If you're building AI products in life sciences, you will eventually hit a three-letter acronym that determines whether your product ships in months or years: SaMD - Software as a Medical Device.

I've worked through FDA regulatory strategy across multiple clinical AI products at HCLTech. Here's the practical guide I wish I'd had on day one.

What Is SaMD?

Software as a Medical Device is software intended to be used for medical purposes without being part of a hardware medical device. Think: a diagnostic algorithm running on a standard laptop, not embedded in an MRI machine.

Examples of SaMD: AI that reads radiology images, clinical decision support tools that recommend treatments, algorithms that predict patient deterioration from EHR data.

Examples that are not SaMD: EHR systems (administrative), hospital scheduling software, fitness trackers (wellness), lab information management systems.

The Classification Framework: Class I, II, and III

  • Class I (Low Risk) - General controls only. Example: software that logs patient symptoms for doctor review.
  • Class II (Moderate Risk) - Requires 510(k) or De Novo. Most AI/ML medical devices land here. Example: AI flagging diabetic retinopathy.
  • Class III (High Risk) - Requires PMA. Example: AI autonomously diagnosing life-threatening conditions.

Key insight: Your classification determines timeline and cost. Class II 510(k): 6-12 months, $200K-$500K. Class III PMA: 2-4 years, $2M-$10M.

Regulatory Pathways

510(k) - The Predicate Device Pathway

Demonstrate substantial equivalence to an already-cleared device. Fastest for Class II. Start predicate searches early using the FDA's public database.

De Novo - The Novel Device Pathway

For low-to-moderate risk devices with no predicate. Increasingly common for AI/ML. Takes 12-18 months. Creates new classification for future devices.

PMA - The Gold Standard

For Class III, high-risk devices. Requires clinical trial data. Most AI teams should design products to include physician oversight, keeping them in Class II territory.

The Clinical Decision Support Exemption

The 21st Century Cures Act exempts CDS software meeting ALL four criteria: not processing medical images/signals, displaying/analyzing medical information, intended for healthcare professionals, and enabling the HCP to independently review recommendations. The fourth criterion is key - explainability isn't just nice-to-have, it's a regulatory strategy.

Predetermined Change Control Plans (PCCPs)

PCCPs let you define upfront how your algorithm will change post-clearance - what data it learns from, how performance is monitored, what triggers resubmission. This means continuous improvement without a new 510(k) every time your model updates. Plan for this from day one.

Key Takeaways

  • Regulatory strategy is product strategy. Start planning in discovery, not after development.
  • Design for Class II. Include physician oversight to avoid Class III/PMA.
  • Explore the CDS exemption. Transparency in AI reasoning can mean no FDA regulation at all.
  • Plan PCCPs from day one. If your AI improves, build change control into your initial submission.
  • Engage FDA early. Pre-Submission meetings are free and can save months.

For more terms, see the glossary.