Is your software a medical device?

What is software as a medical device (SaMD)?

Software as a medical device (SaMD) is software intended for one or more medical purposes that performs them without being part of a hardware medical device, in the definition used by the International Medical Device Regulators Forum (IMDRF). In the US, FDA looks at each software function: it is a device if its intended use fits the device definition in FD&C Act section 201(h) and section 520(o) does not exclude it.

• Medical purpose. Under section 201(h), a device is intended for use in diagnosing disease or other conditions, in curing, mitigating, treating or preventing disease, or to affect the structure or any function of the body.
• Five exclusions. Section 520(o)(1) excludes software functions intended for administrative support of a health care facility, or for a healthy lifestyle unrelated to disease. It also excludes certain electronic patient records, and software that only transfers, stores, converts or displays lab and device data without interpreting it. The fifth is clinical decision support that meets four criteria.
• Intended use, not technology. FDA's software policy is independent of platform, so the same rules apply to mobile, web, desktop and cloud software. Intended use is shown by labeling claims, advertising, oral or written statements and the product's design (21 CFR 801.4), so your website, app store text and sales materials count.
• Three outcomes. FDA's software policy separates functions that are not devices, functions that may be devices but for which FDA intends to exercise enforcement discretion because they pose lower risk, and device functions that are the focus of FDA's oversight. For low-risk general wellness products, FDA says it does not intend to examine whether they are devices.
• One function at a time. In a product with several functions, FDA does not regulate the non-device functions as devices, but it may assess their impact on the device functions (section 520(o)(2)).
• Who is the manufacturer. FDA's software policy treats the company that writes the specifications and markets the product as the manufacturer. A developer that only turns those specifications into software is not the manufacturer. The author is, unless another company assumes all responsibility for manufacturing and distribution. Offering a device function by subscription or as software as a service makes the provider a manufacturer.

This page covers US FDA rules only. The EU, the UK and other markets classify software under different rules, and a 'not a device' result does not mean that no other law applies.

What changed in FDA rules for health software in 2026?

Six changes matter most for software teams: FDA re-issued its clinical decision support (CDS) and general wellness guidances in January 2026, the Quality Management System Regulation (QMSR) took effect on February 2, 2026, the cybersecurity guidance was re-issued on February 3, 2026, new user fees apply from October 1, 2026, and FDA finalized its guidance on prescription drug use-related software in October 2026. The law itself did not change: section 520(o) has been the same since the 21st Century Cures Act of 2016.

• January 6 and January 29, 2026: Clinical Decision Support Software guidance. The January 6 version replaced the 2022 guidance, and the January 29 re-issue (the current version) made a minor correction. New: FDA intends to exercise enforcement discretion when a function gives one specific recommendation, only one option is clinically appropriate, and it meets the other CDS criteria. Time-critical use is now assessed under Criterion 4 only. Continuous, near-continuous or streaming measurement counts as a signal, while routine vital signs taken at discrete visits generally are not a pattern.
• January 6, 2026: General Wellness: Policy for Low Risk Devices replaced the 2019 version. New: FDA may consider non-invasive products that estimate blood pressure, oxygen saturation, blood glucose or heart rate variability to be general wellness products, if the outputs are solely for wellness uses, clinical-style values are validated, and there are no disease claims, clinical alerts or treatment guidance.
• February 2, 2026: the QMSR (21 CFR 820) replaced the Quality System regulation. It incorporates ISO 13485:2016 by reference. Design and development requirements (ISO 13485 clause 7.3) apply to Class II and III devices, to Class I devices automated with computer software and to a short list of other Class I devices (21 CFR 820.10(c)).
• February 3, 2026: FDA re-issued its premarket cybersecurity guidance under the QMSR. Its section on 'cyber devices' under FD&C Act section 524B (a postmarket vulnerability plan, secure design and patching processes, and a software bill of materials) has been part of the guidance since June 27, 2025.
• October 1, 2026: fiscal year 2027 user fees. 510(k) $28,653, De Novo $191,020, PMA $636,732, 513(g) request $8,596, and annual establishment registration $13,785.
• October 20, 2026: final guidance on prescription drug use-related software. FDA treats what software disseminated by or for a drug company shows about its prescription drug as drug labeling, in addition to any device rules that apply.
• Still drafts: FDA's lifecycle guidance for AI-enabled device software functions (January 7, 2025), with a final version on CDRH's A-list of guidances planned for fiscal year 2027, and the cuffless blood pressure testing guidance (January 23, 2026). The guidance on Predetermined Change Control Plans for AI-enabled devices is final (August 18, 2025).

