FDA Classifies AI Imaging Software Under 21 CFR 892.2055

The Lesson Before the Regulation

On June 17, 2026, FDA published a final order in the Federal Register classifying "radiological machine learning-based quantitative imaging software with predetermined change control plan" into Class II, with special controls, at 21 CFR 892.2055. Here's what I want you to take from that, before we get into the clause numbers: if you're building AI-based quantitative imaging software and you've been waiting for FDA to tell you what "good documentation" looks like for a predetermined change control plan, that wait is over. FDA just told you. In writing. Down to the level of which Bland-Altman plots it wants to see. If you make software that runs machine learning algorithms on radiological images to produce quantitative outputs, meaning view selection, segmentation, landmarking, and you want to update your algorithm over time without refiling a new submission every time, this regulation is now your rulebook. Not a guidance document you can argue with. A codified regulation.

I have watched a lot of device makers treat classification orders like they're just paperwork FDA does after the interesting work is finished. They're not. They're the clearest signal FDA gives about what it actually expects to see in a submission, because the special controls are the checklist FDA's own reviewers will use against your file. Let's walk through what changed, why it took three years to show up in the Federal Register, and what it means for your quality system.

What FDA Actually Did on June 17, 2026

The order itself is short, three pages in the Federal Register, but it does three things at once.

First, it codifies a new generic device type at 21 CFR 892.2055: "radiological machine learning-based quantitative imaging software with predetermined change control plan." The regulation defines it as a software-only device that employs machine learning algorithms on radiological images to provide quantitative imaging outputs, including functions like view selection, segmentation, and landmarking. Its design specifications must include planned modifications consistent with an established predetermined change control plan (PCCP).

Second, it assigns that device type to Class II and spells out the special controls that apply. I'll walk through those in detail below, because they're the part you'll actually use.

Third, and this is the part that matters most for anyone else building in this space, it confirms the device type is not exempt from premarket notification under section 510(m) of the FD&C Act. That means every device that fits this definition still needs a 510(k) clearance. The Class II classification lowers your regulatory burden relative to automatic Class III, but it does not let you skip premarket review.

Why the Effective Date Isn't the Whole Story

Here's a detail that trips people up: the order lists two dates, and they're three years apart. The order is effective June 17, 2026. But the classification itself was "applicable" on February 24, 2023.

That gap exists because of how the De Novo pathway actually works. Caption Health, Inc. submitted a De Novo request under section 513(f)(2) of the FD&C Act for its Caption Interpretation Automated Ejection Fraction Software, the underlying device behind this entire classification. Under section 513(f)(2), FDA is required to rule on a De Novo request within 120 days. FDA granted the request on February 24, 2023, classifying that specific device into Class II with special controls. That grant was the real regulatory event for Caption Health.

What happened in the years between 2023 and 2026 is the part most sponsors never see: FDA codifying the special controls it applied to that one device into a generic regulation that governs everyone building the same kind of device going forward. This is standard for De Novo classifications, and it's exactly why treating a De Novo grant letter as a private outcome, rather than reading it as a preview of the eventual regulation, is a mistake. If you're tracking a competitor's De Novo grant in your space, the special controls FDA imposed on them are very likely the special controls that will eventually get codified for you.

The practical upside of the codification: because Caption Health's device was classified via De Novo, it can now serve as a predicate for future 510(k)s of the same generic type under section 513(f)(2)(B)(i). Anyone building a competing radiological ML quantitative imaging device with a PCCP no longer needs to run their own De Novo request. You can use the standard 510(k) pathway instead, which is faster and cheaper.

The Four Special Controls, in Plain Terms

The regulation lists four categories of special control. I've mapped them against what your quality system actually needs to produce.

Special control (4)(vii) is worth sitting with for a second, because it's the one that's genuinely new territory for most quality teams. FDA is requiring you to label the change control plan itself: a plain statement that the device has a PCCP, a description of what modifications have actually been implemented, a version history, and a description of how you'll notify users when the algorithm changes. If your labeling procedure was written before PCCPs existed as a submission concept, it almost certainly doesn't have a home for this yet.

The Risk Table FDA Actually Published

FDA didn't just list special controls in the abstract. It published a risk-to-mitigation crosswalk in the order itself, and that table tells you exactly what FDA is worried about with this device category.

