{"id":23038,"date":"2026-05-26T12:27:22","date_gmt":"2026-05-26T12:27:22","guid":{"rendered":"https:\/\/engineerbabu.com\/blog\/?p=23038"},"modified":"2026-05-26T12:27:22","modified_gmt":"2026-05-26T12:27:22","slug":"medical-device-software-fda-regulations","status":"publish","type":"post","link":"https:\/\/engineerbabu.com\/blog\/medical-device-software-fda-regulations\/","title":{"rendered":"Medical Device Software and FDA Regulations in the USA: What Healthcare App Builders Need to Know in 2026"},"content":{"rendered":"<p><span style=\"font-weight: 400;\">A digital health team spent 18 months building an AI diagnostic tool for dermatology, trained on 500,000 images, achieving 94% sensitivity for melanoma detection, beating dermatologist performance in several study metrics.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">They launched to 40 clinical sites, processed 10,000 patient images, and received a warning letter from FDA 6 months later.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">The problem wasn&#8217;t the AI performance. The problem was the regulatory classification. Their tool was making specific diagnostic recommendations that clinicians relied on for treatment decisions. That made it Software as a Medical Device. They had launched without FDA clearance.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Remediation cost them $2.1 million and 14 months. Two of the 40 clinical sites permanently terminated their contracts rather than wait.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Understanding FDA SaMD classification is not an afterthought for AI healthcare product builders. It is the first conversation.<\/span><\/p>\n<h2><b>What Is Software as a Medical Device (SaMD)?<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Software as a Medical Device (SaMD) is software intended to be used for one or more medical purposes that performs these purposes without being part of a hardware medical device.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">The <\/span><a href=\"https:\/\/www.fda.gov\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">FDA<\/span><\/a><span style=\"font-weight: 400;\"> defines SaMD as software that: (1) diagnoses, treats, cures, mitigates, or prevents disease in a patient; (2) provides decision support for clinical decisions that are not independently verified by the clinician before acting on them; or (3) is intended to be used in connection with any other medical device. SaMD requires FDA regulatory oversight, either 510(k) clearance, De Novo classification, or PMA depending on the risk level of the intended use.<\/span><\/p>\n<h2><b>The SaMD Classification Framework<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">The FDA uses a risk-based framework adapted from the International Medical Device Regulators Forum (IMDRF) to classify SaMD. Two dimensions determine classification:<\/span><\/p>\n<h3><b>Dimension 1: State of healthcare situation or condition:<\/b><\/h3>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Critical:<\/b><span style=\"font-weight: 400;\"> The situation is life-threatening or requires immediate action (ICU, acute care, critical care)<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Serious:<\/b><span style=\"font-weight: 400;\"> Decisions are important but not immediately life-threatening (chronic disease management, diagnosing non-critical conditions)<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Non-serious:<\/b><span style=\"font-weight: 400;\"> Decisions have a minor impact on patient management<\/span><\/li>\n<\/ul>\n<h3><b>Dimension 2: Significance of information provided:<\/b><\/h3>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Treat or diagnose:<\/b><span style=\"font-weight: 400;\"> The software directly treats a patient or provides a definitive diagnosis<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Drive clinical management:<\/b><span style=\"font-weight: 400;\"> The software informs clinical decisions that directly affect patient management<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Inform clinical management:<\/b><span style=\"font-weight: 400;\"> The software provides information used as one input among many that a clinician independently verifies<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">The risk category determines the regulatory pathway:<\/span><\/p>\n<table>\n<tbody>\n<tr>\n<td><b>State of Condition<\/b><\/td>\n<td><b>Treat\/Diagnose<\/b><\/td>\n<td><b>Drive Clinical Management<\/b><\/td>\n<td><b>Inform Clinical Management<\/b><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">Critical<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Category IV (PMA)<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Category III (De Novo\/510k)<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Category II (510k)<\/span><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">Serious<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Category III (De Novo\/510k)<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Category II (510k)<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Category I (General Controls only)<\/span><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">Non-serious<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Category II (510k)<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Category I<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Category I<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2><b>The Three FDA Pathways<\/b><\/h2>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>510(k) Clearance:<\/b><span style=\"font-weight: 400;\"> Demonstrates &#8220;substantial equivalence&#8221; to an existing legally marketed predicate device. Timeline: 90\u2013180 days for straightforward software devices. Cost: $50,000\u2013$300,000 in regulatory preparation. The most common pathway for Category II and some Category III software devices.