The FDA regulates most AI medical devices as software medical devices. It clears them mainly through the 510(k) pathway by comparing each one to a device already on the market, with De Novo and premarket approval used for novel or higher-risk tools. Since December 2024, final guidance lets makers pre-authorize future model updates through a Predetermined Change Control Plan (PCCP).
Picture a radiology AI that flags suspected lung nodules. The vendor has retrained it on far more data and made it measurably better. Under the classic rules, shipping that update could mean a new FDA submission and months in which hospitals keep running the older, worse version.
That is the core tension in how the FDA regulates AI medical devices. The system was designed for physical products that stay the same once they leave the factory. A hip implant cleared in 2020 is the same hip implant in 2026. Software that learns does not stay still, and the regulatory machinery has spent the past five years trying to catch up.
My argument is simple. The 510(k) pathway was never built for software that changes, and the Predetermined Change Control Plan is a patch, not a redesign. It is a good patch. But a patch mostly helps the companies disciplined enough to plan their updates in advance. It does not fix the weakest part of the system, which is how thin the evidence can be when an AI device first reaches the market.
This article is general information, not legal or regulatory advice. It reflects FDA policy as of late April 2026.
Which FDA pathway do AI medical devices use?
AI tools that meet the legal definition of a medical device go through the same three front doors as any other device.
The 510(k) is the busiest by far. A manufacturer shows that its device is “substantially equivalent” to a legally marketed predicate, meaning it has the same intended use and either the same technological characteristics or different ones that raise no new questions of safety and effectiveness. Clinical trial data is often not required.
De Novo classification is for novel devices of low to moderate risk that have no suitable predicate. A successful De Novo creates a new device type, and that device then becomes a predicate others can cite in their own 510(k)s.
Premarket approval (PMA) is the most demanding route. It is reserved for Class III, high-risk devices, and it requires valid scientific evidence of safety and effectiveness, usually from clinical studies.
For AI, the balance between these doors is lopsided. The FDA’s public list of AI-enabled devices, updated in early 2026, counts 1,451 authorizations through the end of December 2025. Industry trackers such as The Imaging Wire report that about 76 percent came through the radiology panel. The great majority were cleared through 510(k), and almost all are Class II.
That chain matters. An early device cleared on modest evidence becomes the predicate for the next, and each defensible step can drift further from anything tested in depth. I made a related argument in an earlier piece on how the device regulator you choose is really a business model: the pathway shapes the evidence a company bothers to produce.
What counts as an AI medical device, and what doesn’t?
Not every algorithm in a hospital is a regulated device. The boundary is set by the FD&C Act’s definition of a device and by the 21st Century Cures Act of 2016, which carved several kinds of software out of that definition. The most consequential carve-out covers clinical decision support (CDS) software that shows a clinician the basis for its recommendation, so the clinician does not have to rely mainly on the software to decide.
In January 2026 the FDA revised its CDS guidance, replacing the 2022 version. Law firms tracking the agency read it as looser. It extends enforcement discretion to some software that gives a single recommendation, including certain generative AI features, as long as a clinician can independently review how the software reached that recommendation. The FDA also updated its general wellness guidance at the same time, widening room for consumer wearables that report physiological measures without making diagnostic claims.
The practical effect is that a growing share of clinical AI, especially tools that summarize, draft or suggest, may never pass through FDA review at all. A large language model that drafts a differential for a physician to read may well not be. Hospitals should not assume that “not FDA-cleared” means “not allowed,” or that “FDA-cleared” means “validated for my patients.”
What is a Predetermined Change Control Plan (PCCP)?
A PCCP is the FDA’s answer to the problem of software that improves. Congress gave the agency explicit authority for it in the Food and Drug Omnibus Reform Act (FDORA), passed in December 2022, which added section 515C to the FD&C Act. The agency then finalized guidance on December 4, 2024, titled Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions.
The idea is to agree on the change before it happens. In the original marketing submission, whether a 510(k), De Novo or PMA, the manufacturer includes a plan with three parts:
- A description of modifications: exactly which changes the company intends to make, such as retraining on new data or adapting to a new scanner model.
- A modification protocol: how each change will be developed, validated and rolled out, including data management, retraining practices, performance evaluation and update procedures.
- An impact assessment: the benefits and risks of the planned changes and how those risks will be mitigated.
If the FDA authorizes the device with the plan, later changes that stay inside the plan do not need a new submission. Changes outside it still do. The final guidance widened the scope from the 2023 draft, which focused on machine learning, to cover all AI-enabled device software functions.
Does a PCCP mean the AI keeps learning on its own?
No, and this is the most common misunderstanding. A PCCP does not authorize a model that continuously updates itself in the field without oversight. It authorizes specific, bounded, pre-described changes, each validated under a protocol the FDA has already seen. Most authorized AI devices are still “locked” in practice: the version in use is fixed until the manufacturer ships a new one. The PCCP makes change predictable, not automatic.
A worked example: two ways to ship the same update
Here is a hypothetical, simplified to show the mechanics.
Two companies each sell an AI tool that detects intracranial hemorrhage on head CT, both cleared through 510(k). Each wants to extend the tool to a new family of CT scanners and retrain on a larger dataset.
Company A did not include a PCCP. Its regulatory team must decide whether the change could significantly affect safety or effectiveness. Retraining a model and adding scanners very plausibly does, so it files a new 510(k). Clearance takes months.
