Is my app a medical device? An FDA decision tree for 2026
TL;DR
Is my app a medical device in 2026? Run each software function through eight questions. Seven come from FDA's Digital Health Policy Navigator, and the eighth picks a premarket pathway. Every function ends in one of four outcomes:
- Not a device: medical purpose absent, or the function sits in a carve-out (admin, wellness, records, data display, qualifying clinician CDS).
- Enforcement discretion: a device FDA does not intend to regulate today, such as patient coaching or simple clinical calculators.
- 510(k): a regulated device with a predicate. The FY2027 fee is $28,653, or $7,163 for a small business.
- De Novo: a novel low to moderate risk device without a predicate, at $191,020, or $47,755 for a small business.
The outcome sets your build cost more than your feature list does.
One app can hold several software functions
FDA does not regulate apps. It regulates software functions. Its Policy for Device Software Functions and Mobile Medical Applications, issued September 28, 2022, says intended use decides device status, and that intended use "may be shown by labeling claims, advertising materials, or oral or written statements" by the manufacturer.
So your App Store description and your sales deck are regulatory evidence. A step counter is wellness. The same step counter marketed to manage heart failure is a device function.
FDA's oversight targets functions that are devices and "whose functionality could pose a risk to a patient's safety if the device were to not function as intended." Run the tree once per function: a meal log and an insulin dose calculator in one app land in different places.
2026 moved two of the lines
On January 6, 2026, FDA issued a new General Wellness: Policy for Low Risk Devices, replacing the 2019 version. In January 2026 FDA also revised its Clinical Decision Support Software guidance.
The Navigator itself was last updated December 14, 2022. Its Steps 3 and 6 point at guidances rewritten since, so the tree below applies the 2026 versions.
How we built this tree
Steps 1 to 7 follow the Navigator question by question, with the 2026 wellness and CDS guidances applied at Steps 3 and 6. Step 8 adds the pathway choice. Fees come from the FY2027 user fee notice, valid October 1, 2026 through September 30, 2027. All FDA pages were read on November 4, 2026.
FDA says the Navigator's result is "not a formal FDA device determination for your product." Neither is ours. Mercury Development sells device software work, so read the estimates as a vendor's view.
The tree at a glance
| Step | Question | Yes means | No means |
|---|---|---|---|
| 1 | Medical purpose? | Go to Step 2 | Not a device |
| 2 | Administrative support for a facility only? | Not a device | Step 3 |
| 3 | General wellness, low risk? | Not a device | Step 4 |
| 4 | Electronic patient record? | Not a device | Step 5 |
| 5 | Only transfers, stores, converts or displays data? | Not a device | Step 6 |
| 6 | Clinician CDS meeting all four criteria? | Not a device | Step 7 |
| 7 | One of FDA's enforcement discretion types? | Enforcement discretion | Regulated device, Step 8 |
| 8 | Predicate device exists? | 510(k) | De Novo, or PMA if high risk |
Step 1: Is there a medical purpose?
Ask whether the function is intended for the diagnosis of a disease or other condition, or for its cure, mitigation, treatment or prevention. Reading about diabetes is not a medical purpose. Flagging possible diabetes from a reading is. No medical purpose, no device.
Step 2: Is it administrative support for a facility?
Billing and claims, appointment schedules, practice and inventory management, population health and business analytics are carved out of the device definition by section 520(o)(1)(A) of the FD&C Act. The carve-out covers running a health care facility, not treating its patients.
Step 3: Is it general wellness?
The 2026 guidance names two kinds of wellness claims. The first relates to "maintaining or encouraging a general state of health or a healthy activity": weight, fitness, sleep, stress, all without naming a disease. The second relates to "helping to reduce the risk or impact of certain chronic diseases or conditions" where healthy lifestyle choices are well understood to matter.
The product must also be low risk. Anything invasive or implanted fails, and a microneedle glucose estimator is FDA's own example of a failure. Noninvasive sensing can stay in wellness when values that mimic clinical ones are validated, as in FDA's wrist-worn blood pressure example. A notification that "evaluation by a healthcare professional may be helpful" is allowed. Naming a disease, calling a reading abnormal or showing a clinical threshold takes you out. Our wearable cost guide prices that line.
Step 4: Is it an electronic patient record?
Software intended to serve as electronic patient records, the way an EHR or a personal health record does, is carved out under section 520(o). If the same function also interprets the record to drive a diagnosis or treatment, keep going.
Step 5: Does it only move or display data?
A function that only transfers, stores, converts formats or displays data and results is not a device. Analysis is the boundary: once the function flags, ranks or interprets readings, keep going to Step 6. Our RPM development guide shows where that line sits in an architecture.
Step 6: Is it clinical decision support for a clinician?
