FDA Sets Class II Controls for Cardiovascular Machine-Learning Notification Software

Confirmed: FDA placed a type of heart-care software in Class II on September 11, 2026. The type uses machine learning to send a notice about a possible heart disease or condition. The final order adds it to 21 CFR 870.2380 under product code QXO.

The order has a narrow scope. The software uses non-invasive body signals gathered during routine care. It suggests the chance of one heart condition and can prompt more tests.

FDA says the output is not of diagnostic quality or meant to detect an arrhythmia. A notice is not a diagnosis. No notice does not rule out a health problem.

How the device type began

FDA received Viz.ai’s De Novo request for Viz HCM on January 10, 2023. It issued the decision on August 3, 2023. The record is DEN230003.

That decision created a generic device type. The 2026 order puts it in federal rules. It does not approve every heart-care AI product.

FDA found that general controls alone were not enough. General and special controls together can give reasonable safety assurance. FDA did not grant a premarket-notice exemption. The device type still needs the 510(k) process unless that changes.

The risks FDA identified

FDA lists four risks. False results may lead to the wrong care or diagnosis. Model bias or weak results in a new group may also cause harm.

Use outside the supported patient group, data input, or hardware can add risk. Users may also rely too much on the notice. These risks shape the controls.

Independent clinical test data

Clinical testing must use real-world data from the intended patient group. The test set must be separate from training data and large enough to show key group results.

The study must report results by site and demographic group. It must cover health factors that may affect results and the hardware used to gather data.

FDA calls for measures such as sensitivity, specificity, and predictive values. The sponsor must explain why its goals fit the risks of follow-up tests.

Test data must come from at least three geographic sites not used for training. This checks whether results hold outside the training setting.

Software and human-factors controls

The maker must verify and validate the software and complete a hazard analysis. Records must explain the model, inputs, outputs, and supported patient group.

Records must cover system integration, data quality, and supported hardware. They must show how the design limits user error and system failure.

A human-factors review must test how intended users read the notice in its real setting. It must address the risk of a wrong reading.

What the label must explain

The label must name the test method, hardware, and patient group. It must show overall and group results, plus the expected minimum performance.

The label must list limits and groups with less reliable results. It must warn that no finding does not rule out follow-up or replace a full clinical review.

The label must warn against using the notice alone. It must explain the result, follow-up, sensor factors, and compatible sensor types.

What the order does not prove

• It does not approve or clear every heart-care machine-learning product.
• It does not turn a software notice into a medical diagnosis.
• It does not promise that any one patient’s result is correct.
• It does not cover arrhythmia detection under this device definition.
• It is not a recall, warning letter, or enforcement action.
• It does not replace current product labels or advice from a qualified clinician.

Questions for buyers and health systems

A buyer should confirm the 510(k), cleared use, patient group, hardware, and installed version.

The public record should show data sources, group results, model limits, and change controls. Health systems should keep the label, test summary, version, incident reports, and monitoring plan.

Health systems should record who receives each notice and the follow-up path. Staff should not treat the notice as a diagnosis or the sole basis for care.

This report explains the classification record and is not medical advice. BadPD will update it if FDA changes the rule, grants an exemption, posts a material correction, or issues a related safety notice.

Primary sources

• FDA final order, published and effective September 11, 2026.
• FDA product-code record for QXO and 21 CFR 870.2380.
• FDA De Novo record for DEN230003 and Viz HCM.
• FDA review summary and special-controls record for DEN230003.

Source status: Source-cleared FDA and Federal Register records. The device definition, Class II status, controls, and De Novo dates are confirmed. The order does not apply to products outside the defined group. This report does not claim a diagnosis, product-wide approval, recall, or enforcement finding.