Introduction
Software as a Medical Device (SaMD) sits where two historically separate worlds meet: software development (rapid iteration, near-zero marginal cost) and medical device regulation (rigorous evidence, fixed product definitions, review before launch). As standalone AI diagnostic tools multiply, healthcare bankers need to know which software the FDA regulates, how AI tools reach the market, how algorithm updates are handled, and why these businesses are valued differently from hardware device makers.
What Qualifies as SaMD
- Software as a Medical Device (SaMD)
Software that performs a medical function on its own, running on general-purpose computing platforms (smartphones, tablets, cloud servers, desktop computers) rather than being embedded in a dedicated hardware device. Key distinction: software IN a medical device (e.g., the operating software of a CT scanner) is regulated as part of the hardware device. SaMD is software that IS the medical device. Examples include AI algorithms that detect diabetic retinopathy from retinal images, apps that calculate insulin dosing, and cloud-based tools that analyze pathology slides for cancer detection.
Not every health app is a device. The 21st Century Cures Act carved some software out of the device definition, including clinical decision support (CDS) tools whose reasoning a clinician can independently review, and the FDA's January 2026 clinical decision support guidance widened that lane further. Software that analyzes medical images or physiological signals stays a device, which is why radiology AI always needs authorization. Where a product sits relative to this regulatory perimeter is a core diligence question: outside it, a company launches without FDA review.
For software that is a device, regulators use an International Medical Device Regulators Forum (IMDRF) risk framework crossing how serious the condition is (critical, serious or non-serious) with how significant the output is (treating or diagnosing, driving clinical management, or informing it). In the US, that risk maps onto the familiar device classes: most AI tools are Class II, cleared through 510(k) or De Novo.
The AI/ML Device Landscape
The FDA's public list counted 1,451 AI-enabled devices authorized through the end of 2025, with radiology accounting for 76% (The Imaging Wire's analysis of the FDA update), and each quarterly update since has added more. The pathway mix is lopsided: a JAMA Health Forum study of 691 FDA-cleared AI devices found that 96.7% went through the 510(k) pathway, and only 1.6% reported randomized trial data. A first-mover De Novo therefore creates the predicate later competitors cite, as Viz.ai did for AI stroke triage and IDx (now Digital Diagnostics) did for autonomous diabetic retinopathy screening in 2018.
| Specialty Panel | Share of AI Authorizations | Example Applications |
|---|---|---|
| Radiology | ~76% | CT/MRI analysis, fracture detection, stroke triage, mammography |
| Cardiovascular | ~10% | ECG interpretation, arrhythmia detection, coronary CT analysis |
| All other panels | ~14% combined | Neurology, hematology, gastroenterology, ophthalmology, pathology |
Radiology dominates because imaging data is already digital, standardized and labeled by radiologist reads, which is why imaging incumbents such as GE HealthCare, Siemens Healthineers and Philips hold the largest AI portfolios, alongside AI-native players such as Aidoc.
Locked vs. Adaptive Algorithms: PCCPs and the TPLC Approach
Traditional clearance assumes a locked algorithm: the device that was cleared is the device that is marketed. A retrained AI model may behave differently six months later, and each significant change could trigger a new 510(k).
- Predetermined Change Control Plan (PCCP)
A plan, reviewed and authorized as part of a 510(k), De Novo or PMA submission, that describes the planned modifications to a device, the methodology to develop, validate and implement them, and an assessment of their impact. Changes made within an authorized PCCP do not need a new marketing submission.
Congress gave the FDA explicit authority to authorize PCCPs in 2022, and the agency's final guidance on PCCPs for AI-enabled devices sets out what the plan must contain. The broader Total Product Life Cycle (TPLC) approach, covering data management, bias, transparency, cybersecurity and postmarket performance monitoring, sits in a separate January 2025 draft guidance that has not been finalized.
Investment Implications
SaMD businesses combine software economics with MedTech constraints, and bankers should test each part:
Software-like economics, with caveats. Pure algorithm businesses can run gross margins above 80% because each extra scan costs almost nothing, versus roughly 60-70% for hardware MedTech. Margins land lower where humans stay in the loop: HeartFlow, an AI coronary analysis company that listed in 2025, reported $176.0 million of revenue at a 76.8% gross margin in its full-year 2025 results, because trained analysts review each case, and guided to an 80-81% non-GAAP margin for 2026.
Reimbursement is the real gate. Clearance lets a company sell; payment decides whether hospitals buy. Many AI tools are sold per study or by subscription out of the hospital's own budget, while tools with dedicated CPT codes are paid directly. HeartFlow's FFRct analysis moved to a Category I CPT code in 2024, and its plaque analysis gained one in January 2026 (see device reimbursement).
Regulatory friction on iteration. Changes outside an authorized PCCP still need a new 510(k) or PMA supplement, slower than consumer software but far faster than hardware cycles, so scaled, reimbursed SaMD names screen closer to healthcare software than to traditional MedTech comps.
The next article covers procedure volume and ASP modeling, the core revenue drivers for device companies.
