FDA SaMD Classification: AI & Machine Learning Guide

The U.S. Food and Drug Administration (FDA) classifies AI/ML-based Software as a Medical Device (SaMD) using the controls needed to assure safety and effectiveness (^[1]). Class II examples do not establish that Class III/PMA has never applied: PowerLook Tomo Detection Software received PMA approval under P160009 on March 24, 2017 (^[2]). Its historical approval must be distinguished from the subsequent reclassification of the MYN medical-image-analyzer device type from Class III to Class II (^[3]). The FDA’s oversight emphasizes premarket review of AI algorithms’ safety and effectiveness, and is now evolving toward total product lifecycle management (including postmarket algorithm changes) (^[4]) (^[5]). This report examines how AI/ML SaMD are defined and classified, reviews the regulatory framework (including recent FDA guidance and action plans), and analyzes trends in FDA-authorized AI devices. Key findings include:

• Regulatory Scope: Determine whether each software function meets the statutory device definition and whether a software exclusion applies. Certain clinical decision support functions are nondevices under section 520(o)(1)(E) (^[6]). FDA also identifies administrative functions without a diagnostic or treatment purpose as nondevices (^[7]). Device functions subject to enforcement discretion remain distinct from nondevices and from classified devices exempt from particular requirements (^[8]; FDA regulatory controls).

• Risk Classification: FDA class depends on the controls needed for safety and effectiveness, rather than a requirement that a disease be non-life-threatening for Class II or that a function be life-sustaining for Class III. General controls apply to Class I; Class II adds special controls; Class III is subject to PMA (^[1]). Determine the applicable device type and requirements for the intended use. The tables distinguish general classes from specific authorizations.

FDA Device Class	Controls and Risk	Premarket Considerations	AI/ML Software Examples
Class I	General controls; low to moderate risk	Check the classification regulation for exemptions; De Novo can establish Class I	No verified Class I AI SaMD example is established here; nondevice wellness and administrative functions are not Class I examples
Class II	General and special controls; moderate to high risk	510(k) when applicable, or De Novo for an eligible new device type	See the scoped Class II authorizations below
Class III	General controls and PMA; high risk	PMA	Historical software PMA approval: PowerLook Tomo Detection Software, P160009 ([2]); distinguish the subsequent MYN device-type reclassification ([3])

Class descriptions follow FDA regulatory controls; De Novo can classify eligible devices into either Class I or Class II.

Selected FDA-Authorized AI/ML Software	Year	Authorized Use and Material Limitations	Pathway and Class
IDx-DR ([9]; FDA order)	2018	Automatic detection of more than mild diabetic retinopathy in adults with diabetes and no previous diabetic-retinopathy diagnosis, using Topcon NW400; prescription use by health care providers, with physician review of results and referral advice	De Novo authorization; Class II
Lunit INSIGHT CXR Triage ([10])	2021	Prioritization or triage of adult chest X-rays with suspected pleural effusion and/or pneumothorax; results are not for standalone clinical decision-making	510(k) clearance; Class II
Viz HDS / Viz Volume Plus / Viz ICH+ ([11])	2024	Labeling, visualization and quantification of intracranial hyperdensities, lateral ventricles and midline shift on non-contrast head CT; physician review with original images is required	510(k) clearance; Class II
Sepsis ImmunoScore ([12])	2024	Adjunctive assessment of presence of or progression to sepsis within 24 hours, using laboratory findings and clinical assessments, in admitted emergency-department or hospital patients with suspected sepsis and a blood culture ordered; not a sole basis for sepsis assessment	De Novo authorization; Class II

These are specific historical authorizations; their indications do not establish authorization for every product or capability in a vendor’s wider portfolio.

Regulatory Definitions

Under U.S. law, a medical device is defined by its intended use (diagnosis, treatment, etc.) and is subject to FDA regulation (^[13]) (^[14]). “Software as a Medical Device” (SaMD) refers to standalone software (including AI/ML algorithms) intended to perform medical functions without being part of other hardware (^[13]) (^[14]). The International Medical Device Regulators Forum (IMDRF) and FDA adopt similar definitions: if an AI software function meets the device definition (e.g. it analyzes patient data to inform diagnosis or therapy), it is regulated as a medical device (^[13]) (^[14]). The 21st Century Cures Act (2016) further clarified that certain low-risk software (like basic clinical decision support that lets clinicians independently review basis) is not a device, but AI/ML tools that independently analyze data typically are (^[14]).

Global SaMD Framework

The IMDRF categorization framework combines the significance of information for the healthcare decision (treat or diagnose, drive clinical management, inform clinical management) with the healthcare situation or condition (critical, serious, non-serious). These are Categories I–IV, with Category IV the highest impact. This framework does not replace a jurisdiction’s classification rules (^[15]). FDA classification must be determined separately through applicable device types and controls (^[1]). Administrative functions without a medical purpose should be assessed as possible nondevices, rather than described as low-risk SaMD (^[7]).

