Cleared is not the same as proven
An FDA clearance shows that software met a regulator's floor; physicians should ask for evidence that it works on patients like theirs before they trust it.
Listen to this special topic
read by an AI voiceOn Oct. 1 two of Medicare's regional contractors proposed not to pay, across 20 states, for software that measures the brain on MRI. The products they named, among them NeuroQuant and icobrain, are cleared by the FDA. "At this time, there is insufficient evidence of clinical utility or validity," the proposals say, and the technology is "considered investigational." The contractor for Kentucky and Ohio stopped covering it in January, and another has proposed the same for 10 more states.
The contractors have put plainly what physicians who use AI should already assume. An FDA clearance or a European CE mark shows that a product met a regulator's floor for a stated use. It does not show that the product works on a given hospital's patients, machines and habits, and the evidence that it would is often thin, private or missing. Authorization should be where a buyer's questions begin, and physicians and hospitals should insist on answers before they let the output steer care.
Almost every AI device reaches the American market by showing that it is substantially equivalent to one already sold: 1,376 of the 1,430 authorized through 2025 took that route, according to an analysis reported by AuntMinnie. Showing equivalence often requires no clinical study. Of 521 AI devices the FDA authorized through 2022, 226 had no published clinical validation, and of the 148 tested on patients as they came in, 22 went through a randomized trial. An earlier review found that 97% of 130 devices authorized from 2015 to 2020 had been evaluated only on past data, and most did not say whether they had been tested at more than one site. Much of this was legal: many of these products did not need validation data, as the lead author of the 2024 study said.
In Europe the gap can be wider. A review published on Oct. 5 by researchers in Helsinki and Split found public evidence of performance for only 30 of 77 authorized AI products in pathology and in the microscope analysis of blood and marrow cells. All eight that also held American authorization had public data; of the 69 authorized only in Europe, fewer than a third did. Where evidence existed it came in 15 different measures, which makes products hard to compare. The authors note that performance results do not have to be published, and they describe "a gap between evidence availability and regulatory authorization."
Even good evidence describes someone else's hospital. Software that flags broken necks on CT reported a sensitivity of 91.7% in its FDA disclosure; at one academic hospital it found 54.9% of fractures, and most of the scans it flagged had no fracture, though it wrongly flagged a smaller share of fracture-free scans than the disclosure implied. Prediction models built into record systems behave the same way. Epic's sepsis model missed two-thirds of sepsis cases at the University of Michigan while alerting on nearly a fifth of all inpatients, and across nine hospitals in one network its ability to tell patients who developed sepsis from those who did not ranged from little better than a coin toss to near the developer's own figures, falling where sepsis was most common. In another study, chest X-ray models could tell which hospital system an image came from almost every time, and a model trained to find pneumonia did worse at a hospital it had not learned from.
When cleared products fail, it tends to be early and among those with the least evidence. Of 950 AI devices, 60 were recalled, 182 times in all; 43% of the recalls came within a year of clearance, and devices with no reported clinical validation were more likely to be recalled. The study's authors suggested requiring prospective evaluation, or clearances that lapse without confirming data.
Nor is the floor about to rise. The FDA's guidance on AI device software has been a draft since January 2025; the agency says it intends to finalize it in the fiscal year that began on Oct. 1. A federal requirement that record-system vendors disclose how their predictive tools were built and tested would be dropped under a proposal published in December. Europe has postponed its AI Act's high-risk rules for AI in medical devices to August 2028. Until regulators ask for more, buyers will have to.
The objection is that this asks too much. Published summaries are not the whole file: the FDA says its summaries leave out most of what companies submit, so missing data is not the same as missing review. Recalls are uncommon, touching about 6% of AI devices. Some authorized tools work in ordinary practice: in an observational study of more than 460,000 women screened in Germany with a CE-marked product, radiologists reading with AI support found more cancers without calling back more women. And small hospitals cannot run trials. Those with fewer resources buy products "off the shelf," as one researcher put it, and a preprint found that rural hospitals in one network lacked the patients needed to recalibrate a model locally. All of that is true, and none of it argues against asking. The vendor holds the evidence the regulator saw, and handing it over costs little. Where good evidence exists, as in Germany, it is easy to show. A hospital too small to test a tool is the one that most needs the seller to have done the testing.
