligence-Enabled Medical Devices List: fda.gov
- FD&C Act Section 515C (PCCP authority, added by FDORA, December 2022)
- 21 CFR Part 803 (Medical Device Reporting)
- 21 CFR Part 806 (Reports of Corrections and Removals)
- 21 CFR Part 820 (Quality System Regulation, transitioning to QMSR aligned with ISO 13485:2016)
- EU Medical Device Regulation (MDR), Regulation 2017/745
- EU AI Act, Regulation 2024/1689 (Annex III Area 2 covers medical devices regulated under Annex I)
Analysis & Commentary
- Lexology / McDermott Will & Emery — “FDA Issues Final Guidance on Predetermined Change Control Plans for AI-Enabled Devices” (December 20, 2024): lexology.com
- IntuitionLabs — “FDA PCCP Explained” (February 9, 2026): intuitionlabs.ai
- IntuitionLabs — “FDA’s AI Medical Device List: Stats, Trends & Regulation” (November 10, 2025): intuitionlabs.ai
- MedDeviceGuide — “FDA Predetermined Change Control Plans (PCCPs) for AI/ML Medical Devices: Complete Implementation Guide” (April 17, 2026): meddeviceguide.com
- Healthcare Discovery — “1,000+ FDA AI Device Clearances” (March 30, 2026): healthcarediscovery.ai
Data Sources
- FDA AI/ML-Enabled Devices Tracker — 1,451 cumulative authorizations as of December 30, 2025; 295 new in 2025; 76% radiology
- “How AI is used in FDA-authorized medical devices: a taxonomy across 1,016 authorizations,” PMC (July 2025): PMC12219150
- IMDRF SaMD risk framework
Related Reading
US AI Regulation Series:
- NIST AI Risk Management Framework Explained — the governance baseline that bridges FDA and EU AI Act documentation
- Colorado AI Act 2026: What Developers and Deployers Must Do — state-layer obligations for AI in healthcare
- SEC and AI: What Financial Firms Need to Know — the parallel sectoral regulator framework
- AI Liability in the United States — how FDA-authorized devices fit into the broader liability landscape
- White House AI Framework 2026 — the federal AI policy context
- Illinois AI Employment Law 2026: AIVICA + HB 3773 — disparate-impact standard with private right of action via IHRA
- NYC Local Law 144: AI Bias Audit Guide — first US mandatory bias audit; DCWP enforcement now active
Cross-jurisdiction:
- EU vs US AI Regulation: The Definitive Comparison — how FDA’s framework compares to the EU AI Act + MDR
This article provides general information about AI regulation and does not constitute legal advice. Laws and policies change frequently. Consult qualified legal counsel for compliance decisions specific to your organization. Reg Intel is not a law firm and does not provide legal services.
Last verified: April 27, 2026. The FDA AI/ML Device List is updated quarterly; the PCCP final guidance is in effect; the general PCCP draft guidance for all medical devices remains in draft form. Re-verify current device counts and PCCP-related guidance before relying on the figures in this article.