Most clinical decision support software is still not an FDA-regulated device, but the 2026 guidance narrows the margin for error. If your CDS function displays image-derived data, drives a time-critical decision, or hides the basis for its recommendation from the clinician, it is likely regulated as a device. Start now: write a precise intended-use statement, run your function through the Digital Health Policy Navigator, and if AI drives the output, draft a Predetermined Change Control Plan before you submit anything.
TL;DR:
- Software that processes or analyzes medical images, proprietary algorithms, or ties recommendations to urgent clinical decisions will likely be regulated as a medical device by the FDA.
- Enforcement discretion for non-device CDS applies only to non-urgent, documented, singular outputs designed for clinicians, not for high-stakes, time-critical workflows like sepsis alerts.
- A well-defined Predetermined Change Control Plan is essential for AI-powered CDS to manage future model updates without triggering new submissions, including clear descriptions and impact assessments.
- The FDA’s 2026 guidance emphasizes labeling, user interface, and transparency, requiring clear basis for recommendations and traceability to guidelines or references, especially for device classification.
- Determining if your software is a device involves assessing input types, output directives, time sensitivity, basis of recommendation, and whether the target user has independent review capability.
Table of Contents
- What Are the Four Non-Device CDS Criteria Under FDA Rules?
- What Changed in the 2026 CDS Guidance?
- How Do Predetermined Change Control Plans Work for AI-Enabled CDS?
- Where Does CDS Fit in FDA's AI and SaMD Regulatory Approach?
- How Do You Determine If Your Software Function Is a Device?
- What Documentation Should You Prepare Before Submission?
- Which FDA Pathway Applies If Your CDS Function Is a Device?
- Where Can You Find the Primary FDA Resources and How Do You Request a Q-Submission?
- What Should Early-Stage Healthtech Teams Prioritize Now?
- How Can The StartupMD Help With CDS Regulatory Strategy?
- Sources
What Are the Four Non-Device CDS Criteria Under FDA Rules?
Section 520(o)(1)(E) of the FD&C Act sets the boundary between clinical decision support software the FDA regulates as a device and CDS that falls outside its jurisdiction. The FDA's clinical decision support guidance walks through all four criteria with examples, and your product has to satisfy every single one to stay outside device regulation.
- Criterion 1: The software cannot acquire, process, or analyze a medical image, an in vitro diagnostic signal, or a pattern from a signal-acquisition system. Once your tool ingests imaging data or lab signals directly, this criterion fails immediately.
- Criterion 2: The function must display, analyze, or print medical information already accepted in clinical practice, such as published guidelines or peer-reviewed literature, not proprietary algorithmic scoring dressed up as reference data.
- Criterion 3: The output has to be a recommendation to a healthcare provider, not a diagnosis or treatment directive. Plural, contextualized recommendations fare better than a single definitive answer.
- Criterion 4: The clinician has to be able to independently review the basis for the recommendation. If your interface hides the underlying data or reasoning behind a black box, this is where most submissions fall apart.
What Changed in the 2026 CDS Guidance?
The FDA's January 2026 reissued guidance keeps the four criteria intact but sharpens how the agency applies them, particularly around Criterion 3. Industry analysis of the update, including a detailed breakdown from Covington, frames it as clarifying rather than deregulating.
FDA now signals enforcement discretion for certain singular-output tools, provided the clinician can still trace the recommendation back to its source and the underlying data meets Criterion 2. That is a narrower exception than a blanket allowance, and it only applies when every other criterion holds.
- Enforcement discretion applies to singular outputs only when timing is not urgent and the clinical basis is fully documented.
- Time-critical workflows, think sepsis alerts or dosing calculators tied to immediate action, remain squarely inside device territory regardless of output format.
- FDA continues to expect information sourced from well-understood, established references rather than proprietary black-box scoring.
- Labeling and UI design now carry more weight during review, since reviewers use them as primary evidence of Criterion 4 compliance.
