AI Medical Devices and FDA in 2026: SaMD, PCCP, and the Clearance Reality

In January 2026 the FDA’s running list of authorized AI/ML-enabled medical devices crossed roughly one thousand entries. The first AI device cleared (PAPNET, a cervical-cytology assist) was authorized in 1995. The next 999 took thirty years, with the bulk arriving in the last five. That curve — and the regulatory plumbing that made it possible — is the story of this post.

The headline regulatory shifts are real. The FDA’s Predetermined Change Control Plan (PCCP) framework, finalized in late 2024 and now a routine part of submissions, lets manufacturers ship model updates without a new clearance for each one. The Software as a Medical Device (SaMD) clinical-evaluation framework from IMDRF is operational. The EU AI Act and EU MDR now form a parallel high-risk-device regime in Europe with its own conformity-assessment plumbing. And the rest-of-world picture — UK MHRA, Health Canada, TGA, NMPA, PMDA — has its own gradient of AI-specific guidance.

What the FDA cleared list actually looks like in 2026#

The dominant share of clearances is radiology — chest, brain, breast, cardiac, abdominal imaging — followed by cardiology (ECG, echo, FFR-CT), ophthalmology, pathology, and a growing tail of dermatology, gastroenterology, and orthopaedics. Almost all are Class II, cleared through the 510(k) substantial-equivalence pathway. A small number of high-risk devices — autonomous diabetic-retinopathy screening (IDx-DR, now Digital Diagnostics), some cardiac-decision-support — went through De Novo or PMA pathways.

The clearance count is real but the deployment density is much sparser. A manufacturer with a 510(k) clearance still has to win procurement, integrate with the IT estate, build a clinical-evidence story for the buyer, and survive the post-market surveillance burden. Many cleared devices have minimal commercial deployment.

The PCCP framework changed the operating model#

Before PCCP, every meaningful model change required a new 510(k) submission. For a continuous-learning AI product this was unworkable; manufacturers shipped frozen models and accumulated technical debt between submissions.

The PCCP framework, codified in the 2024 final guidance, allows manufacturers to pre-specify in their submission:

• The kinds of modifications they intend to make (re-training on new data, hyperparameter changes, expansion to new patient populations)
• The methodology for validating each modification class
• The acceptance criteria that must be met before deployment
• The post-market surveillance plan

Modifications within the PCCP envelope can be deployed without a new clearance, provided the manufacturer documents the change and retains the validation evidence. The FDA can review the change in routine inspection.

This unlocked a much more sensible operating model for AI devices. Most new clearances now include a PCCP. The mature manufacturers built internal model-governance and change-control systems that handle the documentation burden as engineering practice rather than ad-hoc paperwork.

Class II versus Class III versus everything else#

US device classification still anchors the regulatory story. Class II — moderate risk, 510(k) pathway, substantial equivalence to a predicate — is where the vast majority of AI clearances sit. Class III — highest risk, PMA pathway, full clinical-trial evidence — is rare for AI but applies to a small number of autonomous or high-impact decision tools.

Software as a Medical Device (SaMD) — software intended for a medical purpose without being part of a hardware device — gets specific FDA attention. The IMDRF SaMD risk framework cross-walks “significance of information” times “healthcare situation” into one of four risk categories, with corresponding evidence expectations.

Importantly, not all AI in healthcare is a medical device. Clinical decision support tools that meet the four CDS exemption criteria (the so-called “Cures Act CDS exemption”) are not regulated as devices, provided the clinician can independently review the basis. Workflow tools, scheduling AI, ambient scribes, and many administrative-AI surfaces sit outside the device regulatory perimeter — though they carry HIPAA, state privacy, and (increasingly) state-level AI-specific obligations.

The continuous-learning question#

The dream of fully continuous-learning devices — models that retrain in production on every new patient — remains constrained. The PCCP framework allows controlled, validated retraining but not unbounded online learning. The reasons are sound: a drifting model in safety-critical use needs validation guardrails, and a model that has retrained itself in unspecified directions cannot be audited.

Most “continuous-learning” deployments in 2026 are batch-retraining workflows on a quarterly or monthly cadence, with validation against held-out evaluation sets and human review of metric shifts before deployment. The engineering pattern is increasingly familiar: a model registry, a validation pipeline, a sign-off gate, and a deployment workflow with rollback. This is MLOps applied to a regulated context, with audit and documentation requirements that regular MLOps does not impose.

The EU side: AI Act plus MDR#

EU MDR (2021) replaced the previous medical-device directive with a much heavier conformity-assessment regime, and the AI-specific layer arrived via the EU AI Act (in force 2024, with phased applicability through 2026–2027). Medical-device AI is high-risk under the AI Act, which means manufacturers face conformity-assessment obligations on both fronts. Notified bodies expanded their AI expertise — at varying rates — to handle the volume.

The practical impact: timelines for AI device approval in Europe lengthened during the MDR transition, some pre-MDR CE marks lapsed, and several US-first vendors deferred European market entry until the regulatory path stabilised. By 2026 the picture is settling, with predictable assessment timelines and a clearer body of guidance.

Post-market surveillance is the long tail#

Pre-market clearance is the visible event; post-market surveillance is the durable obligation. Manufacturers must track adverse events, monitor model performance in production, report meaningful performance drifts, and feed surveillance learnings back into the PCCP-governed change cycle. The FDA’s MAUDE database, EU’s EUDAMED, and equivalent regional registries are the substrate.

The mature manufacturers built this as engineering: telemetry from deployments, model-performance dashboards that compare current production accuracy to clearance-package expectations, alerting on drift, and a documented incident-response workflow.

Implications for health systems buying AI devices#

Procurement and clinical governance now ask hard questions before signing. The 2026 RFP standard includes the clearance package, the PCCP scope, the post-market surveillance plan, the model-card with population breakdowns, the bias and equity validation, the cybersecurity posture (the FDA’s premarket cybersecurity guidance is in force), and a statement of operational and maintenance commitments. Vendors who treat regulatory and operational hygiene as engineering practice win these conversations; vendors who treat it as paperwork lose them.

Where pdpspectra fits#

We help AI device manufacturers and the health systems that buy them build the operational backbone that the modern regulatory regime expects — model registries, validation pipelines, audit-grade lineage, drift monitoring, and the documentation workflow that turns FDA submissions into engineering artefacts rather than one-off documents. See our ML and MLOps practice.

Related reading#

• Healthcare AI playbook: pilot to production
• AI in clinical trials in 2026
• GDPR compliance for AI systems

If you are building an AI medical device, evaluating one as a buyer, or navigating a PCCP or EU AI Act submission and want pragmatic engineering support, reach out.