The FDA has codified a new class II classification at 21 CFR 870.2380 whose special controls condition cardiovascular machine learning notification software on validation at a minimum of three geographically diverse sites separate from training

Two dates, and why both are in the order

The DATES section gives them plainly: "This order is effective September 11, 2026. The classification was applicable on August 3, 2023." There is no drift to reconcile here, because the agency printed both.

The sequence behind that is in part II of the order. FDA received a De Novo classification request from Viz.ai, Inc. for the Viz HCM device on 10 January 2023, and on 3 August 2023 issued an order to the requester classifying the device into class II. What happened on 11 September 2026 is the codification of that classification, by adding 21 CFR 870.2380.

The distinction matters for anyone reading this as new law. The classification decision is three years old. What is new, and what is in force as of 11 September 2026, is that the generic device type and its special controls now sit in the Code of Federal Regulations, where they define the class for everyone marketing this kind of software rather than for one requester.

The device type is bounded by four negatives

Paragraph (a) identifies the type as software that "employs machine learning techniques to suggest the likelihood of a cardiovascular disease or condition for further referral or diagnostic follow-up". So far that is broad.

The rest of the paragraph narrows it hard. The software identifies a single condition. It works from one or more non-invasive physiological inputs as part of routine medical care. It is intended as the basis for further testing and is not intended to provide diagnostic quality output. It is not intended to identify or detect arrhythmias.

Each of those is a boundary a product can fall outside. Multi-condition output, invasive inputs, a diagnostic quality claim or arrhythmia detection each take a device out of 870.2380, and out of 870.2380 means back to whatever classification does apply. Reading paragraph (a) as a marketing description rather than as a scope test is the error to avoid.

The five clinical performance special controls

Paragraph (b)(1) opens by providing that clinical performance testing must demonstrate that the device performs as intended under anticipated conditions of use, and then sets five conditions that must be met. This is codified and in force, so the obligation is real for a device seeking to fall within the classification.

Sub-paragraph (i) is the longest. Clinical validation must use a test dataset of real-world data from a representative patient population, representative of the range of data sources and data quality likely to be encountered. The test dataset must be independent from data used in training and development, and must contain sufficient numbers of cases from important cohorts, the order giving demographic populations, subsets defined by clinically relevant confounders and comorbidities, and subsets defined by hardware and acquisition characteristics as its examples, so that performance estimates and confidence intervals for those individual subsets can be characterised. The same sub-paragraph adds that study protocols must include a description of the adjudication processes for determining ground truth of training and test datasets.

Sub-paragraphs (ii) to (iv) cover consistency of output over the full range of inputs, justification of performance goals in the context of the risks associated with follow-up testing, and reporting of objective performance measures, with sensitivity, specificity, positive predictive value and negative predictive value given as the examples, together with summary level demographic information and sub-group analyses for each study site, relevant demographic sub-group and acquisition system.

Sub-paragraph (v) is one sentence and it is the one to price into a study budget: the test dataset must include a minimum of three geographically diverse sites, separate from sites used in training of the model. A single-centre validation does not satisfy this classification, whatever its statistical power.

Software documentation, human factors and the labelling list

Paragraph (b)(2) requires software verification, validation and hazard analysis, with documentation covering a description of the model and algorithm, its inputs and outputs and the supported patient population, integration testing in the intended software system or environment, and a description of the expected impact of applicable sensor acquisition hardware characteristics on performance, including input signal and data quality control measures and mitigations for user error or subsystem failure.

Paragraph (b)(3) requires a human factors assessment of the intended users in the intended use environment, evaluating the risk of misinterpretation of device output.

Paragraph (b)(4) sets seven labelling items. Two of them are drafted against specific clinical failure modes: a warning that the user should not rely on the lack of a suspected finding to rule out follow-up, and a statement that device output should not replace a full clinical evaluation and may not be sufficient as the sole basis for further testing. The order's own risk table names overreliance on device output for follow-up as an identified risk, mitigated by human factors assessment and labelling.

What class II buys, and the one thing FDA did not do

The order explains the mechanism in part I. A device not in commercial distribution before 28 May 1976 is automatically classified into class III by operation of law and requires premarket approval unless and until FDA acts. De Novo classification into class II lets the device serve as a predicate for future devices of that type, so other sponsors need not file a De Novo request or a premarket approval application to market a substantially equivalent device.

FDA also recorded what it has not done. Submission of a 510(k) is required for class II devices unless the agency determines the type should be exempt under section 510(m), and the order states that at this time FDA has not made that determination for cardiovascular machine learning-based notification software. The device type is therefore subject to premarket notification.

The order contains no transition provision, no grandfathering language and no compliance date beyond its effective date. It also does not address post-market model change, predetermined change control plans or retraining, and we do not read anything into that absence.

What we did not verify

What we opened: the full final order as published, retrieved from the Government Publishing Office at the FR-2026-09-11 package and read end to end, including the DATES section, parts I to IV, the risks and mitigations table, and the complete codified text of 21 CFR 870.2380 paragraphs (a) and (b)(1) to (b)(4).

What we did not open: the Viz.ai De Novo request, the 3 August 2023 classification order issued to the requester, the decision summary, the FD&C Act provisions the order cites, 21 CFR parts 807, 814, 820, 860 subpart D and 801, and any FDA guidance on machine learning enabled devices. We describe the De Novo mechanism only as this order describes it.

What we refuse to claim: we do not say this is the first classification of its kind, because the order does not say so and we did not test it. We do not say the order creates a new obligation for the original requester, because the classification has been applicable since 3 August 2023. We do not say any existing product does or does not fall within 870.2380, because that turns on the identification language in paragraph (a) and on facts we have not examined. We give no estimate of how many devices or submissions are affected, because the order gives no number. Where we use the word must, it is quoting or closely reporting codified regulatory text now in force.

Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.

Related briefings

• FDA guidance on AI device lifecycle and predetermined change control plans
• FDA on clinical decision support software as a medical device
• North America AI regulation tracker
• AI healthcare compliance tracker
• AI Regulation News hub