AI/ML SaMD and FDA's 2021 Action Plan: What Medical Device Companies Must Know Before Submission

The Regulatory Reality of AI/ML Software as a Medical Device

If your company is developing an AI- or machine learning-powered Software as a Medical Device (SaMD), you are operating in one of the most scrutinized and rapidly evolving corners of FDA oversight. The agency's Artificial Intelligence/Machine Learning (AI/ML)-Based Software as a Medical Device Action Plan, published in January 2021, is not a distant policy document — it is an active framework shaping how FDA reviewers evaluate your submissions today. Understanding its five core pillars is not optional; it is a prerequisite for a credible regulatory strategy.

What FDA's 2021 AI/ML Action Plan Actually Requires

FDA's action plan built directly on the agency's 2019 proposed regulatory framework for AI/ML-based SaMD, which itself referenced the International Medical Device Regulators Forum (IMDRF) SaMD framework. The 2021 document identified five areas of focused action that continue to define expectations across 510(k), De Novo, and PMA pathways:

• Good Machine Learning Practice (GMLP): FDA has been developing GMLP principles in collaboration with Health Canada and the UK's MHRA. These principles — finalized in a joint October 2021 publication — establish baseline expectations around data management, model training, performance evaluation, and post-market monitoring. Reviewers increasingly expect sponsors to demonstrate alignment with GMLP in their software documentation.
• Predetermined Change Control Plans (PCCPs): This is the centerpiece of the action plan and the single concept most misunderstood by startup founders. Because adaptive AI/ML algorithms change over time, FDA introduced the PCCP as a mechanism to prospectively describe the types of modifications a device may undergo, the methodology for implementing those changes, and the performance evaluation protocols that will govern them. FDA finalized guidance on PCCPs in December 2023. If your AI/ML device has any adaptive or continuously learning components, your submission must include a well-structured PCCP or you will face avoidable RTA (Refusal to Accept) or deficiency letters.
• Algorithm Transparency and Labeling: FDA expects AI/ML SaMD submissions to include clear disclosure of the algorithm's intended use, the data it was trained on, known limitations, and performance characteristics across relevant patient subgroups. This ties directly to 21 CFR Part 801 labeling requirements and FDA's broader push for algorithmic transparency. Generic performance summaries are insufficient — stratified performance data by age, sex, race, and clinical setting is increasingly expected for moderate-to-high risk devices.
• Real-World Performance Monitoring: Under 21 CFR Part 820 and the Quality System Regulation (now aligned with ISO 13485 under the amended Quality Management System Regulation finalized in 2024), post-market surveillance obligations apply to SaMD. For AI/ML devices, FDA expects your post-market surveillance plan to include mechanisms for detecting model drift, distribution shift, and performance degradation in real-world deployment. This is not aspirational — it is enforceable.
• Equity and Bias Considerations: FDA's action plan explicitly addressed the risk of algorithmic bias, particularly for devices trained on non-representative datasets. Submissions for AI/ML SaMD involving diagnostic or treatment decision support should include a bias assessment protocol and, where applicable, mitigation strategies embedded in the PCCP.

Matching Your AI/ML Device to the Right Submission Pathway

Not every AI/ML SaMD requires a PMA. FDA's risk-based classification framework under 21 CFR Parts 862–892 still governs, and the key question is whether your device meets a predicate for 510(k) clearance, whether De Novo classification is appropriate, or whether the novelty and risk level demand a PMA. For many early-stage companies, the De Novo pathway under 21 CFR Part 860.257 is underutilized. If your AI/ML SaMD has no valid predicate but presents low-to-moderate risk, De Novo can establish a new classification and a pathway for future 510(k) submissions — including your own.

One critical distinction: FDA's 2021 guidance on Clinical Decision Support (CDS) Software — finalized under Section 520(o) of the FD&C Act as amended by the 21st Century Cures Act — defines which software functions are exempt from device regulation versus those that remain subject to FDA oversight. Misclassifying your AI/ML tool as non-device CDS is one of the most common and costly regulatory errors we see at ADB Consulting & CRO Inc.

