FDA Software as a Medical Device (SaMD) is the regulatory framework that classifies software whose intended use is one or more of the following: to diagnose, prevent, monitor, treat, or alleviate disease — without being part of a hardware medical device. Clinical AI crosses into SaMD territory when the AI’s output drives a clinical decision, and the level of regulatory scrutiny depends on the IMDRF risk classification (Class I through Class IV based on healthcare situation severity and information significance). The 2026 production pathway includes 510(k) for moderate-risk clinical AI with predicate devices, De Novo for novel moderate-risk AI without predicates, and Pre-Submission engagement (Q-Sub) for early FDA dialogue on regulatory pathway. Predetermined Change Control Plans (PCCPs) — letting manufacturers update models within bounds defined in the original submission — are now a routine part of submissions for AI medical devices. Validation methodology is rigorous: prospective protocol pre-specification, gold-standard label adjudication, validation across the intended population, fairness assessment across subgroups, and post-market surveillance commitments.

The FDA SaMD pathway has matured substantially in 2024–2026 from “the regulatory wall most clinical AI hits eventually” to “a predictable pathway with defined methodology and well-understood timelines.” Multiple AI imaging products, AI predictive products, AI clinical decision support tools, and AI sepsis early-warning systems have been cleared through 510(k) or De Novo since 2023, establishing precedent that subsequent submissions build on.

This guide is the engineer’s reference Taction Software® uses with buyers scoping clinical AI use cases that may cross the SaMD line. It covers when SaMD applies, the classification framework, the submission pathways, the PCCP framework, the validation methodology, and the engineering implications for the prototype-to-production progression.

When SaMD Applies and When It Doesn’t

The first question on any clinical AI engagement: does this use case cross the SaMD line. The answer depends on intended use, risk classification, and the position of the human clinician in the decision loop.

Use cases that cross the SaMD line.

AI that produces a diagnosis (sepsis present / absent, stroke present / absent, fracture present / absent) used by a clinician to drive treatment decisions.
AI that produces a treatment recommendation (specific drug, specific dose, specific procedure) for clinician review.
AI that produces a risk score (readmission risk, deterioration probability, mortality risk) used to drive clinical action.
AI that triages or prioritizes patients for clinical attention (worklist priority, alert routing).
AI that monitors clinical state for changes warranting intervention (continuous monitoring, sepsis surveillance, deterioration prediction).

Use cases that typically don’t cross the SaMD line.

AI that drafts clinical documentation for clinician review without offering clinical recommendations (ambient documentation that transcribes the encounter without diagnostic suggestions).
AI that handles administrative or operational tasks (prior-auth letter drafting, coding suggestion based on documented encounter, scheduling, workflow management).
AI that operates on de-identified retrospective data for population analysis, research, or quality improvement.
AI used for clinician education, decision support reference (drug interaction lookup, guideline summarization without patient-specific recommendations), or training simulation.
AI that operates outside the clinical decision loop (operational analytics, fraud detection, claims processing).

The middle ground. Several use cases hover at the line and require careful framing. Clinical decision support that displays peer-reviewed guidelines based on patient context may qualify for the §3060 Cures Act exemption from device classification if specific criteria are met (the clinician can review the basis for the recommendation, the recommendation is not a primary basis for diagnosis or treatment, etc.). Clinical decision support that crosses one of those criteria is SaMD. The framing of “intended use” — what the developer claims the AI is for — drives the classification more than the underlying technology.

The framing matters because intended use is a contractual commitment in the FDA submission. A developer who labels their AI “for informational reference only” and then markets it for clinical decision-making creates regulatory exposure beyond the FDA’s reach. The honest framing of intended use is the starting point.

The IMDRF Risk Classification Framework

FDA’s classification of SaMD draws from the International Medical Device Regulators Forum (IMDRF) framework. Two dimensions determine the risk class:

Significance of information provided to healthcare decision.

To inform clinical management — the SaMD output is one of multiple sources informing the decision.
To drive clinical management — the SaMD output is the primary driver of the clinical decision.
To diagnose or treat — the SaMD output is itself the diagnosis or directly drives treatment.

State of healthcare situation or condition.

Non-serious situation — chronic conditions where slow degradation is acceptable.
Serious situation — significant impact if the SaMD fails (heart disease, cancer, etc., outside critical/emergent contexts).
Critical situation — life-threatening, time-sensitive contexts.

The combination produces a 3×3 matrix yielding four classes (I–IV):

Class I (lowest risk) — non-serious + inform.
Class II — serious + inform OR non-serious + drive.
Class III — critical + inform OR serious + drive OR non-serious + diagnose/treat.
Class IV (highest risk) — critical + drive OR serious + diagnose/treat OR critical + diagnose/treat.