Company B wrote a PCCP into its original submission. The plan described retraining on new data within set limits and adding scanners that meet stated technical specifications. It committed to a validation protocol, including a reserved test set, minimum sensitivity and specificity thresholds overall and in subgroups, and a labeling update telling users what changed. Company B runs the protocol, the new model clears every threshold, and it ships under the authorized plan with documentation on file.
Company B moves faster, but only because it decided before launch what it would change and what “good enough” meant. That is the real value of a PCCP. It forces a company to write down its standards in advance, when the commercial pressure to lower them is weakest.
What is the strongest criticism of the FDA’s approach?
The strongest criticism is not about updates. It is about the starting line.
A study published in JAMA Health Forum in August 2025, by researchers at Johns Hopkins and others, examined the roughly 950 AI-enabled devices authorized through November 2024. Sixty devices were linked to 182 recall events. The most common causes were diagnostic or measurement errors, followed by loss or delay of function. About 43 percent of recalls happened within a year of authorization. Devices with no reported clinical validation were more likely to be recalled, and publicly traded companies accounted for more than 90 percent of recall events despite making about half of the devices.
A PCCP does nothing about that. It governs how a device changes after authorization. It does not raise the evidence bar for the first version, and for most AI devices the first version got through by pointing at a predicate. The FDA’s broader draft guidance on AI-enabled device software functions, published in January 2025 to cover the full product lifecycle from design to postmarket monitoring, was still a draft as of this writing.
There is a fair counterargument, and it deserves weight. Requiring prospective clinical trials for every radiology triage tool would slow useful products, raise costs and entrench the largest incumbents who can afford big studies. On this view, light premarket review plus better postmarket surveillance is the realistic design.
I find that persuasive up to a point. The trouble is that postmarket surveillance for AI is the weakest link of all. Adverse event reporting relies on clinicians noticing that software failed, which is exactly what automation bias makes hard. A model that quietly misses 5 percent more bleeds does not generate reports. It generates worse outcomes that look like ordinary bad luck.
What does this mean for manufacturers, hospitals and clinicians?
For manufacturers, the PCCP is now the default question, not an option. Any team planning to retrain, extend to new devices or populations, or tune thresholds should decide whether those changes belong in a plan at the original submission. Writing the plan is hard work. Rewriting the product roadmap around 510(k) cycles later is harder.
For hospitals, FDA clearance is a floor, not a verdict. Before buying, ask which pathway the device used and what its predicate was. Ask whether there is a PCCP and, if so, how you will be notified when the model changes under it. A silent update on a PCCP is still an update to a tool your clinicians rely on.
For clinicians, the label matters. It tells you the intended use, the population studied and the known limitations. If you are using a cleared tool outside its labeled population, you have left the zone the FDA looked at. As we argued in AI diagnostics: the evidence is strongest where the question is narrowest, the narrower the claim, the more you can trust it.
For policymakers, the gap to close is surveillance. Linking device identifiers to outcomes data, requiring manufacturers to monitor real-world performance, and giving hospitals a standard way to report AI failures would do more for safety than any single change to premarket review.
Frequently asked questions
Are AI medical devices FDA approved or FDA cleared?
Most are cleared, not approved. “Cleared” means the FDA accepted a 510(k) showing substantial equivalence to an existing device. “Approved” applies to premarket approval for high-risk Class III devices, which demands stronger evidence. De Novo devices are “granted.” The distinction matters because clearance usually rests on comparison with a predicate, often without a prospective clinical trial.
How many AI-enabled medical devices has the FDA authorized?
The FDA keeps a public list of AI-enabled medical devices. Its update in early 2026 counted 1,451 authorizations through the end of December 2025, going back to 1995. Roughly three quarters were reviewed by the radiology panel, with cardiology a distant second. The list counts authorizations, not distinct products, and it does not show how widely each device is used.
Does the FDA regulate ChatGPT-style tools used by doctors?
It depends on intended use. A general-purpose chatbot not marketed for diagnosis or treatment is generally not a medical device. Software built to diagnose or recommend treatment may be one, unless it qualifies for the clinical decision support exemption. The FDA’s January 2026 revised CDS guidance widened that exemption for some tools whose reasoning clinicians can independently review.
Can a hospital be sure an FDA-cleared AI tool works on its patients?
No. Clearance means the FDA judged the device reasonably safe and effective for its labeled use, based on the evidence submitted. It says little about performance on your scanners, workflows and patient mix. Hospitals should run their own local validation before go-live and keep monitoring afterward, because performance can shift when populations or equipment change.
What happens when an AI device is updated under a PCCP?
If the change falls inside the authorized plan and passes the plan’s validation protocol, the manufacturer can put it on the market without a new submission. It must document the change and update labeling as the plan describes. Changes outside the plan, or ones that fail the protocol, still require a new marketing submission to the FDA.
The takeaway
The FDA has done something useful with the PCCP. It has given AI makers a legal way to improve products without restarting the regulatory clock, and it has made them spell out their standards before launch. But the patch sits on a foundation built for devices that do not change, and that foundation still lets a thinly validated first version into the market by comparison with an older one. The next real improvement will not be another premarket rule. It will be the ability to see, in the real world, when a cleared algorithm stops doing what its clearance said it did.
Should FDA clearance for AI devices depend on real-world performance data after launch, even if that slows approvals? Tell us where you land.