AI/ML in Medical Devices

AI and machine learning (ML) technologies have proliferated in healthcare as data-driven tools to detect patterns, quantify features, and make predictions from medical images, signals, and records (^[16]) (^[17]). Examples include AI for imaging (radiology, ophthalmology), physiology (arrhythmia detection), pathology (cancer grading), and predictive analytics (sepsis risk, cardiac events). Singh and colleagues’ 2025 taxonomy study identified 1,016 authorization events and 736 unique devices in its historical 1995–2024 snapshot (^[18]). These counts are distinct and are not a current FDA census. These devices have entailed extensive clinical testing and regulatory review, highlighting both transformative potential and the need for robust oversight. The FDA has acknowledged that AI SaMD pose novel challenges—algorithms can “learn” or evolve, and results may vary with different inputs—requiring updated regulatory strategies (^[4]) (^[19]).

Regulatory Evolution

Historically, AI-related SaMD fell under existing digital health policy. The FDA’s Digital Health Innovation Action Plan (2017) and subsequent initiatives (including establishment of the Digital Health Center of Excellence) emphasized that SaMD are assessed by traditional risk-classification methods (^[16]) (^[14]). Notably, the FDA’s 2021 AI/ML Action Plan laid out a “total product lifecycle” approach: it called for new guidances on premarket submissions (e.g. Predetermined Change Control Plans for algorithm changes), best practices for ML development, transparency, and postmarket monitoring (^[20]). These efforts aim to balance innovation with patient safety as AI SaMD become more sophisticated.

Device Classifications (I–III)

FDA assigns devices to Class I, II or III according to the controls necessary to provide reasonable assurance of safety and effectiveness. Class I uses general controls; Class II requires general and special controls; Class III is subject to PMA (^[1]). For AI/ML SaMD, assess the intended use and applicable device classification. A life-sustaining function is not a necessary condition for Class III: FDA also considers prevention of health impairment and potential unreasonable risk of illness or injury where lower-class controls are insufficient, or information is insufficient to determine their adequacy. Conversely, a serious indication does not by itself exclude Class II. Sepsis ImmunoScore’s specific order establishes Class II for adjunctive 24-hour sepsis risk assessment in admitted emergency-department or hospital patients with suspected sepsis and a blood culture ordered; it is not a sole basis for sepsis assessment (^[12]).

Differences for SaMD

The FDA has emphasized that SaMD must be evaluated “like any other device” (^[14]). However, SaMD pose unique issues. Unlike hardware, software can be remotely updated, and ML models can drift as they are exposed to new data.

Software updates. An authorized PCCP is established through a device marketing authorization. Changes specified in that authorized plan can be implemented without a new marketing submission when implemented in accordance with its modification protocol, including the specified methods and performance criteria (^[21]). This is permission for defined, validated modifications within the authorized plan, rather than unrestricted continuous learning. Changes outside the plan must be assessed under applicable FDA modification requirements.

Transparency and bias. Risk classification also influences required evidence and labeling. For Class II AI SaMD, FDA may demand clinical validation studies, algorithmic bias evaluations, and clear performance claims. The dated mixed-device study discussed below measures public-summary reporting, rather than establishing SaMD-specific reporting rates.

IMDRF vs. FDA Classes

The IMDRF categories are not FDA device classes. In the IMDRF matrix, driving clinical management for a non-serious condition is Category I; driving clinical management for a serious condition is Category II; treating or diagnosing a critical condition is Category IV (^[15]). The framework explicitly does not establish a regulatory classification or convergence of classification rules. Determine the FDA class independently from the applicable device type, intended use and adequacy of controls (^[1]).

510(k) and De Novo

A 510(k) review determines substantial equivalence to an eligible predicate. De Novo provides a risk-based marketing pathway for a novel device without a legally marketed predicate when general controls, or general and special controls, provide reasonable assurance of safety and effectiveness for the intended use (^[22]). A De Novo grant can establish Class I or Class II; the pathway alone does not establish Class II. The device examples above identify their actual FDA decisions and authorized uses.

Premarket Approval (PMA)

Class III devices are subject to PMA (^[1]). Historical AI-enabled software approvals include PowerLook Tomo Detection Software, listed by FDA under P160009, with PMA approval on March 24, 2017 (^[23]; FDA SSED). Its indicated use was concurrent assistance to radiologists reading GE Senoclaire breast tomosynthesis exams. FDA subsequently reclassified the MYN medical-image-analyzer device type from Class III to Class II with special controls, effective February 21, 2020 (^[3]). Subsequent reclassification does not change the original PMA approval history. A later Class II-only study cohort cannot establish that PMA has never been used.