Are wearables medical devices under FDA's 2026 general wellness guidance?

Not necessarily. Under the January 6, 2026 General Wellness guidance, FDA may consider a non-invasive wearable that estimates blood pressure, oxygen saturation, blood glucose or heart rate variability to be a low-risk general wellness product when its outputs are intended solely for wellness. It is not a general wellness product if it is intended for screening, diagnosis, monitoring, alerting or management of a disease.

• FDA's conditions (p. 5). The product is non-invasive and not implanted, and uses no technology that is risky without specific controls, such as lasers or radiation. It is not intended to diagnose, cure, mitigate, prevent or treat a disease, and does not substitute for an FDA-authorized device. It has no claims, functions or outputs that prompt specific clinical action. It shows values that mimic clinical ones only if they are validated, for example by manufacturer testing or peer-reviewed literature. Meeting these conditions does not guarantee the outcome: FDA says it 'may consider' such products wellness.
• What it may show (p. 6): values, ranges, trends, baselines and longitudinal summaries, in the context of sleep, activity, stress, recovery or similar wellness domains.
• What disqualifies it (p. 6), anywhere in labeling, advertising, user interface or functionality: references to specific diseases, clinical conditions or diagnostic thresholds, alerts that recommend or require specific clinical action, and treatment guidance. So do claims of clinical accuracy, 'medical grade' or substitution for an FDA-authorized device, and intended uses that target diagnosis, screening, monitoring or management of a disease.
• A note that evaluation by a healthcare professional may be helpful is allowed (p. 6) if it does not name a disease, does not call the output abnormal or diagnostic, gives no clinical thresholds or treatment advice, and is not ongoing monitoring of a disease.
• FDA's own examples (pp. 9-10): a portable product that monitors pulse rate and oxygen saturation during exercise and hiking is a low-risk general wellness product. So is a wrist wearable that shows sleep, pulse rate and photoplethysmography-based blood pressure for activity and recovery, provided the blood pressure values are validated. Claims implying a medical or clinical context would remove that status. A microneedle glucose wearable is not low risk, because it penetrates the skin.
• Software and hardware differ. An app with healthy-lifestyle claims unrelated to disease is excluded from the device definition by FD&C Act section 520(o)(1)(B). For low-risk wellness hardware, CDRH says it does not intend to examine whether the product is a device. The CDS guidance adds that activity monitors not intended or marketed for a medical purpose are not medical devices (p. 9).
• Close to the line. FDA's draft pulse oximeter guidance (January 7, 2025) says wellness oximeters under product codes PGJ and OCH are not reviewed before marketing, and it describes a wellness SpO2 function that feeds a device software function notifying the user of a sleep apnea event. FDA's draft cuffless blood pressure guidance (January 23, 2026) says cuffless devices have generally been Class II under 21 CFR 870.1130 (product code DXN), and a new intended use or new technology may need a De Novo or PMA.

Is clinical decision support software a medical device?

Clinical decision support (CDS) software is not a device if it meets all four criteria in FD&C Act section 520(o)(1)(E). Since January 2026, FDA also intends to exercise enforcement discretion for CDS that gives one specific recommendation when only one option is clinically appropriate and the other criteria are met. Such a function is still a device.

