Written and maintained by CASRAI Editorial Board
Last updated
The FDA Clinical Decision Support (CDS) Software Guidance (finalized September 28, 2022) defines the regulatory boundary between software functions that are excluded from federal medical device regulation—termed Non-Device CDS—and clinical algorithms regulated by the U.S. Food and Drug Administration as Software as a Medical Device (SaMD). Grounded in Section 3060 of the 21st Century Cures Act, which enacted Section 520(o)(1)(E) of the Federal Food, Drug, and Cosmetic (FD&C) Act (21 U.S.C. § 360j(o)(1)(E)), the FDA Final CDS Guidance requires a software function to satisfy all four statutory criteria simultaneously to qualify as Non-Device CDS.
How Does Section 3060 of the 21st Century Cures Act Exempt Certain CDS Software from Device Regulation?
Prior to the 21st Century Cures Act of 2016, the broad statutory definition of a medical device under Section 201(h) of the FD&C Act (21 U.S.C. § 321(h))—covering any instrument or contrivance intended for use in the diagnosis, cure, mitigation, treatment, or prevention of disease—created regulatory ambiguity for Electronic Health Record (EHR) order sets, drug-drug interaction checkers, and clinical calculators. Congress added Section 520(o)(1)(E) to carve out specific low-risk software functions intended for health care professionals (HCPs) from the statutory definition of a device.
If a software function satisfies every element of Section 520(o)(1)(E), it is legally not a medical device and is exempt from FDA registration, listing, Quality Management System Regulation (21 CFR Part 820), Medical Device Reporting (21 CFR Part 803), and premarket review (510(k) premarket notification, De Novo, or PMA). Conversely, if a software function fails even one of the four criteria, it remains a regulated medical device (Device CDS / SaMD).
What Are the Four Criteria for Non-Device Clinical Decision Support (CDS) Under the FDA Guidance?
In its September 2022 Final Guidance, the FDA provides a strict, clause-by-clause interpretation of the four statutory criteria in 21 U.S.C. § 360j(o)(1)(E):
| Criterion | Statutory Text (FD&C Act § 520(o)(1)(E)) | FDA Final Guidance Interpretation | Compliant Non-Device CDS Example vs. Regulated SaMD Example |
|---|---|---|---|
| Criterion 1 (Input Data Limit) |
Not intended to acquire, process, or analyze a medical image or a signal from an in vitro diagnostic (IVD) device or a pattern or signal from a signal acquisition system | Software that takes raw medical images (CT, MRI, X-ray, pathology slides), IVD raw assay outputs, or continuous physiological waveforms/patterns (ECG, EEG, PPG, continuous glucose sensor streams, or repeated vital-sign time series) as inputs fails Criterion 1 immediately. | Non-Device: Uses a single discrete lab value (e.g., serum creatinine) from the EHR. Device SaMD: Analyzes ECG waveforms for atrial fibrillation or CT pixels for stroke triage. |
| Criterion 2 (Medical Information) |
Intended for the purpose of displaying, analyzing, or printing medical information about a patient or other medical information (such as peer-reviewed clinical studies and clinical practice guidelines) | “Medical information” is limited to discrete data elements normally communicated between HCPs in a clinical conversation (such as a single lab test result, diagnosis code, or medication list) or published clinical guidelines/monographs (such as Lexicomp or MDCalc). | Non-Device: Matches a patient’s documented diagnosis and allergies against an authoritative clinical guideline. Device SaMD: Processes high-frequency sensor streams not normally communicated in a single clinical conversation. |
| Criterion 3 (HCP Support vs. Directive) |
Intended for the purpose of supporting or providing recommendations to a health care professional about prevention, diagnosis, or treatment of a disease or condition | Must be intended exclusively for an HCP (never for a patient or lay caregiver) AND must provide multiple clinical options or a prioritized list for the HCP to consider—never a single specific diagnosis, single directive output, or time-critical alarm. | Non-Device: Displays a list of guideline-concordant antibiotic classes for an HCP to consider. Device SaMD: Outputs a single patient-specific insulin dose or a sepsis probability score/alarm. |
| Criterion 4 (Independent Review) |
Intended for the purpose of enabling such health care professional to independently review the basis for such recommendations so that it is not the intent that such HCP rely primarily on any of such recommendations | The software and its labeling must plainly explain the logic, algorithm inputs, clinical guideline citations, and validation cohort limitations so the HCP can verify the recommendation with their own judgment in the available clinical time. | Non-Device: Transparent rule or published score showing every input variable and citation. Device SaMD: Opaque deep-learning / black-box model whose feature weights cannot be independently verified at the bedside. |
Why Do Time-Critical Alerts or Single-Output Treatment Directives Fail the Non-Device CDS Exemption?
