FDA AI Medical Device Guidance: How AI Tools Get Approved

Here is the problem the FDA AI medical device guidance had to solve. Traditional medical devices don’t change. A pacemaker built in 2019 does exactly what it did when it was cleared. An AI model that gets retrained on new data becomes a different device, and under the old rules every retraining would require a new regulatory submission, which would make continuous improvement effectively illegal. The FDA’s answer is the Predetermined Change Control Plan, or PCCP. As the guidance puts it, “the FDA reviews the PCCP as part of a marketing submission for an AI-enabled device to ensure the continued safety and effectiveness of the device without necessitating additional marketing submissions for implementing each modification described in the PCCP.” That single mechanism is how AI medicine can update without going dark.

Key Takeaways

• The FDA publishes a searchable AI-Enabled Medical Devices List with over 800 authorized devices, downloadable as CSV, Excel, or XML. Roughly 70 to 75% are radiology.
• Three pathways apply: 510(k) premarket notification (the majority), De Novo (for novel device types), and PMA premarket approval (highest-risk devices).
• A PCCP must contain three things: a description of planned modifications, the modification methodology for developing and validating them, and an impact assessment of their effect on safety and effectiveness.
• With an approved PCCP, a manufacturer can implement the described changes without a new marketing submission, as long as the changes stay inside the plan.
• The PCCP guidance issued in August 2025 and applies across 510(k), De Novo, and PMA, including device components of device-led combination products.

Why AI broke the old device rules

Medical device regulation was built around a stable object. You submit evidence about a specific version of a specific thing, the FDA evaluates whether it’s safe and effective for its stated use, and then that thing gets manufactured to the same specification.

Machine learning violates that assumption at its core. The whole point of a learning system is that it improves when it sees more data. A radiology model trained on 100,000 chest X-rays in 2024 will be better if retrained on 400,000 by 2026. If retraining requires a fresh submission each time, one of two bad things happens: either manufacturers freeze their models and patients get worse performance than the technology allows, or updates happen informally outside the regulatory frame.

Neither is acceptable. So the FDA had to invent a way to approve a process for changing rather than only a frozen artifact.

How the FDA AI medical device guidance actually works, step by step

Step 1: Pick a pathway. Most AI devices go through 510(k), which requires showing substantial equivalence to an already-cleared predicate device. A genuinely new category with no predicate goes through De Novo. The highest-risk devices, where failure could kill someone directly, go through PMA, which requires clinical evidence of safety and effectiveness.

Step 2: Establish the baseline. The submission describes what the model does, how it was trained, what data it was trained and validated on, its performance metrics, and the clinical context of use. This is the version that gets authorized.

Step 3: Write the PCCP. This is the AI-specific piece, and it has exactly three required components.

The description of modifications says what will change. Not “we’ll improve the model,” but specifically: we will retrain on additional data from these sources, we will expand to these additional imaging devices, we will adjust these thresholds within these bounds.

The modification methodology says how each change will be developed, validated, and implemented. What test set, what performance threshold must be met, what happens if it isn’t, how the update reaches deployed devices.

The impact assessment evaluates how each planned modification affects safety and effectiveness, including for subpopulations.

Step 4: FDA reviews the plan as part of the submission. The agency is evaluating a promise about future behavior, which is why the methodology has to be specific enough to be auditable.

Step 5: Ship changes inside the plan. Once authorized, the manufacturer implements the described modifications without a new marketing submission, provided they align with the approved plan. A change outside the plan still requires a new submission.

What this gets right

It resolves a genuine conflict between continuous improvement and regulatory oversight, and it does so by demanding specificity in advance rather than forgiveness afterward. The requirement to write down the validation methodology before seeing whether the update works is a serious safeguard, because it prevents the retrospective picking of whichever metric happens to look good.

What it does not solve

The PCCP governs changes the manufacturer anticipated. It does not address distribution shift, where the world changes rather than the model: new imaging hardware, new patient populations, changing disease prevalence. It does not require post-market performance monitoring in any specific form. And the concentration of authorized devices in radiology (70 to 75%) reveals that this framework works best where the input is standardized and the ground truth is verifiable, which is much less true in pediatrics, psychiatry, or primary care.

Three regulatory pathways, compared

Pathway	When it applies	What’s required	Typical AI examples
510(k) premarket notification	A similar cleared device (a “predicate”) already exists	Demonstrate substantial equivalence in intended use and technological characteristics	Most AI radiology tools; the majority of the 800+ list
De Novo	Low-to-moderate risk, but no predicate exists	Full risk-benefit evaluation; creates a new device classification others can then use as a predicate	First-of-kind AI diagnostics
PMA premarket approval	Highest risk; failure could cause serious injury or death	Clinical trial evidence of safety and effectiveness	AI in life-sustaining or implanted devices
PCCP (added to any of the above)	The device’s model will be updated over time	Description of modifications, modification methodology, impact assessment	Any AI device planning retraining
Enforcement discretion / wellness	General wellness claims, not diagnosis or treatment	Not a device pathway; much lighter oversight	Step counters, sleep trackers, most consumer apps

The last row is the one families interact with most. A consumer app that says “this may help you sleep better” is not regulated like a device, and that gap is intentional and very wide.

How to Teach Your Kid About How Medical AI Gets Approved

Ages 5–8: The Recipe Rule

Tell your kid they can make their favorite snack for the family, but they must write the recipe down first and follow it exactly. Then the twist: tell them they may change one thing next time, but they have to say now what they’ll change and how they’ll know it worked. That’s a PCCP, and a 6-year-old can follow the logic completely.

Ages 9–12: Write a Change Plan

Have your kid pick something they want to improve: a paper airplane, a free-throw routine, a study habit. Before changing anything, have them write three things: what they will change, how they’ll test whether it’s better, and what could go wrong. Then let them make the change. The discipline of writing the test before running it is the single most valuable habit in this whole article.

