510(k) data quality requirements that clear AI diagnosis devices
The FDA has cleared over 1,000 AI-enabled medical devices, but most 510(k) submissions fail on data quality before they fail on algorithm performance. Understanding exactly what the FDA expects from training and validation datasets is the difference between clearance and a refuse-to-accept letter.
The FDA has authorized over 1,000 AI-enabled medical devices as of October 2024. Most are diagnostic. Most came through the 510(k) pathway. And the single most common deficiency in AI/ML 510(k) submissions is not the algorithm. It is the data.
A 2023 analysis published in Nature Medicine found that only 29% of FDA-cleared AI devices reported demographic subgroup performance in their authorization summaries (2023). That gap is not a documentation oversight. It reflects a systemic failure in how developers assemble, validate, and characterize the datasets they submit.
If your AI-assisted diagnostic tool cannot prove the quality, provenance, and representativeness of its training and validation data, the FDA will not clear it. Here is what that proof actually requires.
The 510(k) pathway for AI diagnostic devices
The 510(k) pathway requires a developer to demonstrate that a new device is substantially equivalent to a legally marketed predicate device. For AI-assisted diagnostic software, this means proving the algorithm performs at least as well as the predicate across the same intended use population.
The FDA's guidance on Clinical Decision Support Software (2022) and its framework for AI/ML-Based Software as a Medical Device (updated 2024) make clear that substantial equivalence is not just about output accuracy. It extends to how the data behind the output was sourced, labeled, curated, and tested.
This matters because an AI model can show excellent aggregate sensitivity and specificity while hiding catastrophic failures in subpopulations that were underrepresented in training. The FDA knows this. Its review framework now treats data quality documentation as a first-order requirement, not an appendix.
What the FDA means by data quality in 510(k) submissions
| Value (% of submissions reviewed for this dimension (est.)) | |
|---|---|
| Relevance to intended use | 95 |
| Representativeness | 85 |
| Label accuracy | 90 |
| Completeness | 80 |
| Provenance | 75 |
| Timeliness | 70 |
The FDA does not use the term "data quality" loosely. Its guidance on the Predetermined Change Control Plan (PCCP) (2023) and the broader Good Machine Learning Practice principles (2021, jointly with Health Canada and the UK MHRA) define data quality across multiple dimensions.
These include:
These dimensions map closely to what health data trust scoring quantifies. The FDA does not use the term "trust score," but the requirements it enforces are functionally identical to what a scored data governance framework would produce.
Training data requirements the FDA actually enforces
| Value (%) | |
|---|---|
| Reported subgroup performance | 29 |
| Reported race/ethnicity data | 17 |
| No demographic breakdown | 54 |
The FDA expects a 510(k) submission for an AI diagnostic device to include a detailed description of training data. The De Novo classification request for IDx-DR (2018), the first FDA-authorized autonomous AI diagnostic, set a precedent that subsequent submissions have followed.
Key requirements include:
Dataset size and source disclosure. The FDA expects developers to report the number of cases, the institutions from which data was collected, and the time period of collection. A submission that says "trained on 50,000 retinal images" without specifying where those images came from, under what IRB protocol, and from what patient demographics will draw a deficiency letter.
Reference standard documentation. For diagnostic AI, the FDA requires that ground truth labels be established by a clearly defined reference standard. In radiology AI, this often means adjudication by multiple board-certified radiologists. In pathology, it means biopsy-confirmed diagnoses. The FDA's guidance on Computer-Assisted Detection Devices (2012, still active) specifies that truth panels must be independent of the development team.
Subgroup performance reporting. The FDA's action plan for AI/ML-based SaMD (2021) calls for performance reporting stratified by age, sex, race, ethnicity, and disease severity. A 2024 study in The Lancet Digital Health found that only 17% of AI devices reported performance data disaggregated by race or ethnicity00116-8/fulltext) (2024). The gap between what the FDA expects and what developers deliver is wide.
Exclusion criteria transparency. If certain records were removed from training or validation datasets, the FDA expects developers to explain why. Removing edge cases to inflate performance metrics is exactly the kind of data manipulation that post-market surveillance will eventually expose.
Validation data: the FDA treats it differently from training data
The FDA draws a hard line between training data and validation data. Validation datasets must be independent. They cannot overlap with training data. And they must be representative of the intended use population in a way that training data alone cannot guarantee.