One of the most consequential shifts in the FDA’s September 2022 Final Guidance is its focus on automation bias—the human factors propensity of clinicians to over-rely on automated computer outputs, especially under high cognitive load or time pressure (as also examined in FDA human factors guidance and augmented vs. artificial intelligence governance).
According to Section IV of the FDA Final Guidance, a clinical software tool fails Criteria 3 and 4 and crosses into regulated medical device territory whenever it exhibits any of the following characteristics:
- Time-Critical Clinical Situations: If a recommendation or alert requires urgent or immediate clinical action (such as an inpatient sepsis deterioration alarm, acute stroke triage alert, or critical arrhythmia notification), the clinician does not have adequate time to read underlying methodology papers or independently recalculate the basis for the alert before acting. Therefore, all time-critical clinical alerts fail Criterion 4.
- Single Specific Output or Directive (“Deterministic” Triage): Software that provides a single specific diagnosis, a single specific treatment directive, or a quantitative disease risk probability/severity score (for example, “Patient has a 78% probability of acute kidney injury within 24 hours”) is interpreted by the FDA as substituting for, rather than supporting, the clinician’s judgment under Criterion 3.
- Opaque or Non-Transparent Machine Learning Logic: Even in a non-urgent outpatient visit, if a predictive model relies on proprietary black-box neural network weights, unexplicated feature interactions, or unpublished training cohorts that prevent the clinician from tracing exactly how the patient’s individual inputs produced the recommendation, it fails Criterion 4 and is regulated under FDA AI/ML medical device pathways.
- Patient- or Caregiver-Facing Tools: Under the plain text of 21 U.S.C. § 360j(o)(1)(E)(ii), any decision-support tool intended to provide diagnostic or treatment recommendations directly to a patient or lay caregiver fails Criterion 3 (note that the FDA dismantled its earlier 2019 draft proposal for enforcement discretion over “low-risk patient CDS” in the 2022 Final Guidance).
Non-Device CDS Qualification & Documentation Checklist for Health IT Teams
Before deploying an EHR CDS Hook, clinical calculator, or order-set recommender without an FDA 510(k) or De Novo submission, regulatory affairs and clinical informatics teams document a formal four-criterion assessment:
- Input Audit (Criterion 1): Confirm that 100% of software inputs are discrete EHR medical records (single lab results, ICD-10/SNOMED codes, demographics, medication lists) and that the software does not ingest DICOM images, IVD raw signal files, ECG/PPG waveforms, or high-frequency continuous sensor time series.
- User & Output Framing Audit (Criteria 2 & 3): Verify that access is restricted to licensed HCPs, that the interface presents a list of clinical options or context rather than a single diagnostic/therapeutic directive or numeric probability score, and that the workflow is non-time-critical.
- Transparency & Labeling Audit (Criterion 4): Embed direct “InfoButton” or inline explanations inside the EHR user interface displaying: (a) the exact intended use and target patient population; (b) the patient-specific EHR inputs used; (c) the cited peer-reviewed clinical practice guideline, FDA-approved drug labeling, or published clinical study; and (d) known limitations or contraindications of the underlying rule.
