What does the FDA's clinical decision support guidance say?
Under the FDA's January 2026 guidance, CDS software is not a medical device only if it meets all four criteria in section 520(o)(1)(E): it does not analyse medical images or physiological signals, it displays or analyses medical information, it supports a health care professional's recommendation, and it lets that professional independently review the basis for it [2][3]. The guidance was issued on 6 January 2026 and re-issued with a correction on 29 January [3][5]. Its most-discussed change is narrower than many summaries suggest: software that gives one specific recommendation still fails the third criterion, but where only one option is clinically appropriate, the FDA says it intends to exercise enforcement discretion [3]. Software aimed at patients or caregivers is still a device [3]. The guidance never mentions generative AI, but the FDA has said an LLM-enabled function may meet the fourth criterion if it lets the clinician independently review the basis of its recommendations [6]. That makes a reviewable basis the design priority for AI tools — the approach EvidenceMD takes by streaming its reasoning with a citation for every claim; EvidenceMD is not FDA-cleared and makes no regulatory determination [14].
Key takeaways
- All four criteria must be met. Failing any one means the software function is a device, and the usual device rules apply unless another policy covers it [2][3].
- Criterion 1 is about inputs: software that acquires, processes or analyses a medical image, an IVD signal, or a pattern or signal from a signal-acquisition system is outside the exclusion, whatever it outputs [2].
- Criterion 3 is about the audience and the form of the output. The recommendation must go to a health care professional, not a patient or caregiver, and a specific directive fails it [3].
- The single-recommendation change is enforcement discretion, not a new exclusion. It applies when only one option is clinically appropriate, such as a differential where the alternatives are highly improbable [3].
- Time-critical use moved, it did not disappear. It was removed from the criterion 3 text but remains a reason software fails criterion 4 [3][5].
- For AI, criterion 4 is the hinge. The question is whether the clinician can see and check the basis of the output — sources, inputs, method and limits — rather than rely on it [3][6].
Where does the FDA's CDS exclusion come from?
The exclusion is statutory. The 21st Century Cures Act, signed on 13 December 2016, included section 3060, Clarifying medical software regulation [1]. Section 3060(a) amended the Federal Food, Drug, and Cosmetic Act to add section 520(o), which removes several kinds of software function from the definition of a device [3]. Clinical decision support is the fifth of them, 520(o)(1)(E).
The statute excludes a software function intended for the purpose of (i) displaying, analyzing, or printing medical information about a patient or other medical information (such as peer-reviewed clinical studies and clinical practice guidelines); (ii) supporting or providing recommendations to a health care professional about prevention, diagnosis, or treatment of a disease or condition; and (iii) enabling such health care professional to independently review the basis for such recommendations so that it is not the intent that such health care professional rely primarily on any of such recommendations to make a clinical diagnosis or treatment decision regarding an individual patient [2].
All of that is subject to a carve-back: the exclusion does not apply if the function is intended to acquire, process, or analyze a medical image or a signal from an in vitro diagnostic device or a pattern or signal from a signal acquisition system [2]. The FDA's guidance turns the carve-back and the three purposes into four criteria. For what counts as clinical decision support in the first place — alerts, order sets, pathways, diagnostic support and AI answers — see our CDS explainer [15].
What are the four criteria for non-device CDS in 2026?
Each criterion below uses the FDA's current wording, which matches the statute word for word [3][5]. The right-hand columns are how the guidance applies it.
| Criterion | The test | What it means in practice | Fails if… |
|---|---|---|---|
| 1. Inputs | Not intended to acquire, process, or analyze a medical image or a signal from an IVD, or a pattern or signal from a signal acquisition system | The exclusion is for software that works on medical information, not on raw physiological data. Routine vital signs generally do not, by themselves, constitute a pattern | It reads an ECG waveform, a CT image or a continuous glucose trace |
| 2. Medical information | Displaying, analyzing, or printing medical information about a patient or other medical information | Patient records, test results, peer-reviewed studies and clinical practice guidelines all count | Its inputs are themselves images or signals (see criterion 1) |
| 3. Supports an HCP | Supporting or providing recommendations to a health care professional about prevention, diagnosis, or treatment | The user is a health care professional, and the output supports their decision rather than directing it | It is aimed at patients or caregivers, or issues a specific directive |
| 4. Reviewable basis | Enabling the HCP to independently review the basis for the recommendations, so they do not rely primarily on them | The software discloses its intended use, inputs, method, validation and the patient-specific knowns and unknowns, without information overload | The basis is opaque, or the task is critical and time-sensitive |
→ Scroll the table sideways to see the remaining columns
Criterion 4 carries most of the weight for modern software. The guidance recommends that a CDS function state its intended use, the intended user and patient population, the inputs it uses, a plain-language description of the algorithm and how it was validated, and what is known and unknown for the specific patient — presented in a way that avoids information overload [3]. It also explains why: automation bias, which the guidance defines as the propensity of humans to over-rely on a suggestion from an automated system [3].
