21 CFR § 870.2345 ("Electrocardiograph software for over-the-counter use")

• Authority: Food and Drug Administration
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: U.S. regulations, executive orders, and agency policies
• Most recent activity: Enacted
• Most recent activity date: 2022-01-18

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• Overreliance and unsafe use
• Lack of capability or robustness

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Lack of transparency or interpretability

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has minimal coverage of approximately 2-3 subdomains, with focus on AI system safety failures (7.3 Lack of robustness) and human-computer interaction risks (5.1 Overreliance and unsafe use). Coverage is concentrated in technical reliability and user interaction safety domains.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Health Care & Social Assistance

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Information
• Scientific Research & Development Services

All other sectors had no coverage in this document.

Sectors Summary

The regulation primarily governs the Health Care and Social Assistance sector, specifically medical device manufacturers developing AI-based diagnostic software. It also has implications for the Information sector (software development) and Scientific Research and Development Services (clinical testing).

Legislative Status

Hard Law

Legislative Status Summary

This is a binding federal regulation from the FDA with mandatory requirements for manufacturers, including specific testing, validation, and labeling obligations that must be met for Class II medical device classification.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: Food and Drug Administration (FDA)
• Summary: The document is a federal regulation (21 CFR § 870.2345) issued by the FDA under its regulatory authority over medical devices.

Target

• Entity Types: AI_Developer, AI_Deployer
• Summary: The regulation applies to manufacturers of electrocardiograph software devices for over-the-counter use, who must develop and deploy these AI-based medical devices in compliance with the special controls specified.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: Food and Drug Administration (FDA)
• Summary: The FDA has enforcement authority over medical devices through its regulatory powers, including the ability to require compliance with Class II special controls and take enforcement action against non-compliant manufacturers.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: Food and Drug Administration (FDA)
• Summary: The FDA monitors compliance with medical device regulations through pre-market review, post-market surveillance, and inspection of manufacturers to ensure adherence to special controls.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Collect and Process Data
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document covers multiple AI lifecycle stages with primary focus on verification/validation, deployment preparation, and operational monitoring. It addresses design requirements, model validation, deployment readiness through labeling, and post-deployment user interaction monitoring.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Models
• AI Systems
• Predictive AI
• Task-specific AI

Technical Scope Summary

The document explicitly addresses AI systems (electrocardiograph software devices) and AI models (detection algorithms). It focuses on task-specific, predictive AI for cardiac arrhythmia detection. No mention of frontier AI, general purpose AI, foundation models, generative AI, open-weight models, or compute thresholds.