• Criterion 1: the function does not acquire, process or analyze a medical image, a signal from an in vitro diagnostic device, or a pattern or signal from a signal acquisition system. Examples of patterns are ECG waveforms, continuous glucose monitor readings over time and genomic sequence files (p. 8).
• Criterion 2: it displays, analyzes or prints medical information, such as demographics, symptoms, certain test results, discharge summaries, clinical practice guidelines or peer-reviewed studies (p. 9).
• Criterion 3: it supports or provides recommendations to a health care professional (HCP). Lists and prioritized lists of options qualify (p. 13). Recommendations to patients or caregivers do not, so patient-facing decision support is a device function, although other FDA policies may place it under enforcement discretion.
• Criterion 4: the HCP can independently review the basis of the recommendation and does not rely primarily on it. FDA recommends showing the required inputs, a plain-language description of how the algorithm was developed and validated, and patient-specific knowns and unknowns. Software for a critical, time-sensitive task or decision does not meet this criterion (p. 14).
• The 2026 single-recommendation policy (pp. 10-12). FDA's examples include a prediction of future cardiovascular events, a treatment plan for diagnosed cognitive impairment, one specific antibiotic, and a draft radiology or pathology report with one guideline-based diagnostic recommendation. In each, the output is presented for an HCP to consider, review or finalize.
• Where the policy stops. It does not cover a function that also analyzes medical images or signal-level data, relies on data that are not well understood and accepted for the clinical use (FDA names genomic data without established relevance), or supports near-term or emergent decisions, such as predicting a cardiovascular event in the next 24 hours. FDA staff added at the March 11, 2026 town hall that not every prediction of harm within 24 hours fails Criterion 4.
• AI and machine learning are not excluded. The guidance lists AI/ML techniques as one approach whose basis should be described in plain language (p. 14), and FDA staff said an LLM-enabled function may meet Criterion 4 if it lets the HCP independently review the basis.
• Simple calculators. Simple medical calculations routinely used in clinical practice that can be calculated manually, such as BMI, APGAR or the NIH Stroke Scale, are not Non-Device CDS, but FDA intends to exercise enforcement discretion for them (FDA CDS FAQ).

Enforcement discretion is FDA policy, not a statutory exclusion. FDA says it does not intend to enforce device requirements at this time, and it can change that position.

Which FDA pathway does my software need: 510(k), De Novo or PMA?

The pathway follows the device type. If a classified type with the same intended use exists, a Class I or II device needs a 510(k) unless that type is exempt. A novel device of low to moderate risk with no predicate can request De Novo classification, and Class III devices generally need premarket approval (PMA).

• 510(k): you show substantial equivalence to a legally marketed predicate with the same intended use. FY2027 fee: $28,653, or $7,163 for a qualified small business. FDA goal: a decision within 90 FDA days for 95% of submissions. You may not market the device until FDA issues its clearance order.
• 510(k)-exempt: most Class I and some Class II device types. You still register, list, meet general controls and stay within the limits of the exemption. For example, software that analyzes retrospective continuous glucose monitor data without dosing or treatment advice (product code PHV) is Class I and 510(k)-exempt.
• De Novo: for a novel device with no predicate whose risks general and special controls can manage. FY2027 fee: $191,020, or $47,755 for a small business. FDA goal: a decision within 150 FDA days for 90% of De Novo requests received in FY2027 (80% in FY2026). FDA may decline a request if a predicate exists or the device is not of low to moderate risk. A granted device becomes a predicate for later 510(k)s, and FDA recommends that sponsors consider a Pre-Submission first.
• PMA: for Class III devices, approved on sufficient valid scientific evidence of safety and effectiveness. FY2027 fee: $636,732, or $159,183 for a small business. FDA goal: a decision within 180 FDA days for 90% of original PMAs, or 320 FDA days with an advisory committee. MDUFA V also sets a shared FDA and industry goal of 285 calendar days on average for original PMAs received in FY2025 to FY2027.
• FDA days are days a submission is under FDA review. They stop while FDA waits for your answers, so the calendar time is longer.
• Real averages, from FDA's MDUFA V performance report of August 26, 2026 (data through June 30, 2026): 510(k)s accepted in FY2023 to FY2025 took about 141 to 144 days in total on average, of which about 75 were FDA days and the rest was the sponsor's response time. De Novo requests took about 248 to 270 days on average to a final outcome in the closed FY2023 and FY2024 cohorts, and the open FY2025 cohort is running longer (about 278 days with about 81% of requests decided).
• How to read these averages: they are averages, not medians, for fiscal-year cohorts of accepted submissions. They count from FDA's receipt of an accepted submission, so preparation time and refuse-to-accept cycles are not included. The 510(k) figures exclude third-party reviews and 510(k)s withdrawn or closed without a substantial equivalence or not substantially equivalent decision. De Novo times include requests that were declined, withdrawn or deleted, so they are not time to a grant: of 72 FY2024 De Novo requests with a final outcome, 29 were granted, 18 declined and 25 withdrawn or deleted.
• Fee rules: for the small business rate (gross receipts or sales of no more than $100 million, including affiliates), you must send FDA proof that you qualify at least 60 days before the fee is due, and qualify again every fiscal year. Up to $30 million, the fee for a first PMA may be waived. The annual establishment registration fee ($13,785) has no small business rate.
• Format: 510(k)s since October 1, 2023, and De Novo requests since October 1, 2025, must be submitted electronically through eSTAR.
• After clearance: FDA's 2017 software change guidance says a new 510(k) is likely needed when a change could cause significant harm through a new or changed risk or risk control, or could significantly affect clinical functionality or performance. A Predetermined Change Control Plan authorized in the original submission can cover planned changes in advance.

