21 CFR § 870.2790 ("Photoplethysmograph analysis software for over-the-counter use")

• Authority: Food and Drug Administration
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: U.S. regulations, executive orders, and agency policies
• Most recent activity: Enacted
• Most recent activity date: 2022-02-04

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• Overreliance and unsafe use
• Lack of capability or robustness

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Lack of transparency or interpretability

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has minimal coverage of approximately 2-3 subdomains, with focus on AI system safety failures (7.3 Lack of robustness) and human-computer interaction risks (5.1 Overreliance and unsafe use). Coverage is concentrated in technical reliability and user interaction safety domains, reflecting the medical device regulatory context.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Health Care & Social Assistance

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Information
• Scientific Research & Development Services

All other sectors had no coverage in this document.

Sectors Summary

This regulation primarily governs the Health Care and Social Assistance sector, specifically medical device manufacturers developing AI-based diagnostic support tools. It also has implications for the Information sector (software developers) and Scientific Research and Development Services (algorithm development and testing).

Legislative Status

Hard Law

Legislative Status Summary

This is a binding federal regulation from the Code of Federal Regulations (CFR) with mandatory requirements and enforcement mechanisms through the FDA.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: Food and Drug Administration (FDA)
• Summary: The document is a regulation from Title 21 of the Code of Federal Regulations, which is promulgated by the FDA under its statutory authority to regulate medical devices.

Target

• Entity Types: AI_Developer, AI_Deployer
• Summary: The regulation applies to manufacturers and developers of photoplethysmograph analysis software devices for over-the-counter use, who must comply with the special controls before marketing such devices. These entities both develop the AI algorithms and deploy them as medical devices.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: Food and Drug Administration (FDA)
• Summary: The FDA has enforcement authority over medical devices under the Federal Food, Drug, and Cosmetic Act, including the authority to conduct pre-market reviews, post-market surveillance, and take enforcement actions for non-compliance with regulations.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: Food and Drug Administration (FDA)
• Summary: The FDA monitors compliance with medical device regulations through pre-market review processes, post-market surveillance systems, and ongoing oversight of device performance and safety.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document covers multiple AI lifecycle stages with primary focus on Verify and Validate, Deploy, and Operate and Monitor stages. It mandates clinical and non-clinical performance testing, software verification and validation, human factors testing, and labeling requirements that span from pre-deployment validation through operational monitoring.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Models
• AI Systems
• Predictive AI
• Task-specific AI

Technical Scope Summary

The document explicitly covers AI systems (photoplethysmograph analysis software) and AI models (detection algorithm) in a task-specific medical application. It does not mention frontier AI, general purpose AI, foundation models, generative AI, or compute thresholds. The focus is on predictive/analytical AI for a narrow medical purpose.