SaMD FDA Classification: What Medical Device Startups Must Know Before Submitting

Software as a Medical Device: Getting Classification Right Before It Costs You

If you're developing software that interacts with patient data, drives clinical decisions, or interfaces with hardware that touches patients, you are almost certainly developing a medical device under U.S. law. That statement surprises more founders than it should. And the misclassification — or complete absence of a classification strategy — is one of the most expensive regulatory mistakes a digital health or medical device company can make.

This post breaks down exactly how FDA classifies Software as a Medical Device (SaMD), which regulatory frameworks apply, and what your team needs to decide before you spend another dollar on development.

What Qualifies as SaMD Under FDA's Framework

FDA defines SaMD consistent with the International Medical Device Regulators Forum (IMDRF) definition: software intended to be used for one or more medical purposes that performs those purposes without being part of a hardware medical device. This definition is foundational — and deceptively broad.

Under the Federal Food, Drug, and Cosmetic Act (FD&C Act) as amended by the 21st Century Cures Act, not all health-related software meets the statutory definition of a device. Section 520(o) of the FD&C Act carves out several software functions from device regulation, including administrative support software, general wellness apps, and electronic health records used for transferring data without clinical decision support.

However, Clinical Decision Support (CDS) software — particularly software that analyzes patient-specific data and provides recommendations a clinician cannot independently review — remains squarely within FDA's oversight. FDA's 2022 final guidance on Clinical Decision Support Software provides the interpretive framework your team should have bookmarked.

The IMDRF Risk Categorization Matrix

FDA has formally adopted the IMDRF SaMD framework for risk stratification, and understanding it will determine your regulatory pathway before a single submission is drafted. The IMDRF matrix evaluates two independent dimensions:

• State of healthcare situation: Is the patient condition critical, serious, or non-serious?
• Significance of information provided by SaMD: Does the software drive, inform, or treat/diagnose?

These two variables intersect to produce four risk categories (Category I through IV), with Category IV representing the highest risk — think software that drives decisions in critical care. FDA's own risk-based framework for SaMD oversight maps directly onto this matrix. A Category I SaMD operating in a non-serious condition context will face a fundamentally different regulatory burden than a Category III or IV product intended to diagnose oncological conditions.

Device Classification Under 21 CFR: Class I, II, and III

FDA device classification under 21 CFR Parts 862–892 applies to SaMD just as it does to hardware devices. Your software will fall into one of three classes:

• Class I (General Controls): Lowest risk. Most are exempt from premarket notification. Registration and listing under 21 CFR Part 807 still applies.
• Class II (Special Controls): Moderate risk. Most require a 510(k) premarket notification demonstrating substantial equivalence to a predicate device. This is the most common pathway for SaMD.
• Class III (PMA): Highest risk. Requires a Premarket Approval Application with valid scientific evidence — the most rigorous and resource-intensive pathway.

For novel SaMD that lacks a predicate but poses moderate risk, the De Novo pathway under 21 CFR Part 860.260 is increasingly relevant. FDA has granted numerous De Novo authorizations for AI/ML-based SaMD and has used those decisions to establish new product codes and special controls that downstream 510(k) submitters can now use as predicates.

AI/ML SaMD: The Predetermined Change Control Plan

If your software learns and adapts — if the algorithm changes post-deployment based on real-world data — you are operating in territory that traditional 510(k) and PMA frameworks were not designed for. FDA's 2021 action plan for AI/ML-based SaMD and the subsequent draft guidance on Predetermined Change Control Plans (PCCPs) directly address this. A PCCP allows manufacturers to specify anticipated modifications and the protocols governing them, seeking pre-authorization for a class of changes rather than filing a new submission for every model update. This is not optional reading for AI/ML SaMD developers — it is the document that defines whether your product can remain commercially viable after clearance.

Practical Steps Before You File Anything

• Conduct a software intended use analysis mapped explicitly to the FD&C Act Section 520(o) exclusions and IMDRF risk categories.
• Identify your product code using FDA's Device Classification Database and confirm whether a predicate exists for a 510(k) strategy.
• Establish your IEC 62304 software development lifecycle documentation early — FDA expects it and auditors will look for it.
• Address cybersecurity under FDA's 2023 final guidance on cybersecurity in medical devices, which applies to SaMD and requires a Software Bill of Materials (SBOM).
• Engage FDA early via a Pre-Submission (Q-Sub) meeting if your intended use is ambiguous or your technology is novel.

Classification Is Strategy, Not Paperwork

The single most costly mistake SaMD companies make is treating classification as a box to check rather than a strategic decision that shapes your entire product, clinical, and commercial roadmap. The pathway you choose — or fail to choose deliberately — determines your timeline to market, your evidence generation requirements, your post-market surveillance obligations, and ultimately your company's valuation in front of investors and acquirers.

Getting this right at the beginning is not a regulatory formality. It is a business imperative.

ADB Consulting & CRO Inc. works with digital health startups and established device manufacturers to develop clear, defensible regulatory strategies for SaMD products at every stage of development. Whether you need a classification analysis, 510(k) strategy, or Pre-Sub meeting preparation, our team brings the hands-on FDA experience your product requires.

Book your free discovery call at adbccro.com and let's map out your regulatory path before your next development sprint.