Enforcement Discretion and Exemptions

Software functions outside the statutory device definition are nondevices; administrative functions without a diagnostic or treatment purpose are among FDA’s examples (^[7]). Certain CDS functions also qualify for a statutory exclusion (^[6]). FDA enforcement discretion instead concerns some functions that may meet the device definition but pose lower risk (^[8]). Separately, a classified device may be exempt from a particular requirement when its classification regulation provides that exemption (^[1]). Do not assign nondevice software a device class or assume that every viewer, wellness app or clinical recommendation has the same regulatory treatment.

Guidance status reviewed October 5, 2026.

Total Product Lifecycle Approach

In January 2021, the FDA published its Artificial Intelligence/Machine Learning (AI/ML)-Based SaMD Action Plan (^[20]). The plan’s lifecycle approach connects premarket evaluation, planned modifications, good machine learning practice, transparency and real-world performance monitoring. These themes also inform the January 2025 AI lifecycle draft, whose recommendations reflect management of risk throughout the device total product life cycle (^[24]).

Recent Guidance and Drafts

• Final AI-specific PCCP guidance: FDA finalized its AI-enabled device software functions PCCP guidance on December 4, 2024 (^[25]); the current final version is dated August 2025 (^[5]). It recommends describing planned modifications, methods to develop, validate and implement them, and their impact.
• Separate general-device PCCP draft: The August 2024 Predetermined Change Control Plans for Medical Devices document remains a draft, marked “Not for implementation” (^[26]). It should not be confused with the final AI-specific document.
• AI lifecycle draft: The January 2025 Artificial Intelligence-Enabled Device Software Functions: Lifecycle Management and Marketing Submission Recommendations remains a draft, also marked “Not for implementation” (^[24]).
• CDS guidance: FDA’s current Clinical Decision Support Software guidance is final and dated January 2026; it explains the statutory criteria for nondevice CDS (^[6]).

A PCCP is optional. An authorized PCCP permits only modifications specified and implemented in accordance with that plan without a new submission. Sponsors may instead submit changes through additional marketing submissions as applicable (^[21]; FDA explanation of the optional mechanism).

Postmarket Monitoring

The AI lifecycle draft proposes recommendations for design, development and implementation across the total product life cycle (^[24]). Its proposed recommendations should be distinguished from binding statutory or regulatory requirements. Public-summary reporting rates in a historical study do not establish the presence or absence of a device’s postmarket obligations.

International Harmonization

FDA lists its December 2017 SaMD: Clinical Evaluation guidance as withdrawn on January 6, 2026 (^[27]). That withdrawal alone does not establish a commitment to adopt any particular replacement standard or to converge with another jurisdiction’s classification rules. The IMDRF framework provides harmonized principles for jurisdictions to adopt within their own regulatory frameworks; it is not itself regulation (^[28]).

Scope of the Historical Cohort

The 2025 study Machine Learning-Enabled Medical Devices Authorized by the US Food and Drug Administration in 2024 analyzed 168 ML-enabled medical devices using FDA database data accessed May 17, 2025 (^[29]). Its cohort included 46 SaMD (27.4%) and 122 other devices. The figures below describe that mixed-device cohort, rather than SaMD-specific rates or a complete current FDA census. All 168 in this study were Class II; 159 (94.6%) had 510(k) clearance and nine (5.4%) had De Novo authorization. Radiology accounted for 74.4%, followed by the cardiovascular review panel at 6.5%. Among the 159 510(k) submissions, 137 were Traditional, 20 Special and two Abbreviated. These historical figures do not negate earlier PMA software approvals.

Predicates and Review Times

In the study, public summaries identified primary predicates for 155 of 159 510(k) devices (97.5%); four lacked publicly reported predicate information. Missing information in a public summary does not establish clearance without a predicate. The study reported that 64.5% of unique predicates were ML-enabled and median review times were 151 days for 510(k) and 372 days for De Novo (^[29]). These observational results do not determine a sponsor’s eligible pathway or predict an individual submission’s review time.

Quality Metrics and Transparency

Within this same mixed cohort, 49 of 168 public summaries (29.2%) jointly reported sensitivity and specificity, 28 (16.7%) mentioned PCCPs, and 26 (15.5%) reported race or ethnicity (^[29]). These are measures of public-summary disclosure, not SaMD subgroup estimates or evidence that undisclosed testing was not performed. The study reports heterogeneous device-specific metrics; it does not establish a pooled 70–90% imaging accuracy benchmark. Sensitivity, specificity and accuracy should not be treated as interchangeable measures.

