FDA Machine Learning Requirements for Drug & Device Submissions

Artificial intelligence and machine learning (AI/ML) are reshaping how drugs are developed, manufactured, and monitored — and how medical devices diagnose, treat, and predict patient outcomes. But if you're planning to incorporate AI/ML into a regulated product, you need to understand one critical truth: the FDA has developed a layered, evolving framework that governs how machine learning is validated, documented, and approved.

This guide covers everything sponsors, manufacturers, and developers need to know about FDA machine learning requirements for drug and device submissions — from foundational definitions to pre-submission strategy and post-market obligations.

---

Why FDA Machine Learning Oversight Is Accelerating

The FDA's engagement with AI/ML is not speculative — it is active and accelerating. According to the FDA's own published data, the agency approved or authorized more than 950 AI/ML-enabled medical devices as of early 2024, up from just 6 in 2015. That exponential growth has forced the agency to move from ad hoc guidance to a structured regulatory architecture.

On the drug side, the FDA's Center for Drug Evaluation and Research (CDER) issued a discussion paper in 2023 outlining how AI/ML used in drug development — including clinical trial design, manufacturing process control, and pharmacovigilance — must meet data integrity and validation standards consistent with existing regulations such as 21 CFR Part 11 and ICH E9(R1).

The stakes are significant: a 2023 report from the Brookings Institution estimated that AI could reduce drug development timelines by 25–50%, but only if regulatory clarity keeps pace with technological adoption.

---

The Two Regulatory Tracks: Drugs vs. Devices

FDA machine learning requirements differ substantially depending on whether your product is regulated as a drug, a medical device, or a combination product. Understanding which track applies is the first step in any regulatory strategy.

Feature	AI/ML in Drug Development	AI/ML-Enabled Medical Devices (SaMD)
Primary Regulatory Framework	21 CFR Parts 210, 211, 312, 314; ICH guidelines	21 CFR Parts 820, 880; FD&C Act Section 520(o)
Key FDA Guidance Document	CDER AI/ML Discussion Paper (2023)	AI/ML-Based SaMD Action Plan (2021); 2024 Final Rule
Submission Type	IND, NDA, ANDA, BLA	510(k), De Novo, PMA
Adaptive Algorithm Concern	Data drift in pharmacovigilance models	Locked vs. adaptive (continuously learning) algorithms
Post-Market Obligations	Signal detection, REMS if applicable	PCCP (Predetermined Change Control Plan)
Primary Review Division	CDER or CBER	CDRH
Validation Standard	21 CFR Part 11; GAMP 5	FDA's Good Machine Learning Practice (GMLP)

---

FDA Machine Learning Requirements for Medical Devices (SaMD)

What Is SaMD and Why Does It Matter?

Software as a Medical Device (SaMD) is defined by the International Medical Device Regulators Forum (IMDRF) as software intended to be used for one or more medical purposes without being part of a hardware medical device. When that software uses machine learning — particularly adaptive algorithms that update based on real-world data — the regulatory calculus becomes significantly more complex.

The FDA's Center for Devices and Radiological Health (CDRH) has been the most active arm of the agency on AI/ML. Their 2021 AI/ML-Based SaMD Action Plan established five focus areas: good machine learning practice (GMLP), transparency, real-world performance, regulatory science tools, and an adaptive regulatory framework.

The 2024 Final Rule: A Turning Point

In 2024, FDA finalized regulations under section 515B of the FD&C Act that formalized requirements for predetermined change control plans (PCCPs). This is arguably the most important regulatory development in AI/ML device history. Under this framework:

• Manufacturers must prospectively define the types of modifications an adaptive algorithm may make
• Changes within the approved PCCP do not require a new 510(k) or PMA supplement
• Changes outside the PCCP do trigger new submission requirements
• The PCCP must include a performance monitoring protocol with defined drift thresholds

This matters because, prior to 2024, there was no clear pathway for continuously learning algorithms. Manufacturers were effectively forced to lock their models at the time of submission, undermining one of AI's core advantages.

Good Machine Learning Practice (GMLP)

FDA's GMLP principles — co-developed with Health Canada and the UK's MHRA — represent the closest thing to a universal standard for AI/ML device development. The 10 guiding principles include:

1. Multi-disciplinary expertise is leveraged throughout the total product lifecycle
2. Good software engineering and security practices are implemented
3. Clinical study participants and data sets are representative of the intended patient population
4. Training data independence from test sets is maintained
5. Selected reference datasets are based on best available methods
6. Model design is tailored to available data and reflects clinical knowledge
7. Focus is placed on the human-AI team performance
8. Testing demonstrates device performance during clinically relevant conditions
9. Users are provided with clear and essential information
10. Deployed models are monitored for performance and re-training needs are identified

Every 510(k), De Novo, or PMA submission involving AI/ML is expected to demonstrate adherence to these principles through documentation, validation reports, and clinical evidence.

