21 CFR § 870.2785 ("Software for optical camera-based measurement of pulse rate, heart rate, breathing rate, and/or respiratory rate")

• Authority: Food and Drug Administration
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: U.S. regulations, executive orders, and agency policies
• Most recent activity: Enacted
• Most recent activity date: 2023-01-31

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• Overreliance and unsafe use
• Lack of capability or robustness
• Lack of transparency or interpretability

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Unequal performance across groups
• AI system security vulnerabilities
• Loss of human agency and autonomy

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 3-4 subdomains, with strong focus on AI system safety and robustness (7.3), lack of transparency (7.4), and human-computer interaction risks related to overreliance (5.1). Coverage is concentrated in technical safety, validation requirements, and user interaction domains.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Information
• Health Care & Social Assistance

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Agriculture, Mining, Construction & Manufacturing
• Scientific Research & Development Services

All other sectors had no coverage in this document.

Sectors Summary

The regulation primarily governs the Health Care and Social Assistance sector, specifically medical device manufacturers developing AI-based vital sign monitoring software. It also has implications for the Information sector (software developers) and Scientific Research and Development Services (clinical testing).

Legislative Status

Hard Law

Legislative Status Summary

This is a binding federal regulation from the Code of Federal Regulations (CFR) with mandatory requirements and enforcement mechanisms through the FDA.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: Food and Drug Administration (FDA)
• Summary: The document is a federal regulation issued by the FDA, as indicated by the citation '21 CFR § 870.2785' and the authority statement identifying the Food and Drug Administration.

Target

• Entity Types: AI_Developer, AI_Deployer
• Summary: The regulation applies to manufacturers and developers of software-based medical devices that use optical camera-based measurement algorithms. These entities must comply with special controls including software validation, clinical testing, and labeling requirements.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: Food and Drug Administration (FDA)
• Summary: The FDA has enforcement authority over medical devices through its regulatory framework. The regulation establishes Class II special controls that the FDA enforces through pre-market clearance and post-market surveillance.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: Food and Drug Administration (FDA)
• Summary: The FDA monitors compliance through review of software documentation, clinical data, and post-market surveillance. The regulation requires ongoing cybersecurity vulnerability management, indicating continuous monitoring obligations.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Collect and Process Data
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document comprehensively covers verification and validation, deployment, and operation/monitoring stages. It requires extensive testing, clinical validation, and ongoing cybersecurity management. The regulation also addresses design considerations through hazard analysis requirements and hardware specifications.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Models
• AI Systems
• Predictive AI
• Task-specific AI

Technical Scope Summary

The document explicitly covers AI software and algorithms for medical device applications. It addresses software-based systems that analyze video data to estimate vital signs. The regulation does not mention frontier AI, general purpose AI, foundation models, or compute thresholds, as it is focused on a specific medical device application.