Foundation Models vs FDA's SaMD Framework

Not yet, as a dedicated category. FDA’s "Artificial Intelligence-Enabled Medical Devices" page states the agency "will explore methods to identify and tag medical devices that incorporate foundation models… from large language models (LLMs) to multimodal architectures" -- language describing a future tagging method on FDA’s device list, not an existing review pathway. Devices using foundation-model components are currently evaluated under FDA’s general AI/ML device framework, the same one built for narrow, single-task models.

FD&C Act §520(o)(1)(E) (21 U.S.C. §360j(o)(1)(E)) excludes certain clinical decision support software from the legal definition of a "device," provided a health care professional can "independently review the basis" for its recommendations rather than relying on them primarily. FDA’s Clinical Decision Support Software guidance (final, January 2026) interprets that carve-out, and CASRAI’s own SaMD guide covering this ground contains zero mentions of "large language model," "foundation model," "generative AI," "LLM," or "GPT" -- the carve-out was not drafted with those systems in mind, and the "independently reviewable basis" test is a harder fit for a model whose basis spans a training corpus rather than a fixed input set.

PCCPs are built for a sponsor to pre-specify one or more defined future modifications -- for example, retraining a locked classifier on a new dataset -- and the exact methodology for validating each one, under FD&C Act §515C and guidance docket FDA-2022-D-2628 (issued Dec. 4, 2024, reissued final Aug. 18, 2025). That structure presumes the sponsor can name the coming change in advance. A general-purpose foundation model’s downstream fine-tuning, prompting surface, or emergent behavior after a base-model update is a much harder fit for a plan that has to be pre-specified at authorization time.

No. CASRAI’s Assessing Third-Party AI Vendor Risk guide is a generic enterprise AI-procurement checklist -- checked line-for-line, it contains zero mentions of "hospital," "healthcare," "patient," "FDA," "SaMD," "medical device," or "EHR." This page is about whether a foundation model embedded in a clinical product has a defined FDA review pathway at all; vendor risk assessment is a separate, later question that applies once a product exists.

CASRAI’s own NIKOLAI project -- an independent, unendorsed reference dictionary of frontier-AI-safety elements, not a standard FDA has adopted -- defines "Deployment Surface" and "Coverage Scope Threshold" in its N1 track as the general problem of pinning down where a model is made available and what if-then test decides whether a rule applies to it. Neither element’s crosswalk table currently carries an FDA row, and this page does not claim one exists. But FDA’s CDS and PCCP mechanisms both assume a fixed deployment surface and a fixed coverage-scope test, and a general-purpose foundation model breaks both assumptions the same way NIKOLAI’s N1 track exists to name in the abstract -- a structural echo, not a claim that FDA uses NIKOLAI’s terms.

A tech-transfer office trying to license an NIH- or NSF-funded foundation-model-based diagnostic algorithm to an industry partner needs to know, before executing that license, which FDA pathway (if any) the resulting product would need to clear — and this page's finding that FDA's own AI-enabled-device page admits it lacks a method to even tag foundation-model-based devices is directly relevant deal information. Separately, a clinical-research office or IRB reviewing a protocol that uses a foundation model for a diagnostic or triage function needs to know whether the CDS software carve-out's "independently reviewable basis" test can plausibly be satisfied by a general-purpose model.