What Is SaMD
Software serving a medical purpose without being part of a hardware device.
Award-Winning FDA Compliance Partner
Does the FDA Regulate Your Software?
FDA regulation follows intended use — diagnostic AI is SaMD; scheduling apps are not.
What the 21st Century Cures Act Exempted
The Cures Act put admin tools, wellness apps, EHRs, and basic lab tests outside FDA scope.
Class I: General Controls
Minimal risk — registration and GMP only; most Class I SaMD is 510(k)-exempt.
Class II: 510(k) Premarket Notification
Moderate risk — a 510(k) proving substantial equivalence to a predicate device.
Class III: Premarket Approval
Highest risk — premarket approval with clinical evidence. Rare for pure SaMD.
The Development Process for FDA-Regulated Software
Quality by design, in five steps.
The 510(k) Submission Process
The common FDA clearance path for Class II SaMD: prove substantial equivalence to a predicate device.
Device Description and Intended Use
The submission opens with a precise device description and intended use statement — the same one locked before development, and the foundation the reviewer evaluates everything else against.
Predicate Comparison
The predicate comparison is the core of the 510(k). It must show the same intended use and demonstrate that any differences in technological characteristics don't raise new safety or effectiveness questions.
Software Documentation
All SaMD submissions require a Software Description Document and SDLC summary. Documentation depth scales with software safety class — Class C requires the most complete design, testing, and risk management records.
Performance Testing and Cybersecurity
Performance data and FDA-compliant cybersecurity documentation are required for all SaMD. AI diagnostic algorithms also need clinical performance study data against a reference standard.
Post-Market Obligations: What Clearance Does Not End
FDA clearance begins post-market regulatory obligations that continue for the life of the product.
-
Complaint Handling and MDR Reporting
Complaint Handling and MDR Reporting
Medical Device Reports are due in 30 days — 5 for urgent events.
-
Change Control
Change Control
Changes to safety, intended use, or labeling may need a new 510(k).
-
Annual and Periodic Reports
Annual and Periodic Reports
Complaint data, MDRs, and corrective actions, filed on schedule.
-
AI/ML Post-Market Performance Monitoring
AI/ML Post-Market Performance Monitoring
Track real-world model performance against 510(k) claims; report drift.
-
Predetermined Change Control Plan
Predetermined Change Control Plan
A PCCP pre-clears algorithm updates without a new 510(k).
Navigating SaMD Regulation the Right Way
Five SaMD decisions made before coding starts.
Book a Regulatory ConsultIntended Use
Lock the intended use statement before development — it drives classification, study design, labeling, and claims.
Predicate
Predicate selection is the foundation of a 510(k): a strong one enables a clean comparison. Novel SaMD without a predicate takes the De Novo route.
De Novo
De Novo clears moderate-risk devices without a predicate. Review takes 12–24 months but establishes a new device type others can cite.
QMS Timing
The QMS must be in place before development, not assembled afterward. Retroactive documentation is a common, expensive SaMD problem.
Clinical Study
For AI diagnostics, study design is the key decision: representative population, defensible reference standard, pre-specified analysis plan.
What Most Teams Get Wrong Before Submission Risk Areas
The most common and expensive SaMD submission problems are predictable — and preventable with the right regulatory strategy from the start.
Classification
Getting Classification Wrong
Underrating risk class derails a submission mid-review.
QMS Gaps
QMS Built After the Product
A backfilled QMS is a top FDA red flag.
Software Docs
Inadequate Software Documentation
The FDA judges your process, not just your test results.
Cybersecurity
Cybersecurity Documentation Gaps
SBOM, threat modeling, and pen-test evidence are now mandatory.
AI Evidence
Insufficient Clinical Evidence for AI Claims
A weak performance study can trigger a whole new one.
Post-Market
Post-Market Infrastructure Not Ready at Clearance
Complaints, MDR, and change control must be live on day one.
Building Software the FDA Will Regulate? Start the Regulatory Strategy Before You Start the Code.
We guide SaMD teams from intended use through 510(k) clearance — QMS setup, predicate selection, clinical validation, and submissions. Our regulatory and engineering teams work together because the documentation and the code are inseparable.
Schedule a Regulatory Call
Award-Winning AI Development & Consulting
100 Fastest Growth Companies
Global Spring Winner
Top App Development Company
AWS Partner Network
Google Cloud Partner
Highly Rated on Trustpilot
Verified Agency
Top App Development Company
ASSOCHAM Member
FDA Software Development Playbook: Frequently Asked Questions
[ 1 ]
How much does it cost to get a 510(k) clearance for a SaMD product?
Straightforward SaMD clearances run $200,000–$500,000; AI diagnostics needing clinical validation reach $1M–$5M.
[ 2 ]
Can a software product be both HIPAA-regulated and FDA-regulated?
Yes. A SaMD handling PHI must meet HIPAA's Security Rule plus FDA's QMS and premarket requirements.
[ 3 ]
What is the regulatory pathway for AI software that learns from new data after deployment?
A predetermined change control plan pre-specifies how the algorithm may evolve, accepted at clearance.
Global presence