Notice that two of the three named risks are about the change control plan itself, not about the base algorithm. FDA is telling you, in its own risk analysis, that the biggest hazard in this device category isn't the machine learning model failing on day one. It's the model changing later in a way users don't understand or your own documentation doesn't support. That should reframe how much attention your PCCP gets relative to your initial validation package.

What This Means If You're Building in This Space

If you already have a cleared or PCCP-eligible quantitative imaging product, or you're planning a 510(k) submission for one, here's the practical checklist this order hands you:

1. Write the algorithm description before you write the submission. FDA wants inputs, outputs, every major functional block, and stated limitations, not a marketing summary of what the model does.

2. Document your training cohorts, not just your training data volume. The regulation specifically calls out subsets defined by patient demographics, clinically relevant confounders, and image acquisition characteristics. If your training data documentation doesn't break out performance by these subsets, it's not compliant with special control (1)(ii).

3. Keep your test set independent, and size it for subgroup analysis. The special control language requires "sufficient numbers of cases from important cohorts" so that performance estimates and confidence intervals can be characterized for each subgroup, not just the population as a whole. That's a sample-size planning decision you make before data collection, not after.

4. Treat the PCCP as a living design document, not a one-time submission exhibit. Special controls (2) and (3) both attach to "planned modifications," meaning every future version of your algorithm needs its own documented development, verification, validation, and risk assessment tied back to the original PCCP scope. Your design change control procedure needs a lane for this that doesn't require re-litigating the whole submission.

5. Build the PCCP labeling now, not at the first update. Version history and user notification procedures are labeling requirements under (4)(vii), which means they go through your labeling control process and get reviewed before your first algorithm update ships, not after.

How This Ties Back to Your Quality System

None of these special controls exist in isolation from your ISO 13485 quality management system. Design verification and validation under special control (1) is your design controls process under clause 7.3, executed against IEC 62304 software lifecycle requirements. Risk management under special control (3) is your ISO 14971 risk management file, extended to cover the specific hazard of a change happening after clearance rather than before it. Labeling under special control (4) runs through the same document control and labeling procedures you already maintain for every other product, just with new content categories added.

The sponsors who will move through this classification cleanly are the ones whose quality system already treats design change control as a formal, documented, risk-assessed process, because that's exactly the muscle this regulation is asking for. If your design change procedure currently treats "we updated the algorithm" as a minor revision with a one-line change note, this classification is your signal to fix that before your next submission. Don't wait for FDA to send a deficiency letter asking for the version history you didn't write down.

Last updated: 2026-09-09

Frequently Asked Questions

What is 21 CFR 892.2055?

It's the new FDA regulation, codified by a final order effective June 17, 2026 (Docket No. FDA-2026-N-6535), that classifies radiological machine learning-based quantitative imaging software with a predetermined change control plan into Class II with special controls. It defines the device as a software-only product that uses machine learning on radiological images to produce outputs such as view selection, segmentation, and landmarking.

Does this classification mean my device is exempt from a 510(k)?

No. FDA explicitly stated in the order that it has not exempted this device type under section 510(m) of the FD&C Act. Every device meeting this generic definition still requires premarket notification under section 510(k) before marketing.

Why does the order reference a 2023 date when it was published in 2026?

FDA granted the underlying De Novo classification to Caption Health, Inc.'s Caption Interpretation Automated Ejection Fraction Software on February 24, 2023, under section 513(f)(2) of the FD&C Act. The June 17, 2026 order is FDA formally codifying the special controls from that individual grant into a generic regulation that applies to the whole device category.

What are the four special controls under 21 CFR 892.2055?

(1) design verification and validation, including algorithm description, training data and cohort documentation, and independent performance testing; (2) documentation of planned modification methodology; (3) risk management for planned modifications; and (4) labeling covering patient population, intended users, performance data, failure conditions, and PCCP-specific disclosures including version history and user notification procedures.

Can I use another company's De Novo grant as my predicate for a similar device?

Yes. Once FDA classifies a device via De Novo under section 513(f)(2), it can serve as a predicate for future 510(k) submissions of the same generic type under section 513(f)(2)(B)(i). That's the practical benefit of this codification: later entrants can use the standard 510(k) pathway instead of filing their own De Novo request.