FDA Struggles With Regulating Adaptive AI Devices

Why It Matters

A new Congressional Research Service report on the Food and Drug Administration's (FDA) artificial intelligence (AI) device regulation arrives at a moment when the technology is outpacing the law. With roughly 1,450 AI-enabled medical devices already authorized for marketing and generative AI tools beginning to enter clinical settings, Congress must confront if the existing regulatory framework built for a world of static hardware is capable of governing software that learns, adapts, and can produce false outputs.

The answer, according to the report, is unsettled — and the stakes are high enough that a 2024 report from the Government Accountability Office (GAO) formally recommended FDA identify specific statutory changes needed and communicate them to Congress.

The Big Picture

FDA regulates AI-enabled medical devices under the Federal Food, Drug, and Cosmetic Act, applying a risk-based classification system — Class I (low), Class II (moderate), and Class III (high) — that was designed largely around physical devices with fixed functionality. Most of the 1,450 authorized AI devices were cleared through the 510(k) premarket notification pathway, which requires a showing that the device is "substantially equivalent" to an already-marketed product. The majority are concentrated in radiology, cardiology, and neurology.

The core structural problem is that AI software can change after deployment. While a traditional device approval is a one-time, premarket event, a machine learning algorithm that updates based on new patient data may look materially different six months after clearance than it did when reviewed.

However, not all AI health software falls under FDA jurisdiction. The 21st Century Cures Act carved out several categories from the statutory definition of a "device," including administrative support tools, general wellness applications, electronic patient records, and certain clinical decision support software used by clinicians who can independently review the underlying recommendations. Determining whether a given AI product crosses the line into FDA-regulated territory remains a live challenge for developers.

As of the report's publication, the FDA has not authorized any generative AI device for marketing. In March 2026, however, the agency granted breakthrough designation to a patient-facing clinical genAI application developed by RecovryAI — a notable procedural milestone. Generative AI raises distinct concerns: these tools can produce false content, perform inconsistently across clinical environments, and are often trained on datasets that lack transparency.

Political Stakes

For the Administration

The report lands during an administration that has signaled a preference for reducing regulatory burdens on emerging technology. FDA's recent updates to its general wellness product and clinical decision support software guidance reflect what the CRS report describes as a "somewhat deregulatory approach." That posture aligns with broader executive branch priorities, but creates friction with patient safety advocates who argue that algorithmic errors in clinical settings can go undetected without robust oversight.

There is a near-term deadline embedded in the FY2026 appropriations law: Congress required the FDA to assess its existing authorities and report back on what statutory changes are needed for post-deployment AI safety monitoring within 90 days of the bill's passage. That report, whenever delivered, will shape the next phase of this debate.

For Republicans

The deregulatory direction offers a coherent policy narrative around innovation and competitiveness. The risk is that a high-profile AI device failure in a clinical setting — particularly one involving a product that benefited from reduced oversight — becomes a liability.

For Democrats

The report provides a legislative opening. The GAO's 2024 recommendation that FDA document and communicate needed statutory changes to Congress has not yet produced legislation. A push for new oversight authorities, particularly around post-market performance monitoring, would align with the party's positioning on both consumer protection and technology accountability.

For the Public

The practical question is whether the AI tools increasingly embedded in their diagnostic care have been adequately vetted, and whether anyone is monitoring how they perform after the fact. FDA's September 2025 request for public comment on best practices for measuring real-world AI device performance suggests the agency itself does not yet have settled answers.

The Bottom Line

The regulatory framework governing AI-enabled medical devices was built for a different era of medical technology, and the gaps are becoming harder to ignore. Congress has made incremental fixes, such as carving out low-risk software, authorizing change control plans, mandating cybersecurity requirements, but no comprehensive legislative update to the underlying framework has followed. The CRS report makes clear that stakeholders are divided on whether new statutory authority is necessary or whether FDA can manage the challenge through guidance alone.

What Congress does next — whether it acts on the GAO's recommendation, responds to FDA's forthcoming statutory assessment, or waits — will determine whether the oversight architecture keeps pace with the technology or continues to lag behind it.