A clinician opens an electronic health record and sees a set of guideline-based options for an adult with possible pneumonia. Down the hall, a different tool scans patient data and sends an urgent sepsis alert. Both can influence care. The US Food and Drug Administration (FDA) gives the first as an example of clinical decision support that can fall outside the device definition if the clinician can independently review its basis. It gives the second as an example of a device function. If either contributes to an injury, the device classification and the question of who may be liable are separate inquiries. FDA final guidance on clinical decision support software, sections V.A and V.C
When clinical decision support is a medical device
The FDA regulates medical devices, including devices that use AI. In its final guidance issued on 29 January 2026, the agency explains how it interprets the statutory exclusion for certain clinical decision support (CDS) software. Apply the criteria to each software function. A platform can contain both device and non-device functions. For the CDS exclusion, a function must meet all four conditions. 21 USC § 360j(o)(1)(E), FDA clinical decision support guidance
- Its intended purpose excludes acquiring, processing or analysing medical images, signals from an in vitro diagnostic device, or patterns or signals from a signal acquisition system.
- It displays, analyses or prints information about a patient or other medical information, such as practice guidelines or peer-reviewed studies.
- It supports or provides recommendations to a healthcare professional about prevention, diagnosis or treatment.
- It is designed to let that professional independently review the recommendation’s basis and use their own judgment when making the patient’s diagnosis or treatment decision.
The inputs can change how the FDA classifies a function. A function that uses a radiologist’s written findings to suggest a report summary with a guideline-based diagnostic recommendation for review may qualify for FDA enforcement discretion in the circumstances described in the guidance. A function that analyses the underlying image to generate those findings fails the first criterion. Recommendations about disease directed to patients or caregivers fall outside this particular clinician-facing exclusion. FDA final guidance, sections IV.1–IV.3
For software that returns one recommendation, the FDA says it intends to exercise enforcement discretion where only one option is clinically appropriate and the function otherwise meets the statutory criteria. The agency still considers that a function intended for a critical, time-sensitive task or decision fails the independent review criterion because the clinician is unlikely to have enough time to check the basis. FDA final guidance, sections IV.3–IV.4
Independent review depends on what the clinician can see and understand at the point of care. The FDA recommends identifying the intended user and patient population, the inputs and their quality requirements, and the method, data and validation in plain language. It also recommends showing relevant patient details and gaps, such as missing or unexpected inputs. A citation to a guideline is most useful when the clinician can see how the tool applied it to the patient in front of them. FDA final guidance, section IV.4
How a missed alert could lead to different claims
Imagine an emergency department patient whose vital signs worsen. An AI system sends no sepsis alert, escalation is delayed and the patient is harmed. The investigation can ask what the bedside team knew, whether the hospital’s alert workflow was reasonable, and whether the product worked as designed. The patient record, alert logs and device version can help establish what happened and whether any failure contributed to the delay.
Clinical malpractice. The question is whether the clinician’s assessment and response met the applicable standard of care and whether a departure caused the injury. A New York appellate decision, for example, describes malpractice in terms of a departure from accepted practice and proximate cause. In the hypothetical, the recorded vital signs, repeat observations and time of escalation matter alongside the system’s silence. New York Appellate Division, Sessa v Peconic Bay Medical Center
Hospital responsibility. A review can also examine how the hospital configured the tool, trained staff, routed alerts and handled downtime. California’s model jury instructions illustrate that a hospital can owe its own duty to use reasonable care, including through appropriate policies, procedures and personnel. Whether the way a tool was deployed breached a duty depends on the facts and applicable state law. California Judicial Council civil jury instructions, No. 514
Product liability. A claim against a manufacturer might focus on a defect or an inadequate warning. The available claims depend on state law, the product and the FDA pathway. In Riegel v. Medtronic, the US Supreme Court held that federal law can pre-empt certain state claims that would impose different or additional safety requirements on a device that received FDA premarket approval. The Court distinguished state duties that parallel federal requirements. Verify the actual pathway before drawing conclusions. FDA 510(k) clearance, De Novo classification and premarket approval are different routes. US Supreme Court, Riegel v. Medtronic, FDA guide to device review pathways
What to check before use and after an incident
Before adopting a tool, ask for the exact function, version and intended use, including the populations and settings covered by its evidence. For a regulated device, verify the submission number and indications in the FDA record. Find out what happens when data are missing, how updates reach your site and who follows up on faults. For some AI devices, the FDA reviews a predetermined change control plan as part of the marketing submission. The plan describes the proposed changes, how they will be developed and validated, and their expected impact. Changes implemented in line with that plan can proceed without a separate marketing submission for each one. FDA list of AI-enabled medical devices, FDA final guidance on change control plans
After suspected harm, address the patient’s immediate needs, use your organisation’s incident process and preserve the relevant input, output, software version and timestamps through approved channels. In the US, clinicians and patients can make voluntary device reports through FDA MedWatch. Manufacturers, importers and qualifying device user facilities have separate mandatory duties for specified events. A hospital’s safety team can determine which facility reporting rules apply. FDA Medical Device Reporting
Frequently asked questions
Does a human reviewer make a clinical AI function exempt from FDA device rules? A reviewer alone is insufficient. For this exclusion, all four statutory criteria must be met. That includes giving the intended clinician enough information and time to review the basis of the recommendation independently.
Does the FDA decide who is liable for an AI error? The FDA oversees medical devices and can act on safety concerns. Civil claims about negligent care or a defective product are decided under the applicable law, which may include both state law and federal limits on certain claims.