FDA Classifies Cardiovascular ML Notification Software as Class II
The U.S. Food and Drug Administration published a Federal Register final order effective 11 September 2026 that classifies cardiovascular machine learning-based notification software as Class II with special
PromptCrates Editorial
Staff Writer
The U.S. Food and Drug Administration published a Federal Register final order effective 11 September 2026 that classifies cardiovascular machine learning-based notification software as Class II with special controls, adding regulation 21 CFR 870.2380. Document 2026-18612, appearing at 91 FR 57785, locks in a pathway that still requires 510(k) clearance rather than treating these tools as lightly regulated wellness apps. The classification descends from Viz.ai's Viz HCM De Novo decision, which has been applicable since 3 August 2023 and is now fully codified for follow-on devices.
What the new Class II category covers
FDA's identification language is deliberately narrow. The software may suggest the likelihood of a single cardiovascular disease or condition using non-invasive physiological inputs so clinicians can decide on referral or follow-up. It is explicitly not diagnostic-quality output and is not intended for arrhythmia detection. That boundary keeps notification agents in a triage-and-escalate lane instead of letting them masquerade as full diagnostic systems—an important distinction as hospitals experiment with always-on monitoring alerts.
Risks called out in the order will sound familiar to anyone shipping clinical ML: false positives and false negatives, model bias and poor generalization, deployment on unsupported populations or hardware, and clinician overreliance. FDA argues those hazards are mitigable through clinical and nonclinical testing, careful labeling, human-factors validation, and software verification and validation—not through hoping users read a model card. Special controls therefore demand multi-site, geographically diverse test datasets that are independent from training data, clear performance metrics, descriptions of how hardware choices affect results, human-factors evidence, and labeling warnings that the absence of a finding must never be used to rule out needed follow-up. Contact for the file is Hetal Odobasic in CDRH, under Docket FDA-2026-N-9907. Clinical AI context continues in our ARPA-H ADVOCATE cardiovascular AI funding story and the FDA generative AI medical device discussion paper.
Codifying Viz HCM's De Novo into a shared Class II bucket matters for competitors. Instead of every similar notification product inventing a one-off regulatory story, sponsors can aim at the same special-control checklist and 510(k) predicate logic. That usually accelerates iteration while raising the documentation bar for anyone hoping to skip representative testing.
Why special controls dominate this AI device story
Machine-learning notification tools fail differently than traditional sensors. A waveform cable either connects or it does not; a model can silently degrade when hospital demographics drift or when a new ECG vendor changes filtering. Requiring geographically diverse, training-independent test sets is FDA's attempt to force that reality into the submission. Human-factors controls similarly target alarm fatigue and automation bias—the failure mode where a busy cardiology reader trusts a quiet dashboard too much.
The order also keeps arrhythmia products out of this lane, which prevents sponsors from stretching a hypertrophic cardiomyopathy-style notification claim into rhythm management without a different evidentiary fight. Non-diagnostic positioning further limits marketing that might imply definitive disease calls. Together those limits answer a recurring 2026 policy theme: let AI speed referral workflows, but do not let probabilistic software quietly replace diagnostic responsibility. Parallel FDA experiments such as the TEMPO pilot for AI chronic care devices and cardiac detection work like FDA Queen of Hearts STEMI detection show the agency carving use-case-specific boxes rather than one generic "clinical AI" class.
For health systems, Class II with 510(k) means procurement still needs cleared indications, version control, and vigilance plans when models update. For startups, the September codification is both permission and homework: a clearer on-ramp than pure De Novo uncertainty, paired with expensive multi-site validation expectations.
What manufacturers should do with the September order
Sponsors eyeing cardiovascular notification claims should map their intended use to the single-condition, non-invasive, referral-support definition before promising broader diagnostic value. Study designs need sites that differ in geography and care patterns, hardware matrices that match real deployments, and labeling that actively discourages "no alert means no disease" reasoning. Quality systems must treat software changes as potentially submission-relevant when performance or intended use shifts.
Hospital biomedical engineering and clinical informatics teams should also update vendor questionnaires to ask whether a notification model was validated on hardware and populations matching local practice, because special controls make those answers part of the compliance story rather than optional marketing slides. The public record from 11 September 2026 is precise. FDA finalized Class II special controls for cardiovascular machine learning-based notification software under 21 CFR 870.2380; 510(k) remains required; Viz HCM's De Novo supplies the lineage since August 2023; arrhythmia and diagnostic-quality uses are out of scope; and special controls emphasize independent multi-site testing, human factors, and follow-up labeling. That is the regulatory floor for this device type going forward.
Primary text is the Federal Register final order 2026-18612.