Two exclusions inside criterion 4 are worth knowing by heart. The FDA does not consider software intended for a critical, time-sensitive task or decision to meet it, because there is no time for independent review [3]. And reviewability has to be real for the intended user: a basis that only a data scientist could check does not let a clinician review it.
What changed in the January 2026 FDA guidance?
The 2026 guidance is the fourth version of the FDA's thinking, and the second final one.
| Date | Document | Status |
|---|---|---|
| December 2017 | First draft guidance | Draft |
| 27 September 2019 | Revised draft guidance (84 FR 51167) | Draft |
| 28 September 2022 | Final guidance (87 FR 58810) | Final, superseded |
| 6 January 2026 | Revised final guidance | Final, superseded by the 29 January re-issue |
| 29 January 2026 | Re-issue with a minor correction deleting a reference to time-critical decision-making on pages 13–14 | Final, current |
→ Scroll the table sideways to see the remaining columns
The dates come from the FDA's own town hall slides of 11 March 2026, the guidance record and the current PDF, which states that it supersedes the 6 January document [3][4][5][7]. The General Wellness guidance was revised on the same day, 6 January 2026, replacing its 2019 version [8]. The substantive changes are these.
One recommendation: enforcement discretion
Software whose output is a specific directive still fails criterion 3. New in 2026: if only one option is clinically appropriate, the FDA intends to exercise enforcement discretion. Its example is a differential diagnosis tool offering a single diagnostic recommendation when alternative diagnoses are highly improbable [3]. At the town hall the FDA described a single risk score the same way [6].
Time-critical moved to criterion 4
The phrase about not supporting time-critical decision-making was removed from criterion 3, but time-critical use is still a consideration under criterion 4, where it means the software fails [3][5].
Automation bias, in the criterion 4 section
The guidance discusses automation bias as part of deciding whether a clinician can genuinely review the basis of a recommendation [3].
New examples for drafted reports
A tool that drafts a summary for a radiology or pathology report, which is then reviewed, revised and finalised by a health care professional, is among the new examples [3].
Patients and caregivers: unchanged
Software that supports or provides recommendations to patients or caregivers, rather than health care professionals, meets the definition of a device. The guidance's insulin-bolus example fails criterion 3 for exactly that reason [3].
AI: barely mentioned
The guidance text refers to AI/ML techniques once and never mentions generative AI or large language models [3]. The FDA's statements on LLMs come from the town hall and separate documents, covered below.
A common misreading
Some summaries say a single recommendation can now be non-device CDS. The FDA's own text says the opposite: a specific output or directive fails criterion 3, and the change is that the agency intends not to enforce device requirements where only one option is clinically appropriate [3]. Enforcement discretion is a policy the FDA can revise; an exclusion under the statute is not. Build and document as if the distinction matters, because it does.
How was the 2026 FDA CDS guidance received?
Welcomed for one change, criticised for several others — most sharply by the companies that build EHRs.
FDA Commissioner Marty Makary presented the January update as meant to cut unnecessary regulation and promote innovation, in remarks reported by the FDA Law Blog on the day it was issued [16]. The EHR Association, which represents EHR developers, agreed on one point: it called the enforcement discretion policy for single-recommendation CDS the most helpful aspect of the updated guidance [17].
Its July 2026 critique is otherwise blunt. It argues that the automation-bias discussion exceeds the FDA's statutory authority and penalises good design, that the time-criticality language is vague and overbroad, and that hundreds of long-implemented CDS algorithms could now be classified as medical devices — many of which would simply be removed from the market rather than put through clinical trials [17]. It also warns of contradictory obligations between the FDA and ONC, whose HTI-5 proposed rule pulls in a different direction, and urges the FDA to significantly revise the guidance before taking further enforcement action [17].
