What is the clinical decision support (CDS) exemption?

In short: Software supporting clinician decisions can be exempt from FDA device regulation if it meets all four statutory criteria — including that the clinician can independently review the basis for its recommendations rather than relying on it. Opaque AI recommendations often still fail that criterion, but FDA's revised January 2026 guidance adds a narrow enforcement-discretion carve-out for software where only one recommendation is clinically appropriate — without waiving the independent-review criterion.

The four conditions, all required together

The CDS exemption, established under the 21st Century Cures Act (FD&C Act §520(o)(1)(E)), applies only to software meeting all four criteria simultaneously — missing any one of them puts the software back inside FDA's device definition. First, it must not be intended to acquire, process, or analyze a medical image, signal from an in vitro diagnostic device, or pattern acquired from a signal acquisition system — software doing direct image or signal analysis is excluded from the exemption regardless of the other three criteria. Second, it must display, analyze, or print medical information already generated elsewhere, not generate new interpretive findings itself. Third, it must support, not replace, clinical judgment. Fourth — and the one AI systems most often fail — the clinician using it must be able to independently review the basis for the recommendation, rather than accepting it as an opaque output.

Why AI makes the fourth criterion the hard one

Traditional rule-based clinical decision support software (if X lab value exceeds Y threshold, flag for review) can satisfy the independent-review criterion relatively easily, because the logic is transparent and auditable by a clinician reading it. Machine-learning models, particularly deep-learning systems, often can't show their reasoning in a way a clinician can meaningfully evaluate before deciding whether to trust the output — which means many AI-based decision support tools fail the exemption not because of what they do, but because of how opaque their reasoning is.

The January 2026 update: enforcement discretion for single-recommendation software

FDA issued a revised final CDS guidance in January 2026 that qualifies the "opaque AI fails" rule above. Where a software function outputs a specific preventive, diagnostic, or treatment recommendation, but only one clinically appropriate recommendation genuinely exists for the situation, and the software otherwise meets the first three criteria, FDA now states it does not intend to enforce device requirements against it. Importantly, this does not waive the fourth criterion — the clinician must still be able to independently review the basis for the recommendation; what changed is that FDA no longer expects such software to present multiple alternative options where only one is clinically appropriate. And whether "only one clinically appropriate recommendation" exists is a judgment FDA retains — not something a developer can self-certify. The update also recalibrates two other criteria: "pattern" is now read more narrowly — discrete, point-in-time measurements, like routine vitals taken at a clinical encounter, generally don't constitute a pattern by themselves — and "medical information about a patient" more broadly. FDA also sharpened its transparency expectations: what data the software uses, the logic behind a recommendation, and how outputs are generated must be accessible enough for the clinician to evaluate independently — an emphasis that applies to CDS generally but that early commentary reads as most consequential for AI-driven tools. The practical effect: a more nuanced test than the four-criteria checklist alone conveys, modestly more permissive for one specific, narrow category of tools.

The practical implication

If your product's value proposition depends on a model whose reasoning isn't fully clinician-reviewable, check first whether the January 2026 single-recommendation carve-out could apply before assuming you need full FDA regulation — but don't rely on it as a default; it's narrow, fact-specific, and enforcement discretion isn't the same legal protection as a clear exemption. For anything broader than that carve-out, plan for FDA regulation rather than exemption from the start — retrofitting explainability into an already-built model to qualify for an exemption after the fact is a far harder problem than designing for it, or for clearance, from day one.

Where next: Does My Health AI Need FDA Clearance? · Is my health AI a medical device under FDA rules?

Find out in minutes where your product likely sits. Start the MedTech Compass → — AI-generated first read, not a validated determination.