How do I ask FDA whether my software is a medical device?

Use a 513(g) Request for Information when you want FDA's written view on whether your product is a device, its class and which submission it needs. Use a Pre-Submission when you know the pathway and want FDA's feedback on your testing and submission plans. For informal questions about whether software is a device, FDA lists the address DigitalHealth@fda.hhs.gov.

• 513(g): FY2027 fee $8,596, or $4,298 for a small business. FDA intends to answer within 60 days, and the review starts once all fees owed, including establishment registration fees, are paid. The answer is FDA's view based on the information you send: it is not a classification decision, not a clearance and not final agency action.
• What a 513(g) answer covers: whether the product appears to be a device, the generic device type and class, and whether a 510(k), a PMA or neither is required. FDA does not review test data and does not say which tests you need. You cannot add a new question, use or technology to a pending request without a new fee.
• Pre-Submission (Q-Submission program): voluntary, and FDA's list of submissions that carry a user fee does not include it. FDA aims to send written feedback within 70 days of receipt, or at least 5 days before a meeting if you ask for one. Meetings 70 to 75 days after receipt are most likely to be feasible. Feedback does not guarantee a favorable decision, although FDA intends it not to change if your later submission is consistent and no important new issues arise.
• Device classification is not decided in a Pre-Submission. FDA recommends that sponsors consider a Pre-Submission before a De Novo request, you can use one to ask about your software's Documentation Level, and FDA's draft cuffless blood pressure guidance recommends one for every new device of that type.
• Questions about whether a product is a drug, a device or a combination product go to FDA's Office of Combination Products, not to a 513(g).
• FDA's Digital Health Policy Navigator walks through the same exclusions step by step. Its pages date from 2022, before the 2026 CDS and general wellness guidances, and its results are not a formal FDA device determination.

How much does SaMD development cost?

By Orangesoft's public benchmark, building Software as a Medical Device costs $200,000 to $350,000+ for a Class I or low-risk product, $330,000 to $600,000+ for a Class II product going through a 510(k) or De Novo, and $550,000 to $800,000+ for a Class III product (PMA). These are our estimates for software development and regulatory documentation, not FDA figures, and FDA fees come on top.

The SaMD ranges cover IEC 62304 lifecycle files, an ISO 14971 risk management file, quality system artifacts, cybersecurity documentation, verification and validation protocols and submission support. They do not include clinical studies, FDA or notified-body fees, legal or regulatory advice, cloud running costs or third-party licenses.

• Medical imaging and diagnostics software, regulated diagnostic product (clinical validation, QMS, 510(k) or De Novo submission support): $300,000 to $500,000+.
• Clinical decision support system: $150,000 to $260,000+ rule-based, and $200,000 to $400,000+ ML-driven with explainability, performance monitoring and a regulatory path.
• Digital therapeutics: $240,000 to $380,000+ for a prescription digital therapeutic pilot, and $360,000 to $500,000+ for a regulated prescription therapeutic with FDA submission.
• Medical device companion app, regulated (part of the device file, IEC 62304, cybersecurity documentation): $150,000 to $250,000+.
• Remote patient monitoring platform with thresholds, alerts and a clinician dashboard: $140,000 to $250,000+.
• AI model validation and clinical evidence package (retrospective analysis, bias testing and a documentation draft, without prospective or multi-site studies): $40,000 to $80,000+.
• For comparison, an activity tracking app with wellness-only claims, which is not a device: $60,000 to $100,000+.

