FDA vs. CE Mark: Navigating Two Regulatory Worlds for Medical AI

I've worked on algorithms that went through both the US (FDA) and European (CE mark) regulatory pathways. They're often mentioned together as if they're variations on the same process. They're not. The philosophical differences run deep, and they affect how you build, validate, and document your models.

What SaMD Means and Why It Matters

Software as a Medical Device (SaMD) is the regulatory category for software that performs a medical function on its own — without being part of a hardware device. An ECG analysis algorithm running on a cloud server is SaMD. The ECG machine itself is hardware; the AI that interprets the signal is SaMD.

This distinction matters because SaMD has its own regulatory framework. The International Medical Device Regulators Forum (IMDRF) defines risk categories for SaMD based on two axes: the seriousness of the healthcare situation and the significance of the information the software provides.

An algorithm that flags possible cardiac amyloidosis from an ECG falls into a high-risk category: serious health condition, software output drives clinical decision-making. This means full regulatory scrutiny in both the US and EU.

The FDA Pathway: Breakthrough Device

The FDA offers several pathways for medical devices. For novel AI diagnostics, the most relevant are:

• 510(k): demonstrate substantial equivalence to an existing device
• De Novo: for novel devices without a clear predicate
• Breakthrough Device Designation: accelerated interaction and review for devices that address unmet needs

At Anumana, the algorithm I worked on received Breakthrough Device Designation. The application required demonstrating that the device (a) addresses a life-threatening or irreversibly debilitating disease, and (b) represents a breakthrough technology — no adequate alternative exists.

For ATTR-CM, the argument was compelling: the disease is severely underdiagnosed, current diagnostic pathways (cardiac MRI, nuclear scintigraphy, endomyocardial biopsy) are expensive and often delayed, and an ECG-based screen could catch patients from a routine test they already receive.

The designation changes the development process. You get:

• Direct access to FDA reviewers during development (not just at submission)
• Feedback on study design and evaluation endpoints
• Priority review once submitted
• Willingness to consider novel evidence approaches

This interaction shaped technical decisions. The FDA provided feedback on which patient subgroups needed dedicated evaluation, which performance benchmarks they'd consider acceptable, and how to handle comparison with existing diagnostic methods.

The CE Mark Pathway: MDR and Technical Documentation

In Europe, medical AI falls under the Medical Device Regulation (MDR 2017/745). The CE marking process involves demonstrating conformity with the regulation, typically through a Notified Body assessment.

The documentation requirements are extensive:

• Technical file: device description, intended purpose, design and manufacturing information
• Clinical evaluation: systematic review of clinical data supporting safety and performance
• Risk management: ISO 14971 compliant risk analysis
• Software lifecycle documentation: IEC 62304 compliant development process
• Usability: IEC 62366 compliant usability engineering

At Idoven, I contributed to the CE mark submission for the ATTR-CM detection algorithm, validated on 20,754 ECGs from 2,901 patients (AUC 0.88). My role was hands-on: model tuning to meet performance targets, extracting validation metrics across patient subgroups, and preparing the SaMD technical documentation for the European Notified Body.

The European approach is more prescriptive about process documentation. The FDA focuses heavily on clinical evidence of safety and effectiveness; the EU additionally requires detailed evidence that you followed specific development standards throughout the software lifecycle.

Where They Diverge

Clinical evidence: The FDA tends to focus on prospective clinical studies with clearly defined endpoints. The EU accepts a broader range of clinical evidence, including systematic literature reviews, but requires a structured clinical evaluation report.

Post-market surveillance: Both require it, but the EU's post-market clinical follow-up (PMCF) requirements under MDR are more explicit and demanding than FDA's post-market surveillance expectations.

Algorithm transparency: The FDA has issued guidance on AI/ML-based SaMD, including a framework for continuous learning algorithms. The EU's approach is still evolving, with the AI Act adding a new layer of requirements for high-risk AI systems.

Timeline: FDA Breakthrough Device review can move faster than EU MDR Notified Body assessments, which have been significantly backlogged since MDR implementation.

What This Means For Data Scientists

If you're building clinical AI and haven't engaged with regulatory teams, you're making technical decisions in the dark. Architecture choices, validation strategies, even data collection protocols look different when you understand what the submission package needs to contain.

The most valuable skill in this space isn't deep learning expertise alone — it's the ability to translate between technical and regulatory language. When a regulatory consultant says "intended purpose," you need to understand that this constrains your training population, your evaluation metrics, and your deployment scope.

This is a draft. Sections to expand: specific examples from the CE mark documentation process, more detail on the Breakthrough Device application, discussion of the AI Act implications for medical SaMD, practical checklist for data scientists entering regulated AI.