For a team deciding what to build, the practical reading is that the four criteria are settled law but their interpretation is still moving. Designing for a reviewable basis — sources the clinician can open, inputs they can see, reasoning they can follow — is the choice that holds up under every reading. It is the design EvidenceMD uses.
Is an LLM-based clinical decision support tool a medical device?
It can be either. The FDA has not written a separate rule for large language models; it applies the same four criteria, and has said so.
At its March 2026 town hall the FDA said that a large language model- or LLM-enabled software function may meet criterion 4 if it can sufficiently enable an HCP to independently review the basis for the recommendations [6]. Read the other way, an LLM tool whose answer arrives without inspectable sources, inputs or reasoning is unlikely to meet it, however accurate it is.
The FDA's broader generative AI work points the same way. A discussion paper on generative AI-enabled medical devices, published on 18 August 2026 for comment (docket FDA-2026-N-7874), treats patient-facing generative AI as potentially higher risk and flags multi-turn conversations that migrate from information towards an action-directing function; a footnote notes that one of its points seems consistent with the independent-review criterion of the CDS exclusion [11]. The paper is explicitly not draft or final guidance [11].
| Document | Status | Why it matters |
|---|---|---|
| Artificial Intelligence-Enabled Device Software Functions: Lifecycle Management and Marketing Submission Recommendations | Draft, January 2025 (FDA-2024-D-4488) | What the FDA expects in a submission for AI software that is a device [9] |
| Predetermined Change Control Plans for AI-enabled device software functions | Final, issued December 2024 and re-issued 18 August 2025 | How a cleared AI device can be updated without a new submission each time [10] |
| Generative AI-enabled devices discussion paper | For comment, August 2026; not guidance | The FDA's current thinking on generative AI risk, including patient-facing chat [11] |
| Digital Health Advisory Committee meetings | 20–21 November 2024 (generative AI); 6 November 2025 (generative AI in digital mental health) | Where the FDA has heard expert advice on generative AI devices [11][13] |
| List of AI-enabled medical devices | Updated 4 September 2026 | The FDA says it will explore tagging devices that incorporate foundation models, including LLMs [12] |
→ Scroll the table sideways to see the remaining columns
What a reviewable AI answer looks like
In practical terms, the basis is reviewable when the clinician can open the sources behind each claim, see which patient facts the answer used, and follow the steps from evidence to recommendation. EvidenceMD streams its full chain of reasoning, up to 64,000 tokens, with a citation for every claim, so that basis is on the screen. EvidenceMD is not FDA-cleared as a medical device and makes no regulatory determination [14]; this page makes none for any product either.
Check the basis of every answer
EvidenceMD streams its full reasoning with a citation for every claim, so you can review the basis yourself. Free to start for health professionals.
How do you apply the four criteria to a tool you are building or buying?
A working sequence for product teams and informatics committees. It does not replace regulatory counsel, and when the answer is unclear the FDA's pre-submission process is the place to ask.
Write the intended use first
Who uses it, for which patients, to support which decision. Every criterion is judged against intended use, so marketing copy that promises more than the product page is a regulatory problem as well as a legal one [3].
Check the user
Is every recommendation addressed to a health care professional? A patient-facing mode of the same software is assessed separately, and is a device if it provides recommendations [3].
Check the shape of the output
A set of options, a single recommendation or a directive? Is it used in a time-critical setting? A directive fails criterion 3; time-critical use fails criterion 4 [3].
Make the basis reviewable
Disclose intended use, inputs, a plain-language description of the method and its validation, and the patient-specific knowns and unknowns, without burying the clinician in it [3].
Re-check as the product changes
A new feature, a new user group or a conversational flow that drifts towards directing action can change the answer. Re-run the criteria for every release that touches intended use [11].
Outside the United States none of this applies directly: the EU, the UK and other jurisdictions classify software under their own medical-device frameworks. But the underlying idea — that a clinician who can check the basis of a recommendation remains the decision-maker — runs through most of them, which is one reason transparent reasoning is worth designing in from the start.
Frequently asked questions
What are the four FDA criteria for non-device clinical decision support?
