FDA AI Guidance in 2026: Every Device, Drug and Policy Document on AI, With Status and Dates

How to read this page

FDA has no single AI rule. It has guidance documents, which are non-binding statements of the agency’s current thinking, plus guiding principles written with other regulators, an advisory committee record, discussion papers and a public device list. Device documents come mainly from the Center for Devices and Radiological Health (CDRH). Drug and biologic documents come from CDER and CBER, often with the other centres signed on.

Every status below was checked on the FDA guidance page or document itself on 25 October 2026. Where a document has been reissued, both dates are given. Where something is only planned, it is labelled as planned. This page covers US regulation only. The European side for devices, including the MDR and the AI Act, is covered in our guide to the EU AI Act for medical devices and hospitals.

FDA AI guidance at a glance: status table

We found no FDA AI guidance withdrawn in 2025 or 2026. The changes were a reissue of the PCCP guidance, two versions of the CDS guidance in one month, and new principles and discussion papers.

FDA guidance on AI-enabled medical devices: the January 2025 draft

The device draft, docket FDA-2024-D-4488, is the closest thing FDA has to a complete AI rulebook for device submissions. It takes a total product life cycle view and sets out what a marketing submission should contain when a device includes an AI-enabled software function. Its sections follow the order a reviewer reads:

• device description, including the model’s role in the device’s intended use;
• user interface and labeling, with an appendix on transparency design;
• risk assessment;
• data management, covering how training and test data were collected, cleaned, annotated and kept apart;
• model description and development;
• validation, with performance validation and usability evaluation appendices;
• device performance monitoring after release;
• cybersecurity;
• a public submission summary, with an example model card and an example 510(k) summary.

Two themes run through it. The first is bias: FDA asks for evidence on whether a device performs similarly across relevant demographic groups such as race, ethnicity, sex and age. The second is transparency to users, which is why the draft includes a model card template.

The draft is not in force. CDRH’s proposed guidance list for fiscal year 2027, current as of 1 October 2026, puts a final version on the A-list under a slightly changed title, “Marketing Submission and Lifecycle Management Recommendations for Artificial Intelligence-Enabled Device Software Functions”. An A-list entry signals intent, not a publication date. Until then, it remains the most detailed public description of what CDRH expects to find in an AI device submission.

Predetermined change control plans: final, reissued in 2025

A predetermined change control plan (PCCP) lets a manufacturer get planned model changes authorised up front, as part of the original 510(k), De Novo or PMA, so that each later update within the plan does not need a new submission. FDA finalised the AI-specific guidance on 4 December 2024, replacing a 2023 draft that covered only machine learning. The current document, docket FDA-2022-D-2628, was reissued on 18 August 2025.

A PCCP has three parts:

1. Description of modifications. Exactly which changes are planned, such as retraining on new data or adjusting a threshold.
2. Modification protocol. How each change will be developed, validated and rolled out, with acceptance criteria.
3. Impact assessment. The benefits and risks of the planned changes and how risks are controlled.

A broader guidance, “Predetermined Change Control Plans for Medical Devices”, covering devices that are not AI-enabled, appears on the CDRH FY2027 A-list as a planned final guidance.

Clinical decision support software: revised in January 2026

Software that gives recommendations to a clinician can fall outside the legal definition of a device if it meets all four criteria in section 520(o)(1)(E) of the Federal Food, Drug, and Cosmetic Act. FDA’s CDS guidance explains how it reads those criteria. A new version issued on 6 January 2026 replaced the 2022 guidance, and it was itself superseded by a version dated 29 January 2026, which is the one in force.

The practical change concerns software that offers a single recommendation. Where only one option is clinically appropriate and the function meets the other criteria, FDA now says it intends to exercise enforcement discretion. The guidance keeps its attention on automation bias and on whether a recommendation is time-critical, and functions that analyse medical images or signals still do not meet the first criterion. Any AI tool aimed at clinicians, including one built on a language model, should be checked against this document first, because it decides whether the device guidances apply at all.

