FDA Software as a Medical Device (SaMD) Regulation

Record: software-cert-034 — FDA Software as a Medical Device (SaMD) regulation
Issuing body / enforcer: U.S. Food and Drug Administration, Center for Devices and Radiological Health (CDRH)
Jurisdiction: United States
Record type / importance: regulation / license
Last verified: 2026-09-30

What it is

FDA's framework for regulating software intended for medical purposes without being part of a hardware medical device — diagnostic algorithms, clinical decision support, digital therapeutics, image-analysis AI. If your software meets the statutory device definition (FD&C Act § 201(h): intended for diagnosis, cure, mitigation, treatment, or prevention of disease), it is a medical device and needs FDA clearance/approval before U.S. marketing — regardless of whether it runs on a phone, in the cloud, or embedded in a workflow. This is the regime that turns an ML model into a regulated product with premarket review, QMS, and postmarket surveillance duties.

Scope: who/what it applies to, triggers, thresholds

Trigger: intended use. Software is SaMD when the manufacturer intends it for a medical purpose independent of hardware. General wellness, administrative, EHR-data-storage, and certain clinical-decision-support functions meeting all four § 520(o)(1)(E) criteria are excluded from device definition.
Risk categorization (IMDRF SaMD framework, adopted by FDA): based on (a) significance of the information provided (treat/diagnose → drive clinical management → inform clinical management) and (b) healthcare situation (critical → serious → non-serious) — yielding Categories I–IV that drive the regulatory pathway.
Pathways: 510(k) (substantial equivalence, most common), De Novo (novel low/moderate risk), PMA (high risk), plus enforcement-discretion categories FDA has carved out (some low-risk CDS and wellness-adjacent functions).

Key requirements and compliance obligations

Premarket: 510(k)/De Novo/PMA submission with software documentation per FDA's software guidance (documentation level scaled to risk), cybersecurity documentation, and for AI/ML — the predetermined change control plan (PCCP) mechanism allowing pre-authorized model updates without new submissions.
QMS: design controls under the FDA QMSR (21 CFR Part 820) — see the shared brief shared/fda-qmsr-21-cfr-820.md; SaMD manufacturers must run a compliant QMS covering design, verification/validation, risk management (ISO 14971), and software lifecycle processes (IEC 62304).
AI/ML-specific: FDA's 2021 AI/ML action plan and subsequent guidance set expectations for transparency, bias evaluation across subpopulations, real-world performance monitoring, and update governance. As of 2026 FDA has authorized hundreds of AI/ML-enabled devices (the agency's public list tracks authorizations).
Postmarket: medical device reporting (MDR, 21 CFR 803), corrections/removals reporting, complaint handling, and cybersecurity postmarket obligations including coordinated vulnerability disclosure.
Labeling and promotion: claims must match cleared intended use — off-label promotion of SaMD functions is a misbranding risk.

Penalties and consequences

Marketing an uncleared device: FDA enforcement via warning letters, import detention, seizure, injunction, and civil money penalties; criminal referral for knowing violations.
Postmarket: failure to report (MDR) draws warning letters and can support enforcement; cybersecurity deficiencies are increasingly cited in inspections.
Commercial: hospital procurement universally requires FDA clearance evidence for regulated functions — no clearance, no enterprise deals.

Version/edition status and LIVE changes (verified 2026-09-30)

The QMSR (21 CFR Part 820) final rule took effect February 2, 2026, harmonizing FDA QMS requirements with ISO 13485:2016 — SaMD manufacturers' QMS obligations now run under the QMSR framework (see shared FDA QMSR brief).
FDA's AI/ML guidance continues to evolve: the PCCP framework (finalized guidance) is the live mechanism for adaptive algorithms; draft guidance on predetermined change control and on AI/ML transparency has been moving through 2024–2026. The agency's authorized-AI/ML-device list is the best public signal of what review divisions currently accept.
Watch: the intersection with the EU AI Act — SaMD with AI safety-component functions is Annex I high-risk under the AI Act (obligations from Aug 2028), creating a dual FDA + EU-AI-Act compliance stack for AI diagnostics sold in Europe.

No catalogue software certification is SaMD-specific. Adjacent: CISSP (software-cert-010) for the cybersecurity-documentation domain. The domain-native credentials (regulatory-affairs certifications, ASQ biomedical auditor) sit in other disciplines' tiers.

Honest flags

The "hundreds of AI/ML-enabled devices" figure reflects FDA's published running list; the exact count moves monthly and was not pinned to a date here. PCCP acceptance criteria remain review-division-dependent in practice — guidance describes the mechanism, not guaranteed outcomes.

Original ETS reference writing, verified against public sources on 2026-09-30. Thin sourcing is flagged inline. Not legal advice — confirm current editions with the issuing body.

FDA Software as a Medical Device (SaMD) Regulation