FDA costs to add for FY2027: $28,653 for a 510(k), $191,020 for a De Novo or $636,732 for a PMA (lower for qualified small businesses), plus $13,785 a year for establishment registration.

Full table, scope levels and method: Orangesoft Healthcare Software Development Cost Benchmark 2026, linked in the sources below.

Does a SaMD development partner need ISO 13485?

Not under FDA rules. Under the QMSR the quality management system belongs to the device manufacturer, and FDA does not require or issue ISO 13485 certificates. Orangesoft is certified to ISO 9001:2015, not ISO 13485.

• Since February 2, 2026, FDA's Quality Management System Regulation (21 CFR 820) requires manufacturers to document a quality management system that complies with the applicable requirements of ISO 13485:2016, which it incorporates by reference.
• An ISO 13485 certificate does not exempt a manufacturer from FDA inspection (QMSR FAQ, Q13).
• FDA says a software developer that only turns the author's specifications into an app is not the manufacturer. The author is, unless another company assumes all responsibility for manufacturing and distribution (Policy for Device Software Functions, p. 8).
• IEC 62304 is recognized by FDA (recognition number 13-79, complete standard). A Declaration of Conformity to it is one accepted way to cover software development and maintenance documentation in a premarket submission, and FDA says a declaration to the complete standard is not needed.

Orangesoft has experience preparing FDA submission documentation (Stroke App).

SaMD examples: how FDA treats 40 common products

Every row is an example FDA itself gives in a guidance, on its website, at its March 2026 CDS town hall or in its product classification database, with FDA's outcome and the page it comes from. Your product's result depends on its exact intended use and claims.