Ages 13+: Search the FDA Database

The FDA’s AI-Enabled Medical Devices List is downloadable as a spreadsheet. Have your teen download it, count devices by specialty, and confirm the radiology concentration themselves. Then have them find a device with a “DEN” submission number (De Novo) and read its summary. Then read the PCCP guidance and find the three required components. This is real regulatory research, done in an afternoon, with public data.

The question to ask: “If a company promises now how it will test future changes, what stops it from changing its mind later?”

What to actually do at home

Learn the cleared/approved/unregulated distinction

“FDA cleared” usually means 510(k): equivalent to something already on the market. “FDA approved” usually means PMA: clinical evidence reviewed. “Not a medical device” means a wellness claim with light oversight. Health-app marketing exploits the confusion between these constantly, and a family that knows the difference is much harder to mislead.

Check whether a health app is a device at all

Most consumer health apps are not. If an app claims to detect, diagnose, or treat a condition, it should be on the FDA list. If it makes general wellness claims, it won’t be, and that’s legal. Searching the list takes two minutes and is a genuinely useful parenting skill.

Use the radiology concentration as a signal

Roughly 70 to 75% of authorized AI devices are radiology. That tells you where the technology actually works today: standardized images, verifiable ground truth. It also tells you where it doesn’t yet, which is the honest context for every claim about AI in pediatrics. Our piece on benchmark scores versus pediatric clinic reality covers that gap with numbers.

Connect it to how AI tools are evaluated in general

The PCCP idea (declare your test before you run it) is exactly what makes any evaluation trustworthy, in medicine or in school. It’s the same principle behind pre-registering a science-fair hypothesis. Our guide on how AI is already used in pediatric care shows the clinical end of the pipeline.

What not to do

Don’t assume FDA authorization means a device was tested on children. Pediatric performance is a separate question from authorization, and many AI devices are cleared on adult data. If a tool is being used in your child’s care, asking whether it was validated in pediatric populations is a precise, answerable, and entirely reasonable question.

What to Watch For Over the Next 3 Months

• Week 4: Your kid can explain why an AI device is harder to regulate than a pacemaker.
• Month 2 red flags: They treat “FDA cleared” and “FDA approved” as the same thing. They aren’t, and the difference is how much evidence was reviewed.
• Month 3 self-check: Ask them to find one AI device on the FDA list in a specialty that isn’t radiology, and explain why that specialty is harder. If they mention standardized inputs or verifiable ground truth, they’ve got it.

Frequently Asked Questions

What is a Predetermined Change Control Plan?

A plan, submitted and reviewed as part of a device’s marketing submission, that describes which future modifications the manufacturer intends to make, the methodology for developing and validating them, and an assessment of their impact on safety and effectiveness. Once authorized, those specific changes can be implemented without a new marketing submission.

How many AI medical devices has the FDA authorized?

Over 800, per the FDA’s own AI-Enabled Medical Devices List, which is published as a searchable database with CSV, Excel, and XML downloads. Roughly 70 to 75% are radiology devices, with cardiovascular, neurology, gastroenterology-urology, pathology, and several other specialties also represented.

What is the difference between FDA cleared and FDA approved?

“Cleared” generally refers to 510(k) clearance, where a manufacturer demonstrates substantial equivalence to an already-marketed predicate device. “Approved” generally refers to premarket approval (PMA), which requires clinical evidence of safety and effectiveness and applies to the highest-risk devices. De Novo sits between them for novel low-to-moderate-risk devices.

Does the FDA regulate health apps on my kid’s phone?

Usually not. Apps making general wellness claims, like encouraging exercise or tracking sleep, fall outside device regulation. Apps that claim to detect, diagnose, or treat a specific condition are regulated as devices and should appear on the FDA’s list. The line is the claim being made, not the technology used.

Was the AI in my child’s care tested on children?

Not necessarily, and this is worth asking. FDA authorization does not by itself guarantee pediatric validation, and much AI training data skews adult. Asking whether a specific tool was validated in pediatric populations, and in which age ranges, is a precise question a clinician or vendor should be able to answer.

---

About the author

Ricky Flores is the founder of HiWave Makers and an electrical engineer with 15+ years of experience building consumer technology at Apple, Samsung, and Texas Instruments. He writes about how kids learn to build, think, and create in a tech-saturated world. Read more at hiwavemakers.com.

---

Sources

1. U.S. Food and Drug Administration. “Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions” (August 2025). https://www.fda.gov/regulatory-information/search-fda-guidance-documents/marketing-submission-recommendations-predetermined-change-control-plan-artificial-intelligence
2. U.S. Food and Drug Administration. “Artificial Intelligence-Enabled Medical Devices” list and specialty breakdown. https://www.fda.gov/medical-devices/software-medical-device-samd/artificial-intelligence-enabled-medical-devices
3. U.S. Food and Drug Administration. Software as a Medical Device (SaMD) overview. https://www.fda.gov/medical-devices/digital-health-center-excellence/software-medical-device-samd
4. Crescendo AI healthcare news roundup. (2026, June 16). FDA expands resources and guidance for AI-enabled medical devices. https://www.crescendo.ai/news/ai-in-healthcare-news
5. Zhao, J., Luo, J., Li, Q., & Chen, Y. (2026, August 28). “Machine Learning, Large Language Models, and Multimodal AI for Diagnosing Pediatric Rare Diseases: Scoping Review.” Journal of Medical Internet Research. https://pmc.ncbi.nlm.nih.gov/articles/PMC13524366/
6. Arora, R. K., et al. (2025). “HealthBench.” arXiv. https://arxiv.org/abs/2505.08775