FDA AI/ML SaMD Regulatory Requirements: What Device Makers Must Know in 2025

FDA's AI/ML SaMD Action Plan: The Regulatory Reality for Device Makers

If your software-based medical device incorporates machine learning or adaptive algorithms, you are operating in one of the most actively evolving areas of FDA oversight. The agency's January 2021 Artificial Intelligence/Machine Learning-Based Software as a Medical Device Action Plan was not a policy statement — it was a roadmap signaling exactly where enforcement, guidance, and premarket expectations are heading. Founders and regulatory teams who treat it as background reading are taking on unnecessary risk.

This post breaks down the practical regulatory implications of the Action Plan and tells you what your organization needs to do right now to stay ahead of FDA scrutiny.

Why the 2021 Action Plan Changed the AI/ML SaMD Landscape

Prior to the Action Plan, FDA regulated AI/ML-enabled SaMD primarily through its existing 510(k), De Novo, and PMA frameworks — applying the same static software logic it had used for decades. The core problem: traditional frameworks assume a locked software specification. A machine learning model that continuously retrains on real-world data doesn't fit that paradigm.

The Action Plan addressed this head-on by proposing five interconnected workstreams:

• Tailored premarket review policies for AI/ML-based SaMD
• A risk-based framework adapted from the 2019 FDA/Health Canada/UK MHRA Guiding Principles for Good Machine Learning Practice (GMLP)
• Patient-centered approaches to transparency and bias management
• Real-world performance monitoring post-clearance
• Fostering a regulatory science culture for AI/ML evaluation

The most operationally significant output from this work is the Predetermined Change Control Plan (PCCP) — now codified in FDA guidance finalized in December 2023.

Understanding the Predetermined Change Control Plan (PCCP)

The PCCP is FDA's solution to the locked-algorithm problem. Instead of submitting a new 510(k) or PMA supplement every time your algorithm improves, a manufacturer can prospectively define the types of modifications it anticipates making — and the performance testing protocols that will validate those changes — within the original premarket submission.

Under the Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions (December 2023), a compliant PCCP must include three core components:

• Description of Modifications: A precise, bounded characterization of the intended changes — improvements to model architecture, expansion of intended use population, updated training datasets — each tied to a specific rationale.
• Modification Protocol: The exact methodology you will use to verify and validate each anticipated modification, including performance benchmarks, dataset requirements, and statistical thresholds that must be met before deployment.
• Impact Assessment: An analysis of how each modification affects the device's benefit-risk profile, cybersecurity posture (cross-referencing FDA's 2023 Cybersecurity in Medical Devices guidance), and labeling requirements.

A poorly scoped PCCP — one that is either too vague to be enforceable or so narrow it fails to cover your actual development pipeline — will either draw a deficiency letter from FDA or leave you needing a separate submission anyway. Getting this document right at the outset is one of the highest-leverage regulatory investments an AI/ML device company can make.

Premarket Pathway Selection: 510(k), De Novo, or PMA?

Pathway selection for AI/ML SaMD follows the same risk-based logic as any other device, anchored to 21 CFR Part 880 classifications and FDA's Software as a Medical Device: Clinical Evaluation (2017 IMDRF guidance), which FDA has formally endorsed. Your Device Risk Category under that framework — Category I through IV — directly informs the level of clinical evidence FDA will expect.

In practice, most Class II AI/ML SaMD pursue 510(k) clearance with a PCCP. However, novel AI/ML functions with no predicate — particularly those making autonomous diagnostic or treatment decisions — are increasingly routed through De Novo classification under 21 CFR Part 860.260, where FDA can establish new special controls tailored to AI-specific risks like dataset bias and performance drift.

High-risk autonomous AI/ML devices — those that replace rather than inform clinical judgment — should be prepared for PMA-level scrutiny, including prospective clinical study data and a robust post-market surveillance plan under 21 CFR Part 822.

Good Machine Learning Practice: The Operational Standard FDA Expects

The ten GMLP principles are not aspirational. FDA reviewers are using them as an informal checklist when evaluating AI/ML submissions. Your technical file should be able to demonstrate:

• Data management practices that address dataset representativeness, bias, and demographic equity
• Model transparency sufficient to support clinical decision-making without a black-box dependency
• Human factors validation confirming that clinicians correctly understand and apply model outputs
• A post-market performance monitoring infrastructure with defined drift thresholds and escalation triggers

What Regulatory Teams Should Be Doing Right Now

The gap between companies that will successfully navigate AI/ML SaMD review and those that won't comes down to preparation, documentation discipline, and early FDA engagement. Specifically:

• Conduct a Pre-Submission (Q-Sub) meeting under FDA's 2023 Q-Sub guidance before finalizing your PCCP — FDA feedback at this stage is binding guidance you can build your submission around.
• Align your software documentation to IEC 62304 and map AI/ML-specific risks through your ISO 14971 process with explicit nodes for algorithmic failure modes.
• Establish your post-market performance monitoring protocol before clearance, not after — FDA is increasingly expecting this detail at submission.

The Cost of Getting This Wrong

An incomplete or inconsistent PCCP, a misclassified device, or a clinical evaluation that doesn't address AI-specific bias risks will generate a Refuse to Accept (RTA) or substantive deficiency letter — adding months and significant cost to your timeline. For a startup with investor milestones tied to clearance, that delay can be existential.

The AI/ML SaMD regulatory environment rewards companies that engage strategically and early. It penalizes those who treat regulatory as a box-checking exercise at the end of the development cycle.

Work With a Regulatory Partner Who Knows AI/ML SaMD

At ADB Consulting & CRO Inc., we specialize in guiding medical device startups and established manufacturers through the full AI/ML SaMD submission lifecycle — from pathway strategy and Pre-Sub preparation to PCCP drafting and post-market compliance architecture. We understand what FDA reviewers are looking for because we've built submissions that get cleared.

If your device incorporates AI or machine learning and you're not certain your regulatory strategy is airtight, book a free discovery call with Andre Butler today. Visit adbccro.com to schedule your consultation and get a clear-eyed assessment of where your program stands and exactly what it needs to move forward.