What Must Be Included in an AI/ML Device Submission

For a 510(k) or PMA involving machine learning, your technical file should address:

Algorithm Description - Type of ML model (e.g., convolutional neural network, random forest, transformer) - Whether the algorithm is locked or adaptive - Training methodology, including data sources, sample size, and class balance

Data Management - Demographics of training and test datasets (race, sex, age, comorbidities) - Data provenance and lineage documentation - Handling of missing data and outliers

Validation and Testing - Standalone performance metrics (sensitivity, specificity, AUC, F1) - Clinical validation against predicate or reference standard - Subgroup performance analysis to detect algorithmic bias

Transparency and Explainability - Level of explainability provided to clinicians - User interface design and labeling - Failure mode documentation

PCCP (if applicable) - Description of anticipated algorithm updates - Performance monitoring plan - Criteria that would trigger a new submission

---

FDA Machine Learning Requirements for Drug Submissions

AI/ML in Drug Discovery and Clinical Development

When AI/ML is used upstream — in target identification, compound screening, or patient stratification for clinical trials — the FDA's current position is that existing frameworks apply. Specifically:

• ICH E9(R1) governs estimands and sensitivity analyses; AI-derived endpoints must be pre-specified and statistically valid
• 21 CFR Part 312 (IND regulations) requires that any AI-generated analysis supporting safety or efficacy claims be reproducible and auditable
• 21 CFR Part 11 applies when AI/ML systems generate or modify electronic records used in regulatory submissions

The practical implication: if your AI model selects a patient subpopulation for a Phase 3 trial, the model's logic, training data, and validation performance must be documentable and defensible in an NDA or BLA.

AI/ML in Drug Manufacturing (Pharma 4.0)

This is where FDA machine learning requirements intersect with Current Good Manufacturing Practice (cGMP). The FDA's 2023 Draft Guidance on Process Analytical Technology (PAT) and Advanced Manufacturing signaled that AI-driven process controls are acceptable — but only if:

• The model is validated under the same principles as traditional process validation (21 CFR § 211.68)
• Any adaptive control system has defined boundaries and override protocols
• Change management procedures under 21 CFR § 211.100 are followed when models are retrained

This is a nuanced area. A machine learning model that adjusts blending time in real time based on in-process sensor data is fundamentally different from a static control chart — and FDA inspectors are increasingly asking about it during PAI (Pre-Approval Inspection) visits.

AI/ML in Pharmacovigilance

FDA's 2023 guidance on Postmarketing Safety Reporting acknowledged that AI/ML tools are being widely used to identify adverse event signals from electronic health records, social media, and literature. The agency's position:

• AI/ML signal detection tools must be validated for their intended purpose
• Manufacturers retain responsibility for all safety signals, regardless of whether they were identified by AI
• Any AI-generated safety report submitted to FDA must meet the same completeness and accuracy standards as manually generated reports (21 CFR Part 314.81)

---

Pre-Submission Strategy: The Q-Sub Pathway

Given the complexity of FDA machine learning requirements, I strongly recommend that sponsors and manufacturers engage FDA early through the Q-Submission (Q-Sub) program before submitting any AI/ML-related application. This applies to both device and drug submissions.

A well-structured Q-Sub for an AI/ML product should:

1. Describe the intended use and the role of ML in the product
2. Summarize the data sources and validation approach
3. Propose the regulatory pathway (e.g., 510(k) vs. De Novo for devices)
4. For devices, propose PCCP structure if the algorithm is adaptive
5. Ask specific questions about FDA's expectations for clinical evidence

FDA's target response time for a Q-Sub with a meeting is 70 days for devices and 90 days for drugs. Early alignment can prevent costly redesigns or complete response letters later.

At Certify Consulting, with 200+ clients served and a 100% first-time audit pass rate, I've seen firsthand how sponsors who engage FDA early on AI/ML strategy avoid the most common pitfalls — particularly around dataset representativeness and PCCP scoping.

