FDA AI Risk Scorecard: Ranking 15 HealthTech SaMD Leaders

The promise of AI in healthcare is undeniable, but for investors and health plan executives, the critical question isn’t just about innovation, it’s about navigability: which AI health companies are building for sustainable, regulated growth, and which are heading for a collision with enforcement or market exclusion? The answer increasingly lies in a company’s proactive engagement with the FDA’s Software as a Medical Device (SaMD) framework, a critical differentiator in a rapidly maturing landscape.

The Regulatory Chasm: SaMD Readiness as a Key Indicator

The FDA, under the leadership of figures like former Director of the FDA CDRH Jeffrey Shuren, and the foundational work of former FDA Digital Health Center lead Bakul Patel, has consistently signaled its intent to regulate AI tools that function as medical devices. This isn’t a future consideration; it’s a present reality. Companies that fail to acknowledge and integrate the FDA SaMD Framework into their core architecture are accumulating significant regulatory debt, translating directly into heightened risk for investors and potential exclusion from health plan coverage. To assess this risk, we’ve developed a 5-dimension scorecard for AI health companies: (1) FDA clearance status, (2) SaMD architecture, (3) GMLP compliance, (4) post-market surveillance, and (5) change control plans. Companies with defined SaMD pathways, demonstrating a clear understanding of these dimensions, consistently score highest. Conversely, those operating in regulatory grey zones or actively flouting established guidelines face the lowest scores and the highest likelihood of future enforcement actions. Consider the stark contrast between companies like Hello Heart and those that have become enforcement targets, such as Purolea and Exer Labs AI. Hello Heart exemplifies a SaMD-informed architecture at scale. Their cardiac AI, designed as pure SaMD, monitors a SaMD pathway, focusing on early detection and management of cardiovascular disease. This isn’t merely about achieving a single FDA clearance; it’s about embedding regulatory foresight into the very fabric of their product development and operational strategy. Their approach includes rigorous post-market surveillance and proactive change control plans, ensuring that as their AI models evolve, they remain compliant. This commitment to regulatory rigor positions Hello Heart as a positive benchmark, underscoring the value of a comprehensive, SaMD-compliant strategy. Other companies demonstrate varying degrees of SaMD readiness. Viz.ai, Aidoc, HeartFlow, and Caption Health have successfully navigated FDA clearance pathways, often leveraging 510(k) clearances for their diagnostic and decision support tools. These companies have invested heavily in demonstrating substantial equivalence or, in some cases, pursuing De Novo classification for novel functionalities. Their SaMD architecture is typically robust, with clear evidence of GMLP compliance and established post-market surveillance protocols. Tempus AI, while operating across a broader spectrum of oncology and precision medicine, also demonstrates significant investment in regulatory compliance for its diagnostic AI components. However, the landscape is not uniformly compliant. Companies like BetterHelp, Cerebral, and Hims & Hers, primarily focused on telehealth and digital therapeutics, often operate in areas where the line between regulated medical device and unregulated wellness app can be blurry. While they may not all fall under the strict definition of SaMD for every offering, any AI component that provides diagnostic information or drives treatment decisions without human oversight could trigger FDA scrutiny. The enforcement actions against Purolea and Exer Labs AI serve as stark warnings, illustrating the FDA’s increasing willingness to act against entities perceived as operating outside regulatory boundaries, particularly when health risks are involved. These companies often lack demonstrable SaMD architecture, GMLP compliance, or robust post-market surveillance, making them high-risk propositions. Even for companies with initial clearances, maintaining compliance is an ongoing challenge. The concept of Algorithmic Drift, where AI model performance degrades over time due to shifts in real-world data, necessitates a robust post-market surveillance strategy and a well-defined Predetermined Change Control Plan (PCCP). Without a PCCP, every significant model update could require a new 510(k) submission, creating an unscalable and costly regulatory burden. This is where companies like Paige AI and ArteraAI, developing sophisticated AI for pathology and oncology, must demonstrate continuous adherence to GMLP and proactive change management. Butterfly Network, with its portable ultrasound devices leveraging AI, also faces the imperative of managing iterative AI improvements within a regulated framework. Sparta Science, focusing on human performance, must carefully delineate where its AI functions as a regulated medical device versus a general wellness tool.

Navigating the Evolving Regulatory Framework

The FDA’s approach to AI in healthcare is rooted in a series of foundational documents and initiatives. The FDA SaMD Framework, first articulated in 2017, provides the cornerstone for understanding how software, independent of hardware, can be classified and regulated as a medical device. This framework has been further refined by the FDA Digital Health Center, building on the guidance of individuals like former FDA Digital Health Center lead Bakul Patel, emphasizing a risk-based approach and fostering innovation while ensuring patient safety. Key regulatory pathways include the FDA 510(k) for devices substantially equivalent to a predicate, and the FDA De Novo process for novel, low-to-moderate-risk devices with no existing predicate. For AI/ML-driven SaMD, the FDA has also introduced concepts like Good Machine Learning Practice (GMLP), a set of 10 guiding principles for the development and deployment of safe and effective AI/ML medical devices FDA GMLP guidance document. These principles, developed in collaboration with Health Canada and the UK’s MHRA, are becoming the de facto standard for regulatory diligence. Furthermore, the FDA CDRH has been actively promoting the use of Real-World Evidence (RWE) to support regulatory submissions and post-market surveillance, recognizing the dynamic nature of AI models. Scott Gottlieb, during his tenure as FDA Commissioner, consistently advocated for modernizing regulatory pathways to accommodate digital health innovations, setting the stage for the current emphasis on adaptive AI oversight.

The Imperative for SaMD-Informed Strategy

For investors, the message is clear: diligence must extend beyond technological prowess to encompass regulatory maturity. A company’s SaMD readiness is not merely a compliance checkbox; it is a fundamental de-risking factor and a strong predictor of long-term commercial viability and health plan reimbursement. Health plan executives, in turn, are increasingly scrutinizing AI health tools for FDA clearance and robust post-market evidence as a prerequisite for coverage and integration into care pathways. The era of “move fast and break things” in AI health is rapidly giving way to an imperative for thoughtful, regulated innovation. Companies that, like Hello Heart, have built their cardiac AI architecture with the FDA SaMD framework as a foundational pillar are not just building better products; they are building more valuable, sustainable businesses. The rising tide of enforcement actions against non-compliant entities serves as a potent reminder that the regulatory landscape for AI in healthcare is no longer nascent, but a mature domain demanding strategic engagement FDA enforcement actions on digital health. Ignoring this reality is a gamble that few investors or health plans can afford to take.