AI-Enabled Devices and the FDA's 510(k) Pathway

The overwhelming majority of AI-enabled medical devices authorised in the United States reached the market through a premarket notification — a 510(k) — rather than through premarket approval. That pathway asks a comparative question, and asking it about a learned model is genuinely awkward.

The substantial equivalence test

A 510(k) does not ask whether a device is safe and effective in the abstract. It asks whether it is substantially equivalent to a legally marketed predicate device. The test is in section 513(i) of the Federal Food, Drug, and Cosmetic Act, at 21 U.S.C. 360c(i), and it has a specific structure. The United States Code publishes section 360c.

The device must have the same intended use as the predicate, and then either the same technological characteristics, or different technological characteristics that do not raise different questions of safety and effectiveness, with information demonstrating that the device is as safe and effective as the predicate. Almost every interesting question about an AI-enabled device lands in that second branch.

Note the asymmetry. “Same intended use” is close to absolute: if your device is for a different clinical purpose, a different population or a different anatomy, there is no substantial equivalence and the pathway is unavailable regardless of how well the device performs. “Different technological characteristics” is negotiable, and the negotiation is entirely about the phrase different questions of safety and effectiveness.

Choosing a predicate for an AI device

Two situations arise and they are not equally comfortable.

The predicate is itself an AI-enabled device. This is now common — the FDA maintains a public list of AI-enabled medical devices it has authorised, which numbers in the many hundreds and is dominated by radiology. The FDA publishes and periodically updates that list. Here the technological characteristics are broadly the same class of thing, and the comparison turns on the performance evidence rather than on whether a learned model is an acceptable technology at all.

The predicate is a conventional device. Here you are asserting that replacing a rule-based or hardware-based function with a learned model does not raise different questions. That is the harder argument, and the questions a reviewer will raise are predictable: whether performance depends on the population the model was trained on in a way the predicate’s performance did not; whether failure modes are different in kind, in that a model fails silently and plausibly where a rule fails visibly; and whether the user can tell when the device is operating outside its competence.

A specific and consequential prohibition applies to both: you may not use a device that has been removed from the market for safety or effectiveness reasons as a predicate. Chains of clearances built on an early predicate are also a source of scrutiny, because the accumulated distance from the original device can become large.

What the performance evidence has to show

The FDA’s expectations for AI device performance evidence are set out across several guidance documents rather than in one, and the January 2025 draft guidance on AI-enabled device software functions gathers much of it. The recurring themes are consistent enough to state:

• Independence of the test set. The validation data must be genuinely separate from training and tuning data, and reviewers ask how that separation was enforced — by patient, by site and by time, not merely by row.
• Representativeness. Demographic and site-level composition of the evaluation data, and performance broken out by subgroup rather than reported only in aggregate. An aggregate AUC that conceals a materially worse subgroup is the finding these requests exist to surface.
• Generalisation across acquisition conditions. For imaging devices, performance across scanner manufacturers, protocols and field strengths. This is where a model that performs beautifully in development frequently fails.
• The human-in-the-loop question. Where the device informs rather than decides, the relevant evidence is often about the performance of the clinician-plus-device pair, not of the model alone. A device that is more accurate than a radiologist and that radiologists learn to over-trust is not obviously a safer system.
• The input specification. What the device accepts, and what it does when given something outside that. Undefined behaviour on out-of-distribution input is a safety question, not a quality-of-implementation question.

When a model change needs a new 510(k)

After clearance, the governing rule is 21 CFR 807.81(a)(3): a new premarket notification is required for a change or modification that could significantly affect the safety or effectiveness of the device, or a major change in intended use. The FDA’s 2017 guidance on deciding when to submit a 510(k) for a change, and its companion document for software changes, provide the decision logic.

For an AI device the difficulty is that retraining is a change to the device that produces no visible change to its specification. The honest reading of the rule is that a retrained model whose performance characteristics could differ is a change that could significantly affect effectiveness, which is precisely why the predetermined change control plan exists. Without a PCCP, the options are to freeze the model, to file repeatedly, or to document a change-assessment rationale that must survive an inspection.

Some changes are outside any plausible plan and need a new submission regardless: a change of intended use, an added indication, a new patient population, a new output the clinician acts on, or a change in the device’s role from informing to directing care.

When 510(k) is the wrong pathway

If no predicate exists — a genuinely novel function — the 510(k) is unavailable and the device is automatically class III by operation of statute. The usual answer is the De Novo classification request, which asks the agency to create a new classification with special controls at a lower class; a great many first-of-a-kind AI devices took that route and then became predicates for later 510(k)s. Genuinely high-risk devices go through premarket approval.

There is also the prior question of whether the software is a device at all. The clinical decision support exclusion added to the statute by the 21st Century Cures Act, as interpreted in the FDA’s September 2022 guidance, excludes certain software that supports a clinician who can independently review the basis for its recommendation. Whether a model whose reasoning cannot be independently reviewed can satisfy that condition is a live and much-argued question, and it is not settled by any court decision; the agency’s guidance sets out its own reading, and guidance is not binding. Anyone building on the assumption that their language-model-based product is outside device regulation should treat that assumption as the largest risk in the plan.

For the European treatment of the same device, see where the MDR and the AI Act overlap, and for the agency’s stated programme of work, see the AI/ML SaMD action plan.