---

Common Pitfalls in FDA AI/ML Submissions

These are the failure modes I see most frequently:

1. Training data that doesn't reflect the intended use population. FDA reviewers will scrutinize demographic breakdowns. If your training data is 90% white male patients and your device is intended for a diverse population, expect a deficiency letter.

2. Locked algorithms presented as "adaptive" (or vice versa). Misclassifying your algorithm type creates downstream problems with your PCCP and post-market monitoring plan.

3. No pre-specified performance thresholds. You must define what "acceptable performance" means before you test — not after. Post-hoc threshold selection is a red flag for reviewers.

4. Treating AI validation like traditional software validation. IEC 62304 is necessary but not sufficient for AI/ML devices. GMLP principles add additional requirements that many software teams are unfamiliar with.

5. Ignoring cybersecurity. FDA's 2023 final guidance on cybersecurity for medical devices applies fully to AI/ML systems. Adversarial attacks on ML models (e.g., data poisoning) must be addressed in your threat model.

---

Citation-Ready Facts on FDA Machine Learning

The FDA authorized over 950 AI/ML-enabled medical devices by early 2024, representing a 15,000% increase from 2015 levels, making the United States the global leader in cleared AI medical technologies.

FDA's 2024 finalized regulations on Predetermined Change Control Plans (PCCPs) under FD&C Act Section 515B represent the first legally binding framework globally that allows adaptive machine learning algorithms to update post-market without triggering a new device submission.

Manufacturers that fail to document dataset demographic breakdowns for AI/ML submissions are at high risk of receiving a Refuse to Accept (RTA) determination under FDA's current review standards for SaMD submissions.

---

How Certify Consulting Supports AI/ML Regulatory Strategy

Jared Clark, JD, MBA, PMP, CMQ-OE, CPGP, CFSQA, RAC — Principal Consultant at Certify Consulting — has guided medical device manufacturers, pharmaceutical companies, and digital health startups through the full arc of FDA AI/ML submissions. With 8+ years of regulatory experience and a 100% first-time audit pass rate across 200+ clients, Certify Consulting offers:

• AI/ML Regulatory Readiness Assessments — gap analysis against GMLP principles and current FDA expectations
• PCCP Development — scoping, drafting, and FDA Q-Sub preparation
• 510(k) and PMA AI/ML Submissions — full technical file preparation
• Drug Submission Support — IND, NDA, and BLA preparation where AI/ML is used in development, manufacturing, or pharmacovigilance
• Training and SOPs — building internal capability for GMLP-compliant development

Visit Certify Consulting to schedule a consultation.

For related regulatory guidance, explore our resources on FDA software as a medical device compliance and 21 CFR Part 11 electronic records requirements.

---

Frequently Asked Questions

Does FDA require a new 510(k) every time an AI algorithm is updated?

Not necessarily. Under FDA's 2024 final regulations, manufacturers can submit a Predetermined Change Control Plan (PCCP) as part of their original submission. Algorithm changes that fall within the approved PCCP do not require a new 510(k). However, changes outside the PCCP — such as a new intended use or a materially different algorithm architecture — do trigger a new submission requirement.

What is the difference between a "locked" and "adaptive" algorithm under FDA rules?

A locked algorithm produces the same output for the same input after it has been deployed — it does not update from real-world data. An adaptive algorithm continuously or periodically updates based on new data after deployment. FDA requires more rigorous post-market monitoring for adaptive algorithms and mandates a PCCP that defines the boundaries and conditions for any updates.

Does 21 CFR Part 11 apply to AI/ML systems used in drug development?

Yes. If an AI/ML system creates, modifies, archives, or transmits electronic records that are required by FDA regulations — such as clinical trial data, manufacturing batch records, or adverse event reports — Part 11 applies. This means the system must have audit trails, access controls, validation documentation, and electronic signature compliance where applicable.

What datasets does FDA expect for AI/ML device validation?

FDA expects training, tuning (validation), and test datasets to be independent of one another. The test dataset should reflect the demographics of the intended use population, including race, ethnicity, sex, age, and relevant comorbidities. FDA also expects manufacturers to document data provenance, exclusion criteria, and how class imbalance was addressed.

How early should I engage FDA on an AI/ML submission?

As early as possible — ideally before locking your dataset or finalizing your model architecture. The Q-Submission (Q-Sub) program allows sponsors to get FDA feedback on their proposed regulatory strategy, data approach, and PCCP structure. For complex AI/ML products, a Q-Sub meeting 12–18 months before your planned submission date is a sound investment that can prevent costly pivots during review.

---

Last updated: 2026-03-30