Hospitals should therefore treat authorization as the start of a purchase rather than the end of one. The first question is exactly what was cleared and for what use, since outside that use even the regulator's floor does not apply. Then comes the full validation report rather than the brochure: how many sites and patients, checked against what, with results by age, sex, race and scanner, and how often a positive result is right at a rate of disease like the hospital's own. Who paid for the studies matters too, and any claim that a tool improves care should rest on a prospective or randomized study; this publication's reviews of 99 clinical AI tools found randomized trials showing a benefit in routine care for eight of them. The answers belong in the contract. A vendor that will not put them in writing has answered anyway.
Even good answers describe someone else's patients, so a tool should first run silently on recent local cases, its output compared with what clinicians decided and what happened to the patients; a small hospital can share that work with others that use the same product. Once it is live, someone named should watch its alerts, overrides and misses, the vendor should report every update and recall, including changes made under a plan the FDA authorized in advance, and the hospital should keep the right to switch it off. And a hospital should check coverage before it buys. Medicare's contractors already refuse to pay for some cleared brain MRI software in two states and have proposed the same in 30 more.
Medicare's contractors have started asking cleared software for proof that it helps patients. Physicians should ask before the software reaches them, not after the claim is denied.
- Palmetto GBA (Alabama, Georgia, North Carolina, South Carolina, Tennessee, Virginia and West Virginia; proposed LCD DL40464) and Noridian (13 Western states and three Pacific territories; DL40454) posted proposed noncoverage policies on Oct. 1, 2026, for "artificial intelligence (AI) assistive software tools for automated detection and quantification of the brain": "At this time, there is insufficient evidence of clinical utility or validity, and use of this technology is considered investigational and therefore not covered." They name NeuroQuant, icobrain, icobrain aria, DeepBrain and Siemens Morphometry Analysis, cite the lack of standardized reference values, proprietary data that are not interchangeable across platforms and training data lacking diversity, and say that radiologists assisted by ARIA software "were significantly superior in detecting ARIA" but that no evidence shows it improves outcomes. Comments close Nov. 14; open meetings Oct. 22 (Noridian) and Oct. 26 (Palmetto). CGS Administrators' final LCD L40224 (Kentucky and Ohio) has applied since Jan. 19, 2026; National Government Services proposed the same policy (DL40332) for 10 states on Jan. 22, 2026.
- Mondal, Purhonen, Marušić and Brück (npj Digital Medicine, Oct. 5, 2026; an accelerated article preview) identified 77 CE-marked or FDA-authorized AI software devices from 29 manufacturers, 68 in digital pathology and nine in hematology morphology, and found publicly available device-specific performance evidence for 30 (39%). Evidence was available for 8 of 8 devices with both EU and US authorization and 22 of 69 EU-only devices, and for 7 of 9 hematology morphology devices and 23 of 68 digital pathology devices. Fifteen distinct performance metrics were reported. The work was funded by the EU's Horizon Europe program; three authors list Cellbytes Ltd as an affiliation, and two declare stock ownership in it.Source: npj Digital Medicine
- Golshani and Joseph (Cureus, July 13, 2026), as reported by AuntMinnie, found that of 1,430 AI or machine learning devices the FDA authorized from September 1995 through December 2025, 1,376 were cleared through the 510(k) pathway, 37 were granted De Novo and 17 received premarket approval (figures from the authors' preprint). Chouffani El Fassi and colleagues (Nature Medicine, 2024) found that 226 of 521 AI devices authorized from 1995 to 2022 lacked published clinical validation data; of 292 with validation data, 144 were studied retrospectively and 148 prospectively, and 22 underwent randomized trials (MedTech Dive). Wu and colleagues (Nature Medicine, 2021) analyzed 130 devices approved from 2015 to 2020: 97% performed only retrospective evaluations, 72% did not publicly report whether the algorithm was tested at more than one site, and 17 device studies mentioned demographic subgroup performance. FDA says its public decision summaries "do not include most of the information that may be submitted in an application."
