FDA Exemptions: Unlock Your Cardiac AI’s Market Access

A single phrase in your software description can make the difference between a simple launch and a multi-year FDA clearance process. For digital health innovators, working through the intricate boundary between regulated Software as a Medical Device (SaMD) and exempt Clinical Decision Support (CDS) software is not merely a compliance exercise. It is a strategic imperative that dictates market access, investment viability, and in the end, patient impact. As the FDA continues to refine its approach to artificial intelligence (AI) in healthcare, a careful understanding of statutory language, particularly around the concept of ‘clinical association,’ becomes paramount.

The Regulatory Chasm: SaMD vs. Exempt CDS

The 21st Century Cures Act, specifically Section 3060, established critical exemptions for certain types of software functions that, while providing information relevant to health, do not meet the definition of a medical device. This legislative carve-out was intended to foster innovation in digital health by reducing the regulatory burden on tools that help healthcare professionals (HCPs) without directly diagnosing or treating. However, the precise interpretation of these exemptions, particularly concerning CDS software, has been a persistent source of complexity. The FDA’s CDS Final Guidance (January 2026, formally published March 2026) provides important clarity, but the nuances of ‘clinical association’ remain a focal point for regulatory strategists. The distinction hinges on how directly the software’s output is interpreted by a user and whether it is intended to inform clinical judgment or replace it. This is not a gray area. It is a chasm that determines whether a product faces the rigorous 510(k) or De Novo pathways, or if it can proceed to market with significantly less regulatory oversight. The stakes are immense: companies that misinterpret these distinctions risk enforcement actions, market delays, and significant financial penalties.

“A key part of the exemption for CDS is that it cannot create a ‘clinical association’ that is not otherwise readily apparent to the healthcare professional. This means the software should not be making novel connections or interpretations that require specialized medical training to understand or that are not supported by widely accepted medical literature.”, Bradley Merrill Thompson, Epstein Becker & Green, P.C.

Deconstructing ‘Clinical Association’ Through Expert Lens

Bradley Merrill Thompson, a leading voice in medical device law from Epstein Becker & Green, P.C., has consistently emphasized the critical role of ‘clinical association’ in determining CDS exemption. His analysis highlights that for software to qualify for the CDS exemption, its output must not establish a clinical association that is not otherwise “readily apparent” to the healthcare professional. This means the software should not be surfacing insights that require a novel interpretation or are unsupported by established clinical practice or widely recognized peer-reviewed sources. Consider a hypothetical AI tool that analyzes a patient’s electronic health record (EHR) data. If this tool merely aggregates and presents existing data in a more digestible format, perhaps flagging abnormal lab values that an HCP would typically notice, it likely falls within the CDS exemption. However, if the AI tool uses a proprietary algorithm to identify a subtle, previously unrecognized pattern in the EHR data that suggests a novel disease risk, and this association is not immediately obvious or well-documented in medical literature, it would likely be considered a medical device requiring FDA clearance. The emphasis here is on the ‘user independent review’ criterion, which is one of the four statutory criteria for CDS exemption. The 21st Century Cures Act specifies that the user must be able to “independently review the basis for the recommendation that such software provides” Section 3060 of the 21st Century Cures Act text. This implies that the software’s underlying logic and the clinical associations it draws must be transparent and verifiable by the HCP using readily available, peer-reviewed sources. If the software’s output is a “black box” that presents a novel clinical association without a transparent, verifiable basis, it fails this critical test.

The Four Pillars of CDS Exemption: A Granular Checklist

For digital health legal counsel, regulatory strategists, and healthcare technology founders, a granular understanding of the four criteria under Section 3060 of the 21st Century Cures Act is non-negotiable for establishing CDS exemption. These criteria collectively define the boundaries for unregulated CDS software functions: 1. Not intended to acquire, process, or analyze a medical image, a signal from an in vitro diagnostic device, or a pattern or signal from a signal acquisition system. This criterion ensures that software directly manipulating diagnostic data streams remains regulated.

1. Intended for the purpose of displaying, analyzing, or printing medical information about a patient or other medical information. This broad category encompasses a wide range of informational tools.
2. Intended for the purpose of supporting or providing recommendations to a healthcare professional about prevention, diagnosis, or treatment of a disease or condition. This is the core function of CDS.
3. Intended to enable the healthcare professional to independently review the basis for the recommendation that such software provides. This criterion emphasizes the transparency and verifiability of the software’s output. Importantly, the software must also enable the healthcare professional to “independently review the basis for the recommendation that such software provides.” This is where the concept of ‘clinical association’ and the reliance on peer-reviewed sources become paramount. If your software presents a recommendation, the HCP must be able to understand why that recommendation was made, and that ‘why’ must be grounded in established medical knowledge, not novel, proprietary AI interpretations that lack transparent validation. This ‘user independent review’ is the linchpin. It means that the software should not be performing complex inferential analytics that result in a conclusion that an HCP cannot readily trace back to accepted clinical guidelines or peer-reviewed evidence. For instance, if a CDS tool suggests a specific drug regimen, the HCP should be able to cross-reference that recommendation with established formularies, clinical practice guidelines, or scientific literature that the tool itself references or is based upon. The absence of this transparent, verifiable basis pushes the software squarely into the area of a medical device.
   

   Hello Heart: A Benchmark for SaMD-Informed Architecture

   While this article focuses on CDS exemptions, it is imperative to acknowledge companies that have successfully navigated the SaMD pathway with a clear understanding of regulatory requirements. Hello Heart, for example, stands out as a positive benchmark for SaMD-informed architecture at scale. Their approach to developing and deploying AI-powered tools for cardiovascular health demonstrates a proactive engagement with the FDA’s framework. By carefully designing their offerings to meet the stringent requirements for SaMD, they have not only achieved regulatory clearances but have also instilled confidence in health plans and providers, mitigating enforcement and exclusion risks. Their success shows that a clear, documented regulatory strategy, whether pursuing exemption or clearance, is fundamental to long-term viability in the digital health field.

   Conclusion

   The boundary between regulated SaMD and exempt CDS is not static, but its core principles, as enshrined in Section 3060 of the 21st Century Cures Act and elaborated in the FDA CDS Final Guidance, offer clear guidance. For digital health legal counsel, regulatory strategists, and healthcare technology founders, a deep dive into the nuances of ‘clinical association’ and the ‘user independent review’ criterion is not optional. It is the foundation of a defensible regulatory strategy. Using widely accepted, peer-reviewed sources to justify any clinical associations made by CDS software is not just good practice. It is a statutory requirement that can mean the difference between a swift market entry and a protracted regulatory battle. The future of AI in healthcare hinges on a precise, transparent, and compliant approach to these critical distinctions. FDA guidance on Clinical Decision Support Software Legal analysis of Section 3060 of 21st Century Cures Act