After first publishing the draft guidance in 2017, the agency received feedback from many stakeholders advising us on improvements that could be made to better clarify the agency’s oversight of CDS products. We heard you and worked to incorporate that important feedback. More specifically, stakeholders asked that the FDA consider the inclusion of risk-based categorization of software products based on the risk to patients if a software product malfunctions, so we’ve leveraged the International Medical Device Regulators ForumExternal Link Disclaimer (IMDRF) risk-based framework for categorizing products. The IMDRF final document, “Software as a Medical Device: Possible Framework for Risk Categorization and Corresponding ConsiderationsExternal Link Disclaimer,” progressing from our international harmonization efforts, establishes common principles that can be used by all stakeholders, including regulators, to promote safe innovation and protect patient safety. The draft guidance clarifies categories of CDS that would be subject to FDA oversight, categories of CDS for which we intend not to enforce applicable regulatory requirements (known as enforcement discretion) due to the software’s low risk to patients, and CDS categories that do not meet the definition of a medical device.

In this draft guidance, we propose to focus our regulatory oversight on CDS functions that are intended to help health care professionals and patients inform their clinical management for serious or critical conditions and that are not intended for health care professionals to independently evaluate the basis of the software’s recommendations. An example of a product we would focus our oversight on would be CDS that identifies hospitalized, type 1 diabetic patients at increased risk of postoperative cardiovascular events and which does not explain why the software made that identification to the health care professional. In this case, if the CDS provides information that is not accurate (e.g., inappropriately identifies a patient as low risk when he is high risk), then any misidentification could lead to inappropriate treatment and patient harm. Since the potential for patient harm is significant, FDA regulation plays an important role in evaluating the software’s safety and effectiveness.


We believe our proposed approach for regulating CDS not only fulfills the provisions of the Cures Act, but also strikes the right balance between ensuring patient safety and promoting innovation by clarifying which products would be the focus of FDA’s oversight and which would not.

U.S. Healthcare Homepage