Good machine learning practice and transparency principles

FDA, Health Canada and the UK’s MHRA have published three sets of joint principles for machine learning devices:

• Good Machine Learning Practice, ten principles from October 2021, covering topics such as representative data, independence of training and test sets, and monitoring deployed models. The International Medical Device Regulators Forum released a final document building on them in January 2025.
• Predetermined change control plans, five principles that sit behind the PCCP guidance.
• Transparency, published in June 2024, organised around who needs information, why, what, where, when and how.

These are not guidance documents and carry no review checklist. They still matter in practice: the January 2025 device draft cites the GMLP and transparency principles in its opening paragraphs.

The FDA AI-enabled device list

FDA keeps a List of Artificial Intelligence-Enabled Medical Devices, downloadable as CSV, Excel or XML. Its AI device page said FDA had authorised more than 1,600 AI-enabled devices as of September 2026. When we counted the published table on 25 October 2026 it held 1,614 entries, of which 1,230 were assigned to the radiology review panel, followed by cardiovascular and neurology. The latest decision date shown was 29 June 2026.

Three points matter when you use it. It is not a list of approvals, since most entries were cleared through 510(k) or granted through De Novo. It is not complete, because FDA finds devices by searching summaries for AI terms. And FDA says it intends to tag devices that use foundation models, including language models, in a future update, and asks sponsors to describe such functionality in their public summaries.

Generative AI devices: still at discussion stage

There is no FDA guidance for generative AI devices yet. The Digital Health Advisory Committee discussed generative AI-enabled devices in November 2024 and generative AI mental health devices on 6 November 2025. On 30 September 2025 FDA asked for public comment on measuring the real-world performance of AI-enabled devices, including drift, under docket FDA-2025-N-4203.

On 18 August 2026 CDRH’s Digital Health Center of Excellence released a discussion paper on regulating generative AI-enabled devices, docket FDA-2026-N-7874. It proposes a two-axis risk assessment, a premarket approach built on competency assessment, and risk-proportionate post-market monitoring, and it discusses foundation models and agentic systems. Comments closed on 19 October 2026. The FY2027 lists add a draft on generative AI conversational devices for mental disorders and a guidance on generative AI risk assessment that is still under construction.

FDA’s AI guidance for drug development: the seven-step credibility framework

The drug draft, docket FDA-2024-D-4689, was announced on 6 January 2025. FDA said at the time that it had seen more than 500 drug and biologic submissions with AI components since 2016. The draft covers AI models that produce information or data to support a regulatory decision about a drug’s safety, effectiveness or quality, across nonclinical, clinical, post-marketing and manufacturing phases.

Its framework has seven steps:

1. Define the question of interest.
2. Define the context of use for the AI model.
3. Assess the AI model risk.
4. Develop a plan to establish the credibility of the model’s output within that context of use.
5. Execute the plan.
6. Document the results of the credibility assessment plan and discuss deviations from it.
7. Determine whether the model is adequate for the context of use.

Model risk combines two factors that are rated separately. Model influence is how much weight the model’s output carries relative to other evidence. Decision consequence is how serious an adverse outcome would be if the decision were wrong. The draft’s clinical example, a model that alone decides which trial participants skip inpatient monitoring after dosing, scores high on both. Its manufacturing example, an AI vision system checking vial fill levels alongside other release tests, carries less influence.

Equally useful is what the draft leaves out. It does not cover AI used in drug discovery, or AI used for operational efficiency, and it names drafting or writing a regulatory submission as an example, provided the use does not affect patient safety, drug quality or the reliability of study results. The draft was still marked “Draft Level 1 Guidance” on 25 October 2026.

On 14 January 2026 FDA and the EMA published ten Guiding Principles of Good AI Practice in Drug Development: human-centric by design, risk-based approach, adherence to standards, clear context of use, multidisciplinary expertise, data governance and documentation, model design and development practices, risk-based performance assessment, life cycle management, and clear, essential information. They are principles to consider, not guidance, and EMA said EU guideline work building on its 2024 reflection paper was already under way.