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>De Novo Classification:<\/b><span style=\"font-weight: 400;\"> For novel devices without a predicate. The FDA establishes a new regulatory classification based on the device&#8217;s specific characteristics. Timeline: 12\u201324 months. Cost: $200,000\u2013$800,000. Required when the technology is genuinely new and no predicate exists for 510(k).<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Premarket Approval (PMA):<\/b><span style=\"font-weight: 400;\"> Required for Class III devices (highest risk). Most common for SaMD in oncology diagnosis, life-critical support systems, and novel therapeutic applications. Timeline: 1\u20133 years. Cost: $500,000\u2013$2,000,000+. Requires clinical trials demonstrating safety and effectiveness.<\/span><\/li>\n<\/ul>\n<h2><b>The Non-Device Exceptions: What Doesn&#8217;t Require FDA Clearance<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Not all healthcare software is SaMD. Understanding the exceptions is as important as understanding the regulation.<\/span><\/p>\n<h3><b>The FDA&#8217;s five non-device software functions (21st Century Cures Act):<\/b><\/h3>\n<ol>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Administrative support software:<\/b><span style=\"font-weight: 400;\"> Billing, scheduling, insurance claims, appointment reminders. Not a medical device.<\/span><span style=\"font-weight: 400;\">\n<p><\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>General wellness software:<\/b> <a href=\"https:\/\/engineerbabu.com\/blog\/how-to-create-an-app-like-healthifyme\/\"><span style=\"font-weight: 400;\">Healthy lifestyle apps<\/span><\/a><span style=\"font-weight: 400;\"> tracking diet, exercise, sleep, when not making claims about diagnosing, treating, or preventing disease. Not a medical device.<\/span><span style=\"font-weight: 400;\">\n<p><\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Electronic health records:<\/b><span style=\"font-weight: 400;\"> EHR systems transferring, storing, and displaying patient health information. Not a medical device in most configurations.<\/span><span style=\"font-weight: 400;\">\n<p><\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Decision support software intended for non-serious conditions where clinicians independently verify:<\/b><span style=\"font-weight: 400;\"> If your software provides information a clinician can independently verify before acting, reference information, educational content, general risk calculators and the condition is non-serious, this is not a medical device. This is the exception most builders try to rely on. It has specific conditions.<\/span><b>\n<p><\/b><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Software that facilitates communication and results:<\/b><span style=\"font-weight: 400;\"> Patient portals, lab result displays, appointment notifications. Not medical devices.<\/span><\/li>\n<\/ol>\n<p><b>The critical nuance of exception 4:<\/b><span style=\"font-weight: 400;\"> The FDA published guidance clarifying that &#8220;independent verification&#8221; must be genuine. A clinician reviewing an AI recommendation by looking at the same data the AI used and applying their own clinical judgment is independent verification. A clinician accepting an AI recommendation because they trust the algorithm, without independently analyzing the underlying data, is not. This distinction is difficult to engineer and even harder to demonstrate in an audit.<\/span><\/p>\n<h2><b>The AI\/ML SaMD Challenge in 2026<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Traditional SaMD regulatory frameworks were designed for static software, a device that does the same thing every time, approved as-is. <\/span><a href=\"https:\/\/engineerbabu.com\/technologies\/machine-learning-development-services\"><span style=\"font-weight: 400;\">ML models<\/span><\/a><span style=\"font-weight: 400;\"> are different: they learn from new data, potentially changing their behavior post-clearance.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">FDA published its AI\/ML-Based Software as a Medical Device action plan in 2021 and has been developing a Predetermined Change Control Plan (PCCP) framework that allows AI models to update within pre-approved parameters without re-clearance.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">The current status: FDA accepts PCCPs as part of 510(k) submissions, allowing modest performance improvements and retraining on similar data distributions without requiring a new submission.<\/span><\/p>\n<p><b>The post-market surveillance obligation:<\/b><span style=\"font-weight: 400;\"> Once cleared, AI SaMD is subject to FDA post-market surveillance requirements: adverse event reporting, performance monitoring, and real-world evidence collection. For <\/span><a href=\"https:\/\/engineerbabu.com\/services\/ai-development\"><span style=\"font-weight: 400;\">AI model development<\/span><\/a><span style=\"font-weight: 400;\">, this means maintaining outcome tracking infrastructure, connecting model predictions to patient outcomes, monitoring for performance drift, detecting bias in subpopulations.<\/span><\/p>\n<h2><b>Practical Guidance for Healthcare App Builders<\/b><\/h2>\n<h3><b>Step 1: Perform the SaMD determination before building.<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">Ask: Is this software intended to make a diagnostic or therapeutic claim? Is the clinician expected to act on the recommendation without independent verification? Is the condition critical or serious? If yes to any of these, engage FDA regulatory counsel before your first sprint.<\/span><\/p>\n<h3><b>Step 2: Design toward the non-device exception if you can do so honestly.