In FDA practice, the classification maps roughly to:

Class I → Class I medical device (lowest regulatory burden, often de novo simple).
Class II → Class II (510(k) pathway in many cases).
Class III–IV → Class II or Class III (510(k) with substantial requirements, or PMA in highest-risk cases).

For most clinical AI in 2026 production, Class II / 510(k) is the dominant pathway. The very-highest-risk AI (autonomous diagnostic, autonomous treatment driving) is rarely shipped today; the pathway exists but the bar is high.

The Submission Pathways

Three FDA pathways cover most clinical AI submissions in 2026.

510(k) Premarket Notification

The most common pathway. Used when there is a substantially equivalent predicate device — an existing FDA-cleared device with similar intended use and technological characteristics. The submission demonstrates that the new device is as safe and effective as the predicate.

For clinical AI, 510(k) submissions typically include:

Indications for use statement.
Device description (hardware, software architecture, model architecture).
Comparison to predicate device(s).
Performance testing (accuracy, sensitivity, specificity, calibration, subgroup performance).
Software documentation (per FDA’s general principles of software validation guidance).
Cybersecurity documentation (per FDA’s cybersecurity guidance).
Labeling.
510(k) summary.

Timeline: typically 6–12 months from submission to clearance. Pre-submission engagement (see below) shortens the path materially by addressing FDA questions before formal submission.

De Novo Classification

Used when the AI is novel — no substantially equivalent predicate exists. The De Novo pathway lets FDA classify a device that would otherwise be Class III by default into Class I or Class II based on a risk assessment. After De Novo clearance, the device can serve as a predicate for subsequent 510(k) submissions.

De Novo submissions are more involved than 510(k) — typically 9–18 months from submission to clearance. The first AI in a novel category typically goes De Novo; subsequent entrants benefit from the predicate.

Pre-Submission (Q-Sub)

Not a clearance pathway, but a structured FDA engagement that runs before submission. The developer submits questions to FDA covering the intended use, the proposed validation methodology, the data sets, the statistical approach, and any regulatory pathway questions. FDA provides feedback in writing or via a meeting.

Q-Sub engagement is the single highest-leverage activity in the SaMD pathway for clinical AI. A 9-month Q-Sub engagement before formal submission can compress the formal review timeline materially because the major methodological questions are settled before submission. Most AI medical devices cleared since 2023 used Q-Sub; the pattern has become standard practice.

Predetermined Change Control Plans (PCCPs)

The PCCP framework — finalized by FDA in late 2024 — is one of the most important developments for AI medical devices. It addresses the core tension between AI’s iteration speed and the FDA’s clearance-per-major-change traditional model.

A PCCP, included in the original 510(k) or De Novo submission, predefines the types of modifications the manufacturer plans to make post-clearance and the methodology for validating those modifications. Within the bounds of the PCCP, the manufacturer can update the AI without requiring a new clearance.

What a PCCP typically covers:

Change types. What kinds of changes are anticipated (model retraining on new data, threshold re-tuning, expansion to new patient populations within the cleared indication, performance improvements within the cleared performance envelope).
Modification protocol. The methodology for validating each change type — what data, what tests, what acceptance criteria.
Performance envelope. The bounds within which the device’s performance will remain after modification (no decrease beyond X% on pre-specified metrics, no degradation in subgroup performance below Y, etc.).
Update communication plan. How the manufacturer communicates changes to users.
Real-world performance monitoring. How the manufacturer tracks performance in deployed use to detect drift.

What a PCCP typically excludes. Changes that would meaningfully alter intended use, indications, target population, or risk profile typically remain outside the PCCP and require a new submission.

The PCCP framework is what makes AI medical devices economically viable in the FDA pathway. Without it, every model retrain would trigger new clearance — making the regulatory cost of normal AI iteration prohibitive. With it, AI medical device manufacturers can iterate within defined bounds at the same speed as software competitors.

Validation Methodology for SaMD-Track Clinical AI

The validation methodology that distinguishes SaMD-cleared clinical AI from non-cleared clinical AI is rigorous. The methodology shapes the engineering effort from prototype through production.

Pre-Specified Protocol

Before any validation testing runs, the protocol is specified in writing — what tests, what data sets, what statistics, what acceptance criteria. The pre-specification protects against post-hoc analysis that finds favorable results in the data after the fact. FDA reviewers expect to see the protocol, the data, and the analysis exactly matching what was pre-specified.

