SaMD FDA Classification: What Medical Device Startups Need to Know Before Submitting

Software as a Medical Device: Getting Classification Right From Day One

If your company is building software that analyzes patient data, drives clinical decision-making, or controls a therapeutic function, you are almost certainly developing a Software as a Medical Device (SaMD). And if you are not certain how FDA classifies your product — or whether it is regulated at all — you are taking on significant regulatory and commercial risk that could delay your launch by months or kill it entirely.

This post breaks down the FDA classification framework for SaMD in practical terms, drawing on the regulatory references your team needs to make defensible decisions early in development.

What Qualifies as SaMD Under FDA's Framework

FDA aligns its SaMD definition with the International Medical Device Regulators Forum (IMDRF), defining SaMD as software intended to be used for one or more medical purposes that performs these purposes without being part of a hardware medical device. That distinction matters. Software that is embedded in or an integral part of a hardware device is not SaMD — it is Software in a Medical Device (SiMD) and falls under a different regulatory pathway.

SaMD includes clinical decision support tools, AI-powered diagnostic algorithms, remote patient monitoring applications, and software that interprets imaging data. It does not automatically include general wellness apps, administrative hospital software, or products explicitly excluded by the 21st Century Cures Act.

The 21st Century Cures Act Exclusions: Know What Is Off the Table

Before you assume FDA has jurisdiction over your software, audit it against the exclusions codified in Section 3060 of the 21st Century Cures Act, now reflected in 21 CFR Part 880 and FDA's 2019 guidance Policy for Device Software Functions and Mobile Medical Applications. FDA does not regulate software functions that:

• Are intended for administrative support of a healthcare facility
• Are intended for general patient communication or appointment scheduling
• Are general wellness products with low risk to patient safety
• Meet the definition of a non-device clinical decision support (CDS) function — meaning a licensed clinician can independently review the basis for the software's recommendation and is not reliant on the software to make the clinical decision

That last exclusion is where many startups miscalculate. FDA's September 2022 final guidance on Clinical Decision Support Software provides a four-factor test to determine whether your CDS tool meets the non-device criteria. If your software obscures its logic or renders a recommendation a clinician cannot easily audit, it is likely a device subject to FDA oversight.

IMDRF Risk Categorization: The Framework Behind FDA's Thinking

Even if your product is a regulated SaMD, not all SaMD carries the same regulatory burden. FDA's risk-based approach draws heavily from the IMDRF SaMD framework, which stratifies products across two axes: the significance of the information provided by the SaMD to a healthcare decision, and the state of the healthcare situation or condition.

This produces four risk categories (I through IV), where Category IV — software providing critical information for an immediately life-threatening condition — carries the highest scrutiny. FDA maps these categories to its existing device classification structure: Class I (low risk), Class II (moderate risk, typically cleared via 510(k) or De Novo), and Class III (high risk, requiring Premarket Approval under 21 CFR Part 814).

Practical Implications for Your Regulatory Pathway

Classification determines your submission type, and your submission type determines your timeline, budget, and clinical evidence requirements. Here is what that looks like in practice:

• Class I SaMD is generally exempt from premarket notification, though General Controls under 21 CFR Part 820 still apply — including your Quality Management System obligations.
• Class II SaMD most commonly requires a 510(k) submission demonstrating substantial equivalence to a predicate device, or a De Novo request if no predicate exists. FDA's guidance Factors to Consider When Making Benefit-Risk Determinations in Medical Device Premarket Approval and De Novo Classifications applies here.
• Class III SaMD requires a PMA with clinical data, which is time-intensive and expensive. For novel AI/ML-based SaMD, FDA's Predetermined Change Control Plan guidance — finalized in 2024 — adds another layer of planning your team must address before first submission.

Cybersecurity is not optional for any of these pathways. FDA's final Cybersecurity in Medical Devices guidance (2023) requires a Software Bill of Materials (SBOM) and a documented cybersecurity risk management process as part of your premarket submission regardless of device class.

The Cost of Misclassification

Misclassifying your SaMD — whether by claiming a CDS exemption that does not hold, selecting the wrong device class, or ignoring SaMD status entirely — creates compounding problems. FDA Warning Letters and 483 observations tied to software have increased year over year. More immediately, investors and acquirers conduct regulatory due diligence, and a broken classification rationale is a material finding that erodes valuation and deal certainty.

Getting your classification right is not a bureaucratic checkbox. It is a foundational commercial decision.

Work With a Regulatory Partner Who Knows SaMD

At ADB Consulting & CRO Inc., Andre Butler and the team work directly with medical device startups and established manufacturers to build defensible SaMD classification rationales, prepare 510(k) and De Novo submissions, and develop regulatory strategies that keep products moving through FDA review without surprises.

Whether you are at the concept stage or preparing for your first submission, a clear-eyed regulatory assessment now saves significant time and capital later. Book a free discovery call at adbccro.com and let us help you navigate SaMD classification with the precision your product and your patients deserve.