IDx-DR (Diabetic Retinopathy Detection)

In 2018, FDA granted De Novo authorization for IDx-DR and classified it as a Class II retinal diagnostic software device (^[30]; FDA classification order). Its authorized function is automatic detection of more than mild diabetic retinopathy in adults with diabetes who have not previously been diagnosed with diabetic retinopathy, using the Topcon NW400 (^[9]). This is prescription software for use by health care providers. Physicians should review results and advise on referral; autonomous image analysis does not remove those responsibilities. The decision summary describes a pivotal study enrolling 900 patients at ten primary care sites. This was a De Novo authorization, rather than a 510(k) clearance or PMA approval.

Viz HDS / Viz ICH+ (NCCT Quantification)

FDA’s 2024 510(k) record K232363 identifies Viz HDS, Viz Volume Plus and Viz ICH+ as Class II, under 21 CFR 892.2050, product code QIH, with qER-Quant (K211222) as the predicate (^[11]). The scoped use is automatic labeling, visualization and quantification of segmentable structures on non-contrast head CT, including intracranial hyperdensities, lateral ventricles and midline shift. A physician should review device output with the original images. This specific clearance does not establish the status of all Viz.ai products.

Sepsis ImmunoScore (Prenosis)

FDA’s April 2, 2024 De Novo order, DEN230036, classified Sepsis ImmunoScore into Class II, product code SAK, under 21 CFR 880.6316 (^[12]). It uses electronic-health-record inputs to support risk assessment for presence of or progression to sepsis within 24 hours, alongside laboratory findings and clinical assessments. The indicated population is patients admitted to the emergency department or hospital with suspected sepsis and a blood culture ordered. It should not be used as the sole basis for determining sepsis or 24-hour sepsis risk. Its Class II designation follows from its FDA order; De Novo itself can yield either Class I or Class II (^[22]).

Lunit INSIGHT CXR Triage

FDA’s 2021 510(k) record K211733 identifies Lunit INSIGHT CXR Triage as Class II under 21 CFR 892.2080 (^[10]). Its indicated use is to analyze adult chest X-rays for suspected pleural effusion and/or pneumothorax, providing case-level output for worklist prioritization or triage. Its results are not intended for standalone clinical decision-making. This clearance concerns the Triage product and those specified findings, rather than pulmonary nodules, edema or the broader INSIGHT CXR family.

These examples illustrate classification decisions tied to particular intended uses and controls. Determine each device’s status from its own FDA record and labeling; the use of AI does not establish a uniform class (^[1]).

Adaptation to Rapid Innovation

For planned AI modifications, manufacturers may include a PCCP in a marketing submission; it is optional. An authorized PCCP permits specified changes implemented in accordance with that plan without a new marketing submission. Sponsors may instead use additional submissions for changes as applicable (^[25]; FDA final AI PCCP guidance). Do not turn this mechanism into a universal requirement for future SaMD submissions or an authorization for arbitrary continuous learning.

Quality and Transparency

The historical study above measures disclosure in public summaries across a mixed-device cohort. Its reporting percentages should not be described as SaMD-specific performance or transparency estimates, or as evidence that testing was omitted. Future changes to regulatory requirements should be distinguished from current rules and from recommendations in draft guidance. FDA’s AI lifecycle draft proposes an approach to risk management throughout the total product life cycle (^[24]).

Global Regulatory Alignment

Under EU MDR Annex VIII, Rule 11, software providing information for diagnostic or therapeutic decisions is generally Class IIa, rising to Class III when the decisions may cause death or irreversible deterioration of health, or Class IIb when they may cause serious deterioration of health or surgical intervention. Software monitoring physiological processes is generally Class IIa, but monitoring vital physiological parameters whose variations could result in immediate danger is Class IIb. Rule 11 retains Class I for all other software within its scope (^[31]). Apply the relevant rules to the software’s intended purpose; being non-wellness software does not establish a blanket minimum of Class IIa.

Potential Shifts

As of the October 5, 2026 review, FDA’s final AI PCCP guidance provides recommendations for defined device modifications, while its AI lifecycle document remains a draft (^[5]; FDA lifecycle draft). Neither document establishes a uniform future Class II status for AI software or an automatic FDA class based on an IMDRF category. Classification and authorization should be checked against the applicable regulator records as policy evolves.

FDA classification of AI/ML SaMD depends on the intended use and controls needed to assure safety and effectiveness (^[1]). The Class II-only mixed-device cohort discussed here is a dated study snapshot, rather than proof that all AI software authorizations are Class II. Historical PMA approvals include PowerLook Tomo Detection Software in 2017 (^[2]); subsequent reclassification of its device type must be distinguished from that original approval (^[3]).

510(k) clearance, De Novo authorization/classification and PMA approval are distinct pathways. For planned modifications, an authorized PCCP can permit changes specified and implemented in accordance with that plan without a new submission (^[21]). Each product’s FDA decision and labeling remains the basis for stating its class, authorized use and limitations.