Gold-Standard Label Adjudication

Validation requires comparing the AI’s output to a gold-standard label. The gold-standard adjudication methodology is itself a critical artifact — typically two or three clinician reviewers independently labeling each case, with a structured disagreement-resolution methodology when reviewers disagree. Single-reviewer gold standards rarely survive FDA scrutiny.

Independent Validation Set

The validation runs on a held-out test set that was not used during model development or hyperparameter tuning. The held-out set is locked at the start of validation; no model iteration touches it. The split-from-development data set has to be representative of the intended-use population.

Subgroup Performance Reporting

Performance is reported across the protected characteristics (age, sex, race/ethnicity where ascertainable) and across clinical strata (severity, comorbidity, disease subtype). Subgroup performance has to be acceptable across the strata, not just on average. Disparities in subgroup performance are increasingly investigated by FDA.

Calibration and Decision-Curve Analysis (Where Applicable)

For probabilistic outputs (risk scores, probability estimates), calibration is reported alongside discrimination. Decision-curve analysis at the clinical threshold the device will use shows the net benefit of the AI’s recommendations vs. existing clinical practice.

External Validation

Beyond internal held-out testing, external validation — testing on data from sites or populations not represented in development — is increasingly expected for clinical AI clearance. The external validation often happens in collaboration with academic medical centers participating in FDA’s MDUFA programs.

Real-World Performance Monitoring

Post-clearance, the manufacturer commits to monitoring real-world performance and reporting drift, subgroup-performance changes, or unexpected failure modes. The monitoring plan is part of the submission.

The Engineering Implications

The FDA pathway has specific implications for the prototype-to-production progression.

At the Prototype Stage

For use cases that may cross the SaMD line, the prototype’s validation methodology has to be FDA-aligned from week 1. Specifically:

The eval test set is constructed to support eventual submission — adequate size, representative of intended use, with gold-standard labels adjudicated by clinician reviewers.
Subgroup performance is measured and reported, even if performance gaps are not yet addressed.
Calibration is measured for probabilistic outputs.
Documentation of the methodology is structured to support eventual submission — pre-specified protocols, data set descriptions, analysis plans.

The cost addition over a non-FDA-aligned prototype: typically $20,000–$60,000 in additional methodology and clinician-reviewer engagement. Treating SaMD-aligned methodology as an afterthought at the production stage typically requires repeating the validation work — which is much more expensive than building it correctly in the first place.

At the MVP Stage

The MVP includes the production-grade engineering for the SaMD pathway: the pre-specified validation protocol, the locked validation data set, the structured methodology documentation, the cybersecurity controls (per FDA’s cybersecurity guidance for medical devices), and the documentation supporting the eventual submission.

At the Production Stage

The production deployment includes:

The PCCP defining the performance envelope and modification methodology.
The post-market surveillance plan with quarterly drift monitoring and annual review.
The 510(k) or De Novo submission preparation work, often running in parallel with the production deployment.

For institutions with limited FDA experience, the typical pattern is partnership with a regulatory consultant alongside the engineering team. The engineering work — the model, the validation, the architecture — Taction handles. The regulatory consulting, FDA-meeting strategy, and submission writing typically come from a specialist regulatory firm. The two work together; neither substitutes for the other.

When SaMD Pathway Is Worth the Investment

The SaMD pathway is cost-justified for clinical AI use cases with three properties.

Property 1 — The use case is intrinsically clinical. The AI’s output drives clinical decisions. There is no operational-only framing that would avoid the SaMD pathway. Sepsis early-warning, stroke detection, AI-driven diagnostic recommendations all qualify.

Property 2 — The market opportunity justifies the regulatory cost. The total cost of FDA clearance for a Class II 510(k) clinical AI device runs $200,000–$800,000 in regulatory and engineering work, depending on novelty, predicate availability, and validation scope. The market opportunity at scale has to substantially exceed this — typically a market that supports tens of millions of dollars of annual revenue at maturity.

Property 3 — The deployment context requires it. Some buyers (large enterprise health systems, payers, large healthtech companies with regulated products) require FDA clearance as a procurement gate. Others (innovation-team pilots, internal-only deployments, research applications) do not. The SaMD pathway is more often pursued when the deployment context demands it than when it is technically required.

For use cases where SaMD is required and economically justified, the pathway is well-defined and the timelines are predictable. For use cases where SaMD is not required, sticking to the SaMD-adjacent compliance posture (HIPAA, clinical accuracy validation, audit logging) without pursuing actual FDA clearance is the right operational decision.

Common Mistakes in SaMD Engagements

Five patterns Taction’s engagements catch in customer scoping conversations.

