AI Diligence: Eleven Questions, and What the Regulatory Record Answers
Eleven AI due diligence questions for healthcare companies, each answered from a named FDA De Novo or 510(k) record: indication, autonomy, evidence, inputs, change control and holder.
By Peleg Chevion, Managing Partner
11 min read · Artificial Intelligence
In this note07 · 11 min
A healthcare company's AI claim can be tested against a public record before the first management meeting. FDA's database entries and decision summaries state what the software was authorized to do, for whom, on which hardware, on what evidence and under what change rules. Each of the eleven questions below is answered from a named FDA record; the distance between the deck and that record is the diligence finding.
01The Regulatory Record
Artificial intelligence is the accelerant across Biopharma & Therapeutics, Diagnostics & Precision Medicine, Devices & Robotics, Digital Health & Delivery and Longevity & Neuro, never a sector of its own. The useful diligence question is therefore narrow: what does the model do inside a device, diagnostic or care-delivery business, and what has the regulator written down about it?
A general AI review covers data rights, model governance, contracts and security. In a regulated clinical product, including software as a medical device, those items sit downstream of one public document, the marketing authorization, which fixes the indication, the user, the inputs and the evidence.
Four layers of that record repay a full reading: the database entry (requester, regulation, product code, decision date and a field labeled "Predetermined Change Control Plan Authorized"); the decision or 510(k) summary (indications, limitations, studies and, for a De Novo, special controls); the classification regulation in 21 CFR, which binds every later device of the same type; and FDA's list of AI-enabled medical devices, which links each listed device to its database entry and which FDA describes as not comprehensive.
Three statutory mechanisms frame what the record can say. A De Novo request under 21 U.S.C. 360c(f)(2)(A)(ii) is available when no legally marketed predicate exists, and a granted request creates a new classification. A 510(k) clears a device as substantially equivalent to a predicate; under 21 CFR 807.81(a)(3) a change that could significantly affect safety or effectiveness requires a new notification.
Section 515C of the Federal Food, Drug, and Cosmetic Act, codified at 21 U.S.C. 360e-4 and added on December 29, 2022 by Pub. L. 117-328, allows a cleared or approved predetermined change control plan (PCCP) to absorb planned modifications without a new submission. FDA's final guidance on PCCPs for AI-enabled device software functions, announced at 89 FR 96259 on December 4, 2024, recommends that a plan describe the planned modifications, the methodology to develop, validate and implement them, and an assessment of their impact.
02The Eleven Questions
Each row pairs a diligence question with the FDA record that answers it for an authorized product. The same question is then put to the company under review, against its own record.
| # | Question | FDA record | What the record answers | What it asks of the company |
|---|---|---|---|---|
| 1 | What exactly is authorized, and for whom? | DermaSensor, DEN230008 (granted January 12, 2024) | Use on lesions already judged suspicious, in patients aged 40 and above, by physicians who are not dermatologists, to assist a referral decision; not a screening tool and not a sole diagnostic criterion. | Map every market-sizing line to the indication. Volume outside it is not addressable market. |
| 2 | Does the system decide, or does a clinician read every output? | IDx-DR, DEN180001 (granted April 11, 2018) | The pivotal study supported use to "automatically (without physician assistance)" detect more-than-mild diabetic retinopathy, across 900 enrolled participants at 10 primary care sites. | Confirm whether autonomy appears in the indication or only in marketing; it changes who bears the error and how the service is paid. |
| 3 | What is the output allowed to do? | ContaCT, DEN170073 (granted February 13, 2018) | A "notification-only, parallel workflow tool"; findings are "not for diagnostic use beyond notification." The classification regulation created from it bars the device type from removing cases from a reading queue. | Test whether the roadmap needs a different output, such as marking or diagnosis, and therefore a different submission. |
| 4 | Who can follow through the same door? | BriefCase, K180647 (cleared August 1, 2018) | A different company cleared a triage tool for intracranial hemorrhage under 510(k), naming ContaCT (DEN170073) as its predicate, although ContaCT addressed large vessel occlusion. | Treat a De Novo as a head start, not a moat. Count the 510(k)s already filed against the company's own classification. |
| 5 | Who was studied, and does that match the authorized population? | GI Genius, DEN200055 (granted April 9, 2021) | A randomized trial at three Italian centers with six endoscopists; FDA requested re-analysis limited to 263 low-risk patients, in which adjusted adenoma detection rate was 55.1% versus 42.0%. | Reconcile the headline population with the one FDA relied on, and list the uncertainties FDA recorded. |
