AI Medical Devices: FDA Rules for Monitoring and Diagnostics

AI medical devices are products, often software, that use artificial intelligence to help diagnose, monitor or treat patients. In the United States, the FDA doesn't regulate AI as such: it regulates the device, so AI software meant for diagnosis or monitoring generally needs clearance or approval through the 510(k), De Novo or PMA pathway before it's marketed.

This guide is for hospital executives, CMIOs, biomedical engineering and IT leaders deciding which AI monitoring and diagnostic tools to bring in, and how to do it safely.

Key takeaways

• The FDA says it "does not regulate AI as such"; it regulates medical devices, and the legal definition of a device includes software.
• The FDA reports it has authorized over 1,600 AI-enabled medical devices as of September 2026, and keeps a public list that it says is not comprehensive.
• A Predetermined Change Control Plan (PCCP) lets a manufacturer make specific, pre-authorized changes to an AI model without filing a new submission for each one.
• Software that analyzes patterns or signals, such as continuous pulse oximetry or glucose readings, generally does not qualify as non-device clinical decision support.
• Since March 29, 2023, submissions for internet-connected "cyber devices" must include a software bill of materials and a plan to monitor vulnerabilities.

What counts as an AI-enabled medical device?

An AI-enabled medical device is any device, including standalone software, that uses AI and is intended to diagnose, cure, mitigate, treat or prevent disease, or to affect the structure or function of the body. The intended use, not the technology, is what makes it a device.

The FDA's page on artificial intelligence in software as a medical device gives examples that map well to hospital use:

• An imaging system that uses algorithms to give diagnostic information about skin cancer.
• Deep learning software that sharpens medical images.
• AI that detects diabetic retinopathy from retinal images.
• A smart sensor that estimates the probability of a heart attack.
• Algorithms that automate insulin dosing based on continuous glucose monitor readings.

Software as a Medical Device (SaMD) means software that is itself the device, running on general hardware such as a server or phone, rather than code embedded inside a scanner or pump. Many AI diagnostic tools fall in this group. For background on the wider clinical and operational uses of AI beyond regulated devices, see our CIO guide to AI and machine learning in healthcare.

How does the FDA regulate AI medical devices?

Through the same risk-based premarket pathways as other devices, plus AI-specific guidance on model changes, transparency and good machine learning practice. Which pathway applies depends on the device's risk class and whether a similar device already exists.

The FDA's page on selecting the correct premarket submission sets out the options:

Pathway	Used for	What it means for buyers
510(k) premarket notification	Class I and II devices that are not exempt from premarket review	The device was compared with a legally marketed predicate. Ask what that predicate was.
De Novo classification request	Novel low-to-moderate risk devices with no predicate	A new device type; the decision summary often explains the testing in detail.
Premarket approval (PMA)	Class III devices	The most demanding review, for the highest-risk devices.

To see what's already been authorized, check the FDA's list of AI-enabled medical devices. The FDA says devices are added mainly based on AI-related terms in their authorization summaries, that the list isn't comprehensive, and that it plans to explore ways to tag devices that use foundation models, including large language models. Each entry links to the FDA database record, which is where you'll find the public summary of the evidence.

The FDA's AI page also lists the principles and guidance that shape reviews, including Good Machine Learning Practice guiding principles, transparency principles for machine learning-enabled devices, and draft guidance on lifecycle management for AI-enabled device software functions.

Can an AI device change after it's cleared?

Yes, but only within limits the FDA has agreed in advance. That's the job of a Predetermined Change Control Plan.

A PCCP is part of the original marketing submission and describes planned modifications, how they'll be developed, tested and rolled out, and how their impact will be assessed. Once authorized, the manufacturer can make those planned changes without a new submission each time, as long as it follows the plan. PCCPs can be included in 510(k), De Novo and PMA submissions. The FDA describes three components:

1. Description of modifications: the specific changes planned, such as retraining with new data.
2. Modification protocol: performance tests with pre-defined acceptance criteria, plus update procedures, including how users are told.
3. Impact assessment: the benefits and risks of each change, alone and combined.

For a hospital, this matters in practice. If your vendor's model updates quarterly, ask whether those updates fall under an authorized PCCP and how you'll be notified. A model that changes outside a plan may need a new FDA submission first.

When is clinical decision support software not a device?

When it meets all four statutory criteria for non-device clinical decision support, the main one being that it doesn't analyze medical images or signals and that a clinician can independently review the basis for its recommendation. Patient monitoring tools usually fail that test.

The FDA's Clinical Decision Support Software guidance was issued in final form in January 2026. In the FDA's webinar on the final guidance, presenters walked through examples relevant to monitoring:

• Software that analyzes hourly pulse oximetry and heart rate to alert a clinician to deterioration fails the first criterion because it "analyzes a pattern." Software analyzing continuous glucose readings every 30 minutes is treated the same way.
• Software that detects conditions such as stroke or sepsis and generates an alarm that "supports time-critical decision-making" is a device function.
• Discrete, point-in-time measurements, such as routine vital signs taken at separate encounters, generally don't count as a pattern by themselves.

The takeaway: an early warning score built into your EHR may or may not be a device, depending on what data it analyzes and how it alerts. Treat "it's just decision support" as a claim to verify, not an assumption. Our explainer on healthcare decision support systems covers the non-device side in more depth.