Practical Steps Before You Submit

Regulatory preparedness for AI/ML SaMD is not something you bolt on before submission. It must be architected into your development process. At minimum, your team should address the following before engaging FDA:

• Define your Software Level of Concern under FDA's 2023 Software as a Medical Device guidance and ensure your software documentation package aligns with IEC 62304 lifecycle requirements.
• Draft a PCCP that is specific, bounded, and tied to defined performance thresholds — vague PCCPs are routinely flagged in interactive review.
• Conduct a pre-submission (Q-Sub) meeting under FDA's Pre-Submission Program to align on your proposed study design, performance benchmarks, and classification rationale before you invest in pivotal validation studies.
• Ensure your Quality Management System — whether ISO 13485-certified or not — has documented procedures for AI/ML-specific risks including training data governance, version control, and post-market performance monitoring.

The Regulatory Window Is Narrowing

FDA is moving toward a more defined regulatory framework for AI/ML SaMD, and the agency has signaled through recent 510(k) decisions and warning letters that informal tolerance for underdeveloped AI submissions is eroding. Sponsors who engage early, document rigorously, and build a credible PCCP are consistently better positioned for timely clearance.

At ADB Consulting & CRO Inc., we work directly with medical device startups and established companies to build submission-ready AI/ML SaMD regulatory strategies — from pre-submission meetings through clearance and post-market compliance. Whether you are entering your first FDA interaction or responding to a deficiency letter, we bring the technical depth and regulatory experience to move your program forward.

Book a free discovery call with Andre Butler today at adbccro.com. In 30 minutes, we can assess your regulatory pathway, identify submission gaps, and give you a clear picture of what it takes to bring your AI/ML device to market.

FDA's AI/ML SaMD Action Plan: The Regulatory Reality for Device Makers

If your software-based medical device incorporates machine learning or adaptive algorithms, you are operating in one of the most actively evolving areas of FDA oversight. The agency's January 2021 Artificial Intelligence/Machine Learning-Based Software as a Medical Device Action Plan was not a policy statement — it was a roadmap signaling exactly where enforcement, guidance, and premarket expectations are heading. Founders and regulatory teams who treat it as background reading are taking on unnecessary risk.

This post breaks down the practical regulatory implications of the Action Plan and tells you what your organization needs to do right now to stay ahead of FDA scrutiny.

Why the 2021 Action Plan Changed the AI/ML SaMD Landscape

Prior to the Action Plan, FDA regulated AI/ML-enabled SaMD primarily through its existing 510(k), De Novo, and PMA frameworks — applying the same static software logic it had used for decades. The core problem: traditional frameworks assume a locked software specification. A machine learning model that continuously retrains on real-world data doesn't fit that paradigm.

The Action Plan addressed this head-on by proposing five interconnected workstreams:

• Tailored premarket review policies for AI/ML-based SaMD
• A risk-based framework adapted from the 2019 FDA/Health Canada/UK MHRA Guiding Principles for Good Machine Learning Practice (GMLP)
• Patient-centered approaches to transparency and bias management
• Real-world performance monitoring post-clearance
• Fostering a regulatory science culture for AI/ML evaluation

The most operationally significant output from this work is the Predetermined Change Control Plan (PCCP) — now codified in FDA guidance finalized in December 2023.

Understanding the Predetermined Change Control Plan (PCCP)

The PCCP is FDA's solution to the locked-algorithm problem. Instead of submitting a new 510(k) or PMA supplement every time your algorithm improves, a manufacturer can prospectively define the types of modifications it anticipates making — and the performance testing protocols that will assesses those changes — within the original premarket submission.

Under the Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions (December 2023), a compliant PCCP must include three core components:

• Description of Modifications: A precise, bounded characterization of the intended changes — improvements to model architecture, expansion of intended use population, updated training datasets — each tied to a specific rationale.
• Modification Protocol: The exact methodology you will use to verify and assesses each anticipated modification, including performance benchmarks, dataset requirements, and statistical thresholds that must be met before deployment.
• Impact Assessment: An analysis of how each modification affects the device's benefit-risk profile, cybersecurity posture (cross-referencing FDA's 2023 Cybersecurity in Medical Devices guidance), and labeling requirements.

