AI Governance

FDA codifies a Class II pathway for certain cardiovascular machine-learning notification software

FDA has finalized a device classification that gives a defined regulatory home to a narrow category of cardiovascular machine-learning software.

Matt Reid

— 2 min read
Share

FDA has finalized a device classification that gives a defined regulatory home to a narrow category of cardiovascular machine-learning software. The September 11 order places it in Class II with special controls.

What It Is

The rule creates 21 CFR 870.2380 for “cardiovascular machine learning-based notification software.” The category covers software that uses machine learning and one or more non-invasive physiological inputs gathered during routine care to suggest the likelihood of a single cardiovascular disease or condition for referral or diagnostic follow-up. FDA is explicit about the guardrails: the output is not diagnostic-quality, is meant to support further testing, and is not intended to identify or detect arrhythmias.

The order is the public codification of a De Novo classification FDA issued to Viz.ai on August 3, 2023. It became effective September 11, 2026, and carries Docket No. FDA-2026-N-9907.

What’s Changing

Class II status comes with special controls tailored to an AI-enabled clinical notification tool. The regulation requires clinical validation using independent real-world data from a representative patient population, including enough cases to characterize performance across important cohorts, clinically relevant confounders, comorbidities, and acquisition systems. The test data must include at least three geographically diverse sites that were not used to train the model.

It also requires software verification, validation, and hazard analysis; human-factors assessment of the risk that users will misinterpret the output; and labeling that spells out performance testing, supported populations, device limitations, sensor-related factors, and appropriate follow-up. The labeling must warn users not to treat the absence of a suspected finding as a reason to rule out follow-up, or to substitute the output for a full clinical evaluation. A rare moment when the regulatory prose has the decency to say the quiet part plainly.

Why It Matters

For physicians and health systems, the practical signal is not that AI has been granted clinical carte blanche. It is that FDA has specified the evidence and communication expectations for a particular class of cardiovascular notification software before it is used to steer downstream testing. The requirements place model performance, subgroup characterization, workflow interpretation, and hardware inputs in the same regulatory frame—an acknowledgement that a reassuring-looking alert can still mislead if it travels poorly from dataset to clinic.

For product developers, the generic Class II classification means a substantially equivalent future device may use the 510(k) route rather than begin with a De Novo request, subject to the applicable requirements. That may lower a procedural hurdle, but it does not dissolve the special controls or premarket-notification requirement. The more interesting test now is whether these detailed controls become a useful template for other clinical AI categories—or a reminder that every algorithm eventually meets the labels, validation files, and human behavior it cannot wish away.

Read the final order in the Federal Register (https://www.federalregister.gov/documents/2026/09/11/2026-18612/medical-devices-cardiovascular-devices-classification-of-the-cardiovascular-machine-learning-based)

Read more