FDA’s CDS Shift: Navigating Risk & Opportunity in AI Procurement

The field of digital health procurement for hospitals and health systems is undergoing a deep transformation, driven by evolving regulatory clarity from the FDA. What was once a gray area for many software tools, particularly those offering clinical insights, has crystallized into distinct categories with significant implications for risk, compliance, and in the end, patient safety. This shift necessitates a rigorous re-evaluation of vendor partnerships, especially concerning AI-powered clinical decision support (CDS) tools.

The Regulatory Chasm: CDS Exemptions vs. Regulated SaMD

At the heart of this shift is the FDA’s January 2026 Final Guidance on Clinical Decision Support Software, a key document that clarifies the boundaries established by Section 3060 of the 21st Century Cures Act. This guidance delineates precisely which CDS software functions are exempt from FDA regulation and which fall squarely under the purview of Software as a Medical Device (SaMD). For Hospital CIOs, health system procurement officers, and regulatory compliance directors, understanding this distinction is paramount. The FDA’s framework distinguishes between CDS software that merely provides information for healthcare professionals to review and independently act upon, and software that provides a “specific diagnostic or treatment recommendation” or “analyzes or processes medical images or signals” to generate a recommendation. The latter categories, particularly those driven by advanced AI algorithms, are increasingly being identified as regulated SaMD. A key criterion for exemption is that the software allows the healthcare professional to independently review the basis of the recommendation, not rely solely on the software’s output. If the software’s output is intended to be relied upon for diagnosis or treatment without independent review of the underlying data and reasoning, it likely crosses into SaMD territory. This distinction is critical because SaMD requires a formal regulatory pathway, such as 510(k) clearance or De Novo classification, accompanied by a strong Quality Management System (QMS) and adherence to principles like Good Machine Learning Practice (GMLP) FDA GMLP principles guidance. Companies that have not navigated these pathways face substantial enforcement and health-plan exclusion risk.

Epic Systems and Viz.ai: Working through the New Regulatory Currents

Consider the implications for widely adopted platforms like Epic Systems and specialized AI tools such as those offered by Viz.ai. Epic, as a foundational EHR provider, incorporates numerous CDS functionalities within its suite. Many of these, particularly those providing general information or administrative support, would likely remain exempt under the FDA’s CDS guidance. However, as Epic and other EHR vendors integrate more sophisticated AI-driven predictive analytics or diagnostic support tools directly into clinical workflows, they must carefully evaluate each module against the FDA’s criteria. For instance, an Epic module that flags potential drug-drug interactions based on a patient’s medication list and provides evidence-based alternatives for a clinician to consider would likely remain exempt. Conversely, an AI-powered Epic module that analyzes patient vital signs and lab results to diagnose sepsis with a high probability and recommends a specific treatment protocol without clear, independently reviewable underlying data, might very well be classified as SaMD. The onus is on Epic, and by extension, health systems adopting these features, to ensure appropriate regulatory classification and compliance. Viz.ai provides an even clearer example of this regulatory dynamic. Viz.ai’s core offerings, such as AI-powered stroke detection and notification, are inherently designed to analyze medical images (CT scans) and provide rapid, specific clinical insights that directly impact patient treatment pathways. These tools are explicitly regulated as SaMD by the FDA, with Viz.ai having secured multiple 510(k) clearances for its various modules. This proactive engagement with the FDA regulatory framework, including obtaining necessary clearances and potentially implementing a Predetermined Change Control Plan (PCCP) for adaptive algorithms, positions Viz.ai as a benchmark for SaMD-informed architecture at scale. Their approach demonstrates a clear understanding that their AI-driven diagnostic assistance tools are not mere “information providers” but actively contribute to diagnostic and treatment decisions, thus requiring strong regulatory oversight. The contrast highlights a critical procurement consideration: vendors whose AI tools operate closer to diagnostic or treatment recommendations, particularly those analyzing complex medical data or images, must demonstrate a clear and successful FDA SaMD pathway. Without it, the risk profile for the procuring health system escalates dramatically.

Procurement Checklists for Vendor Compliance

Given this evolving regulatory field, health system procurement officers and compliance directors must adopt a more stringent approach to evaluating AI health tools. The Clinical Decision Support Coalition has advocated for clear guidelines, and the FDA has provided them. Here’s a pragmatic checklist:

• Understand the Vendor’s Classification: Directly ask vendors how they classify their AI tool under the FDA’s January 2026 CDS Final Guidance. Request documentation supporting their classification.
• SaMD Status Verification: If the tool performs functions that could be considered SaMD (e.g., diagnostic interpretation, specific treatment recommendations based on complex data analysis, image processing for diagnostic purposes), demand proof of FDA clearance (e.g., 510(k) or De Novo). Verify these clearances on the FDA’s 510(k) database FDA 510(k) database search.
• Transparency and Explainability: For any AI-driven CDS tool, assess its explainability. Can clinicians independently review the underlying data, algorithms, and logic that led to a recommendation? If the AI acts as a “black box” where the rationale is obscured, it increases the likelihood of being considered SaMD, and therefore, regulatory risk if not cleared.
• Quality Management System (QMS): For regulated SaMD, inquire about the vendor’s QMS. Is it ISO 13485-certified? What are their processes for post-market surveillance, algorithmic drift monitoring, and cybersecurity (e.g., HITRUST, SOC 2 Type II)? ISO 13485 standard overview.
• Clinical Validation Evidence: Beyond regulatory clearance, demand strong clinical evidence (Real-World Evidence (RWE) or randomized controlled trials) demonstrating the tool’s safety, effectiveness, and clinical utility in diverse patient populations.
• Data Privacy and Security: Ensure compliance with HIPAA and other relevant data privacy regulations. Verify independent security audits and certifications.
• Reimbursement Pathways: For tools impacting patient care, understand the vendor’s strategy for reimbursement (e.g., CPT codes, NTAP eligibility), which often correlates with regulatory maturity.
  

  Methodology and Source Note

  This analysis is grounded in a careful review of the FDA’s January 2026 Final Guidance on Clinical Decision Support Software, the foundational provisions of Section 3060 of the 21st Century Cures Act, and the broader regulatory framework for Software as a Medical Device. Our interpretations are informed by the FDA’s expressed intent to ensure patient safety while fostering innovation in digital health. The examples of Epic Systems and Viz.ai serve to illustrate the practical application of these guidelines, distinguishing between software functionalities likely to be exempt and those clearly requiring FDA clearance as SaMD. Procurement decisions in this new era are not merely about functionality or cost. They are fundamentally about regulatory compliance and risk mitigation. Health systems that fail to integrate a strong understanding of the FDA’s CDS guidance into their vendor selection processes risk acquiring tools that could expose them to significant legal, financial, and reputational liabilities. Proactive due diligence, informed by the principles outlined here, is no longer optional, it is a strategic imperative.