FDA Rules for Custom Medical AI: Where the Line Is

You want a tool that reads wound photos and tracks healing between visits. Or one that flags patients overdue for a screening. Or one that sorts incoming faxes. All three are AI, and all three are custom software. Only one of them is likely to be a medical device in the eyes of the FDA.

Where that line falls decides whether a project is a few months of development or a regulatory submission. The Food and Drug Administration updated its clinical decision support software guidance in January 2026. The update clarified the line in some places and left it fuzzy in others. This guide explains it for a practice or a developer deciding what to build.

Software that is not a medical device at all

The 21st Century Cures Act of 2016 took several kinds of software out of the definition of a medical device. Two exclusions matter most for practices.

The first covers software "for administrative support of a health care facility." The statute lists examples including billing, appointment schedules, business analytics, practice and inventory management, and laboratory workflow.

That covers a large share of what small practices want built. A fax pipeline that sorts referrals, a prior authorization tracker, a recall engine and a practice dashboard are all administrative. Our guides to AI fax processing and custom tools small practices build describe tools that sit on this side of the line.

The second exclusion covers certain general wellness products, such as consumer apps that support a healthy lifestyle without claims about a specific disease. They matter less for a practice's own tools, but they explain why so many health apps never see FDA review.

Clinical decision support: the four criteria

The third exclusion is the one with the most nuance. Clinical decision support software, or CDS software, is not a device if it meets all four criteria in the law. The FDA restated them at its March 2026 town hall on the guidance:

1. It does not acquire, process or analyze a medical image, a signal from an in vitro diagnostic device, or a pattern or signal from a signal acquisition system.
2. It displays, analyzes or prints medical information about a patient, or other medical information such as clinical practice guidelines.
3. It supports or provides recommendations to healthcare professionals about prevention, diagnosis or treatment.
4. It lets the professional independently review the basis for its recommendations, so they do not rely primarily on the software.

Fail any one of the four and the software function is a device, subject to FDA oversight unless another exemption applies.

The fourth criterion carries the safety logic. Its concern is automation bias: a clinician accepting a recommendation they cannot check, simply because software produced it.

Why images fall on the device side

The first criterion is the one that catches image AI. The FDA was explicit in that town hall: it "considers software functions that assess or interpret the clinical implications or relevance of a signal, pattern, or medical image to be software functions that do not meet criterion one."

So software that reads an X-ray, a CT scan or an ultrasound and tells a clinician what it shows is a device. That is why products in this space go through FDA clearance, as our guide to dental AI x-ray analysis describes.

Photos are the gray zone. A wound photo or a picture of a skin lesion taken on a phone was not captured by a medical imaging system. It is still being analyzed for a clinical purpose. Treat software that interprets clinical photos as likely device territory, and get regulatory advice before building it.

What changed in January 2026

The FDA issued the revised guidance on January 6, 2026, replacing the 2022 version. The statutory criteria did not change; the FDA's interpretation of them did, in a few ways that matter for AI.

• Single recommendations. The 2022 guidance was wary of CDS that offered one answer. The FDA will now exercise enforcement discretion for tools that give a single recommendation where only one is clinically appropriate, if the other criteria are met.
• AI, including generative AI. As Orrick summarized it, this applies to AI features as long as clinicians can understand and verify the underlying logic.
• Time-critical decisions. Software meant for time-critical decision-making still fails the independent-review test. Covington notes that the guidance moved this point from criterion three to criterion four, without defining exactly what counts as time-critical.

The direction is lighter regulatory oversight for transparent tools. It is not deregulation. Opaque models, image analysis and software that directs care without human review still sit inside FDA oversight.

A practical sorting guide

"Likely" is doing real work in that table. Classification depends on the intended use and the claims you make, so the same code can land differently depending on how it is described.

What this means if you are building

For a practice commissioning its own tools, the safest strategy is simple. Build the administrative tools, and build transparent CDS that shows its working. Buy FDA-cleared products for anything that interprets images or signals.

If you do want custom software on the device side, plan for it from the start. Whoever markets a device takes on manufacturer obligations, including premarket review and a quality system, and that changes the budget and the timeline entirely.

Whichever side you are on, HIPAA still applies to any tool that touches patient data. Our guide to HIPAA-compliant software development covers those requirements, and a written AI policy sets the rules for how clinicians use the tools you deploy.

This guide is general information, not legal advice. For anything near the line, a short consultation with regulatory counsel costs far less than building the wrong thing.

Scoping a custom tool and want to keep it on the right side of the line? Our custom healthcare software practice builds administrative and transparent clinical tools. It also tells you early when a project would need FDA review.