A poorly scoped PCCP — one that is either too vague to be enforceable or so narrow it fails to cover your actual development pipeline — will either draw a deficiency letter from FDA or leave you needing a separate submission anyway. Getting this document right at the outset is one of the highest-leverage regulatory investments an AI/ML device company can make.

Premarket Pathway Selection: 510(k), De Novo, or PMA?

Pathway selection for AI/ML SaMD follows the same risk-based logic as any other device, anchored to 21 CFR Part 880 classifications and FDA's Software as a Medical Device: Clinical Evaluation (2017 IMDRF guidance), which FDA has formally endorsed. Your Device Risk Category under that framework — Category I through IV — directly informs the level of clinical evidence FDA will expect.

In practice, most Class II AI/ML SaMD pursue 510(k) clearance with a PCCP. However, novel AI/ML functions with no predicate — particularly those making autonomous diagnostic or treatment decisions — are increasingly routed through De Novo classification under 21 CFR Part 860.260, where FDA can establish new special controls tailored to AI-specific risks like dataset bias and performance drift.

High-risk autonomous AI/ML devices — those that replace rather than inform clinical judgment — should be prepared for PMA-level scrutiny, including prospective clinical study data and a robust post-market surveillance plan under 21 CFR Part 822.

Good Machine Learning Practice: The Operational Standard FDA Expects

The ten GMLP principles are not aspirational. FDA reviewers are using them as an informal checklist when evaluating AI/ML submissions. Your technical file should be able to demonstrate:

• Data management practices that address dataset representativeness, bias, and demographic equity
• Model transparency sufficient to support clinical decision-making without a black-box dependency
• Human factors validation confirming that clinicians correctly understand and apply model outputs
• A post-market performance monitoring infrastructure with defined drift thresholds and escalation triggers

What Regulatory Teams Should Be Doing Right Now

The gap between companies that will successfully navigate AI/ML SaMD review and those that won't comes down to preparation, documentation discipline, and early FDA engagement. Specifically:

• Conduct a Pre-Submission (Q-Sub) meeting under FDA's 2023 Q-Sub guidance before finalizing your PCCP — FDA feedback at this stage is binding guidance you can build your submission around.
• Align your software documentation to IEC 62304 and map AI/ML-specific risks through your ISO 14971 process with explicit nodes for algorithmic failure modes.
• Establish your post-market performance monitoring protocol before clearance, not after — FDA is increasingly expecting this detail at submission.

The Cost of Getting This Wrong

An incomplete or inconsistent PCCP, a misclassified device, or a clinical evaluation that doesn't address AI-specific bias risks will generate a Refuse to Accept (RTA) or substantive deficiency letter — adding months and significant cost to your timeline. For a startup with investor milestones tied to clearance, that delay can be existential.

The AI/ML SaMD regulatory environment rewards companies that engage strategically and early. It penalizes those who treat regulatory as a box-checking exercise at the end of the development cycle.

Work With a Regulatory Partner Who Knows AI/ML SaMD

At ADB Consulting & CRO Inc., we specialize in guiding medical device startups and established manufacturers through the full AI/ML SaMD submission lifecycle — from pathway strategy and Pre-Sub preparation to PCCP drafting and post-market compliance architecture. We understand what FDA reviewers are looking for because we've built submissions that get cleared.

If your device incorporates AI or machine learning and you're not certain your regulatory strategy is airtight, book a free discovery call with Andre Butler today. Visit adbccro.com to schedule your consultation and get a clear-eyed assessment of where your program stands and exactly what it needs to move forward.

What Is SaMD and Why Does AI/ML Change Everything?