- Lee and colleagues (JAMA Health Forum, Aug. 22, 2025) matched 950 FDA-cleared AI-enabled devices to recall records: 60 (6.3%) were associated with 182 recall events, 79 of them (43.4%) within 12 months of clearance; lack of clinical validation was independently associated with recall (odds ratio 2.8), and public companies accounted for 53.2% of devices but 91.8% of recalls. The authors wrote that requiring prospective evaluation or issuing time-limited clearances that lapse without confirmatory data may reduce these risks.
- Voter and colleagues (AJNR, 2021) found that Aidoc's cervical spine fracture tool identified 67 of 122 fractures (sensitivity 54.9%, specificity 94.1%) at one institution, against sensitivity of 91.7% and specificity of 88.6% in its initial FDA disclosure. Wong and colleagues (JAMA Internal Medicine, 2021) found that the Epic Sepsis Model had an area under the curve of 0.63 at Michigan Medicine, did not identify 1,709 of 2,552 patients with sepsis and generated alerts for 18% of all hospitalized patients; the developer had reported 0.76 to 0.83. Lyons and colleagues (2023) found C-statistics from 0.55 to 0.73 across nine hospitals, lower where sepsis incidence was higher. Zech and colleagues (PLOS Medicine, 2018) found that chest X-ray models could identify the hospital system of a radiograph in more than 99.9% of cases and performed worse at an external hospital (AUC 0.815 vs 0.931).
- FDA's draft guidance on AI-enabled device software functions was issued in January 2025; the final version is on CDRH's A-list of guidance it intends to publish in fiscal 2027. FDA's guidance on predetermined change control plans, final in December 2024 and reissued Aug. 18, 2025, lets a manufacturer make planned modifications without new marketing submissions. ASTP/ONC's HTI-1 rule requires developers of certified health IT to supply source attributes for predictive decision support interventions; the HTI-5 proposed rule (December 2025) would eliminate that requirement, and a final HTI-5 rule was under review at the Office of Management and Budget in August 2026 (WEDI). FDA, Health Canada and the MHRA issued non-binding transparency principles for machine learning devices in June 2024. The EU's Digital Omnibus on AI (Regulation 2026/1744) moves the AI Act's high-risk obligations for AI embedded in medical devices to Aug. 2, 2028. The Coalition for Health AI offers a voluntary applied model card.
- Nong and colleagues (Health Affairs, January 2025) reported that 65% of U.S. hospitals used predictive models, 61% tested them for accuracy with their own data and 44% evaluated them locally for bias (Healthcare Dive). ASTP/ONC reported that 71% of hospitals used predictive AI integrated with the EHR in 2024, that system-affiliated hospitals used it far more than independent hospitals (86% vs. 37%) and that, among hospitals using predictive AI, 80% used models sourced from their EHR developer. A 2025 preprint (not peer reviewed) found that rural sites in one Middle Tennessee network had worse calibration than the primary urban site and failed to meet sample size requirements for local recalibration. Five radiology societies' joint statement (January 2024) says that bringing AI into clinical practice demands increased monitoring of its utility and safety.
- In the PRAIM study (Nature Medicine, Jan. 7, 2025), 463,094 women were screened at 12 sites in Germany, 260,739 with AI support, by 119 radiologists; the cancer detection rate was 6.7 per 1,000 with AI support and 5.7 without, and the recall rate 37.4 and 38.3 per 1,000. The study was observational, and radiologists chose whether to use the AI, a CE-certified product, Vara MG.Source: Nature Medicine