Artificial Intelligence-Enabled Device Software Functions: Lifecycle Management and Marketing Submission Recommendations
United States Β· Guideline Β· Food and Drug Administration
Our summary
This draft guidance provides FDA recommendations for companies submitting applications for medical devices that use artificial intelligence-enabled software functions, including documentation requirements to support evaluation of safety and effectiveness. The guidance reflects risk management across the device's total product lifecycle and proposes design and development recommendations manufacturers may consider throughout product development.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
15 sections
Jump to a chapter
Appendix E Example Model Card
Sponsors must provide comprehensive documentation on device user interface, labeling, AI architecture, development and validation data, model training methods, risk assessment, and postmarket monitoring to FDA marketing submissions for AI-enabled devices. Documentation must address the degree of automation, model inputs and outputs, training and test data sources and representativeness, performance validation with subgroup analyses, cybersecurity risks including data poisoning and model theft, and plans to monitor performance changes post-launch, with information detailed enough that competent AI practitioners could reproduce equivalent models and sufficient for FDA to determine safety and effectiveness. Device labeling must explain AI involvement and how users should interpret outputs at appropriate reading levels, validation must demonstrate users can comprehend and correctly use device information in real-world conditions, and submissions should identify populations at risk of underperformance, justify data characteristics and management differences between development and validation phases, and include baseline study population distributions, statistical analysis plans with pre-specified success criteria and subgroup analyses by sex, age, race, ethnicity, and disease markers, with powered subgroup analysis required when specific performance claims are made for subgroups.
Appendix A Table of Recommended Documentation
9 sections
The guidance recommends documenting information through interactive submission tools like eSTAR, an electronic form that assists applicants in assembling comprehensive submissions; the eSTAR system is provided at no cost and applies to all 510(k) submissions except those qualifying for exemption.
Section V Device Description
Section VI A User Interface
Section VII Risk Assessment
Section VIII Data Management
Development data should be documented in the Software Description section, while testing data should be included in Performance Testing documentation.
Section IX Model Description and Development
Section X A Performance Validation
Clinical and non-clinical testing results should be included in Performance Testing documentation, while software verification and validation should be documented in Software Documentation as part of overall Software testing.
Section XI Device Performance Monitoring
Section XII Cybersecurity
Section XIII Public Submission Summary
Public submission summary information should be included in the Administrative Information section of the marketing submission, with further guidance available through FDA's eSTAR Program documentation.
Appendix B Transparency Design Considerations
Sponsors are recommended to integrate transparency considerations throughout the product lifecycle starting in the design phase by identifying what information users need, when they need it, and what risks arise from missing or misunderstood information, while recognizing that transparency about significant clinical risks alone may not be adequate control. When designing communication, sponsors should consider user characteristics including functional capabilities, experience and education levels, interaction frequency, expected training, and familiarity with similar information, and select communication timing, mode, and format based on reading level, information location, and design elements such as hierarchy and visualizations. Sponsors should develop and validate explainability tools or visualizations through testing to ensure intended users understand key information and avoid misleading users.
Appendix C Performance Validation Considerations
Appendix D Usability Evaluation Considerations
Sponsors must perform human factors evaluations during design controls for all devices needing premarket submission; if critical tasks exist, formal validation is required, but sponsors without critical tasks may use alternative methods. For AI-enabled devices, sponsors should demonstrate that intended users can find, understand, and appropriately apply device information including AI outputs in clinical decision-making, considering that explainability varies from decision trees to deep neural networks; task analysis techniques and risk documentation of misuse and misinterpretation are recommended, with Appendix B transparency design recommendations available to identify user tasks and develop controls. Model cards are a recommended but not required format covering device identification, intended users and use, clinical benefits, inputs and outputs, performance metrics (sensitivity, specificity with confidence intervals), known biases and data gaps, risk management, deployment and update procedures, and software quality, with sponsors documenting development data sources (such as clinical trials or databases), data format categories, number of observations, statistical magnitude, quality aspects, comparison standard, population variation, and suitability to intended use.
Appendix F Example 510(k) Summary with Model Card
The Disease X Screening Model version 1.0.1, a convolutional neural network for patients above age 22 using 12-lead ECG from four compatible devices, was validated through a retrospective study of 25,000 patient records (eligible patients aged over 22 with 10-second ECGs and echocardiograms within 30 days, excluding those under 22, with missing data, using different ECG models, with non-10-second ECGs, or with pacemakers) and training on 30,000 patients (20% with Disease X, 80% without), achieving sensitivity of 84%, specificity of 83%, positive predictive value of 55.3%, and negative predictive value of 95.4% in detecting Disease X with subgroup analyses by demographics, ECG device models (A, B, C, D), and hospital sites (A through E). The model is not a stand-alone diagnostic tool; positive results should prompt further clinical evaluation such as echocardiography, and negative results should not exclude additional cardiac evaluation if high-risk factors exist. Deployment requires monitoring through site-specific validation testing, automated performance monitoring every 6 months, transparent reporting of successes and failures across sites, change management procedures, and user reporting of issues within 48 hours; publicly available summaries must follow applicable marketing submission requirements and may include technological characteristics, indications for use, and device description, with the FDA able to request additional information beyond examples provided.
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 0 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 0 of 4
- Risk classification, not covered
- Prohibited practices, not covered
- Risk management system, not covered
- Impact assessment, not covered
Data and privacy 0 of 4
- Data governance and quality, not covered
- Data subject rights and consent, not covered
- Cross-border data transfer, not covered
- Copyright and training data, not covered
Transparency and records 0 of 4
- Transparency and disclosure to users, not covered
- Labelling of synthetic content, not covered
- Technical documentation, not covered
- Record keeping and logging, not covered
Technical safeguards 0 of 4
- Human oversight, not covered
- Accuracy, robustness and cybersecurity, not covered
- Bias and non-discrimination, not covered
- Testing and evaluation, not covered
Assurance and lifecycle 0 of 4
- Conformity assessment and certification, not covered
- Registration and notification, not covered
- Incident and breach reporting, not covered
- Post-market monitoring and corrective action, not covered
Rights and protected groups 0 of 4
- Automated decision-making rights, not covered
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 0 of 6
- Supply chain and provider-deployer duties, not covered
- General purpose and foundation models, not covered
- Accountability and governance roles, not covered
- Training and AI literacy, not covered
- Public sector use and procurement, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 0 of 5
- Enforcement, penalties and regulators, not covered
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 0 are shown.
Change history
No changes recorded since we began monitoring this policy.