What are the main benefits and risks?

The benefit is faster, more consistent detection, especially in imaging and continuous monitoring. The risks are performance gaps in your population, alert fatigue, model changes, cybersecurity and over-reliance by staff.

Category	Typical use	Main risk to manage
Imaging analysis and triage	Flagging findings on scans for faster review	Performance in your scanners and patient mix
Ophthalmic and dermatology screening	Detecting diabetic retinopathy or skin lesions	Image quality and referral pathways for positives
Physiologic monitoring and early warning	Deterioration alerts from vital-sign trends	Alarm burden and response workflow
Wearables and remote monitoring	Sensors estimating cardiac risk at home	Data gaps, patient adherence, who watches alerts
Closed-loop therapy	Insulin dosing from glucose readings	Failure modes when the loop acts without a clinician

Bias and fairness deserve their own conversation with clinical leadership. Our article on the ethics of AI in medical diagnosis covers consent, accountability and fairness questions, and our piece on wearable technology in healthcare covers the practical side of remote monitoring.

Cybersecurity is a regulatory issue too. Under section 524B of the FD&C Act, a "cyber device" includes software and can connect to the internet. The FDA's cybersecurity FAQ says that, starting March 29, 2023, submissions for these devices must include a plan to monitor and address postmarket vulnerabilities, processes for secure design and updates, and a software bill of materials. Ask your vendor for that SBOM.

Hospital adoption checklist for AI medical devices

Use this checklist before signing a contract. It keeps clinical, regulatory, IT and security questions in one place.

1. Confirm regulatory status. Get the FDA submission number and check it in the FDA database. Read the decision summary.
2. Match the intended use. Make sure your planned use matches the cleared indication, patient population and care setting. Using it outside that scope shifts risk to you.
3. Ask about change control. Is there an authorized PCCP? How often will the model change, and how will you be told?
4. Validate locally. Run a silent pilot on your own data before it affects care, and compare results with clinician judgment.
5. Design the workflow. Decide who sees each alert, how fast they must respond, and how responses are documented.
6. Review security. Request the SBOM and vulnerability monitoring plan, and fold the vendor into your third-party risk management program.
7. Check data handling. Confirm where patient data goes, whether a business associate agreement is needed, and how it's protected. Our breakdown of how healthcare data breaches happen shows what to look for.
8. Train staff on limits. Clinicians should know what the device can't do, so they don't over-trust it.
9. Monitor after go-live. Track performance, overrides and alert volume, and report problems through your safety reporting process.

For the broader buying process, budget and vendor comparison, see our guide to healthcare IT purchasing decisions.

Common mistakes hospitals make

Most failures come from treating FDA clearance as the finish line instead of the starting point. Watch for these:

• Assuming clearance means it works here. Clearance is based on the manufacturer's testing, not on your patients or equipment.
• Skipping the decision summary. It tells you the data, settings and limits. Few buyers read it.
• Adding alerts without removing any. More alarms can mean slower response to all of them.
• Letting a vendor call a monitoring tool "non-device CDS" without checking. Pattern analysis of physiological signals usually makes it a device.
• Not planning for model updates. Changes can alter performance; make update notice a contract term.

This article is general information, not legal advice. Talk to regulatory counsel about your specific use.

FAQ

Are all AI health tools regulated by the FDA?

No. The FDA regulates software that meets the definition of a medical device. Some clinical decision support tools meet all four non-device criteria and fall outside device oversight, and many administrative tools, such as scheduling or billing software, aren't devices at all. Tools that analyze images or physiological signals for diagnosis or monitoring generally are devices.

How can I check whether an AI device is FDA authorized?

Start with the FDA's list of AI-enabled medical devices, then search the FDA device database using the submission number your vendor provides. The record links to the public summary, which describes the intended use and testing. Remember the FDA says its AI list isn't comprehensive, so absence from it isn't proof of anything.

What is a PCCP in plain terms?

A Predetermined Change Control Plan is an agreement, reviewed by the FDA as part of the original submission, that spells out which changes a manufacturer may make to its device, how each change will be tested against pre-set criteria, and how users will be informed. Changes inside the plan don't need a fresh submission each time.

Do AI tools that use large language models get FDA clearance?

Some may, if they meet the device definition. The FDA has said it will explore ways to identify and tag devices on its AI list that incorporate foundation models, including large language model functionality, and it encourages sponsors to describe this in their public summaries. Ask any vendor directly whether their product uses one.

What to do next

1. Inventory every AI tool already in clinical use and record its FDA status and intended use.
2. Form a small review group from clinical, IT security, biomedical engineering and compliance to approve new AI devices.
3. Add PCCP, update notification and SBOM requirements to your standard vendor contract.
4. Pick one high-volume use case and run a silent local validation before going live. Our look at AI in lung cancer prediction is a useful example of the questions to ask.

Sources

• FDA: Artificial Intelligence in Software as a Medical Device
• FDA: Artificial Intelligence-Enabled Medical Devices list
• FDA: Premarket Submissions: Selecting and Preparing the Correct Submission
• FDA: Predetermined Change Control Plans
• FDA: Clinical Decision Support Software guidance
• FDA: Cybersecurity in Medical Devices FAQs

Last reviewed: October 2026.