Four Criteria Stand Between Your Product and Device Regulation.
Regulatory strategy for CDS — where the Cures Act carve-out is narrower than your product roadmap, and intended use decides which side of the line you are on.
The Exemption Was Written for Advice a Physician Can Ignore.
The 21st Century Cures Act removed certain decision-support software from the device definition — and for six years industry read that carve-out generously. FDA’s final CDS guidance in September 2022 read it the way it was written: narrowly. Software that tells a clinician what to do, on a clock, about a specific patient, is a device — however advisory the marketing sounds.
The determinative concepts are automation bias and independent review: can the clinician actually inspect the basis for your recommendation and reach their own judgment, in the time the decision allows? A sepsis alert at 3 a.m. fails that test no matter what the About page says. We make the determination rigorously, in writing, before the roadmap depends on the answer.
Where minutes matter, the guidance presumes the clinician cannot independently review your basis — and the carve-out closes.
Pass All Four Gates or You Are a Device.
The statute is conjunctive — every criterion, not most of them. This is the analysis we run against the product you have and the one on the roadmap.
Not acquiring or analyzing signals
The software must not process medical images or signals from an IVD or a monitor. One waveform in, and the analysis ends here — imaging AI and wearable-signal products never reach gate two.
Displaying or analyzing medical information
What flows in must be the kind of medical information clinicians already exchange — labs, notes, guidelines. Proprietary signals dressed as “information” do not qualify.
Supporting, not replacing, judgment
The output supports or provides recommendations to a professional — it does not direct. A single specific directive, a score that maps to an action, or an alarm that demands response reads as driving care.
Independent review of the basis
The clinician must be able to see why — inputs, logic, sources — and practicably reach their own conclusion in the time available. Black-box models and time-critical settings fail here, which is where most modern CDS dies.
And Europe never wrote the carve-out. Under MDR Rule 11, decision-support software for diagnosis or therapy is a medical device — usually Class IIa or higher. A US non-device determination is a US answer only.
The Same Pitch Deck Can Contain All Three Outcomes.
Run the four gates against real product archetypes and the pattern is clear: the more useful the output, the more likely it is regulated.
Sepsis & deterioration alerts
Time-critical, patient-specific, action-demanding — the archetype the 2022 guidance was written about.
Imaging triage & CAD
Analyzes images, so it fails gate one before the conversation starts. CADe, CADx, and CADt each have device classifications waiting.
Opaque risk scores
A proprietary score with no inspectable basis fails the transparency gate — even delivered inside an EHR banner.
Drug–drug interaction flags
Guideline-based, source-cited, no urgency — the kind of advice the carve-out was actually written for.
Order-set & guideline surfacing
Matching patients to published protocols the clinician can read — supportive, transparent, ignorable.
Calculators & stewardship tools
A published formula with visible inputs can pass; add proprietary weighting or urgency and the determination flips.
The determination reads your UI, your sales deck, and your website — not just your regulatory rationale.
Your Marketing Deck Is Part of Your Intended Use.
Non-device status is not a clearance — it is a conclusion that stays true only while the facts do. The facts include every screenshot, every sales claim, and every “AI-powered early warning” a growth team ships on a Tuesday. Products cross the line in the marketing copy long before they cross it in the code.
We build the guardrails that keep the determination durable: a claims register tied to the four criteria, UI review for outputs that drift from recommendation to directive, and a documented re-determination every time the roadmap touches the boundary. And when the product should be a device — because that is where the value is — we plan the 510(k) instead of the euphemism.
What the CDS Line Actually Turns On.
Memorize these three and you can predict most determinations from the demo alone.
The criteria are conjunctive. Passing three of four is failing — and gate one disqualifies every product that touches an image or a signal.
The final guidance that ended the broad reading — time-critical use and automation bias became determinative concepts.
Europe’s answer: there is no CDS carve-out. Decision software for diagnosis or therapy is MDR-regulated, notified body included.
Six Failure Modes We Are Brought In to Prevent.
Most CDS trouble is a determination made once, optimistically, and never revisited.
A risk score with a hidden basis
The model is the moat, so the basis stays proprietary — and gate four closes. Transparency is a design requirement, not a legal argument.
Time-critical output assumed exempt
An alert that must be acted on in minutes, analyzed as if the clinician had an afternoon to review the literature.
“Non-device” with an alarm attached
The moment the output escalates, pages, or interrupts, it is driving care — and the enforcement-discretion story stops holding.
No QMS when the answer changes
The roadmap crosses the line and there is no design history, no risk file, no lifecycle — a device program starting from zero, in public.
The EU treated as a footnote
A US carve-out strategy shipped to Europe, where Rule 11 was waiting with a notified body and a year of scheduling.
Pilot to product without a file
The health-system pilot becomes a commercial deployment, and the informal determination that covered fifty users now covers five million.
CDS Regulatory Leadership That Reads the Statute and the UI.
Our leads have made device determinations that held, filed the 510(k)s when they didn’t, and kept growth teams from reclassifying the company.
“The carve-out is a needle’s eye, and the product that fits through it rarely survives the roadmap. Plan for the version of your product that doesn’t.”
The discipline we bring to decision support, risk scores, and clinical alerts.
Building Decision Support? Get the Determination in Writing Before the Roadmap Outgrows It.
Bring senior CDS regulatory leadership in before the four criteria meet your growth plan.
Senior-led. Embedded in your team. No junior hand-offs.