April 2, 2019 — U.S. Food and Drug Administration (FDA) Commissioner Scott Gottlieb, M.D., announced Tuesday the agency is pursuing a new framework in which to review artificial intelligence (AI)-based medical software and devices to ensure ongoing effectiveness and patient safety. The agency released a 20-page discussion paper explaining the need for a new framework, the tenets of a total product lifecycle (TPLC) approach to certification, and examples of potential real-world AI software modifications that may or may not be permitted under the proposed framework. The FDA is asking for comments and feedback from all parties to inform future decisions.
Locked Versus Adaptive AI
To date, only two AI-based technologies have received full FDA approval and are in clinical use — IDx-DR, a software that detects diabetic retinopathy, and the Viz.AI Contact application that analyzes computed tomography (CT) images for potential signs of stroke. Gottlieb noted that both of these technologies can be considered “locked” algorithms. This means that the base algorithms can only be modified by the manufacturer, and must be manually verified and validated by them as well. Other AI algorithms are considered “adaptive” or “continuously learning,” and these learn from new user data acquired through real-world use.
In the statement, Gottlieb acknowledged the vast potential of such adaptive algorithms, but also insisted that these more open technologies must still adhere to the FDA’s safety and effectiveness standards.
Total Product Lifecycle Regulatory Approach
The discussion paper describes how the current 510(k) approval pathway takes a risk-based approach, requiring new premarket submissions for some software modifications. Categories of software modifications that may require a premarket submission include:
- A change that introduces a new risk or modifies an existing risk that could result in significant harm;
- A change to risk controls to prevent significant harm; and
- A change that significantly affects clinical functionality or performance specifications of the device.
For today’s AI-based technologies, the discussion paper notes these considerations must be balanced with the ability for the software to “continue to learn and evolve over time to improve patient care.”
To satisfy all of these requirements, the discussion paper explores the potential of a total product lifecycle (TPLC)-based approach to certification. In this model, the FDA would “assess the culture of quality and organizational excellence of a particular company, and have reasonable assurance of the high quality of their software development, testing and performance monitoring of their products.”
One of the key elements considered in the TPLC approach will be a software’s predetermined change control plan. This plan would provide detailed information about the types of anticipated modifications based on the algorithm’s re-training and update strategy, and the associated methodology being used to implement those changes in a controlled manner that manages risks to patients. According to Gottlieb, the goal of a revised framework would to assure that ongoing algorithm changes:
- Follow pre-specified performance objectives and change control plans;
- Use a validation process that ensures improvements to the performance, safety and effectiveness of the AI software; and
- Include real-world monitoring of performance once the device is on the market to ensure safety and effectiveness are maintained.
The agency is taking public comment on the contents of the discussion paper through June 3, 2019. The full discussion paper can be read here. Comments can be submitted here.
For more information: www.fda.gov
November 20, 2025 
