New Codified Classification Under 21 CFR 870.2380
On September 11, 2026, the US Food and Drug Administration (FDA) published a final order in the Federal Register (91 FR 57785, Document 2026-18612) officially classifying cardiovascular machine learning-based notification software into Class II (special controls). The order amends 21 CFR Part 870 by creating a dedicated regulation at 21 CFR § 870.2380.
The generic device type encompasses software that employs machine learning techniques to assess one or more non-invasive physiological inputs obtained during routine care and suggest the likelihood of a single cardiovascular condition for referral or diagnostic follow-up.
This codification stems from the De Novo granting of Viz HCM (DEN230003). Devices within this product classification remain subject to premarket notification requirements under section 510(k) of the FD&C Act, enabling subsequent developers of substantially equivalent notification algorithms to seek market clearance via 510(k) rather than submitting novel De Novo requests.
Regulatory Scope and Exclusions
The codified definition establishes clear clinical and functional boundaries:
- Adjunctive notification focus: The software is intended solely as an informative trigger for secondary testing or specialist follow-up. It is not intended to yield diagnostic-quality outputs or replace comprehensive clinical evaluation.
- Arrhythmia exclusion: The regulation explicitly specifies that cardiovascular machine learning-based notification software is not intended to identify or detect arrhythmias. Software that includes arrhythmia identification or detection therefore falls outside this generic device type and requires assessment under the applicable separate classification.
- Use as a basis for further testing: The software identifies a single condition from non-invasive physiological inputs as part of routine medical care and is intended as the basis for further testing; it is not intended to provide diagnostic-quality output.
Mandatory Special Controls
To provide reasonable assurance of safety and effectiveness, devices classified under § 870.2380 must satisfy four pillars of special controls:
- Multi-center real-world clinical validation: Clinical performance testing must rely on an independent test dataset of real-world data gathered from representative patient populations. The test set must be entirely separate from training data, incorporate ground-truth adjudication protocols, and include a minimum of three geographically diverse clinical sites distinct from training sites. Sponsors must report objective metrics—including sensitivity, specificity, and positive or negative predictive values—alongside subgroup analyses covering demographic cohorts, clinical confounders, and acquisition hardware variants.
- Software V&V and hardware compatibility: Verification, validation, and hazard analyses must demonstrate system integration in the operational software environment. Sponsors must document sensor input requirements, specify input signal quality control (QC) criteria, and define technical mitigations against component failures and user errors.
- Human factors assessment: Usability testing must evaluate target clinicians in their intended workflow to identify and mitigate risks of output misinterpretation or clinical overreliance.
- Prescription labeling and warnings: User documentation must present validation methodologies, subgroup performance outcomes, and compatible hardware sensor specifications. Labeling must prominently feature warnings that a negative output must never be used to rule out clinical follow-up and that the software does not substitute for a clinician’s comprehensive assessment.
Practical Checks for Manufacturers
Manufacturers developing AI/ML-driven cardiovascular screening or notification tools can evaluate the following actions:
- Verify intended use boundaries: Confirm whether the algorithm focuses on predicting chronic structural or functional conditions (such as cardiomyopathy, reduced ejection fraction, or aortic stenosis) rather than acute arrhythmia detection. If arrhythmia detection is included, regulatory alignment under the applicable separate classification is required.
- Audit clinical test datasets against the three-site rule: Review clinical protocols to ensure the independent validation dataset incorporates real-world data from at least three geographically separate clinical sites with verified ground-truth adjudication.
- Define sensor hardware and signal QC specifications: Document minimum sensor requirements and input validation checks to prevent degraded signal quality from generating unreliable algorithmic outputs.
Sources
- Primary official sourceMedical Devices; Cardiovascular Devices; Classification of the Cardiovascular Machine Learning-Based Notification Software (opens in a new tab)Food and Drug Administration