FDA Cardiovascular Machine-Learning Software Rule: What Class II Controls Mean

What changed on 11 September

The U.S. Food and Drug Administration’s final order, Federal Register document 2026-18612 (91 FR 57785), was published and became effective on 11 September 2026. It added 21 CFR 870.2380, codifying a generic class II device type named cardiovascular machine learning-based notification software.

The underlying device classification had been applicable since 3 August 2023. The 2026 action is regulatory codification, not the first marketing authorization for the device that led to the classification.

What the software type is intended to do

The generic type uses machine-learning techniques to suggest the likelihood of one cardiovascular disease or condition from one or more non-invasive physiological inputs gathered during routine medical care.

Its output is intended to support further referral or diagnostic follow-up. FDA states that the output is not diagnostic quality and that the device type is not intended to identify or detect arrhythmias.

The 2023 De Novo history

FDA received Viz.ai’s De Novo request for the Viz HCM device on 10 January 2023 and issued the class II order on 3 August 2023. De Novo classification established the initial classification and allowed the generic device type to serve as a potential predicate for future substantially equivalent devices.

The September 2026 final order places that classification into the Code of Federal Regulations. It should not be described as a new first authorization in 2026.

Risks FDA identified

FDA identified false-positive and false-negative outputs that could contribute to incorrect treatment or diagnosis; model bias or failure to generalize to the intended population; use with unsupported populations, inputs or hardware; and overreliance on device output.

The special controls pair these risks with clinical and non-clinical performance testing, labeling, software verification and validation, hazard analysis, and human-factors assessment.

Independent and representative clinical validation

Clinical validation must use real-world data from a representative intended-use population. The test data must be independent of data used for training and development and include sufficient cases from important demographic, clinical-confounder, comorbidity, hardware and acquisition subsets to characterize performance estimates and confidence intervals.

Study protocols must describe how ground truth was adjudicated. FDA also requires justified performance goals, objective performance measures and subgroup analyses.

Three-site minimum and full input range

The test dataset must include at least three geographically diverse sites that are separate from model-training sites. Validation must address the full supported input range and the data sources, quality, hardware and preprocessing conditions expected in practice.

These requirements are designed to test whether performance generalizes beyond development conditions. They do not guarantee identical performance in every future population or clinical environment.

Software, hardware and human-factors controls

Documentation must describe the model, inputs and outputs, supported population, intended software environment and effects of sensor-acquisition hardware. Verification must cover signal and data-quality controls and mitigations for user or subsystem failure.

Human-factors assessment must examine the risk that intended users misinterpret the notification. That requirement reinforces the device’s limited role as a prompt for further evaluation rather than an autonomous clinical decision.

Labeling and clinician oversight

Labeling must summarize tested populations, hardware, methods and performance, identify supported inputs and limitations, and communicate that the software’s suggestion requires follow-up rather than representing a diagnosis.

A generic class rule should not be converted into a recommendation for any product, screening programme, diagnosis or treatment. The rule sets requirements; it does not establish that every future device will have the same performance.

Class II does not mean exemption

Class II devices generally remain subject to premarket notification under section 510(k) unless FDA determines that the device type is exempt. FDA explicitly said it had not made that exemption determination for this device type.

The 2026 order therefore does not mean that future cardiovascular machine-learning notification devices can enter the U.S. market without the applicable premarket process.

India relevance and evidence boundary

The order has no direct CDSCO authorization effect and does not show that a product is approved, available or endorsed in India. Its educational relevance is the emphasis on independent validation, subgroup performance, confidence intervals, hardware boundaries, bias, labeling and human oversight.

It is not proof of clinical benefit, diagnostic accuracy for every setting, superiority over clinician judgment or permission to use a notification as a personal diagnosis.

What would require an update

This page should be revised if FDA changes the classification or exemption status, publishes materially different special controls, clears or authorizes relevant future devices with new evidence, or if an Indian authority issues a directly relevant decision.

Medical review status: Pending. MedoPulse has checked the cited FDA/Federal Register source, but this source-led page has not been reviewed by a MedoPulse clinician.

Educational notice: MedoPulse explains a U.S. device-classification rule and does not provide diagnosis, screening advice, product selection or individualized medical guidance.