Every update to an AI-enabled medical device raises a critical question for quality and regulatory teams: who approved this version, and what evidence shows it remains safe and effective? FDA was authorizing AI-enabled devices well before 2019, but that year it proposed its first tailored regulatory framework for modifications to AI and machine learning (ML)-based software as a medical device.
Since then, many of those early ideas have evolved into guidance and statutory provisions, while the number of authorized AI-enabled medical devices has grown. Changes in US AI policy in 2025 and evolving implementation timelines for the EU AI Act have added further complexity for manufacturers operating across different markets.
This article explains where FDA regulation of AI in medical devices stands in 2026: what the original framework proposed, which regulatory requirements and guidance apply today and what quality systems need to demonstrate to support the safety and ongoing oversight of AI-enabled devices.
How does the FDA regulate AI in medical devices?
The FDA does not regulate AI as such. It regulates medical devices, including AI-enabled devices, under the Federal Food, Drug, and Cosmetic Act (FD&C Act), with a risk-based approach that weighs each device's intended use and technological characteristics.
An AI-enabled device is a device that includes one or more AI-enabled device software functions. Many are software as a medical device (SaMD): software that serves a medical purpose without being part of a hardware device. However, AI can also be incorporated into a physical medical device. Not every health software tool qualifies as a medical device under FDA rules.
Section 520(o) of the FD&C Act excludes certain software functions from the device definition, and FDA's Clinical Decision Support Software guidance, first finalized in September 2022 and revised on January 6, 2026, explains where decision-support tools fall.
AI-enabled devices reach the US market through the same premarket pathways as any other device.
FDA also reviews modifications that could significantly affect a device's safety or effectiveness. For fixed software, that rule is easy to apply. For an algorithm designed to improve with new data, it's the central regulatory question.
FDA's public list of AI-enabled medical devices passed 1,600 authorizations as of September 2026. The agency's own examples include an imaging system that gives diagnostic information for skin cancer, AI that detects diabetic retinopathy from retinal images, and algorithms that automate insulin dosing from continuous glucose monitor readings.
Why do adaptive AI algorithms challenge traditional device review?
A locked algorithm returns the same output for the same input every time. An adaptive, or continuously learning, algorithm can change its behavior as it learns from real-world data the device captures in use. Both create work for quality teams: a locked model still gets re-trained and re-released, while an adaptive one can drift between releases, which makes "the version that was reviewed" harder to pin down.
FDA's software change policy treats each update as a discrete event. Under its guidance on deciding when to submit a 510(k) for a software change, a manufacturer assesses whether each change could significantly affect the device's safety or effectiveness, with risk assessment as a central input. The outcome is either a new 510(k) or documentation of the change and the supporting analysis in the manufacturer’s quality system records. For PMA devices, changes that affect safety or effectiveness generally need a PMA supplement under 21 CFR 814.39.
That works for occasional updates. It strains when a model is retrained often, because each retraining can shift performance in ways that are hard to predict. Requiring a new submission every time would slow improvements that could help patients, while skipping review would leave safety unverified. FDA's answer, first proposed in 2019, was to review the plan for change instead of every individual change.
What did FDA's 2019 proposed regulatory framework introduce?
In 2019, FDA published a discussion paper, the Proposed Regulatory Framework for Modifications to Artificial Intelligence/Machine Learning (AI/ML)-Based Software as a Medical Device (SaMD). It was never binding guidance. It did, however, set the vocabulary FDA still uses, and most of its core ideas now sit in final or draft guidance.
Risk-based categorization
The framework placed AI/ML-based SaMD into four categories, from Category I (lowest risk) to Category IV (highest), using the International Medical Device Regulators Forum (IMDRF) risk categorization principles. Two factors set the category: how serious the patient's condition is, and how significant the software's information is to the healthcare decision. Notice that these IMDRF categories are not FDA device classes: US classification into Class I, II or III still follows 21 CFR Parts 862 to 892.
IMDRF SaMD risk categories, as applied in FDA's 2019 discussion paper.
Types of modification
The paper sorted AI/ML modifications into three broad types. They aren't mutually exclusive, and each can carry a different impact on risk.
- Performance: changes to clinical and analytical performance, such as retraining on new data.
- Inputs: changes to the algorithm's inputs and their clinical association with the output.
- Intended use: changes to what the device is intended to do.
Total product lifecycle (TPLC) approach
The TPLC approach evaluates a device from premarket development through post market performance, together with the manufacturer's quality culture and its practices for software development, testing, and performance monitoring. The paper proposed applying it to AI/ML-based SaMD that require a premarket submission.
The organization-level part, which leaned on FDA's Software Precertification (Pre-Cert) pilot, was never implemented: FDA closed the pilot in 2022, concluding that new statutory authority would be needed. The product-level lifecycle view did carry forward and frames FDA's January 2025 draft guidance on AI-enabled device software functions.
SaMD Pre-Specifications and the Algorithm Change Protocol
The FDA's 2019 discussion paper proposed two components for managing planned AI modifications. SaMD Pre-Specifications (SPS) defined anticipated changes, while the Algorithm Change Protocol (ACP) described how manufacturers would develop, validate, and implement them.
These concepts have since evolved into the Predetermined Change Control Plan (PCCP), supported by statutory authority under section 515C of the FD&C Act and FDA's final guidance issued in December 2024 and revised in August 2025. A PCCP now covers three elements: planned modifications, the protocol for implementing them, and an assessment of their impact.