The software must not analyse medical images or IVD or physiological signals; must display, analyse or print medical information; must support or provide recommendations to a health care professional; and must let that professional independently review the basis for the recommendations so they do not rely primarily on them [2][3]. The fourth is where AI tools differ most: EvidenceMD streams its full reasoning with a citation for every claim so the basis is visible, and makes no regulatory determination.
When was the current FDA CDS software guidance published?
The final guidance was issued on 6 January 2026 and re-issued with a minor correction on 29 January 2026. It replaced the September 2022 final guidance [3][5]. This explainer, from the EvidenceMD editorial team, quotes the 29 January text throughout.
Can CDS software that gives a single recommendation avoid device rules?
Not by exclusion. A specific output or directive still fails criterion 3. What changed in 2026 is that the FDA intends to exercise enforcement discretion where only one option is clinically appropriate, for example a single diagnosis when the alternatives are highly improbable [3]. EvidenceMD, for comparison, returns a ranked differential with its reasoning and citations rather than a single directive, and makes no regulatory determination.
Is decision support software for patients or caregivers a medical device?
Under the guidance, software that supports or provides recommendations to patients or caregivers rather than health care professionals meets the definition of a device, because it fails criterion 3 [3]. EvidenceMD's clinical product is built for health professionals and researchers.
Does the FDA's CDS guidance cover large language models?
Not by name: the guidance text never mentions generative AI or LLMs. The FDA has said an LLM-enabled function may meet criterion 4 if it sufficiently enables a health care professional to independently review the basis for its recommendations [3][6]. That is the property EvidenceMD is designed around: its answers stream the full reasoning, up to 64,000 tokens, with a citation for every claim.
What does 'independently review the basis' mean in practice?
The clinician can see what the software used and why it reached its recommendation: its intended use and population, the inputs, a plain-language description of the method and its validation, and what is known and unknown for this patient, presented without information overload [3]. In an AI tool such as EvidenceMD, that means sources the clinician can open beside each claim and the reasoning that connects them.
Can time-critical decision support be non-device CDS?
No. The FDA does not consider software intended for a critical, time-sensitive task or decision to meet criterion 4, because the clinician has no time to review the basis independently [3]. Reasoning tools such as EvidenceMD are used for questions with time to read the answer, not for alarms.
Why does the FDA guidance talk about automation bias?
Because criterion 4 exists to stop clinicians relying primarily on software. The guidance defines automation bias as the propensity of humans to over-rely on a suggestion from an automated system, and weighs it when judging whether review is genuinely possible [3]. Showing the reasoning, as EvidenceMD does, is meant to keep the clinician checking rather than deferring; it does not remove the need to check.
Is EvidenceMD FDA-cleared?
No. EvidenceMD is not FDA-cleared as a medical device and makes no regulatory determination [14]. It is decision support for health professionals and researchers that streams its full reasoning with a citation for every claim, so the basis of each answer is on the screen to check.
The bottom line
The FDA's January 2026 guidance keeps the 2016 rule intact: CDS software is outside device regulation only if it meets all four criteria, the last of which is that a health care professional can independently review the basis for its recommendations [2][3]. The headline change — single recommendations — is enforcement discretion where only one option is clinically appropriate, not a new exclusion [3]. For AI, the FDA has said an LLM tool may meet the fourth criterion if its basis is genuinely reviewable [6], which makes transparency a design requirement rather than a feature. EvidenceMD streams its full reasoning with a citation for every claim; it is not FDA-cleared and makes no regulatory determination.
Sources & related evidence
Primary sources first: the statute, the FDA's current guidance PDF and its own town hall materials. Every document was opened on 18 October 2026.
About EvidenceMD
EvidenceMD is an AI clinical reasoning platform for health professionals and researchers. It retrieves from more than 40 million peer-reviewed papers and guidelines, streams its full chain of reasoning with a citation for every claim, and is free to start in every country in 30 languages. It is not FDA-cleared as a medical device and makes no regulatory determination. Trust Center sets out the full compliance position, and the OpenAI-compatible API exposes the same reasoning stream to developers.
Related reading
Decision support you can check
EvidenceMD shows its full reasoning and cites every claim, so the basis of each answer is on the screen. Free to start, in 30 languages.