FDA Classification Decision Tree Checklist

Free Guide · Blue Goat Cyber · Updated 2026

CHECKLIST · 1 PAGE · PROSPECT RESOURCE

FDA Classification Decision Tree (Wellness vs. Device) Validate a 'non-device' classification before FDA does it for you.

Misclassifying a software product as a general wellness tool is one of the most expensive mistakes in early-stage MedTech. Use this to pressure-test your current intended-use statement against the criteria FDA reviewers actually apply.

A. Clinical Decision Support (CDS) triggers Does the software provide a time-critical diagnosis or treatment recommendation? Is the algorithm opaque to the clinician (they cannot independently review the basis for the output)? Does it analyse medical images, waveforms, or genomic data to produce an output? Is it intended to automate a task previously performed by a licensed professional?

B. Wellness vs. disease claims Does any marketing or technical document mention a specific disease (e.g. diabetes, anxiety, PTSD)? Does the product claim to treat, diagnose, mitigate, or cure any condition? Is it intended to be used inside a clinical workflow or integrated with an EHR?

Does it generate alerts that require immediate clinical intervention?

C. Cybersecurity & 524B scope Does the software connect to the internet, a network, or a physical medical device?

Does it use off-the-shelf code that could carry known vulnerabilities?

Could a breach lead to patient harm, even indirectly through data corruption?

How to read it. Multiple 'Yes' answers in any section is a strong signal that the current non-device classification will not survive FDA scrutiny. Section C in particular maps directly to the 'cyber device' definition under Section 524B.

NEXT STEP → Book a 30-minute classification stress-test with a regulatory engineer to review your intended-use statement before submission. Book your discovery call: go.bluegoatcyber.com/meetings/blue-goat-cyber/discovery-session

Page 1 · © Blue Goat Cyber · 250+ FDA submissions, zero rejections, since 2014

---

Talk to us

This guide is part of Blue Goat Cyber's MedTech cybersecurity library. To apply it to your device program, book a 30-minute strategy session - no cost, no obligation. Or browse all guides.