Device Classification: Class I, II, and III

How the FDA classifies medical devices by risk, where most AI/ML tools fall, and what classification means for the regulatory burden you will face.

OK, which of these things is not like the others? 1) X-ray machine, 2) robotic surgery arm, 3) heart catheter, 4) tongue depressor?

Trick question. They’re all considered medical devices by the FDA.

Of course that’s ridiculous, the tongue depressor obviously stands out. That’s where device classification comes in. It’s the regulatory system’s way of saying, “Here’s how risky we think your thing is, and here’s what you need to do about it.” Think of device classifications as a triage system for regulation. A tongue depressor and a pacemaker need very different levels of scrutiny, and the FDA’s classification scheme reflects that difference. For AI and machine learning tools in clinical research, understanding which bucket you fall into is foundational, because it determines everything downstream: your approval pathway, the evidence you’ll need to gather, how long the process takes, and how much it costs.

The Three Risk Classes

Class I devices are the lowest-risk category. These are tools where, if they fail or perform poorly, the harm is minimal or easily caught by standard clinical practice. The FDA’s governing principle here is “general controls.” General controls are the baseline rules that apply to all devices: you need to register with the FDA, you need to follow manufacturing standards (if you’re manufacturing anything physical), you keep records, and you tell the truth about what your device does. Examples include tongue depressors, elastic bandages, bedpans, and basic thermometers. Since we haven’t yet advanced to the stage of AI-powered bedpans, you’re probably not in this category.

Class II devices sit in the middle and are where most AI and machine learning tools for clinical diagnostics and decision support land. These carry moderate risk. If they malfunction or give bad results, they could lead to a wrong diagnosis or missed treatment opportunity, but clinicians can usually catch the error with other tools or clinical judgment. Class II devices require general controls plus something called special controls. Special controls are device-specific rules that address the particular risks of that device type. For AI diagnostic aids, special controls typically include things like validation studies, performance metrics across subgroups, software documentation, and cybersecurity measures. Most AI imaging tools (chest X-ray analysis, retinal screening, pathology image analysis), clinical decision support systems, and computer-aided detection tools are Class II.

Class III devices are high-risk. These are things where failure could result in serious injury or death, or where the device makes a critical determination without meaningful human oversight. They require the most intensive approval process, called a Premarket Approval or PMA application. These include life-sustaining devices like pacemakers, insulin pumps, and ventilator control systems. In the AI space, Class III might apply to a fully autonomous diagnostic system with no physician review step (which is rare in practice, because most deployed AI systems still have a clinician in the loop). We don’t recommend an autonomous neurosurgery robot as your first AI project.

Where AI/ML Tools Usually Live

Most AI and machine learning tools you’ll encounter in clinical research fall into Class II. The bad news is that Class II is more complex, more expensive, and time-consuming than Class I (but simpler than Class III). The good news is that a clearly-defined pathway exists for Class II devices: the 510(k) pathway. This pathway is designed to be faster and more straightforward than full PMA review, and it’s where the FDA has built up experience and standardized practices for digital health tools.

The reason most AI tools end up as Class II is because they’re designed to help clinicians make better decisions, not to replace clinical judgment. Your AI system identifies suspicious findings in a mammogram, but a radiologist still reviews it and makes the final call. Your algorithm flags high-risk patients for intensive monitoring, but a nurse or doctor decides what to do about that flag. That physician-in-the-loop design is actually what keeps you out of Class III and makes the 510(k) pathway available to you.

How Intended Use Shapes Your Classification

Here’s something that trips up a lot of people early on: the same algorithm can be classified differently depending on what you say it’s supposed to do. This is where “intended use” becomes critically important.

Imagine you’ve built a model that analyzes pathology slides to identify tumor cells. If your intended use is “to assist pathologists in detecting tumor cells, with final diagnosis made by the pathologist,” you’re Class II. The AI is a tool, an extra pair of eyes. But if your intended use statement says “to autonomously diagnose malignant tumors without pathologist review,” suddenly you’re looking at Class III. Same algorithm, much higher regulatory barrier.

This is why your intended use statement (sometimes called the “indication for use”) is one of the first things you’ll nail down with the FDA. It defines the scope of your device’s purpose in the clinical workflow. You’ll use this statement in every regulatory interaction downstream, from Q-Submissions all the way through final approval. It’s a weird phrase becase it sounds like boilerplate, but it’s actually one of the key strategic decisions you’ll need to make.

The Product Code System

The FDA maintains a database of device types, each assigned a unique “product code.” This is how the agency organizes devices for regulatory purposes. There are thousands of product codes covering everything from catheters to chemistry analyzers to image analysis software.

To find your device’s likely classification, you can search the FDA’s 510(k) database and AI/ML device list. If you can find a predicate device (a similar device already approved), you’ll see its classification right there in the database. The product code tells you what regulatory rules apply.

For example, if you’re building a computer-aided detection (CADe) system for chest X-rays, you’d look up the product code for chest X-ray CADe devices. You’ll likely find existing approved devices in the same category, and their classification and approval pathway will give you a roadmap for your own device.

Practical: How to Determine Your Device’s Classification

Before you get deep into development, take these steps to figure out where you’ll land:

Write down your intended use statement. What is the clinician’s workflow? What is your AI supposed to do in that workflow? What does the clinician do with your output? Be as specific as possible (“assists radiologists in detecting breast cancer on mammography” is better than “helps with radiology”).
Search the FDA 510(k) database for devices with similar intended uses. Look at the product codes and classifications of devices already approved. Are they Class I, II, or III?
If you find several comparable devices and they’re all Class II, you’re likely Class II. If you’re seeing a mix, document the differences in intended use that might explain the variation.
Consider whether your device makes a final clinical determination without human review. What sounds good for a grant application or gets seats filled at a conference is different than what you want for the FDA.
Once you have a hypothesis about your classification, consider booking a Q-Submission to confirm it with the FDA. This is the strategic move: you get written FDA guidance on your pathway before you’ve committed significant resources to development.

The classification decision ripples through everything that comes next. It determines whether you’ll use the 510(k) pathway or the De Novo pathway, how much evidence you’ll need to generate, what timeline you’re looking at, and how much money you should budget. Get it right early.

Key Takeaways

The FDA classifies devices by risk: Class I (low, general controls), Class II (moderate, general + special controls), Class III (high, PMA required)
Most AI diagnostic and decision-support tools are Class II
Your intended use statement determines your classification, and the same algorithm can be Class II or Class III depending on intended use
Devices with physician oversight are typically Class II; devices that make autonomous clinical determinations are Class III
Search the FDA’s 510(k) database and AI/ML device list to find comparable devices and their classifications
Confirm your classification via Q-Submission before committing to a development pathway