Here’s how the original proposals map to the current PCCP framework:
What is a predetermined change control plan (PCCP)?
A predetermined change control plan (PCCP) is documentation, reviewed and authorized with a device's marketing submission, that describes planned modifications to an AI-enabled device. Once the plan is authorized, modifications made exactly as it describes don't each need a new marketing submission.
FDA finalized its PCCP guidance for AI-enabled device software functions in December 2024 and issued a revised version on August 18, 2025. It applies to AI-enabled devices reviewed through the 510(k), De Novo, and PMA pathways, including the device constituent part of device-led combination products. Its statutory basis is section 515C of the FD&C Act, added by the Food and Drug Omnibus Reform Act (FDORA) in 2022.
Per the guidance, every PCCP should cover three elements.
- Description of modifications: the specific changes the manufacturer plans to make.
- Modification protocol: the methodology to develop, validate, and implement those changes.
- Impact assessment: an assessment of the impact of those modifications on the device.
The boundary matters. A modification that is in the plan but not implemented according to its modification protocol will likely need a new marketing submission, and one that fails the plan's acceptance criteria can't be implemented under the PCCP. A change that isn't described in the plan must be evaluated under FDA's existing device-modification rules and guidance, which may or may not lead to a new submission. Modifications made under an authorized PCCP also still run through the manufacturer's quality system, including design controls, change control, and records.
Which FDA guidance applies to AI-enabled medical devices in 2026?
FDA guidance for AI-enabled medical devices covers AI lifecycle management, planned model changes, clinical decision support, cybersecurity, and machine learning development. The following key documents below summarize what each covers and its current regulatory status.
One document to watch is the FDA's draft guidance on AI-enabled device software functions. It was first published in January 2025 and it remains draft guidance, so check its status before relying on it in a submission.
Other resources offer guidance on specific aspects of AI-enabled device development. The FDA's Good Machine Learning Practice principles and PCCP guiding principles, developed jointly with Health Canada and the MHRA, address model development and planned changes. The transparency principles, also published jointly with Health Canada and the MHRA in June 2024, focus on communicating how AI-enabled devices work.
Beyond AI-specific resources, manufacturers should also consider the FDA's final cybersecurity guidance for medical devices and its Quality Management System Regulation (QMSR) overview, which address cybersecurity and device quality system requirements. FDA's final guidance on Content of Premarket Submissions for Device Software Functions (June 2023) also applies to AI-enabled software, and the AI lifecycle draft builds on it.
Together, these resources help manufacturers align AI-specific development and change management with the cybersecurity and quality system requirements that apply throughout a medical device's lifecycle.
The Quality Management System Regulation (QMSR), effective February 2, 2026, incorporates ISO 13485:2016 by reference into 21 CFR Part 820. For AI-enabled devices, this means design, verification, validation, and changes must be managed within the applicable quality system, with supporting documentation. See Scilife's guide to preparing for the QMSR for details.
How does the EU AI Act affect AI-enabled medical devices?
The EU AI Act (Regulation (EU) 2024/1689) adds requirements for high-risk AI-enabled medical devices alongside existing MDR and IVDR obligations. It entered into force on August 1, 2024 and applies in phases. An AI system that is a medical device, or a safety component of one, and meets the Act's Article 6(1) conditions is a high-risk AI system. In practice, this captures AI-enabled devices whose MDR or IVDR conformity assessment involves a notified body; fully self-certified devices are not high-risk under this route.
The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on July 27, 2026 and moved the high-risk dates back. Devices already on the EU market before August 2, 2028 come under these requirements only if their design changes significantly from that date, which makes significant assessment of planned model updates a quality system task.
The MDR and IVDR stay in Section A of Annex I, so AI-enabled devices remain subject to the high-risk requirements, and notified bodies already designated under the MDR or IVDR that want to assess AI Act conformity must apply by January 28, 2028. A Commission proposal of December 16, 2025 to simplify the MDR and IVDR would move both to Section B, largely taking devices out of the AI Act's high-risk regime; it is still under negotiation.
On October 14, 2026, the Commission published the reference of EN 18286:2026, Artificial intelligence: Quality management system for EU AI Act regulatory purposes, in the Official Journal (Implementing Decision (EU) 2026/2274). Applying it gives a presumption of conformity with the AI Act quality management requirements it covers, which device manufacturers can integrate into their MDR or IVDR quality system (Article 17(3))
An AI-enabled device sold in both markets answers to two regimes on different clocks. FDA requirements apply now, and the AI Act's high-risk requirements will apply alongside MDR or IVDR conformity assessment from August 2028. Scilife's practical guide to EU AI Act compliance in life sciences covers the EU side in detail.
What FDA regulation of AI in medical devices means for your quality system
FDA regulation of AI in medical devices has moved from a proposal to a working system: risk-based premarket review, PCCPs for planned model changes, a lifecycle draft guidance, and a quality system regulation aligned with ISO 13485. US AI policy shifted in 2025, but device requirements kept moving on their own track: the QMSR took effect, and FDA revised its CDS and cybersecurity guidance in early 2026.
For quality teams, this means maintaining traceable evidence for every relevant change, from the approved plan and validation results to documented review and approval. As AI models evolve, the quality system needs to keep that evidence connected and inspection-ready.