Mistake 1 — Defaulting away from SaMD when the intended use clearly requires it. A team scopes a clinical decision support feature with the framing “for informational reference only” to avoid SaMD classification — then markets it for clinical decision-making. The framing doesn’t survive FDA scrutiny if a complaint, adverse event, or competitor referral triggers FDA review. Resolution: honest framing of intended use from week 1.

Mistake 2 — Treating SaMD methodology as a phase-2 retrofit. A team builds the prototype and MVP with non-SaMD-aligned methodology, then plans to “add the FDA work later.” Retrofitting requires rebuilding the validation data set, re-running the methodology, and often re-engaging the clinician reviewers. Resolution: SaMD-aligned methodology is built in from week 1 if the use case is in scope.

Mistake 3 — Underestimating the regulatory cost. A team budgets $50,000 for the FDA clearance work. The actual cost runs $200,000–$800,000+. Resolution: regulatory cost is part of the production-readiness gap assessment from the prototype stage.

Mistake 4 — Skipping Pre-Submission engagement. A team submits formally without prior FDA engagement and discovers methodological questions in the FDA review that could have been addressed in advance. Resolution: Q-Sub engagement is standard practice for AI medical devices in 2026.

Mistake 5 — Not building PCCP into the original submission. A team gets initial clearance without a PCCP and discovers that every model retrain requires a new submission. Resolution: PCCP is part of the original submission scope.

The fix in every case is the same: SaMD pathway awareness is part of the project scope from week 1, not a post-clearance retrofit.

The Decision Framework

The framework Taction’s engineering team applies when scoping a clinical AI engagement that may cross the SaMD line.

Step 1 — Assess intended use. Is the AI’s output driving clinical decisions, or is it operational/administrative?

Step 2 — If intended use is clinical, classify under IMDRF. Significance of information × state of healthcare situation = risk class (I–IV).

Step 3 — Assess predicate availability. Are there cleared devices with substantially equivalent intended use and technology? Predicate availability favors 510(k); absence favors De Novo.

Step 4 — Engage FDA via Pre-Submission. Q-Sub addresses the major methodological questions before formal submission. The engagement is the highest-leverage activity in the pathway.

Step 5 — Build PCCP into the original submission. Define the performance envelope, the modification methodology, and the post-market monitoring plan.

Step 6 — Run validation per the FDA-aligned methodology. Pre-specified protocol, gold-standard adjudication, held-out test set, subgroup performance, calibration, external validation where appropriate.

Step 7 — Submit, respond to FDA questions, achieve clearance. Typical timeline: 9–18 months for the formal review phase, depending on pathway and complexity.

The decision framework above is the structured progression for SaMD-track clinical AI in 2026. Each step is well-defined; each artifact is well-understood. The engagement that runs the framework rigorously produces clearance; the engagement that skips steps produces FDA review questions that compress the timeline by months.

Closing

The FDA SaMD pathway for clinical AI in 2026 is a predictable engineering and regulatory exercise — not the regulatory wall it once was. The classification framework is well-defined, the submission pathways are well-understood, the PCCP framework supports normal AI iteration, and the validation methodology is rigorous but reproducible.

Buyers building clinical AI use cases that cross the SaMD line should plan the regulatory work from week 1 of the prototype, not as a phase-2 retrofit. Buyers building use cases that don’t cross the line should maintain SaMD-adjacent compliance posture (HIPAA, clinical accuracy validation, audit logging) without pursuing actual FDA clearance. The two paths diverge early; recognizing which path the use case is on is the highest-leverage scoping decision.

If you are scoping a clinical AI use case that may cross the SaMD line and want a partner who handles the FDA-aligned methodology from week 1, book a 60-minute scoping call. Taction Software has shipped 785+ healthcare implementations since 2013, with 200+ EHR integrations across Epic, Cerner-Oracle, Athena, and Allscripts, zero HIPAA findings on shipped software, and active BAA paper trails with every major AI provider. Our healthcare engineering team handles SaMD-aligned validation methodology as default scope on regulated-track engagements; for the FDA strategy and submission writing, we partner with specialist regulatory consultants. Our verified case studies cover the production deployments behind these patterns. For the engineering scope behind the engagement, see our healthcare software development practice and our hospital and health-system practice for the operational context. For the data integration patterns this work depends on, see our healthcare data integration practice. For an estimate against your specific use case, see the healthcare engineering cost calculator. For deeper context, see our broader generative AI healthcare applications work.

FDA SaMD for Clinical AI: When the Pathway Applies, How to Navigate It, and What the 2026 Engineer Needs to Know