| 6 | How wide was the margin on the primary endpoint? | QuantX, DEN170022 (granted July 19, 2017) | Nineteen readers and 111 cases; the improvement in area under the curve was 0.052 (95% CI 0.0022 to 0.1018), and FDA wrote that the study "marginally met the primary endpoint." | Read intervals, not point estimates; a marginal pivotal result constrains label expansion. |
| 7 | What is the benefit per patient, not per specimen? | Paige Prostate, DEN200080 (granted September 21, 2021) | Sensitivity improved in 7.3% of cancer specimens in the reader study, and FDA noted the per-patient benefit "would likely be substantially lower." | Rebuild the value case on the unit a payer buys, usually the patient episode. |
| 8 | Which inputs and instruments was the model validated on? | Sepsis ImmunoScore, DEN230036 (granted April 2, 2024) | Up to 22 inputs from the electronic health record, 12 of them required, each tied in the summary to a named analyzer; not validated in the ICU or labor and delivery. | Compare the validated inputs with the pipeline customers' installed base. Each mismatch is an integration cost or a new study. |
| 9 | What may change without a new submission? | Fibresolve (with PCCP), K252041 (cleared November 7, 2025) | A cleared PCCP covering three modification types: model architecture, new training data and ancillary non-imaging inputs, each with pre-specified testing against the original clearance. | Ask for the PCCP itself. Any planned change outside its stated scope is a future 510(k), with its time and cost. |
| 10 | Does the database flag tell the whole story? | Caption Guidance, DEN190040, then K200755 and K201992 (2020) | The De Novo summary describes a PCCP for future algorithm improvements, and K201992 was filed to modify it, yet each database entry reads "No" in the PCCP field. | Read every summary in the chain; the structured field is not dispositive. |
| 11 | Does the holder of record match the entity being financed? | IDx-DR, K203629 (cleared June 10, 2021) | The De Novo names IDx, LLC of Iowa City; the later 510(k) for the same device, citing DEN180001 as predicate, names Digital Diagnostics, Inc. of Coralville. | Trace each authorization to the legal entity in the capitalization table, with transfer documents. |
03Indication, Autonomy and Output
The indication is the boundary of the business that a regulator has endorsed. The DermaSensor decision summary shows how precisely that boundary is drawn and why. Standalone sensitivity for melanoma was high in participants aged 40 to 79 but relatively lower under age 40 (71.4%) and over 80 (66.7%), and the authorized indication begins at age 40. The same summary reports that, with physician performance interpolated to the device's sensitivity of 95.5%, device specificity was 20.7% against 9.0% for primary care physicians. A device that raises sensitivity at low specificity generates referrals, and its economics depend on who pays for them.
Autonomy is a regulatory fact before it is a product feature. The IDx-DR record states that the pivotal study demonstrated performance "when used to automatically (without physician assistance) detect" more-than-mild diabetic retinopathy, with observed sensitivity of 87.4% and specificity of 89.5%. The same indication ties the device to one camera, the Topcon NW400. A company that calls its product autonomous should point to equivalent language in its own summary; otherwise the claim is marketing, and the liability analysis changes.
Output scope matters as much as accuracy. ContaCT was authorized as a parallel notification tool, and the regulation created from it, the classification regulation for this device type in 21 CFR part 892, states that a device of this type "does not mark, highlight, or direct users' attention to a specific location in the original image" and "does not remove cases from a reading queue." Its evidence was speed: in 44 true-positive cases with a standard-of-care comparison, mean time to specialist notification was 7.32 minutes for the device against 58.72 minutes for standard care. A triage product sells time, so its value case is measured in time.
A De Novo quickly becomes a shared classification. The BriefCase 510(k) summary describes a device that processes head CT for intracranial hemorrhage, names ContaCT as its predicate, and notes that its indications "differ slightly from the predicate." Less than six months separated the two decisions. A first-of-kind authorization buys time and evidence, not exclusivity.
04The Evidence Behind the Claim
Decision summaries report FDA's reading of the evidence, often more cautious than the company's. In the GI Genius file, the original trial's intent-to-treat population was 700 patients, but FDA requested a re-analysis limited to patients at low risk for colorectal cancer, and results are presented only for that group of 263. The summary records that race and ethnicity were not collected and that the effect of more, US-based or differently skilled endoscopists is unknown. Each such sentence is a generalization question the company should already have answered with post-market data.
The QuantX summary is a reminder to read intervals. The primary multi-reader analysis met its endpoint with a lower confidence bound of 0.0022, and a second, trapezoidal estimate of the same difference had a lower bound below zero. A product authorized on a marginal result is legitimate, but its label is hard to widen, and superiority claims in sales material deserve scrutiny against the record.
