Holland & Knight attorney Sara Klock [Photo courtesy of Holland & Knight]
Medical device manufacturers and developers that are incorporating artificial intelligence or machine learning into their products need to recognize if and how the FDA will regulate the device and the software itself.
To start with, products that are built with or consist of computer and/or software components or applications are subject to regulation as a medical device when they meet the definition of medical device. FDA defines a medical device as products intended for use to diagnose, address or prevent disease.
More specifically, the Federal Food, Drug, and Cosmetic (FD&C) Act defines a medical device as “an instrument, apparatus, implement, machine, contrivance, implant, in vitro reagent, or other similar or related article, including a component part, or accessory which is recognized in the official National Formulary, or the United States Pharmacopoeia, or any supplement to them, intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease, in man or other animals, or intended to affect the structure or any function of the body of man or other animals, and which does not achieve its primary intended purposes through chemical action within or on the body of man or other animals and which is not dependent upon being metabolized for the achievement of its primary intended purposes.”
Related: AI-enabled medtech introduces risks facilities aren’t ready for, cybersecurity report says
That definition includes a standalone medical device such as an X-ray machine, but also includes software functions that transform a general-purpose computing platform into a regulated medical device by performing patient specific analysis or by acting as an extension controlling one or more standalone medical devices. The FDA excludes some software functions under section 520(o)(1)(E) of the FD&C Act, and products like general wellness devices that do not meet the above definition are not regulated as medical devices.
The FDA explains AI as a “machine-based system that can, for a given set of human-defined objectives, make predictions, recommendations, or decisions influencing real or virtual environments” (using a definition from the Organization for Economic Cooperation and Development that OECD updated in 2024), while saying machine learning (ML) is a “set of techniques that can be used to train AI algorithms to improve performance at a task based on data.”
Some medical devices fall under FDA enforcement discretion. These products are typically software functions that help patients self-manage their disease or conditions without providing specific treatment or treatment suggestions, or automate simple tasks for health care providers. Because the product is subject to enforcement discretion, FDA has the right to inspect a manufacturer, but likely would not.
Other medical devices are subject to FDA regulatory oversight including marketing submissions such as 510(k) submission, de novo classification request and premarket approval (PMA) application, because these medical devices pose a risk to patient safety if they were to not function as intended.
Related: AI chatbots top ECRI’s annual list of health tech hazards
FDA draft and final guidances for AI, ML and software
When determining if a product is a medical device and if the AI/ML or software will be considered a medical device, FDA has issued numerous guidance documents giving developers a roadmap of the agency’s thinking on specific topics, including Clinical Decision Support (CDS) Software and Device Software Functions and Mobile Medical Applications.
FDA recently updated its CDS Software guidance, and while FDA discusses AI implicitly, there is no explicit mention. Moreover, it is expected that FDA will release an updated Device Software Functions and Mobile Medical Applications guidance in 2026 under the new title of Policy for Device Software Functions.
While FDA does not separately regulate AI or ML, the FDA encourages a total product life cycle (TPLC) approach to the oversight of medical devices. The agency has therefore taken steps to develop guidance and resources for developers, including Good Machine Learning Practice (GMLP) for Medical Device Development Guiding Principles.
The FDA has also drafted AI/ML guidance for developers to consider when preparing an FDA submission, Artificial Intelligence-Enabled Device Software Functions: Lifecycle Management and Marketing Submission Recommendations. Within this draft, FDA outlines how it views and defines certain terms of art such as validation, what it views as appropriate and what developers should include in submission, such as a statement that AI is used in the device and a description of the device inputs and device outputs, including whether the inputs are entered manually or automatically, and a list of compatible input devices and acquisition protocols, as applicable.
Determining if a product is a regulated medical device and if the AI/ML affects that determination is a product-specific analysis. Developers should be aware that minor modifications of a product could cause the product to be squarely within FDA’s oversight and purview.
Sara Klock is a partner at Holland & Knight focusing her practice on food, drugs and devices, digital health, and life sciences. She represents life sciences clients on regulatory, enforcement, and compliance matters before federal and state agencies, including FDA, USDA, DEA, and FTC, and advises on market strategy, product classification, due diligence for regulated transactions, and the drafting and negotiation of life sciences agreements and legislative and regulatory advocacy materials.
Read more MDO Contributions and learn how to submit your own.
The opinions expressed in this blog post are the author’s only and do not necessarily reflect those of Medical Design & Outsourcing or its employees.
