FDA updates its Clinical Decision Support and General Wellness Guidances: Key points

The United States Food and Drug Administration (FDA) issued revisions this month to its guidance documents "Clinical Decision Support Software" (CDS Guidance) and "General Wellness: Policy for Low Risk Devices" (General Wellness Guidance).

The updates illustrate the evolution of FDA’s regulatory approach to CDS and general wellness devices since the enactment of the 21st Century Cures Act (Cures Act) in 2016, which exempted certain categories of software from the medical “device” definition. These are the second updates to the final versions of the CDS Guidance and General Wellness Guidance documents since they were originally issued in 2016 and 2019, respectively.

Both documents reflect an attempt to provide greater clarity on the line between device and non-device functions while emphasizing additional factors that will influence intended use and risk determinations.

Key takeaways from both guidance documents are:

• The context of use is still determinative of medical device status.
  
  
• FDA is applying a more flexible approach to determining what types of patient-specific clinical recommendations trigger a device-CDS designation (i.e., a single clinical recommendation rather than a list of suggestions might be warranted for non-device CDS).
  
  
• Non-device disclosure of contextually relevant information about the underlying logic, limitations, and intended use of software output is key.

While the guidance documents do not reflect a wholesale change in FDA’s prior regulatory policy, there are a few notable departures from prior approaches that may impact regulatory and commercial strategies for certain products.

CDS Guidance

Background

CDS software covers a variety of tools, including software-based alerts, reminders, and other outputs that provide patient-specific recommendations and insights to healthcare providers (HCPs), patients, or consumers in a contextually relevant way.

Section 520(o)(e) (21 U.S.C. § 360j(o)(E)) of the Cures Act exempted HCP-facing CDS that satisfy statutorily defined criteria from the definition of medical “device.”

In 2016, FDA issued the first draft of the CDS Guidance, interpreting the Cures Act CDS exemption by establishing a four-criterion test for determining whether a CDS tool was exempt under the Cures Act (non-device CDS) or a regulated medical device (device CDS).

To be considered non-device CDS, a tool must satisfy all of the following criteria:

• Criterion 1: Not intended to acquire, process, or analyze a medical image or a signal from an in vitro diagnostic device or a pattern or signal from a signal acquisition system
  
  
• Criterion 2: Intended for the purpose of displaying, analyzing, or printing medical information about a patient or other medical information (e.g., peer-reviewed clinical practice guidelines)
  
  
• Criterion 3: Intended for the purpose of supporting or providing recommendations to an HCP about prevention, diagnosis, or treatment of a disease or condition
  
  
• Criterion 4: Intended for the purpose of enabling the HCP to independently review the basis for such recommendations without relying primarily on the software output to make a clinical diagnosis or treatment decision regarding an individual patient

For years, developers and other stakeholders have dissected and interpreted key words and phrases in this four-part test to assess whether their CDS solutions are medical devices. The outcome of misinterpreting the guidance can be significant from a commercial and enforcement standpoint.

Key updates

The updated CDS Guidance includes a notable departure from FDA’s prior guidance on the interpretation and application of Criterion 3. Criterion 3 focuses on whether the output of the CDS is intended to provide a recommendation or diagnosis. This distinction is important and often very nuanced.

Historically, FDA took the position that, in order to satisfy Criterion 3, the CDS output should provide a list of recommendations and suggestions – rather than one clinical recommendation, which was often considered more akin to providing a definitive diagnosis.

However, in the updated guidance, FDA indicates that where software presents only one option – because that one option is the only one that is “clinically appropriate” – and the software otherwise meets the remaining CDS criteria, the agency intends to exercise enforcement discretion and will not actively regulate such functions.

FDA then provides several illustrative examples of scenarios in which the output featuring only one clinically appropriate recommendation would not receive enforcement discretion, including (1) those that present risk factors such as time-sensitive risk predictions, (2) recommendations that rely on analysis of certain clinical images (e.g., positron emission tomography scans), and (3) outputs that rely on data or inputs that cannot be verified or validated from well-accepted or well-understood sources.

For example, in relation to Criterion 3, FDA states that it would apply enforcement discretion to software functions that “analyze[] a radiologist’s clinical findings of an image to generate a summary of the clinical findings for a radiology or pathology report” that includes “a specific diagnostic recommendation based on clinical guidelines” for the HCP’s review, revision, and finalization. However, software that analyzes the image itself to generate clinical findings or measurements would remain a medical device.

Although the practical outcome of enforcement discretion is that the product is not subject to device requirements, the regulatory implications for enforcement discretion versus a non-device designation are slightly different. FDA can withdraw its enforcement discretion as to a specific product or a category of products if it later determines that medical device or other regulatory controls are necessary to ensure the safety and effectiveness of the product.

Therefore, while the flexibility to provide a single clinical recommendation has the potential benefit of simplifying outputs and providing more targeted and clinically relevant information, this might come with a greater expectation that developers maintain and provide appropriate evidence to demonstrate the validity of the clinical output, including the clinically validated data supporting the use of a single clinically relevant recommendation.

The updated guidance is also more direct in clarifying its approach to non-device signal acquisition or physiological sensing and analysis functions under Criterion 1. Under Criterion 1, a product would not be considered non-device CDS if one of its intended uses involved the acquisition, processing, or analysis of medical images, signals from in vitro diagnostics (e.g., output from assays or diagnostic instruments), or signals or patterns from other systems or devices that acquire physiological data (e.g., electrocardiograms).

FDA acknowledges that not all signal acquisition systems that measure physiological parameters are medical devices, especially if they measure physiological parameters for non-medical purposes. Manufacturers are encouraged by FDA to speak to the agency to speak to the Agency if they intend to use inputs from a signal acquisition system that was previously used for medical purposes for a non-device or non-medical purpose.