Paige Prostate illustrates the unit-of-analysis problem. The reader study involved sixteen pathologists, and the 7.3% sensitivity improvement was measured per biopsy specimen. Because a typical patient has multiple cores and cancer often appears in more than one, FDA expected the per-patient benefit to be substantially lower. A value model built on per-specimen figures overstates what a customer buys.
05Inputs, Locks and Change Control
An AI model is only as portable as its validated inputs. The Sepsis ImmunoScore summary lists 22 parameters, assigns each a source panel and a named analyzer, and states that no score is generated if any of twelve required values is missing. Its special controls require sub-group analyses by study site, demographic group and acquisition system. IDx-DR is likewise indicated for one camera, and the Caption Guidance De Novo instructs users not to operate the software with any probe other than the specified Terason transducer. Each binding is a cost of expansion the revenue plan should carry.
Whether the model is locked is answered in the file. The Paige Prostate summary states that software version 2.1.501 "will remain locked" and "will not be continually trained" after authorization. A company that says its model improves continuously in the field should show a PCCP permitting those changes or a sequence of new submissions; otherwise the statement is inaccurate or describes an unauthorized practice.
The Fibresolve record shows the statutory route in practice. The device was first granted under DEN220040 on January 12, 2024, and K252041 then added a PCCP. FDA's clearance letter cites section 515C(b)(1) and 21 CFR 807.81(a)(3), and warns that a deviation from the established plan that significantly affects safety or effectiveness requires a new notification. The plan is narrow: three modification types, each tested against the prior version using the statistical standards of the original clearance. A PCCP is worth what its scope covers of the roadmap.
Caption Guidance shows why the structured field is not enough. Its De Novo summary describes a PCCP under which "Caption Health will make future algorithm improvements," and the K201992 summary states that its purpose was "to address the modification of a predetermined change control plan," with all algorithm modifications "trained, tuned, and locked prior to release" and no provision for continuously learning algorithms. All three database entries in the chain read "No" in the PCCP field. The plan predates section 515C, which may account for the gap, but the lesson for a reviewer is general: open every summary in a device's history rather than filtering on a database field.
06The Holder of Record and the Valuation Consequence
The authorization belongs to a named entity. The IDx-DR De Novo lists IDx, LLC as requester, while the June 2021 510(k) for the same device, with the same indication and the same camera, lists Digital Diagnostics, Inc. as applicant. The record shows the change on its face and nothing more; the corporate history and assignment that connect the two belong in the data room. Likewise, the GI Genius requester of record is Cosmo Artificial Intelligence - AI, Ltd., of Dublin, and any financing that depends on that device should confirm who holds the authorization and on what terms others commercialize it.
The answers translate into underwriting. A narrower indication reduces the addressable market. A marginal or narrowly sourced pivotal study raises the cost of label expansion. Bound inputs raise integration cost per customer. A PCCP that matches the roadmap shortens the path between model versions, and its absence lengthens it. A holder-of-record gap is a closing condition. None of this requires source code or model weights, which is why the public record is the first workstream of healthcare AI diligence, not the last.
07Frequently asked questions
What is AI due diligence for a healthcare company?
It is the review of what a company's AI actually does, on what evidence and under what authority. For a regulated clinical product, the starting point is the FDA marketing authorization: the database entry, the decision or 510(k) summary and the classification regulation, which together state the indication, intended user, validated inputs, clinical evidence and change rules. Data rights, model governance and contracts are then reviewed against that record.
What is a predetermined change control plan?
A PCCP is a plan, reviewed and cleared or approved with a marketing submission, that describes specific future modifications to a device and the methods used to develop, validate and implement them. Under section 515C of the FD&C Act (21 U.S.C. 360e-4), a change consistent with an established plan does not require a new 510(k) or PMA supplement. Changes outside the plan's scope still follow the ordinary rules, including 21 CFR 807.81(a)(3).
Does FDA authorization prove that an AI model will perform in a customer's setting?
No. Authorization reflects performance in the studied population, with the validated inputs and hardware named in the summary. FDA's own summaries often record the uncertainties, such as single-country studies, small reader panels, missing demographic data or per-specimen rather than per-patient benefit. Those passages identify the post-market evidence a buyer or investor should request.
Nothing in this piece is investment, legal, tax or accounting advice, and nothing in it is an offer to sell or a solicitation of an offer to buy any security.
Three decades of operational leadership across agriculture, pharmaceuticals, biotechnology, climate, food and defense. He has spent that career doing the work this seat requires: strategic partnerships, licensing and business development, executed transaction by transaction. He sits with a company as an operating partner and a growth strategist rather than as a name on its board. A corporate finance and intellectual property attorney, an INSEAD MBA, and a former Air Force officer in aerospace. He also brings strong private equity experience.