How the FDA Approaches AI-Enabled Medical Devices

Introduction

By early 2026, the FDA had authorized more than 1,350 AI-enabled medical devices, roughly double the count from just two years earlier. That growth raises a practical question for anyone building or buying this software: what does an FDA authorization actually certify, and how does the agency keep up with software that can change every few months?

This article walks through the regulatory pathways AI devices use, the newer mechanism built specifically for algorithms that update over time, and what a clearance does and doesn't tell you.

The Basic Pathways

Most AI-enabled software reaches market through one of three routes: 510(k) clearance, where a manufacturer shows the device is substantially equivalent to an already-cleared predicate; De Novo authorization, used for novel devices with no predicate but a reasonable risk profile; and premarket approval (PMA), reserved for the highest-risk devices. The large majority of AI-enabled devices to date have gone through 510(k), which is faster but requires an existing point of comparison, something that gets harder to find for genuinely novel AI applications.

The Problem Traditional Pathways Didn't Anticipate

Conventional medical devices are static once cleared. AI software isn't. A model might be retrained periodically on new data to improve performance, or updated to add compatibility with a new scanner. Under the traditional framework, a meaningful change could trigger an entirely new submission, which is slow and creates a disincentive to actually improve a deployed model.

Predetermined Change Control Plans

The FDA's answer is the Predetermined Change Control Plan, or PCCP, formalized through Section 515C of the FD&C Act and detailed in final guidance the agency issued in December 2024 specifically for AI-enabled device software functions. A PCCP is submitted alongside the initial application and describes, in advance, the specific modifications a manufacturer plans to make, such as retraining on new data, the methods that will be used to validate each change, and how the manufacturer will communicate changes to users. If a modification stays within the boundaries defined in the authorized PCCP, the manufacturer can make it without filing a new submission. If it falls outside those boundaries, a new submission is required.

As of independent research examining devices through May 2025, a modest number of AI/ML-enabled devices, in the dozens, had an authorized PCCP, with retraining on new data being the most common type of change manufacturers planned for. That's a small fraction of the full AI-enabled device count, meaning most currently authorized devices still rely on the traditional model, where a significant change requires a fresh submission.

What FDA Authorization Actually Means

An authorization confirms that the device met the applicable regulatory standard, based on the evidence submitted, for its specific stated intended use. It is not a guarantee of performance in your particular setting, patient population, or workflow, and the FDA's own AI-enabled device list is explicitly described as not a fully comprehensive resource. Two things worth checking on any cleared device: the exact intended use statement, since a tool cleared for one task shouldn't be quietly extended to another, and whether it has a PCCP, which tells you whether the version you're evaluating today might legitimately change without a new review.

What This Means for Buyers and Integrators

• Check the intended use statement closely. Marketing language is often broader than the cleared indication.
• Ask whether the device has a PCCP, If so, find out what changes it covers. This affects how you plan validation and monitoring on your end.
• Understand that clearance is a floor, not a ceiling. It addresses a regulatory standard, not whether the tool fits your specific population or workflow, a theme covered throughout this series, including in Blog 04 on local validation.
• Watch for labeling that discloses AI-ML technology and PCCP status,which the FDA recommends manufacturers include.

Where Oversight Is Still Catching Up

Regulators, including the FDA, have acknowledged that a substantial share of AI tools used in healthcare operations, particularly administrative and workflow tools rather than diagnostic devices, have never gone through a formal regulatory review at all, because they don't meet the legal definition of a medical device. That's not necessarily a gap that needs closing for every tool, since not every AI application carries device-level risk, but it does mean regulatory clearance is not a universal signal you can rely on across the AI healthcare landscape. Organizational governance, covered in Blog 18, has to fill that space for tools that fall outside FDA's jurisdiction.

Bottom Line

FDA authorization is a meaningful signal for the specific, narrow claim a device makes, but it is not proof of real-world performance in your hospital, and a growing share of AI healthcare tools sit outside the FDA's device definition entirely. The PCCP framework is a genuine step toward regulating software that evolves, but it currently covers a small minority of authorized devices. Read the intended use, check for a PCCP, and validate locally regardless of what the clearance says.

This article is educational and does not provide legal or regulatory advice.

Suggested Internal Links

• Healthcare industry solutions
• Machine learning development

Sources / References

• "FDA AI/ML SaMD Guidance: Complete 2026 Compliance Guide," IntuitionLabs:
• "FDA Issues Final Guidance on Predetermined Change Control Plans for AI-Enabled Devices," McDermott Will & Emery:
• "Regulating Flexibility for Artificial Intelligence: FDA Experience with Predetermined Change Control Plans," medRxiv preprint (not peer reviewed):
• "Predetermined Change Control Plans: Guiding Principles for Advancing Safe, Effective, and High-Quality AI-ML Technologies," PMC:
• FDA, "Artificial Intelligence-Enabled Medical Devices" list. Confirm current URL before linking.

CTA

If you're building software that may fall under FDA's medical device definition, planning for regulatory strategy early avoids costly rework. Techverse Solutions can help design the technical architecture with compliance and validation in mind from day one. Reach out to discuss your project.