The FDA's FAQ page, last updated in June 2026, works through the boundary cases the guidance itself leaves ambiguous, and it is worth reading before you draft your own intended-use language.
How Do Predetermined Change Control Plans Work for AI-Enabled CDS?
A Predetermined Change Control Plan lets you pre-authorize future AI model updates so you are not filing a new marketing submission every time you retrain. The FDA's PCCP guidance requires three components, and reviewers expect all three to be tightly linked to each other, not written as separate, disconnected sections.
- Description of Modifications: Specify exactly what will change, whether that is a retrained model version, a new input data source, or a performance threshold adjustment.
- Modification Protocol: Define whether each change is automatic (triggered by predefined criteria without human sign-off) or manual, and whether it applies homogenously across all deployments or only to local, site-specific adaptations.
- Impact Assessment: Show how each planned modification affects safety and effectiveness, and tie that assessment to a specific verification or validation activity with a pre-defined acceptance threshold.
Reviewers consistently ask how a manufacturer will detect and respond to model drift, so anticipate that question directly in your protocol rather than waiting for it to surface in review correspondence.
Pro Tip: Before submitting a PCCP, request a Q-Submission meeting specifically to confirm your acceptance criteria and modification boundaries. Getting informal FDA feedback on scope before your formal submission saves months compared to discovering a scoping problem mid-review.
Where Does CDS Fit in FDA's AI and SaMD Regulatory Approach?
CDS software does not exist in a separate regulatory universe from FDA's broader software-as-a-medical-device framework. The FDA's AI/SaMD resource hub ties CDS enforcement decisions directly to the agency's AI/ML action plan, Good Machine Learning Practice principles, and transparency expectations for AI-enabled devices.
- Intended use and patient risk, not model complexity, determine whether a function needs premarket review, whether it uses a large language model or a simple rules engine.
- AI-enabled devices increasingly need public transparency summaries, including disclosure of whether a foundation model underlies the output.
- Good ML practice principles inform how reviewers evaluate your training data representativeness and your plan for detecting performance drift over time.
- A well-scoped PCCP is the primary mechanism the FDA offers for managing AI lifecycle changes without repeated resubmission.
How Do You Determine If Your Software Function Is a Device?
Run every distinct software function, not your whole product, through this sequence before you finalize your intended-use claim:
- Identify your intended user. Is the recommendation going to a licensed healthcare provider or directly to a patient or caregiver?
- Map your inputs. Do you ingest images, IVD signals, or raw waveform data anywhere in the pipeline?
- Characterize your output. Is it a specific directive or a set of contextualized options a clinician evaluates?
- Assess time sensitivity. Does a delay in acting on the output create meaningful clinical risk?
- Trace your basis. Can you point to the specific guideline, study, or reference driving each recommendation?
- Evaluate clinical context. Does the function operate in an emergency, critical-care, or otherwise high-stakes setting?
- Review your labeling and interface. Does the clinician see enough information to independently judge the recommendation?
Overlapping guidances, particularly those covering mobile medical apps and general wellness products, sometimes apply alongside CDS criteria, so run the Digital Health Policy Navigator checklist rather than relying on the CDS guidance in isolation.
Pro Tip: Document every step of this checklist in writing, even the ones with obvious answers. Reviewers and investors alike will ask how you reached your non-device conclusion, and a paper trail beats a verbal explanation every time.
Red flags that point strongly toward device status: any image or IVD input, any output tied to an urgent clinical window, and any inability to show your work behind a recommendation.
What Documentation Should You Prepare Before Submission?
Whether you are arguing for non-device status or preparing a premarket submission, the artifacts you need overlap heavily, so choosing the right virtual data room software can streamline secure file exchange and documentation management. Building them early, well before a reviewer asks, shortens every conversation that follows.
- A precise intended-use statement that names the user, the clinical context, and the decision the software supports.