Software as a Medical Device is defined by the International Medical Device Regulators Forum (IMDRF) as software intended to be used for one or more medical purposes without being part of a hardware medical device. When that software uses machine learning to make or inform clinical decisions — predicting disease, triaging patients, recommending treatment — it falls squarely into FDA's most scrutinized regulatory category.

The challenge with AI/ML is that it does not stay static. Traditional software executes fixed logic. A machine learning model can change its behavior as it processes more data — sometimes imperceptibly, sometimes dramatically. FDA's traditional regulatory framework was built around locked, deterministic software. AI/ML forced a fundamental rethink.

The Action Plan and the Predetermined Change Control Plan

In January 2021, FDA published its Artificial Intelligence/Machine Learning-Based Software as a Medical Device Action Plan. The centerpiece of that plan is the Predetermined Change Control Plan (PCCP) — a mechanism that allows manufacturers to describe anticipated modifications to their AI/ML algorithm and receive FDA's pre-authorization to make those changes without filing a new 510(k) for each update.

Under 21 CFR Part 814 and the Consolidated Appropriations Act of 2023, FDA was directed to issue formal guidance on PCCPs. That guidance arrived in 2023 and fundamentally changes how sponsors need to think about AI/ML device submissions. A well-structured PCCP must include:

• Description of Modifications: Precisely what types of changes are contemplated — performance improvements, expansion to new patient populations, algorithmic retraining protocols
• Modification Protocol: How changes will be implemented, validated, and verified before deployment
• Impact Assessment: Analysis of how each type of change may affect device safety and effectiveness

Without a PCCP, every meaningful algorithm update typically triggers a new 510(k) submission. With a well-crafted PCCP, you can build a learning system that improves over time within a pre-approved envelope. The competitive advantage is significant.

Classification: Where Does Your AI/ML SaMD Fit?

FDA uses the IMDRF SaMD risk framework to classify AI/ML devices. The framework considers two axes: the significance of the information provided (treat, diagnose, drive clinical management, inform clinical management) and the state of the healthcare situation (critical, serious, non-serious). Higher significance plus higher acuity equals higher regulatory risk — and more rigorous FDA scrutiny.

Most AI/ML SaMD that supports diagnosis or treatment decisions in serious conditions will require a 510(k) or De Novo pathway at minimum. AI/ML devices that drive clinical decisions autonomously — without clinician override — are increasingly being assessed as Class III devices requiring PMA.

What FDA Reviewers Are Actually Looking For

Based on interactions with FDA and recent device clearances, reviewers are focusing heavily on three areas for AI/ML submissions:

• Training Data Transparency: Where did the training data come from? Does it reflect the intended use population? Are demographic subgroups adequately represented? FDA has been explicit that bias in training data is a safety issue, not just an equity issue.
• Algorithm Validation on Independent Datasets: A model that performs well on its training set is not validated. FDA expects independent test sets that were withheld from development — ideally prospective clinical data from the intended use environment.
• Human Factors for AI Outputs: How does the algorithm present its output to clinicians? Poorly designed interfaces that lead to automation bias — where clinicians defer to the AI without critical evaluation — are increasingly flagged in deficiency letters.

The Good Machine Learning Practices Guidance

In 2021, FDA joined an international coalition to develop Good Machine Learning Practice (GMLP) guidelines — the AI/ML equivalent of Good Manufacturing Practice. While not yet codified in regulation, GMLP principles are increasingly embedded in FDA's review expectations. Key principles include data management, model training documentation, independent performance testing, and ongoing monitoring post-clearance.

Sponsors who build GMLP principles into their development lifecycle from day one are consistently better positioned in FDA review than those who attempt to retrofit documentation late in the process.

Practical Steps for AI/ML SaMD Developers

If you are early in AI/ML device development, the most important step you can take right now is scheduling a Pre-Submission (Q-Sub) meeting with FDA. This voluntary meeting lets you test your regulatory strategy — including PCCP scope, intended use definition, and performance benchmarks — before you invest in full clinical validation. FDA's feedback in Q-Sub meetings is non-binding but directionally reliable, and it is far cheaper to course-correct at this stage than after a deficiency letter.