FDA Artificial Intelligence Guidance for AI-Enabled Medical Devices
FDA Guidance on AI-Enabled Medical Devices: Lifecycle Management & Marketing Submissions
In January 2025 the FDA released draft guidance on AI-enabled device software functions, titled "Lifecycle Management and Marketing Submission Recommendations." It explains what documentation the FDA recommends in marketing submissions for AI-enabled devices, and it gives recommendations on transparency and on reducing bias throughout a product's lifecycle. The guidance rests on a Total Product Lifecycle (TPLC) approach, treating an AI-enabled device as something to manage from design through post-market use, not just at clearance.
Two points to keep in mind:
- It is draft guidance. It reflects the FDA's current thinking and uses recommendations ("should"), not binding requirements. Check its status before relying on it, as final versions can differ.
- It applies across submission types. It covers marketing submissions such as 510(k), De Novo, and premarket approval (PMA).
What Are AI-Enabled Devices and AI-Enabled Software Functions?
An AI-enabled device is a device that includes one or more AI-enabled device software functions. An AI-enabled device software function (AI-DSF) is a device software function that implements one or more AI models to achieve its intended purpose. The term covers software as a medical device (SaMD), software in a medical device (SiMD), and the device part of combination products.
Typical examples are software that reads medical images to flag findings, algorithms that interpret ECG signals, and tools that predict risk from patient data.
Why FDA Guidance on AI Matters
AI-enabled devices rely on complex algorithms to analyze medical data and provide insights. That can improve healthcare outcomes, but it also raises three important questions:
- How do we ensure these devices work as intended?
- What documentation is needed for FDA authorization?
- How can manufacturers demonstrate the safety and effectiveness of their AI models?
AI adds challenges that conventional software does not. Models learn from data, so gaps or imbalances in that data can cause bias. Performance can degrade after release if real-world data changes, and users may not understand how a result was produced. The FDA's guidance aims to address these concerns by recommending good practice for documentation and submissions.
What Does the FDA Artificial Intelligence Guidance Cover?
AI-Enabled Device Lifecycle Management
The guidance treats AI-enabled devices through the total product lifecycle:
- Development: data selection and management, model training and tuning, and validation, following good machine learning practice
- Premarket: evidence supporting safety and effectiveness
- Change management: planned modifications, ideally described in a predetermined change control plan (PCCP)
- Post-market: real-world performance monitoring, including detection of drift, feeding data back into improvement
This works within the manufacturer's quality management system, not beside it.
Marketing Submission Considerations
The guidance sets out what to include in a marketing submission and where to put it. The recommended content areas are:
- Device description
- User interface and labeling
- Risk assessment
- Data management
- Model description and development
- Validation
- Device performance monitoring
- Cybersecurity
- A public submission summary
It also recommends using an AI "model card" as a clear, structured way to present key information in the labeling. Manufacturers can use a Pre-Submission to get FDA feedback before filing.
Safety, Effectiveness, and Risk Management
The guidance ties everything to risk management. Risks specific to AI include bias, incorrect outputs, poor generalization to new patients or settings, drift over time, and cybersecurity threats. Manufacturers are expected to assess these risks, control them, and show the results through performance validation. The FDA also encourages evidence that the device performs consistently across relevant patient groups, such as different races, ethnicities, sexes, and ages.
AI Enabled Device Marketing Submission Content Recommendations
The recommendations fall into eight areas. Use them as a checklist for the documents you assemble.
1. Quality Management System (QMS) Documentation
Manufacturers should show that device development follows a robust quality management system. Since February 2026, this means the QMSR (21 CFR Part 820), which is built on ISO 13485. The QMS should include:
- Design controls showing the device meets user needs and its intended use. This involves documenting all design processes and building in iterative improvements based on testing feedback.
- A risk management process, commonly based on ISO 14971, to identify and address risks from AI algorithms, such as bias, incorrect outputs, and cybersecurity vulnerabilities. Risk management should be ongoing across the device lifecycle.
- A software development life cycle procedure, usually aligned with IEC 62304, that standardizes AI model development, training, testing, and maintenance to ensure consistency, robustness, and reliability.
2. Device Description
A detailed device description is critical. It should include:
- The medical conditions the device is intended to diagnose, monitor, or treat, and the specific patient populations it serves
- The AI model's role in device operation, including how inputs are processed and how outputs contribute to clinical decision-making
- A summary of hardware and software dependencies, processing capabilities, interoperability features, and system configurations
- The intended use environment, such as a clinical or home setting
3. Data Management
Data is a key component of AI-enabled devices, so manufacturers should document:
- Data management practices, including data collection, processing, storage, control, and use
- A characterization of the data used to develop and validate the device
- Diverse patient populations, to avoid bias and improve generalizability across demographics and clinical settings
- Standardization techniques, quality control measures, and annotation guidelines that keep training data consistent and accurate
- Methods to detect and reduce bias, such as analyzing performance across subgroups and adjusting datasets accordingly
- Clear separation between training, tuning, and test data, so validation results are not inflated
4. Model Description and Development
To support review and transparency, document key aspects of model development:
- The rationale for choosing a specific AI architecture and learning method, supported by comparative analysis and prior research
- An explanation of the learning process, hyperparameter tuning, and strategies used to improve accuracy and reduce errors
- Performance benchmarks, including key metrics such as accuracy, sensitivity, specificity, and robustness
5. Performance Validation and Risk Assessment
A crucial part of the submission is proving that the device consistently meets its predefined safety and performance goals. That involves:
- Rigorous testing in simulated and real-world conditions to confirm outputs align with accepted medical standards
- Evidence that the model performs as intended and supports the claimed benefit, compared with an appropriate reference standard or existing approach where relevant
- Addressing failure points such as model drift, where performance degrades over time as data evolves, and incorrect predictions that could affect patient safety
- Pre-specified validation methods, not methods chosen after seeing the results
- Subgroup analysis to show consistent performance across patient populations and clinical environments
Well-documented validation studies help the FDA judge whether the device performs consistently across those groups. The risk assessment should cover AI-specific hazards and how each is controlled.