Questions about software as a medical device

Sources and how to cite this tool

• FD&C Act section 201(h), 21 U.S.C. 321(h): definition of device, current through Pub. L. 119-136 (October 22, 2026) (statute)
• FD&C Act section 520(o), 21 U.S.C. 360j(o): software functions excluded from the device definition, current through Pub. L. 119-136 (October 22, 2026), unchanged since 2016 (statute)
• FD&C Act section 513, 21 U.S.C. 360c: classification, including 513(g), U.S. Code 2024 edition (statute)
• FD&C Act section 524B, 21 U.S.C. 360n-2: ensuring cybersecurity of devices, U.S. Code 2024 edition (statute)
• 21 CFR 801.4, Meaning of intended uses, eCFR as of October 22, 2026 (last amended 2021) (regulation)
• Medical Devices; Quality System Regulation Amendments (QMSR), final rule, 89 FR 7496, February 2, 2024, effective February 2, 2026 (regulation)
• Quality Management System Regulation: Frequently Asked Questions, content current as of October 2, 2026 (FDA web page)
• Clinical Decision Support Software, January 29, 2026 (supersedes January 6, 2026) (final guidance)
• Clinical Decision Support Software Frequently Asked Questions (FAQs), content current as of June 29, 2026 (FDA web page)
• CDRH Town Hall: Clinical Decision Support Software, Final Guidance, transcript, March 11, 2026 (FDA staff remarks)
• General Wellness: Policy for Low Risk Devices, January 6, 2026 (supersedes September 27, 2019) (final guidance)
• Policy for Device Software Functions and Mobile Medical Applications, September 28, 2022 (final guidance)
• Medical Device Data Systems, Medical Image Storage Devices, and Medical Image Communications Devices, September 28, 2022 (final guidance)
• Changes to Existing Medical Software Policies Resulting from Section 3060 of the 21st Century Cures Act, September 27, 2019 (no longer updated) (final guidance)
• Digital Health Policy Navigator, content current as of December 14, 2022 (FDA web page)
• Content of Premarket Submissions for Device Software Functions, June 14, 2023 (final guidance)
• Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions, February 3, 2026 (supersedes June 27, 2025) (final guidance)
• Federal Register notice 2025-11669: Cybersecurity in Medical Devices guidance (adds the section 524B cyber device section), June 27, 2025 (Federal Register notice)
• Artificial Intelligence-Enabled Device Software Functions: Lifecycle Management and Marketing Submission Recommendations, January 7, 2025 (draft guidance)
• Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions, August 18, 2025 (first issued December 4, 2024) (final guidance)
• CDRH Proposed Guidances for Fiscal Year 2027, October 1, 2026 (FDA agenda list)
• Regulatory Considerations for Prescription Drug Use-Related Software, October 20, 2026 (final guidance)
• Pulse Oximeters for Medical Purposes: Non-Clinical and Clinical Performance Testing, Labeling, and Premarket Submission Recommendations, January 7, 2025 (draft guidance)
• Cuffless Non-invasive Blood Pressure Measuring Devices: Clinical Performance Testing and Evaluation, January 23, 2026 (draft guidance)
• Deciding When to Submit a 510(k) for a Software Change to an Existing Device, October 25, 2017 (final guidance)
• Medical Device User Fee Rates for Fiscal Year 2027, 91 FR 48134, July 30, 2026 (fees apply October 1, 2026 to September 30, 2027) (Federal Register notice)
• Medical Device User Fee Amendments (MDUFA): Fees, content current as of October 1, 2026 (FDA web page)
• MDUFA Performance Goals and Procedures, Fiscal Years 2023 Through 2027 (MDUFA V commitment letter), 2022, in force FY2023 to FY2027 (FDA commitment letter)
• MDUFA V Performance Report, actions through June 30, 2026, August 26, 2026 (FDA performance report)
• MDUFA V Performance Report, actions through March 31, 2026, May 19, 2026 (FDA performance report (superseded))
• FDA and Industry Procedures for Section 513(g) Requests for Information under the Federal Food, Drug, and Cosmetic Act, August 23, 2024 (final guidance)
• Requests for Feedback and Meetings for Medical Device Submissions: The Q-Submission Program, May 29, 2025 (final guidance)
• Premarket Notification 510(k), content current as of August 22, 2024 (FDA web page)
• De Novo Classification Request, content current as of September 30, 2025 (FDA web page)
• Premarket Approval (PMA), content current as of May 16, 2019 (FDA web page)
• Class I and Class II Device Exemptions, content current as of October 6, 2026 (FDA web page)
• Classify Your Medical Device, content current as of August 26, 2026 (FDA web page)
• eSTAR Program, content current as of September 21, 2026 (FDA web page)
• FDA Recognized Consensus Standards: IEC 62304 Edition 1.1 2015-06, recognition number 13-79, entered January 14, 2019 (FDA database)
• IMDRF, Software as a Medical Device (SaMD): Key Definitions (IMDRF/SaMD WG/N10FINAL:2013), December 9, 2013 (IMDRF final document)
• FDA Product Classification Database, product code QAS: Radiological computer-assisted triage and notification software, page checked October 26, 2026 (FDA database)
• FDA Product Classification Database, product code MYN: Analyzer, medical image, page checked October 26, 2026 (FDA database)
• FDA Product Classification Database, product code PIB: Diabetic retinopathy detection device, page checked October 26, 2026 (FDA database)
• FDA Product Classification Database, product code QDA: Electrocardiograph software for over-the-counter use, page checked October 26, 2026 (FDA database)
• FDA Product Classification Database, product code QDB: Photoplethysmograph analysis software for over-the-counter use, page checked October 26, 2026 (FDA database)
• FDA Product Classification Database, product code QVO: Computerized behavioral therapy device for insomnia, page checked October 26, 2026 (FDA database)
• FDA Product Classification Database, product code QRX: Continuous glucose monitor informed insulin dose calculator, page checked October 26, 2026 (FDA database)
• FDA Product Classification Database, product code SAK: Software device to aid in the prediction or diagnosis of sepsis, page checked October 26, 2026 (FDA database)
• FDA Product Classification Database, product code PYT: Device, fertility diagnostic, contraceptive, software application, page checked October 26, 2026 (FDA database)
• FDA Product Classification Database, product code PHV: Continuous glucose monitor retrospective data analysis software, page checked October 26, 2026 (FDA database)

Orangesoft. (2026). SaMD Check: Is your software a medical device? [Online tool]. Retrieved from https://orangesoft.co/services/medical-device-software-development/samd-check

Orientation only, not legal or regulatory advice or an FDA decision. It is based on your answers, not a review of your product, labeling or marketing. US FDA rules as of October 26, 2026.