- A clinical-basis dossier citing the specific guidelines or literature behind each recommendation category.
- Transparency and usability documentation showing how a clinician sees and evaluates the basis for output.
- Performance validation reports, including bias and representativeness testing across your training and evaluation populations.
- Human factors and usability testing results tied to your actual interface, not a wireframe.
- A draft PCCP or, at minimum, a change-management plan describing how you will handle model or logic updates.
| Artifact | Prepared for | Primary risk if missing |
|---|---|---|
| Intended-use statement | Non-device argument and submissions | Misclassification, delayed review |
| Clinical-basis dossier | Criterion 2 compliance | Reviewer challenge on evidence source |
| Usability/transparency notes | Criterion 4 compliance | Failed independent-review argument |
| Validation and bias reports | Premarket submissions | Performance or equity concerns |
| PCCP or change plan | AI-enabled functions | Resubmission for every model update |
Postmarket, build a monitoring plan that tracks performance signals against your validation baseline, maintains version control across every model iteration, and updates labeling whenever a PCCP-authorized change shifts the tool's behavior.
Which FDA Pathway Applies If Your CDS Function Is a Device?
Once a function fails one of the four criteria, you are choosing among 510(k), De Novo, and PMA, and the choice depends on risk and precedent.
- 510(k) fits most software-driven CDS devices with a reasonably close predicate, where substantial equivalence rests heavily on documented software validation and comparable intended use.
- De Novo applies when your device has no predicate but presents moderate risk that general controls, plus special controls, can adequately manage.
- PMA is reserved for high-risk functions, typically those tied to life-sustaining decisions or diagnostic conclusions with no reasonable predicate pathway.
- A cleared or authorized PCCP shapes what reviewers expect postmarket, since it preauthorizes specific future changes rather than requiring a new submission for each one.
- Resourcing varies widely by pathway. A straightforward 510(k) with a strong predicate moves faster than a De Novo request building a new risk classification from scratch.
Where Can You Find the Primary FDA Resources and How Do You Request a Q-Submission?
Start with the CDS guidance, the FAQ page, the PCCP guidance, and the AI/SaMD resource hub, then review the FDA's March 2026 town hall notes for stakeholder Q&A.
- Bring a clear intended-use statement and your criteria mapping to any Q-Submission meeting.
- Sequence your work: clarify intended use, draft core documentation, plan validation, then request FDA input.
- Ask FDA directly about PCCP scope boundaries before finalizing your modification protocol.
What Should Early-Stage Healthtech Teams Prioritize Now?
Founders come to us convinced their AI is the hard problem. It rarely is. The hard problem is usually a fuzzy intended-use statement that nobody can defend under questioning, months into development.
Three priorities matter most after this guidance update: nail your intended-use language before you write another line of product copy, scope your PCCP early rather than as an afterthought, and design your interface for clinician review from day one, not as a compliance patch later. Fractional regulatory or clinical leadership catches these gaps before they cost a funding round or a review cycle. Teams we have advised through clinical use case development consistently move faster once intended use is locked down early.
— Paul Bergeron MD, MBA
How Can The StartupMD Help With CDS Regulatory Strategy?
The StartupMD is the alternative to guessing your way through FDA classification. Instead of hiring a full-time Chief Medical Officer before you have product-market fit, you get fractional clinical and regulatory leadership scoped to exactly what your CDS product needs right now: intended-use clarity, PCCP strategy for your AI models, and usability documentation reviewers actually accept.
Paul Bergeron, MD, MBA brings extensive medical and business experience to engagements that range from a regulatory readiness review to fractional CMO support. Regulatory classification is an important consideration for investors during fundraising. If you are preparing for a raise, start with the Healthcare SaaS Revenue Model Evaluation: 2026 Investor Guide to see how regulatory readiness fits into the metrics investors evaluate. Reach out to scope an engagement built around your product's actual stage and risk profile.
This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.