How FDA itself uses AI

FDA announced Elsa, an agency-wide generative AI assistant, on 2 June 2025. The agency said it runs in a high-security GovCloud environment, that its models do not train on data submitted by regulated industry, and that staff were using it for reading, writing and summarising, including adverse event summaries, label comparisons and clinical protocol reviews. On 1 December 2025 FDA extended this with agentic AI capabilities for all employees, for tasks including pre-market reviews, review validation, post-market surveillance and inspections, again voluntary and with human oversight built in. It reported that more than 70 per cent of staff were using Elsa.

For sponsors, the implication is modest but real. FDA has said its staff use Elsa for label comparisons and protocol reviews, so sponsors should assume that inconsistencies between documents are now easier for the agency to spot.

What this means for a device maker

• Write to the draft now. Structure the AI portions of a submission the way the January 2025 draft lays them out, including the model card in the public summary. FDA has given no date for the final version, so the draft is the best outline available.
• Decide on a PCCP before the first submission. If the model will be retrained or retuned, the change plan has to be authorised with the device. Adding it later means another submission.
• Test the CDS criteria first. For clinician-facing decision support, the January 2026 CDS guidance decides whether the software is a device at all. Record that analysis.
• Plan subgroup evidence early. Demographic performance data is hard to assemble after the validation study has closed.
• Watch the generative AI track. Anyone building a device on a language model is in discussion-paper territory, so a Q-Submission meeting is the safer route.

What this means for a drug sponsor

• Sort AI uses by scope first. Models that produce evidence on safety, effectiveness or quality fall under the credibility framework. Discovery tools and internal productivity tools, including drafting assistance, do not, although the content they help produce still has to be accurate.
• Write the question of interest and context of use down. Those two statements drive the risk rating and every later step.
• Engage early for high-risk models. The draft lists formal meetings and other routes, including INTERACT, CDER’s Emerging Technology Program and CBER’s Advanced Technologies Team, for discussing a credibility plan.
• Keep GxP validation separate in your head, joined in your files. A model used in manufacturing or quality also needs computerised system validation; our walkthrough of GxP validation for AI and LLMs covers that side.

Documentation and credibility evidence

Across both centres FDA is asking the same question: can you show, with records, that this model is fit for this one use? For a drug sponsor, the credibility assessment report either goes to FDA or is held and made available on request, for example during an inspection. For a device maker, the evidence sits in the submission and the design history file.

In practice that means keeping, for every model and version: the question of interest or intended use, the context of use, the risk rating and its reasoning, data provenance and the split between training and test data, performance results with subgroup analysis, deviations from plan, the change history, and who approved each step. Teams that assemble this from email threads and shared drives at submission time struggle. Teams that keep it as versioned records from the start can answer a reviewer’s question in hours.

How VDF AI fits the documentation side of FDA work

VDF AI is not a medical device, holds no FDA clearance or approval, and is not designed to diagnose, treat or drive clinical decisions. It sits in the regulatory and quality workflow, where FDA’s drug draft places drafting and internal operational uses outside its credibility framework, and where the work is reading, cross-checking and assembling documents for people who sign them off.

The platform is installed on the company’s own servers, in a private cloud or in an air-gapped network, and can be set to use local open-weight models only. That keeps unpublished submission content, validation data and correspondence with FDA inside the company’s environment. Typical uses are retrieval across SOPs, guidance and prior submissions, as in the pharma compliance knowledge chat use case; drafting and checking submission sections, as shown in the regulatory submission assistant playbook; and supporting deviation and CAPA investigations with cited sources.

Retrieval respects per-collection permissions, so a device team’s design history file is not visible to people outside the project. Agents run with tool rights set per role and a human approval step, and each answer records the user, the model and the passages it used, which gives the regulatory lead a record of how a draft was produced. The VDF AI Router registers local models served through Ollama or vLLM and adds cloud models only where policy allows. On-premises sign-in uses Microsoft Entra ID natively, with Okta or Keycloak connected through an SSO-aware reverse proxy. Any on-premises seat bundle can open with a three-month platform trial, so a regulatory team can try it on real documents before committing.

The healthcare and life sciences solution page and the healthcare AI use case hub show the wider setup. The free AI readiness assessment shows where data access, validation or governance would slow a first regulatory pilot. This page is general information, not regulatory advice for any specific product.