FDA also includes several examples of software functions in the updated guidance that remain focuses of its oversight, including software functions that:

• Incorporate as an input data (e.g., genomic data or other data sources) that are not well-understood and accepted for the stated clinical use or without established relevance to the diagnostic recommendation
  
  
• Use information that cannot be verified and validated to be from well-understood and accepted sources
  
  
• Incorporate analysis of medical imaging (e.g., scan images) or other signal-level inputs
  
  
• Establish a definitive diagnosis
  
  
• Provide care pathway recommendations for patients with conditions where immediate clinical intervention may be required, or
  
  
• Provide predictions intended to guide immediate escalation of care.

Lastly, FDA continues to focus on risk factors including: the impact of issues such as automation bias (i.e., the propensity for a user to over-rely on a suggestion from an automated system), usability, disclosure of contextually relevant information about the software logic, and the reliability of the clinical data and evidence driving the outputs.

These factors influence not only the device-versus-non-device designation for CDS products, but also potentially the ultimate device classification and premarket pathway. In the 2022 version of the CDS Guidance, FDA discussed the risk of automation primarily in the context of whether software provides a user with a single output.

Given FDA’s new posture of enforcement discretion in some cases in which there is a single output, the agency shifts the evaluation of the risk of automation bias in the updated CDS Guidance to the level of software automation and the time-critical nature of the HCP’s decision-making, i.e., whether an HCP can independently review the basis of a recommendation and overcome the potential for automation bias.

In addition, FDA was careful to note that existing digital health guidances such as the Policy for Device Software Functions and Mobile Medical Applications continue to apply to consumer or patient-facing CDS.

General Wellness Guidance

Background

General Wellness software includes mobile applications, consumer-facing software, and tools that are intended for maintaining and encouraging a healthy lifestyle and are unrelated to the diagnosis, cure, mitigation, prevention, or treatment of a disease or condition. Like HCP-facing CDS, the Cures Act exempted general wellness software from the medical “device” definition. FDA issued the 2019 General Wellness Guidance to further define a “general wellness product” to be inclusive of, but not limited to, software and describe which software functions would be exempt from medical device requirements, and which low-risk devices would be subject to enforcement discretion.

In its original guidance, FDA defined “general wellness products” as products that satisfy the following two-factor test: (1) they are intended for only “general wellness use,” as defined in the guidance; and (2) they present a low risk to the safety of users or other persons. In evaluating the second factor, FDA states that general wellness products cannot (1) be invasive, (2) be implanted, or (3) involve an intervention or technology that may pose a risk to the safety of users or other persons if specific regulatory controls are not applied (e.g., risks from lasers or radiation exposure). The third criterion in the second factor effectively gives FDA the ultimate discretion to determine that a product should be subject to medical device requirements because of its risk profile.

Key updates

The updated General Wellness Guidance attempts to clarify two issues that have led to confusion regarding the line between regulated device functions and general wellness. The first issue relates to the practice of marketing non-invasive physiological monitors and sensors that are capable of capturing biometric or medical data for wellness purposes such as sleep or fitness tracking. This issue was the focus of FDA’s 2025 Warning Letter to WHOOP, Inc., in which the agency alleged that the company’s “blood pressure insights” function was a medical device function, citing claims related to “delivering medical-grade health & performance insights” as evidence of a device intended use.

In the updated guidance, FDA clarifies that certain products that use non-invasive sensing to “estimate, infer, or output physiologic parameters (e.g.[,] blood pressure, oxygen saturation, blood glucose, heart rate variability)” may satisfy the criteria for general wellness products “when such outputs are intended solely for wellness uses.”

The agency cites the use of sensing technology for displaying values, ranges, trends, baselines, or summaries of time in relation to sleep, activity, stress, or exercise recovery as examples of general well uses. FDA notes, however, that these products are subject to medical device requirements if they are intended for medical or clinical purposes.

Evidence of medical or clinical use includes references to specific diseases or conditions; use of alerts, alarms, or prompts related to clinical action or medical management; treatment guidance; claims related to clinical equivalence or accuracy, medical or clinical grade, or substitution for an FDA-authorized, cleared, or approved product; and intended uses that relate to diagnosis, screening, monitoring, or management of a disease or condition.

The agency also specifically highlights blood pressure monitors and sphygmomanometers as examples of products that remain under FDA oversight, so the agency does not appear to be conceding its enforcement position with respect to WHOOP’s Blood Pressure Insights feature.

The second issue relates to the integration of alert features into general wellness tools that notify users of changes in trends or other parameters and prompt the user to seek a medical evaluation or consultation. Historically, the use of alerts, prompts, or notifications with recommendations to escalate care or seek medical attention increased the risk that such functions would trigger medical device requirements. In the updated General Wellness Guidance, FDA clarifies that these notifications are permissible for a general wellness tool, provided that the notifications:

• Do not identify or name a specific disease or medical condition
• Do not characterize the output as abnormal, pathological, or diagnostic
• Do not include clinical threshold, diagnoses, or treatment recommendations, and
• Do not provide ongoing alerts or monitoring intended to manage a disease or condition.

Conclusion

FDA issued both updated guidance documents as direct-to-final guidance without seeking industry comments or feedback on the changes. Both areas of focus in each guidance document – and the updated examples of regulated and unregulated functions in each – reflect FDA’s continued engagement with industry and stakeholders on classification decisions and policy for digital health tools.

Overall, the guidance documents appear to reflect a risk-based response to rapid and continued digital health innovation, rather than a radical change in direction from past policy and guidance.

For more information, please contact the authors.