FDA clinical decision support guidance and AI adverse event grading

The FDA clinical decision support (CDS) guidance, formally titled Clinical Decision Support Software, explains how FDA reads section 520(o)(1)(E) of the Federal Food, Drug, and Cosmetic Act. That provision excludes some software that supports a health care professional's decisions from the medical device definition. A function is excluded only if it meets all four statutory criteria: it does not analyze a medical image or a signal or pattern from a device, it displays or analyzes medical information, it supports or provides recommendations to a health care professional, and it enables that professional to independently review the basis for the recommendation.

FDA revised the guidance on January 6, 2026 and reissued it with a minor correction on January 29, 2026; the revision supersedes the September 2022 final guidance. For adverse event grading software, the fourth criterion is the one the design turns on. A suggested CTCAE grade that arrives with the criterion it applied and the line in the medical record it rests on can be checked by the investigator who signs it. A grade that arrives alone gives the investigator nothing to check.

What is the FDA clinical decision support guidance?

The FDA clinical decision support guidance is FDA's nonbinding explanation of how it reads section 520(o)(1)(E). Section 3060(a) of the 21st Century Cures Act, enacted on December 13, 2016, added section 520(o) to the FD&C Act. Section 520(o)(1) lists five kinds of excluded software function, and clinical decision support is the fifth (21 U.S.C. 360j(o)(1); slide 7 of FDA's CDRH town hall Clinical Decision Support Software, Final Guidance, March 11, 2026). The guidance has moved through five versions under docket FDA-2017-D-6569 (town hall slide 8):

1. December 2017: first draft guidance.
2. September 2019: revised draft guidance.
3. September 28, 2022: final guidance (Federal Register notice).
4. January 6, 2026: revised final guidance.
5. January 29, 2026: the current document, reissued with a minor correction on pages 13 and 14 for alignment with the January 6 update (guidance PDF, guidance history table, p. 27).

At the town hall, FDA said the four statutory criteria did not change with the update (transcript, p. 2).

What are the four non-device CDS criteria?

The four criteria are that the function (1) does not analyze a medical image or a signal or pattern from a device, (2) displays, analyzes or prints medical information, (3) supports or provides recommendations to a health care professional, and (4) enables that professional to independently review the basis for the recommendation, so they do not rely primarily on it. Applied to software that suggests CTCAE grades:

Criterion (section 520(o)(1)(E))	What FDA's guidance says	What it means for adverse event grading software
1. Not intended to acquire, process, or analyze a medical image, a signal from an in vitro diagnostic device, or a pattern or signal from a signal acquisition system	Analyzing an image, an ECG waveform or a continuous glucose stream fails. Discrete, point-in-time measurements, such as routine vital signs taken at a visit, generally are not a pattern by themselves (p. 8).	Met when the inputs are clinical notes and discrete results already in the record. A tool that reads the ECG tracing itself to grade QTc prolongation, rather than the QTc value recorded in the chart, analyzes a signal and does not meet Criterion 1.
2. Intended to display, analyze, or print medical information about a patient or other medical information	Medical information includes symptoms, certain test results, discharge summaries, clinical practice guidelines, peer-reviewed studies and government agency recommendations (p. 9).	The progress note is medical information about the participant; the CTCAE criteria NCI publishes are the reference the grade is matched against.
3. Intended to support or provide recommendations to a health care professional about prevention, diagnosis, or treatment	The output informs a professional's decision and does not replace or direct it. Functions that support recommendations to patients or caregivers fall outside the section 520(o)(1)(E) exclusion (p. 13).	The suggestion goes to the investigator or a delegated sub-investigator, never to the participant, and the investigator assigns the grade.
4. Intended to enable the professional to independently review the basis for the recommendation, so that they do not rely primarily on it	FDA recommends disclosing intended use, inputs, a plain-language description of the method and its evidence, and patient-specific knowns and unknowns (pp. 14 to 15).	Each suggested grade shows the criterion text it applied, in the CTCAE version the protocol names, beside the source line it was drawn from.

What changed in the 2026 CDS guidance?

