Compliance Guide

Clinical Decision Support Exemption Under Section 3060 of the 21st Century Cures Act

How FDA’s four statutory criteria in section 520(o)(1)(E) determine whether a clinical decision support software function is exempt from device regulation, and how compliance teams should document those determinations over time.

Explore Runtime Governance Explore AI Compliance
A CDS software function qualifies for exemption from FDA device regulation under Section 3060 only if it meets all four statutory criteria in section 520(o)(1)(E): no medical image, IVD signal, or signal-acquisition analysis; display or analysis of medical information; support of a healthcare professional’s clinical recommendation; and enablement of independent professional review of that recommendation’s basis. FDA’s September 2022 guidance remains the current authoritative interpretation, and the exemption applies only to functions intended for use by healthcare professionals, evaluated individually rather than at the product level.

Section 3060 exemption at a glance

These reference points frame how the exemption is scoped and applied in practice.

Statutory basis

FD&C Act section 520(o)(1)(E), added by the 21st Century Cures Act, 2016

Governing guidance

FDA final guidance, Clinical Decision Support Software, September 28, 2022

Evaluation unit

Individual software function, not the product as a whole

Eligible users

Healthcare professionals only; patient- or caregiver-facing CDS is generally regulated

Four statutory criteria and documentation practices

All four criteria must be satisfied for a given function to qualify as non-device CDS. Failing any single criterion subjects that function to device regulation.

  • Criterion 1. The function must not be intended to acquire, process, or analyze a medical image, a signal from an in vitro diagnostic device, or a pattern or signal from a signal acquisition system.
  • Criterion 2. The function must be intended to display, analyze, or print medical information about a patient or other medical information.
  • Criterion 3. The function must be intended to support or provide recommendations to a healthcare professional about the prevention, diagnosis, or treatment of a disease or condition.
  • Criterion 4. The function must enable the healthcare professional to independently review the basis for the recommendation, such that the professional is not intended to rely primarily on the software output for a clinical decision.
  • Function-level mapping. Map each discrete software function individually against all four statutory criteria rather than assessing the product holistically.
  • Intended use statements. Document intended use statements that identify the target healthcare professional user and the clinical decision context.
  • Design evidence. Capture design evidence showing the interface discloses inputs, logic, and evidence basis for each recommendation.
  • Separate non-CDS functions. Evaluate image, signal, or IVD data processing functions separately from CDS display or recommendation functions.
  • Ongoing re-assessment. Re-assess exemption status whenever CDS logic, algorithms, or transparency features change, since criteria are evaluated against current function design and intended use.

Statutory basis and scope of the exemption

Section 3060 of the 21st Century Cures Act, enacted in 2016, added section 520(o)(1)(E) to the Federal Food, Drug, and Cosmetic Act, removing certain clinical decision support software functions from the statutory definition of a medical device. FDA’s final guidance, Clinical Decision Support Software, issued September 28, 2022, remains the agency’s current and authoritative interpretation of this provision. No additional FDA guidance specific to Section 3060 has been identified within the past 12 months, so the 2022 guidance continues to govern exemption determinations.

The exemption is analyzed at the level of an individual software function rather than the software product as a whole. A single product may contain both exempt CDS functions and non-exempt functions, such as image or signal analysis, and those non-exempt functions require separate evaluation for device status.

The independent review criterion and algorithmic transparency

FDA guidance treats the fourth criterion, independent review, as the most technically demanding of the four. To satisfy it, software must disclose the basis for its recommendations, including the inputs used, the underlying logic or rationale, and the intended purpose of the output, so a healthcare professional can evaluate the recommendation independently rather than defer to it as the primary decision input.

FDA guidance distinguishes time-critical clinical contexts, where a professional has limited opportunity for independent review before a decision must be made, from routine decision-support contexts where independent review is feasible. Functions built on complex or adaptive algorithms face closer scrutiny under this criterion, because algorithmic complexity can reduce the transparency needed for meaningful clinician review.

AI and machine-learning CDS

FDA guidance does not provide a categorical exemption for AI- or machine-learning-based CDS. Each function is assessed against the same four criteria regardless of the underlying technology.

Exempt CDS functions versus regulated SaMD

Because analysis occurs at the function level, products often mix exempt and regulated capabilities. Display, analysis, or recommendation functions that meet all four criteria may fall outside the device definition, while functions that acquire, process, or analyze medical images, IVD signals, or signal-acquisition patterns remain subject to device regulation as software as a medical device (SaMD). Compliance teams should inventory functions separately, apply the four criteria to each, and treat any function that fails a criterion as potentially regulated SaMD requiring its own regulatory pathway assessment.

Governance considerations for ongoing compliance

Because exemption status depends on current function design and intended use, Section 3060 determinations should be treated as an ongoing compliance activity rather than a one-time classification. Version changes to CDS logic, algorithms, or transparency features should trigger a documented re-assessment against the four criteria.

Compliance processes should also distinguish CDS intended for healthcare professional use from patient- or caregiver-facing decision support, since FDA guidance treats these populations differently for exemption purposes. Organizations should maintain a documented rationale mapping each software function to the four section 520(o)(1)(E) criteria, so that this rationale is available in the event of an FDA inquiry.

Because no confirmed guidance update has been issued within the past 12 months, regulatory teams should continue monitoring FDA communications for interpretive changes that could affect existing exemption determinations.

Track CDS compliance as software and algorithms evolve

As CDS functions and underlying algorithms change over time, maintaining an auditable record of function-level decisions and governance activity becomes part of the compliance workload. Trussed AI provides runtime governance and audit logging capabilities relevant to organizations managing AI-enabled software across regulated environments.

Explore Runtime Governance