{"id":6999,"date":"2026-10-08T00:51:20","date_gmt":"2026-10-08T00:51:20","guid":{"rendered":"https:\/\/blogs.luc.edu\/compliance\/?p=6999"},"modified":"2026-10-08T00:51:20","modified_gmt":"2026-10-08T00:51:20","slug":"the-fdas-handle-on-ai-regulation","status":"publish","type":"post","link":"https:\/\/blogs.luc.edu\/compliance\/?p=6999","title":{"rendered":"The FDA\u2019s Handle on AI Regulation"},"content":{"rendered":"

Anjali Patel<\/em><\/p>\n

Associate Editor<\/em><\/p>\n

Loyola University Chicago School of Law, JD 2028<\/em><\/p>\n

Imagine a patient suffering from sporadic unconsciousness is hooked up to a heart monitor. Suddenly, an irregular heart rhythm begins but is flagged almost instantaneously. The irregularity was not spotted by a cardiologist analyzing an EKG but rather by AI trained on millions of other heartbeats. That\u2019s not a scene from the future. It\u2019s already routine.<\/p>\n

The FDA has authorized the marketing of over 1,500<\/a> AI-enabled medical devices in the United States. The first one dates back to 1995<\/a>, but the number of devices has sharply increased since then and continues to do so. However, the main caveat for AI devices<\/a> is that their software can change after authorization, but the FDA’s monitoring of those changes doesn\u2019t. In light of this, the FDA needs stricter and more continuous regulation of AI-enabled medical devices.<\/p>\n

Built for pacemakers, not algorithms<\/strong><\/p>\n

The FDA\u2019s approval system<\/a> is built around products, such as pacemakers, implants, or drugs. These products are checked thoroughly and approved by regulators before entering the market; thereafter, the product is meant to stay as is. AI doesn\u2019t fit that mold.<\/p>\n

The FDA sorts medical devices into three classes based on risk level<\/a>: Class I\u2014low risk, Class II\u2014moderate risk, and Class III\u2014high risk. Most AI devices<\/a> land in Class II. Devices in this class<\/a> are usually subject to premarket review under section 510(k) of the Federal Food, Drug, and Cosmetic Act. Instead of proving safety and effectiveness from ground zero, as high-risk Class III devices generally have to<\/a>, manufacturers only have to show that their device is substantially equivalent<\/a> to a device already on the market. Once proven, the FDA clears the device for sale, which is generally a faster and cheaper process<\/a> than a full premarket approval.<\/p>\n

Over the years, the FDA has tried to modernize its approach by allowing companies to submit predetermined change control plans<\/a>, which describe how their AI devices might change over time. Congress has also taken notice. In its FY2026 appropriations<\/a>, it required the FDA to assess its existing authorities and report back within 90 days on the statutory changes needed to oversee post-deployment performance of AI devices.<\/p>\n

The FDA has since published a discussion paper and request for feedback<\/a> on regulating generative AI-enabled devices. The paper touches on<\/a> how the FDA\u2019s Center for Devices and Radiological Health (CDRH) has recognized these challenges. The CDRH believes<\/a> that to ensure the continued safety and effectiveness of generative AI devices, it might be necessary for premarket evidence to be complemented by postmarket results, meaning checking in on how devices work not just before they hit the market but after as well. In line with this, the CDRH’s discussion paper<\/a> suggests possible postmarket approaches for generative AI devices, such as periodic re-benchmarking and sample-based clinician review, which would work like regular check-ins after a device reaches the market.<\/p>\n

Oversight beyond the first green light<\/strong><\/p>\n

The FDA’s current regulatory approach falls short<\/a>. As it stands, the FDA has not authorized any generative AI device for marketing. It has, however, granted a breakthrough device designation to RecovryAI<\/a> for its patient-facing clinical AI chatbot tool designed to help patients in post-operative recovery. This is a notable step forward for AI, though a designation is not an authorization. Devices such as this present an array of risks<\/a>: they can hallucinate, perform worse in real-world use than in testing, and operate with uncertain limits on what they are meant to be used for. Having AI complete simple tasks or answer routine recovery questions is one thing, but having it handle complex medical cases and diagnoses would be something entirely different.<\/p>\n

Undoubtedly, there are many opinions on how to address<\/a> this problem. Some say the FDA should adopt new regulations, requiring that AI devices be monitored well after initial authorization. Others say the current parameters work as is. Additionally, some industry groups want the FDA to use existing standards and a risk-based approach rather than instituting new postmarket monitoring standards.<\/p>\n

Regardless of whether new statutory changes are required in the current model, something needs to change to address the unprecedented regulatory complication that accompanies AI devices. Without a shift, it is likely the current process will fail to properly screen devices. The FDA must set up a strong and continuous regulatory framework that includes mandatory postmarket monitoring protocols for technology the industry can only anticipate.<\/p>\n","protected":false},"excerpt":{"rendered":"

Imagine a patient suffering from sporadic unconsciousness is hooked up to a heart monitor. Suddenly, an irregular heart rhythm begins but is flagged almost instantaneously. The irregularity was not spotted by a cardiologist analyzing an EKG but rather by AI trained on millions of other heartbeats. That\u2019s not a scene from the future. It\u2019s already routine.\u00a0<\/p>\n

The FDA has authorized the marketing of over 1,500 AI-enabled medical devices in the United States. The first one dates back to 1995, but the number of devices has sharply increased since then and continues to do so. However, the main caveat for AI devices is that their software can change after authorization, but the FDA’s monitoring of those changes doesn\u2019t. In light of this, the FDA needs stricter and more continuous regulation of AI-enabled medical devices.<\/p>\n","protected":false},"author":183,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[24,34],"tags":[2460],"class_list":["post-6999","post","type-post","status-publish","format-standard","hentry","category-fda","category-healthcare-compliance","tag-artificial-intelligence-in-healthcare"],"_links":{"self":[{"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=\/wp\/v2\/posts\/6999","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=\/wp\/v2\/users\/183"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=6999"}],"version-history":[{"count":1,"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=\/wp\/v2\/posts\/6999\/revisions"}],"predecessor-version":[{"id":7000,"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=\/wp\/v2\/posts\/6999\/revisions\/7000"}],"wp:attachment":[{"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6999"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6999"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6999"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}