The statutory criteria are unchanged; FDA's interpretation moved. Page links go to the September 2022 final guidance and the January 2026 guidance.

Topic	September 2022 final guidance	January 2026 guidance
One specific output	Fails Criterion 3; a risk probability or risk score for a specific disease counts as one (pp. 12 to 13).	Still fails Criterion 3, but where only one option is clinically appropriate and every other criterion is met, FDA intends to exercise enforcement discretion (pp. 10 to 11).
Time-critical decisions	Criterion 3 covers software that "is not intended to support time-critical decision-making" (p. 12); Criterion 4 repeats it (p. 14).	Removed from Criterion 3. A function for "a critical, time-sensitive task or decision" does not meet Criterion 4 (p. 14).
Automation bias	Defined under Criterion 3 as "the propensity of humans to over-rely on a suggestion from an automated system" (p. 11).	Same definition, moved to Criterion 4, noting it increases when action is urgent (pp. 15 to 16).
Plain language and presentation	Plain-language background on inputs, algorithm logic, datasets and validation (p. 14).	Adds usability: the most decision-relevant information first, more detail available, no information overload (p. 15).
Signals, patterns and medical information	A signal acquisition system measures a parameter for a medical purpose (p. 8); medical information is listed by example (p. 9).	Adds streaming measurement and says point-in-time measurements generally are not a pattern (p. 8); whether information is commonly discussed clinically is not by itself determinative (p. 9).

The one-specific-output row is the one a grading function has to read closely. The guidance speaks of a "specific preventive, diagnostic or treatment output or directive" and does not address severity grading. If one suggested CTCAE grade per event counts as such an output, the 2022 text failed it on Criterion 3, and the January 2026 text still treats it as failing while stating enforcement discretion where only one option is clinically appropriate and every other criterion is met (pp. 10 to 11). How that reading applies to a given product is the question the 513(g) and Q-Submission routes put to FDA (see the common questions below).

How does Criterion 4 apply to AI adverse event grading?

The guidance lists four recommendations for satisfying Criterion 4, labeled (a) to (d) (pp. 14 to 15). Each translates into something a grading reviewer can see on the screen.

• (a) Purpose, intended user and population. State that the function suggests CTCAE grades and attribution in clinical research, for review and signature by the investigator.
• (b) Inputs, with their relevance and data quality requirements. Name what the grade drew on: the notes and lab results in scope, the protocol, and the CTCAE version the protocol names, because 376 terms are worded differently at one grade or more between v5.0 and v6.0. CTCAE v6.0 has 850 terms: 45 new, 7 renamed, and 376 reworded at one grade or more since v5.0 (every change, term by term). Diarrhea grade 1 reads "Increase of <4 stools per day over baseline; mild increase in ostomy output compared to baseline" in v5.0 and "Change in consistency or frequency" in v6.0.
• (c) The method and its evidence, in plain language. Summarize the general approach (FDA's examples include expert panels, statistical modeling and AI/ML techniques), the data relied upon, and the results of the studies that evaluated it. For attribution, name the causality method, such as the WHO-UMC system or the Kramer algorithm.
• (d) Patient-specific information and knowns and unknowns. Show the source sentence beside the grade, and say when an expected input is missing. In FDA's worked example of a non-device function, the output indicates "whether any expected input medical information from the medical record was missing" (section V.B, example 1, p. 20).

Recommendation (a) also carries the time-critical question. Grading classifies an event the record already documents, on the timescale of a visit and a case report form. The guidance's time-critical examples are clinical interventions: stroke triage, a sepsis alert, the timing of a C-section (pp. 23 to 25). The urgent clock in adverse event reporting runs on seriousness: an investigator must report any serious adverse event to the sponsor immediately under 21 CFR 312.64(b), and seriousness is defined by outcome in 21 CFR 312.32(a). The CTCAE grade is a severity classification, which is a separate determination.

Consider a note that records six more stools a day than the participant's usual. Under both CTCAE v5.0 and v6.0, Diarrhea grade 2 includes an increase of 4 to 6 stools per day over baseline. A reviewable suggestion shows the sentence, the grade 2 criterion and the baseline the comparison used, and if the record holds no baseline, it says so. The investigator can reach the grade without the software. A grade and a confidence score, shown alone, ask the investigator to trust a number.