CDS escapes the device definition only if it meets all four criteria in section 520(o)(1)(E), quoted on FDA's Step 6 page:
- It does not acquire, process or analyze a medical image or a signal from an in vitro diagnostic or signal acquisition system.
- It displays, analyzes or prints medical information about a patient.
- It supports or provides recommendations to a health care professional about prevention, diagnosis or treatment.
- It enables that professional to independently review the basis for the recommendations.
Three 2026 details matter. A single recommendation now gets enforcement discretion under Criterion 3 when only one option is clinically appropriate. Software for a critical, time-sensitive decision does not meet Criterion 4. And continuous or near-continuous sampling counts as a signal, which fails Criterion 1. Patient-facing advice fails Criterion 3 by definition and goes to Step 7.
Step 7: Does FDA intend enforcement discretion?
Enforcement discretion means the function may be a device, but FDA does not intend to enforce its requirements at this time. FDA's Step 7 page asks six questions.
Yes to any of these three points to enforcement discretion:
- Coaching or prompting patients to manage a condition in daily life, such as hypertension, diabetes or obesity.
- Helping patients send images, such as skin lesions or wounds, to their clinician.
- Simple calculations routinely used in clinical practice, such as BMI or the Glasgow Coma Scale.
Yes to any of these three makes the function the focus of FDA oversight:
- Connecting to a medical device to control it or analyze its data, such as an insulin pump or a blood pressure cuff.
- Turning a phone into a regulated device with attachments, displays or sensors.
- Patient-specific analysis that outputs a diagnosis, treatment or prevention recommendation.
No to all six also lands on the oversight side.
Step 8: 510(k) or De Novo?
A regulated function needs a premarket route. If a legally marketed predicate exists, file a 510(k) and show substantial equivalence to it. If none exists and general or special controls can assure safety and effectiveness, file a De Novo request. A granted De Novo creates a new classification regulation, and your device becomes a predicate for later 510(k)s. High-risk class III functions go to PMA, at $636,732 in FY2027.
Not sure? A 513(g) request asks FDA for the classification and applicable requirements, at $8,596, or $4,298 for a small business. A Pre-Submission carries no user fee on FDA's fee schedule and gets written feedback within 70 days under FDA's MDUFA goals.
What each outcome changes in your estimate
| Outcome | Premarket fee FY2027 | FDA review goal | What the build adds |
|---|---|---|---|
| Not a device | None | None | Claim review of store copy and marketing |
| Enforcement discretion | None | None | Claim discipline, a watch on guidance changes |
| 510(k) | $28,653, small business $7,163 | 90 FDA Days for 95% | Design controls, software documentation, predicate testing |
| De Novo | $191,020, small business $47,755 | 150 FDA Days for 70% | 510(k) work plus a risk and controls case without a predicate |
Fees are the small line. The large line is documentation. FDA's Content of Premarket Submissions for Device Software Functions asks every submission for a risk management file, requirements, architecture, development practices, testing and unresolved anomalies. Enhanced documentation applies when a software failure could present a probable risk of death or serious injury, and it adds a design specification and full unit and integration test records.
The quality system is part of the bill too. Since February 2, 2026, the Quality Management System Regulation incorporates ISO 13485:2016 by reference. Our IEC 62304 cost guide breaks those lines down, and our companion app guide covers apps tied to cleared hardware.
What our device pipeline shows
Two patterns from our pipeline records, without names.
A device maker with a prescription Class III device in prototyping asked for an iOS and Android companion app over Bluetooth. On regulation, its brief said only that the app had to comply with FDA regulations.
A second buyer, building a controller app for a consumer stimulation device, listed FDA, IEC 62304 and IEC 82304 as constraints. Those constraints pushed delivery into a waterfall, agile, waterfall sequence.
Both arrived with the regulation named and the classification open. That gap is where an estimate goes wrong.
Decide the claim before you write the code
Every outcome in this tree follows from a sentence your marketing team writes. Change the claim and you change the step where the function exits. A sleep app that says "improve your sleep" and one that says "manage insomnia" can share a codebase and still sit on different sides of the line.
Write the intended use statement first, per function, and have regulatory counsel read it. Then scope. Teams that scope first discover the classification in review, where the fix is rebuilding evidence.
Written by Rob Devereaux, Chief Operating Officer at Mercury Development. Rob has run the firm's operations from Hudson, Ohio since 2019 and has over 20 years of operational and financial experience. The pipeline records behind this article's device buyer examples sit in the operations he oversees.
Send us your intended use and we will run the tree
Send the claims you plan to make and a list of your app's functions. We will run each function through the eight steps and return a scoped estimate per outcome, with the regulatory lines kept separate from the build.