6. User Interface and Labeling
A well-designed interface and clear labeling are crucial so that clinicians and patients can use AI devices effectively. The guidance recommends:
- Step-by-step instructions for installation, operation, and maintenance
- Clear instructions for use, and transparency about how the AI model operates
- A clear statement of the model's capabilities, limitations, and expected performance metrics, which a model card can present
- Warnings and disclaimers to manage user expectations and prevent misuse
Usability engineering supports this. Formative and summative evaluation can show users understand the outputs and their limits.
7. Device Performance Monitoring
AI-enabled devices should be monitored continuously after release to make sure they stay accurate and reliable. Manufacturers can do this by:
- Collecting post-market data to spot performance variations, detect model drift, and confirm reliability across patient populations
- Establishing structured reporting for malfunctions, adverse events, and software updates
- Refining models with new data while making sure every modification meets regulatory requirements, ideally under an authorized PCCP
A performance monitoring plan is part of the recommended submission content.
8. Cybersecurity Considerations
AI-enabled devices handle sensitive patient data, so cybersecurity is a top priority. The guidance points to:
- Robust security protocols to detect and mitigate cyber threats
- Encryption, authentication, and access controls to prevent unauthorized breaches
- Secure data storage and transmission
- Preparation for cyber incidents through proactive monitoring, rapid response, and system recovery
It also flags AI-specific threats to address for cyber devices: data poisoning, model inversion or theft, model evasion, data leakage, overfitting, model bias, and performance drift. Connected devices must meet the FDA's broader cybersecurity requirements too, including an SBOM.
Key Considerations for AI-Enabled Medical Device Manufacturers
Data Quality and Bias
Bias usually starts in the data. Document where data came from, how it was labeled, and who is represented. Test performance across demographic and clinical subgroups, fix gaps by improving or rebalancing datasets, and keep checking after launch as populations change.
Model Performance and Validation
Plan validation before you run it. Keep test data separate from training data, choose meaningful metrics, and test in conditions that resemble real use. Show performance for the intended population, and set out how you will detect and respond to drift.
Transparency and Human Oversight
Users need to understand what the AI does, what it does not do, and how well it performs. Use clear labeling and a model card, describe how a clinician stays in control, and test the interface through usability engineering so results are not over-trusted or misread.
Cybersecurity and Patient Safety
Treat security as a safety issue. Model tampering, poisoned training data, or leaked patient data can harm patients. Build security into design, plan for updates and patches, and connect your security risk process to ISO 14971 safety risk management.
Summary
The FDA's draft guidance gives manufacturers a roadmap for developing safe, effective AI-enabled medical devices. By focusing on comprehensive documentation, performance validation, bias control, and cybersecurity, companies can work through the regulatory process more efficiently. These recommendations are a foundation for AI-enabled device development, and they are essential for maintaining patient trust and regulatory compliance. Because the guidance is still evolving, manufacturers should review the FDA's current version and its final guidance on PCCPs for AI-enabled software before finalizing their plans.
Frequently Asked Questions About FDA Guidance on AI-Enabled Medical Devices
1. What does the FDA guidance on AI-enabled medical devices cover?
It covers the content of marketing submissions for devices that include AI-enabled software functions, and recommendations for designing, developing, and managing them across the total product lifecycle. Areas include device description, user interface and labeling, risk assessment, data management, model description and development, validation, performance monitoring, cybersecurity, and a public submission summary. It also sets out the FDA's thinking on transparency and bias.
2. Which AI-enabled medical devices are regulated by the FDA?
Software functions that meet the legal definition of a device are regulated, including AI-enabled SaMD, AI in SiMD, and the device part of combination products. Software that is not a device, such as some administrative or general wellness software, is outside device regulation. The guidance also does not apply to software used only in manufacturing or quality systems. How the device is regulated depends on its risk class, which determines whether it goes through a 510(k), De Novo, or premarket approval.
3. What are the FDA requirements for AI-enabled medical device submissions?
The statutory standards do not change: substantial equivalence for a 510(k), and reasonable assurance of safety and effectiveness for De Novo and PMA. The draft guidance recommends what evidence and documentation to provide:
- The eight content areas above, plus a public submission summary
- Software documentation at the right Basic or Enhanced level
- Cybersecurity and human factors documentation
- Evidence of quality system controls under the QMSR
- Optionally, a PCCP for planned model changes
The guidance is non-binding, and a Pre-Submission is a good way to confirm expectations for your product.
4. How does FDA guidance on AI address the lifecycle of AI-enabled medical devices?
It uses the total product lifecycle approach. Manufacturers follow good machine learning practice in development, validate before release, and plan for changes through change control or a PCCP. After launch, they monitor real-world performance, detect drift, handle complaints and adverse events, and update models under controlled procedures. All of this sits inside the quality management system, with risk management running throughout.
5. Does FDA guidance on AI address data quality and bias?
Yes. It stresses data management, meaning documenting how data was collected, processed, annotated, and stored. It asks for a characterization of the datasets, evidence that they represent the intended population, separation of training and test data, and analysis of performance across subgroups such as race, ethnicity, sex, and age. It also recommends bias detection and mitigation methods, ongoing monitoring after release, and transparency in labeling through tools like model cards.