How FDA Reviews AI-Enabled Devices, and Why Generative AI Tests the System

The Food and Drug Administration has authorized more than 1,500 medical devices with an artificial intelligence component but has not yet authorized a generative AI-enabled device, a Department of Health and Human Services spokesperson told MedTech Dive in a report published Sept. 9. The report said device makers are waiting for FDA guidance on generative AI after the agency's device center released a discussion paper on the subject in August.

The gap between those two numbers reflects how FDA reviews AI today, and why the agency says generative models raise new questions.

AI devices use the standard pathways

AI-enabled devices are reviewed under FDA's existing premarket requirements. An AI-enabled device reaches the market the way other devices do: a 510(k) clearance for a moderate-risk device with a predicate, a De Novo grant for a new low-to-moderate-risk type, or premarket approval (PMA) for high-risk devices.

FDA keeps a public AI-Enabled Medical Device List. The agency says the devices on it "have met the FDA's applicable premarket requirements," including a focused review of overall safety and effectiveness and an evaluation of whether the studies fit the device's intended use. Each entry links to the device's database record, which carries releasable information such as summaries of safety and effectiveness.

The list has limits that FDA spells out. It is "not a comprehensive resource," the agency says; devices are identified mainly by AI-related terms in their authorization documents or classification. FDA says it will explore ways to identify and tag devices that use foundation models, including large language models, in a future update.

Planning for changes in advance

Software that learns from data creates a regulatory problem: some changes to a model or algorithm can be significant enough to require a new premarket review. FDA's tool for this is the predetermined change control plan, or PCCP.

In guiding principles published jointly with Health Canada and the UK's Medicines and Healthcare products Regulatory Agency, FDA describes a PCCP as a plan, proposed by a manufacturer, that specifies "certain planned modifications to a device," the protocol for implementing and controlling them, and the assessment of their impacts. The principles say a PCCP should be focused and bounded, limited to modifications within the device's original intended use, and should include ways to detect and revert a change that fails to meet performance criteria.

Why generative AI is different

FDA's August discussion paper, announced in an agency bulletin on Aug. 18, seeks feedback on risk assessment, premarket evaluation and postmarket monitoring for generative AI-enabled devices. The bulletin says such devices "may introduce unique risks when compared to traditional software and AI-enabled medical devices." It is a discussion paper, not guidance, and comments are due under docket FDA-2026-N-7874 by Oct. 19.

According to MedTech Dive, the paper says generative AI devices may have a range of possible inputs and outputs too large to test, so FDA is looking at benchmarking, in what it calls a "competency-based assessment" modeled on how physicians are evaluated. The paper also floats foundation model device master files, through which developers of underlying models could voluntarily give FDA confidential information, and says the agency is considering whether to accept greater premarket uncertainty with more reliance on postmarket monitoring.

MedTech Dive reported that FDA has granted breakthrough device designation to a handful of generative AI tools, none yet authorized. HHS spokesperson Grace Davis Jamison wrote that FDA intends to "better understand the unique challenges presented by generative AI-enabled medical devices and inform the development of future guidance."