How the FDA Regulates AI in Healthcare — And What It Means for Patients

Practical takeaway: Some artificial intelligence (AI) tools used to diagnose or treat disease must meet U.S. Food and Drug Administration (FDA) standards for safety and effectiveness. Others — such as scheduling software or note-writing assistants — may not be regulated as medical devices at all. Understanding the difference can help you ask informed questions about your care.

AI is now used across American healthcare: reading X-rays, flagging irregular heart rhythms, screening for diabetic eye disease, and helping clinicians review large medical records. As these tools become more common, many patients wonder: Are they regulated like drugs? Are they tested? Who checks that they keep working properly?

The answer is nuanced. The FDA regulates certain AI tools as medical devices, specifically as “Software as a Medical Device” (SaMD). But not every healthcare AI system falls into that category. Here’s what that means in plain language.

What Counts as an AI Medical Device — and What Does Not

According to the FDA, software qualifies as a medical device if it is intended to diagnose, cure, mitigate, treat, or prevent disease. That includes AI systems that:

Analyze medical images to detect cancer or stroke.
Screen for diabetic retinopathy using retinal photographs.
Interpret heart rhythm data from ECGs.
Calculate risk scores that guide treatment decisions.

These tools fall under the FDA’s oversight because they directly affect diagnosis or treatment decisions.

By contrast, many AI tools used in healthcare are not regulated as medical devices. Examples may include:

Scheduling and billing systems.
Chatbots that answer general health questions.
Software that drafts clinical notes for a clinician to review.

If a tool only supports administrative work or provides general education — and does not independently drive clinical decisions — it may fall outside device regulation.

This distinction matters. FDA oversight focuses on tools that could directly affect patient safety.

How FDA Clearance and Approval Pathways Work

Not all regulated devices go through the same review process. The FDA uses different pathways depending on risk level.

1. 510(k) Clearance

This is the most common pathway. A company must show that its device is “substantially equivalent” to a device already legally on the market. It does not require proving the device is better — only that it performs similarly and is safe and effective for its intended use.

2. De Novo Pathway

If a device is new and does not have a comparable predecessor, it may go through the De Novo process. This pathway establishes a new device classification and includes a risk-based review.

3. Premarket Approval (PMA)

This is the most stringent pathway, typically used for high-risk devices. It generally requires more extensive clinical evidence.

It’s important to understand that FDA clearance or approval means a device met regulatory standards for safety and effectiveness for its intended use. It does not mean the tool is perfect, risk-free, or proven superior to all alternatives.

How the FDA Handles “Learning” or Adaptive AI

Traditional medical devices do not change after approval unless the manufacturer submits updates. AI systems can be different. Some are designed to adapt over time as they process new data.

Recognizing this challenge, the FDA released an AI/ML Software as a Medical Device Action Plan outlining a framework for oversight of adaptive algorithms. A key concept is the Predetermined Change Control Plan.

Under this approach, companies proposing adaptive AI must:

Pre-specify what types of changes the algorithm may undergo.
Describe how those changes will be controlled and validated.
Provide a plan for monitoring real-world performance.

This allows certain updates to occur without a full re-review — but only within boundaries the FDA has already evaluated.

Oversight of adaptive AI remains an evolving area. Regulatory policy continues to develop as experience grows.

What “Good Machine Learning Practice” Means

The FDA, in collaboration with international partners, has outlined Good Machine Learning Practice (GMLP) principles. These focus on the full lifecycle of AI-enabled devices, including:

High-quality, representative training data.
Clear documentation of intended use.
Robust testing before release.
Ongoing monitoring after deployment.

For patients, this means AI devices are expected to be developed using quality standards similar to other regulated medical technologies. GMLP principles also emphasize identifying and reducing bias, though eliminating bias entirely is not always possible.

What Happens After a Device Is on the Market?

FDA oversight does not stop at clearance or approval. Post-market monitoring includes:

Mandatory reporting of adverse events.
Monitoring for “drift,” when performance changes over time.
Safety communications or recalls if problems arise.
Review of certain significant software updates.

Real-world performance data are especially important for AI systems, since clinical environments can differ from testing settings.

If safety concerns emerge, the FDA can require corrective actions or remove devices from the market.

Limits of FDA Oversight

Not every AI tool that influences healthcare decisions is regulated.

Some clinical decision support (CDS) software is exempt if it allows clinicians to independently review the basis for recommendations. Consumer-facing wellness apps often fall outside medical device rules.

Privacy protections also vary. HIPAA applies when AI tools are used by covered healthcare entities, but consumer health apps may not be subject to the same protections.

A 2021 review in JAMA noted that regulatory frameworks for AI in medicine are still evolving and that evidence standards continue to be refined. Oversight is active — but not static.

What This Means for Patients

If AI is used in your care, here are practical questions you can ask:

Is this tool FDA-cleared or approved?
What is its intended use?
How does a clinician review or confirm its recommendation?
Has it been tested in patients like me?
How is my data protected?

Most AI tools are designed to assist clinicians — not replace them. A licensed professional remains responsible for your diagnosis and treatment decisions.

Insurance coverage can depend on whether a tool is considered medically necessary and how it is classified. FDA clearance does not automatically guarantee coverage.

What Remains Uncertain

Adaptive AI oversight continues to evolve. Regulators are still refining how best to evaluate continuously learning systems. Transparency around performance across different patient populations — including race, age, and geography — remains an area of active attention.

AI in healthcare is expanding rapidly, but regulation is focused on managing risk, not eliminating it entirely.

The Bottom Line

Some AI tools in healthcare are regulated medical devices reviewed by the FDA. Others are not. Clearance means a device met safety and effectiveness standards for its intended use — not that it is flawless.

For patients, the most important safeguards remain transparency, clinician oversight, and informed questions. As AI becomes more integrated into American healthcare, understanding how it is regulated can help you participate confidently in decisions about your care.

Sources

This article is for general informational purposes only and is not medical advice. Research findings can be early, limited, or subject to change as new evidence emerges. For personal guidance, diagnosis, or treatment, consult a licensed clinician. For current outbreak or public health guidance, follow your local health department, the CDC, or another relevant public health authority.