FDA and US pathway

If your software analyses patient data to diagnose, treat, monitor, or recommend care, it likely meets the FDA device definition. Exemptions exist for general wellness products and some clinical decision support — but they turn on your claims and the clinician's ability to independently review the basis for recommendations.

Only if your app is a medical device: making disease-related claims or performing diagnosis, treatment, monitoring, or care recommendations. Wellness apps that avoid disease claims typically don't need clearance. If you do, the pathway — usually 510(k) or De Novo — depends on whether a predicate exists.

FDA's general wellness policy keeps low-risk products that promote healthy lifestyles without referencing disease out of active FDA oversight — as enforcement discretion, not a blanket statutory exemption. The test is claims plus risk — not technology. A wellness label does not override clinical marketing language: one disease claim in your copy, store listing, or investor deck framing can make you a device.

510(k) if a substantially equivalent predicate device exists; De Novo if your device is novel but low-to-moderate risk with no predicate; PMA if it is high-risk Class III. Most health software targets a 510(k) where a predicate exists — which makes predicate research the first real task.

FDA's review goal for a 510(k) is 90 "FDA days," but that clock pauses during additional-information holds — which most first submissions hit. Total elapsed time from project start to clearance commonly runs 6–12 months, per industry-cited estimates from regulatory consultancies. Preparation quality — predicate fit and documentation completeness — is what moves the total.

Industry-cited figures for preparing a first 510(k) run from the low tens of thousands of USD for a simple software 510(k) with a strong predicate, up to roughly USD 150,000–350,000 for complex, consulting-heavy submissions — on top of FDA user fees (reduced for qualifying small businesses). Testing — bench, software V&V, cybersecurity — is usually the largest variable. Figures are industry-cited ranges, not quotes.

A Predetermined Change Control Plan is FDA's mechanism for updating AI-enabled devices without a new submission: you pre-specify anticipated model changes, the protocol for making them, and the impact assessment, and FDA authorizes the plan with your original clearance. Only changes within the plan's bounds are covered.

The Quality Management System Regulation replaced FDA's QSR in February 2026, incorporating ISO 13485 by reference. US-facing manufacturers now run an ISO 13485-aligned QMS with FDA-specific additions. Teams already building a 13485 QMS for CE marking are largely covered; QSR-era documentation needs updating.

No. The frameworks are legally separate: FDA clearance grants nothing in the EU, and a CE mark grants nothing with FDA. What transfers is the underlying evidence — testing, clinical data, QMS work — which is why sequencing and dossier design matter more than which badge comes first.

Software supporting clinician decisions can be exempt from FDA device regulation if it meets all four statutory criteria — including that the clinician can independently review the basis for its recommendations rather than relying on it. Opaque AI recommendations often still fail that criterion, but FDA's revised January 2026 guidance adds a narrow enforcement-discretion carve-out for software where only one recommendation is clinically appropriate — without waiving the independent-review criterion.

A predicate is a legally marketed device your 510(k) claims substantial equivalence to — same intended use, comparable technological characteristics. Choose by matching intended use first, technology second, and checking the predicate's own history. Predicate mismatch is the most common cause of substantial-equivalence problems — the Additional Information requests and holds that stall 510(k)s.

Industry estimates vary by definition: roughly 10–15% of 510(k)s face final rejection, while broader figures — counting any Additional Information request or hold at any point — run as high as 64–69% by some industry estimates. Predicate mismatch and documentation gaps are the most common causes, and both are preventable before submission.

A Pre-Submission is a free, formal way to get FDA's written feedback on your pathway, predicate logic, or testing plan before you submit. For novel devices, AI/ML functions, or contested predicates it is usually worth the added calendar time — it converts guesswork into documented agency feedback.

FDA expects software documentation scaled to risk (basic or enhanced level), covering architecture, requirements, V&V, and lifecycle processes — plus, since Section 524B, cybersecurity documentation including an SBOM for connected devices. AI/ML functions add data, performance, and change-management expectations on top.

A 513(g) is a formal, fee-based request asking FDA how it would classify your product and which regulatory requirements apply. It is useful when device status is genuinely unclear, but slower and less interactive than a Pre-Submission — many teams get more value from a Q-Sub.