FDA also notes that developers may need usability testing to evaluate whether their implementation meets Criterion 4 (p. 15).

Four checks for any adverse event grading vendor

Two of FDA's device examples show how Criterion 4 fails. In example 31, the professional cannot tell what the software considered from the record or which key variables drove its recommendations. In example 32, the full report of the clinical studies relied on is not available to the user (section V.C, pp. 25 to 26). A safety, regulatory or IT lead can test any vendor against both with four checks; how to evaluate AI adverse event grading software goes further, with four questions about the architecture.

1. Open one graded event. The source line and the criterion text should sit on the same screen as the grade, which is what example 31 lacks.
2. Give it a record that cannot support a grade. The output should say what is missing rather than complete the form, as recommendation (d) asks.
3. Ask for the evidence behind the method. The vendor should share its study design and results or, where a study has not read out, its design and when and where results will be reported. That is the disclosure example 32 lacks. Ask too for the usability testing that shows investigators can review the basis.
4. Change a suggested grade. The suggestion, the change, the reason and the signer should all survive in the audit trail, as a 21 CFR Part 11 record.

How Burna AI is built for independent review

Burna AI is citation-bound by design. Citation-bound means each grade traces to the line in the medical record that produced it and to the CTCAE criterion applied, in the version the protocol names. A grade whose citation set is incomplete is flagged before it is signed. Attribution is scored against every drug in the regimen with WHO-UMC and Kramer, with the reasoning shown. A grade becomes a record when a qualified investigator signs it, under a 21 CFR Part 11 electronic signature that carries what was accepted, what was overridden and the citation set as signed. The engine is twelve specialized agents in a cascading constraint pipeline. AI suggests, clinicians decide. Human-in-the-loop, always.

Burna AI is built as non-device clinical decision support for clinical research and postmarket surveillance. Burna AI has submitted a Q-Submission to FDA, and its application to the CDER Emerging Drug Safety Technology Program (EDSTP) is in progress. The determination rests with FDA.

Recommendation (c) asks for the studies behind an algorithm. Burna AI's concordance study is designed around 1,600 cases drawn from a de-identified dataset of 3 million patients across three campuses, graded against an adjudicated two-clinician reference panel, with a readout in December 2026. Ongoing internal testing demonstrates strong agreement with expert clinicians. How agreement is measured describes the study design. Burna AI is a Mayo Clinic Platform_Accelerate participant.

Common questions about FDA's CDS guidance

Is clinical decision support software a medical device?

Some is and some is not: a function is excluded only when it meets all four criteria in section 520(o)(1)(E), and the guidance treats a function that fails any of them as a device software function. Where a function fails only Criterion 3 because it gives one specific output, and that is the only clinically appropriate option, FDA intends to exercise enforcement discretion.

How do you ask FDA whether a CDS function is a device?

At the March 2026 town hall, FDA pointed developers to [email protected] and named two formal routes: a 513(g) request for device determination, or a Q-Submission (town hall transcript, p. 9). Comments on the guidance itself can be filed at any time under docket FDA-2017-D-6569 on regulations.gov (guidance, p. 2).

Does FDA's CDS guidance apply to AI and large language models?

Yes; the criteria apply whatever the model. Asked at the March 2026 town hall, FDA said an LLM-enabled function "may meet this criterion if it can sufficiently enable an HCP to independently review the basis for the recommendations" (town hall transcript, p. 10). The model type does not decide the question; what the reviewer can see does.

Is the FDA clinical decision support guidance binding?

No. The guidance sets out FDA's current thinking and is not binding on FDA or the public (p. 4); FDA's guidance documents do not establish legally enforceable responsibilities (p. 5). The statutory criteria are what bind, and sponsors may use alternative approaches so long as the professional can independently review the basis for the recommendations (p. 14).

If your team is working through Criterion 4 for adverse event grading and wants to see what an investigator reviews before signing, book a 15-minute conversation.