<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">If your software provides reference information that clinicians independently verify before acting, and the condition is non-serious, design the product and user experience to genuinely support independent verification. Documentation, <\/span><a href=\"https:\/\/engineerbabu.com\/services\/ui-ux-design\"><span style=\"font-weight: 400;\">UI design<\/span><\/a><span style=\"font-weight: 400;\">, and user training all matter. &#8220;The algorithm recommends X&#8221; with a one-click accept is closer to the device side. &#8220;Here are the factors that suggest X, here is the evidence, you decide&#8221; is closer to the non-device side.<\/span><\/p>\n<h3><b>Step 3: If SaMD, engage the FDA Pre-Sub program.<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">FDA&#8217;s Pre-Submission program allows companies to request feedback on their regulatory approach before submitting a formal application. For novel AI devices, a Pre-Sub meeting can save 12\u201324 months by confirming the intended pathway before preparation is complete.<\/span><\/p>\n<h3><b>Step 4: Build audit-ready infrastructure from day one.<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">Clinical validation studies, human factors studies, and post-market surveillance infrastructure are not built in the last sprint before FDA submission. They are built into the product from the beginning. The data you collect during development and early deployment becomes the clinical evidence in your 510(k) submission.<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><b>Author:<\/b><span style=\"font-weight: 400;\"> Mayank Pratap | Co-Founder, EngineerBabu | Google AI Accelerator 2024 \u00b7 CMMI Level 5<\/span><\/p>\n<h2><b>FAQ<\/b><\/h2>\n<ul>\n<li aria-level=\"1\">\n<h3><b>Does my healthcare app need FDA clearance?<\/b><\/h3>\n<\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">Only if it qualifies as Software as a Medical Device. Administrative software, wellness apps, EHRs, and decision support software where clinicians independently verify before acting on non-serious conditions are generally not regulated as medical devices. AI systems making specific diagnostic or treatment recommendations in serious or critical clinical contexts likely require FDA clearance.<\/span><\/p>\n<ul>\n<li aria-level=\"1\">\n<h3><b>What is the difference between 510(k) and De Novo?<\/b><\/h3>\n<\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">510(k) clearance demonstrates substantial equivalence to an existing cleared device (the predicate). De Novo classification is for genuinely novel devices without a predicate, the FDA establishes a new device type. 510(k) is faster when a predicate exists; De Novo is the pathway for true innovation.<\/span><\/p>\n<ul>\n<li aria-level=\"1\">\n<h3><b>How long does FDA clearance take for AI software?<\/b><\/h3>\n<\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">510(k): 90\u2013180 days for straightforward software devices. De Novo: 12\u201324 months. PMA: 1\u20133 years with clinical trials. Pre-Submission program feedback typically takes 60\u201390 days and can significantly de-risk the formal submission timeline.<\/span><\/p>\n<ul>\n<li aria-level=\"1\">\n<h3><b>What is a Predetermined Change Control Plan (PCCP)?<\/b><\/h3>\n<\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">A PCCP defines the parameters within which an AI\/ML model can be updated after clearance without requiring a new FDA submission. It specifies the allowed changes (retraining on additional data within the same distribution, minor performance optimizations), the performance thresholds that trigger re-review, and the post-market monitoring required to detect unintended performance changes.<\/span><\/p>\n<ul>\n<li aria-level=\"1\">\n<h3><b>What happens if I deploy AI clinical software without FDA clearance?<\/b><\/h3>\n<\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">If the software qualifies as SaMD and is deployed without clearance, FDA can issue warning letters, require product recall, impose injunctions, and in cases of intentional violations, pursue criminal charges. Civil penalties can reach $15,000 per violation per day. The reputational impact with health system clients, who typically audit their software vendors for FDA compliance is often more immediately damaging than the regulatory action itself.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>A digital health team spent 18 months building an AI diagnostic tool for dermatology, trained on 500,000 images, achieving 94% sensitivity for melanoma detection, beating dermatologist performance in several study metrics. They launched to 40 clinical sites, processed 10,000 patient images, and received a warning letter from FDA 6 months later. The problem wasn&#8217;t the [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":23039,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1246],"tags":[],"class_list":["post-23038","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-healthtech"],"_links":{"self":[{"href":"https:\/\/engineerbabu.com\/blog\/wp-json\/wp\/v2\/posts\/23038","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/engineerbabu.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/engineerbabu.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/engineerbabu.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/engineerbabu.com\/blog\/wp-json\/wp\/v2\/comments?post=23038"}],"version-history":[{"count":1,"href":"https:\/\/engineerbabu.com\/blog\/wp-json\/wp\/v2\/posts\/23038\/revisions"}],"predecessor-version":[{"id":23040,"href":"https:\/\/engineerbabu.com\/blog\/wp-json\/wp\/v2\/posts\/23038\/revisions\/23040"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/engineerbabu.com\/blog\/wp-json\/wp\/v2\/media\/23039"}],"wp:attachment":[{"href":"https:\/\/engineerbabu.com\/blog\/wp-json\/wp\/v2\/media?parent=23038"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/engineerbabu.com\/blog\/wp-json\/wp\/v2\/categories?post=23038"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/engineerbabu.com\/blog\/wp-json\/wp\/v2\/tags?post=23038"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}