FDA's AI/ML SaMD Framework: What Device Developers Need to Know

Artificial intelligence and machine learning are transforming medical device development — but they are also creating a regulatory landscape that moves faster than most companies can track. If you are developing an AI/ML-based Software as a Medical Device (SaMD), understanding the FDA's current framework is not optional. It is the difference between a cleared product and a submission that never makes it to market.

What Is SaMD and Why Does AI/ML Change Everything?

Software as a Medical Device is defined by the International Medical Device Regulators Forum (IMDRF) as software intended to be used for one or more medical purposes without being part of a hardware medical device. When that software uses machine learning to make or inform clinical decisions — predicting disease, triaging patients, recommending treatment — it falls squarely into FDA's most scrutinized regulatory category.

The challenge with AI/ML is that it does not stay static. Traditional software executes fixed logic. A machine learning model can change its behavior as it processes more data — sometimes imperceptibly, sometimes dramatically. FDA's traditional regulatory framework was built around locked, deterministic software. AI/ML forced a fundamental rethink.

The Action Plan and the Predetermined Change Control Plan

In January 2021, FDA published its Artificial Intelligence/Machine Learning-Based Software as a Medical Device Action Plan. The centerpiece of that plan is the Predetermined Change Control Plan (PCCP) — a mechanism that allows manufacturers to describe anticipated modifications to their AI/ML algorithm and receive FDA's pre-authorization to make those changes without filing a new 510(k) for each update.

Under 21 CFR Part 814 and the Consolidated Appropriations Act of 2023, FDA was directed to issue formal guidance on PCCPs. That guidance arrived in 2023 and fundamentally changes how sponsors need to think about AI/ML device submissions. A well-structured PCCP must include:

• Description of Modifications: Precisely what types of changes are contemplated — performance improvements, expansion to new patient populations, algorithmic retraining protocols
• Modification Protocol: How changes will be implemented, validated, and verified before deployment
• Impact Assessment: Analysis of how each type of change may affect device safety and effectiveness

Without a PCCP, every meaningful algorithm update typically triggers a new 510(k) submission. With a well-crafted PCCP, you can build a learning system that improves over time within a pre-approved envelope. The competitive advantage is significant.

Classification: Where Does Your AI/ML SaMD Fit?

FDA uses the IMDRF SaMD risk framework to classify AI/ML devices. The framework considers two axes: the significance of the information provided (treat, diagnose, drive clinical management, inform clinical management) and the state of the healthcare situation (critical, serious, non-serious). Higher significance plus higher acuity equals higher regulatory risk — and more rigorous FDA scrutiny.

Most AI/ML SaMD that supports diagnosis or treatment decisions in serious conditions will require a 510(k) or De Novo pathway at minimum. AI/ML devices that drive clinical decisions autonomously — without clinician override — are increasingly being assessed as Class III devices requiring PMA.

What FDA Reviewers Are Actually Looking For

Based on interactions with FDA and recent device clearances, reviewers are focusing heavily on three areas for AI/ML submissions:

• Training Data Transparency: Where did the training data come from? Does it reflect the intended use population? Are demographic subgroups adequately represented? FDA has been explicit that bias in training data is a safety issue, not just an equity issue.
• Algorithm Validation on Independent Datasets: A model that performs well on its training set is not validated. FDA expects independent test sets that were withheld from development — ideally prospective clinical data from the intended use environment.
• Human Factors for AI Outputs: How does the algorithm present its output to clinicians? Poorly designed interfaces that lead to automation bias — where clinicians defer to the AI without critical evaluation — are increasingly flagged in deficiency letters.

The Good Machine Learning Practices Guidance

In 2021, FDA joined an international coalition to develop Good Machine Learning Practice (GMLP) guidelines — the AI/ML equivalent of Good Manufacturing Practice. While not yet codified in regulation, GMLP principles are increasingly embedded in FDA's review expectations. Key principles include data management, model training documentation, independent performance testing, and ongoing monitoring post-clearance.

Sponsors who build GMLP principles into their development lifecycle from day one are consistently better positioned in FDA review than those who attempt to retrofit documentation late in the process.

Practical Steps for AI/ML SaMD Developers

If you are early in AI/ML device development, the most important step you can take right now is scheduling a Pre-Submission (Q-Sub) meeting with FDA. This voluntary meeting lets you test your regulatory strategy — including PCCP scope, intended use definition, and performance benchmarks — before you invest in full clinical validation. FDA's feedback in Q-Sub meetings is non-binding but directionally reliable, and it is far cheaper to course-correct at this stage than after a deficiency letter.