FDA’s draft guidance on AI/ML has startups on high alert

Author, Eric Elsen, Forte Group.

On January 7, 2025, the US Food and Drug Administration (FDA) released draft guidance titled “Artificial Intelligence and Machine Learning in Software as a Medical Device”. The document outlines expectations for pre-market applications and lifecycle management of AI-enabled medical software. While the document may have flown under many readers’ radar, the implications for AI-driven diagnostics and early-stage medtech startups are substantial and urgent.

What’s changed, and why it matters

• Total product lifecycle oversight
  The FDA commits to a full lifecycle approach to AI/ML, from product design, testing, and model validation, to ongoing post-market monitoring. Startups must now plan for long-term oversight, not just pre-market validation.

• Bias and transparency requirements
  The guidance demands details on dataset diversity, potential biases, and “model cards”: concise summaries designed to improve transparency. AI-centric startups should assess these elements early, or risk having products delayed or rejected.

• Predetermined Change Control Plan (PCCP)
  Innovative adaptive systems may now seek FDA approval upfront for routine learning updates, without repeatedly submitting new filings. But startups must define update boundaries and risk assessments clearly to benefit from PCCP.

• Heightened cybersecurity expectations
  The draft guidance specifies threats unique to AI, like data poisoning and model inversion, and asks for clear mitigation strategies in pre-market submissions. Early product roadmaps need dedicated cybersecurity design from day one.

Key takeaways for startups

• Engage with FDA early through pre-submission Q-meetings. These established mechanisms can clarify expectations and reduce surprises,

• Invest in robust data pipelines with clear separation of training, validation, and test sets to address bias and drift,

• Prepare a credible PCCP or, at minimum, a change logic module if your device adapts or learns post-deployment,

• Embed security into AI design, accounting for adversarial threats before product launch.

Wider regulatory context: Parallel AI-for-drug guidance

The FDA has also issued “Considerations for the Use of Artificial Intelligence to Support Regulatory Decision-Making for Drug and Biological Products”, focusing on a risk-based credibility framework. The framework introduces a seven-step model credibility evaluation and encourages lifecycle monitoring even in drug-development tools. Although not specific to devices, it signals the FDA’s commitment to embedding lifecycle, transparency, and accountability principles in all AI-healthcare sectors.

Why startups should care and act fast

• Barriers rising: New documentation expectations for lifecycle, bias, cybersecurity, and transparency will likely increase time-to-market and raise costs,

• Funding implications: Investors will now expect teams to anticipate FDA-level compliance from early MVP stages,

• Competitive edge: Startups that align early with FDA guidance can reduce regulatory delays and avoid costly post-market fixes,

• Public trust: Meeting transparency standards may not only satisfy regulators – it can build consumer and clinician trust; crucial for adoption.

For startups navigating these shifting regulatory demands, partnering with experienced development teams can make all the difference. Forte Group’s Healthcare IT Solutions specialise in helping MedTech innovators accelerate FDA compliance through secure, scalable, and audit-ready software solutions. From implementing robust data governance frameworks to building adaptive AI pipelines and integrating cybersecurity-by-design, Forte Group supports early-stage companies to align with evolving FDA standards, without slowing down innovation.

Conclusion

The FDA’s January 2025 draft guidance represents a change in how AI medical devices will be regulated. The Agency expects proactive lifecycle planning, bias mitigation strategies, embedded cybersecurity, and clear change control mechanisms. For startups racing to innovate, this is a call to bake compliance into core technology architectures.

What to do now: analyse the full guidance, schedule a Q-submission meeting, and update your product roadmaps to align with the new FDA guidelines.

Author, Eric Elsen, Forte Group.