The FDA's discussion paper on Transparency for Machine Learning-Enabled Medical Devices (2021) notes that validation should occur on data the algorithm has never seen, collected from sites not represented in training, under conditions that approximate real-world clinical use.
This is where many 510(k) submissions break down. A developer may train on data from three academic medical centers and validate on a held-out subset from the same three centers. The FDA increasingly treats this as insufficient. The agency wants to see multi-site validation, ideally including community hospitals and outpatient settings where image quality, patient acuity, and clinical workflows differ from the academic centers where most AI training data originates.
The PCCP pathway and what it means for data quality over time
The FDA's Predetermined Change Control Plan guidance (final, 2023) created a mechanism for AI devices to update their algorithms post-clearance without filing a new 510(k) for every change. This is significant because diagnostic AI models degrade over time as clinical practices, patient populations, and imaging equipment evolve.
But PCCP does not reduce data quality requirements. It increases them. A PCCP submission must specify:
This means the data quality burden extends from pre-market into post-market. A device cleared today with a PCCP must maintain ongoing data collection, labeling, and validation infrastructure that meets the same standards as the original submission. Developers who treat clearance as a one-time data exercise will find themselves unable to execute their own change control plans.
Where most AI diagnostic submissions fail on data
Based on publicly available FDA review summaries and De Novo decision summaries (2024), the most common data-related deficiencies fall into predictable categories.
Insufficient demographic representation. A device trained predominantly on data from patients aged 40 to 70 at urban academic centers will not clear if the intended use includes patients outside that demographic. The FDA has flagged this repeatedly in radiology and cardiology AI submissions.
Weak reference standards. Using a single radiologist's read as ground truth, without adjudication or biopsy confirmation, is a deficiency. The FDA expects multi-reader panels or histopathologic confirmation for diagnostic claims.
Data provenance gaps. If the developer cannot trace a training image back to a specific institution, IRB approval, and patient consent, the FDA considers the data unreliable. This is especially problematic for developers who scrape data from public repositories or use datasets with unclear licensing terms.
Temporal mismatch. Training on data collected between 2005 and 2012 and validating on data from the same period does not demonstrate that the device works on images acquired with current-generation equipment. The FDA has begun asking for recency documentation.
Missing failure mode analysis. The FDA expects developers to characterize not just where the algorithm succeeds but where it fails. If the submission does not include analysis of false positives, false negatives, and edge cases, it signals that the developer has not fully characterized the relationship between data quality and algorithm performance.
The connection between data trust and regulatory clearance
Every data quality dimension the FDA evaluates maps to a scoreable, auditable property of a health record. Provenance is traceable. Consent is documentable. Recency is timestamped. Completeness is measurable. Concordance across sources is verifiable.
The problem is that most developers do not score these dimensions before they train. They assemble datasets from multiple sources, apply ad hoc cleaning, and discover gaps only when the FDA asks questions they cannot answer. By then, the cost of remediation is measured in months and millions.
A trust-scored dataset, where every record carries a quantified assessment of its provenance, consent status, recency, and quality before it enters a training pipeline, eliminates the most common 510(k) deficiencies at the source. It also creates the audit trail the FDA increasingly expects.
The FDA's 2021 Good Machine Learning Practice principles include "data quality assurance" as principle number four: "Ensure data quality and relevance, including data collection protocols, data management plans, and appropriate characterization of datasets." This is not aspirational language. It is a review criterion.
What the 2025-2026 guidance trajectory signals
The FDA's Digital Health Center of Excellence has signaled through workshops and draft guidance documents that future AI device reviews will require more granular data documentation. The agency's AI/ML glossary (2024) standardizes terminology around training data, validation data, and reference standards, which typically precedes more prescriptive guidance.
Developers preparing 510(k) submissions for 2026 and beyond should expect:
The direction is clear. The FDA is moving from evaluating AI outputs to evaluating AI inputs. Data quality is becoming the primary regulatory surface.
Practical steps for AI diagnostic developers
Developers who want to avoid refuse-to-accept letters and lengthy review cycles should build data trust infrastructure before they build models.
Score every record before training. Assign quantifiable metrics for provenance, consent, recency, completeness, and concordance to every record in your training and validation datasets. If a record scores below your threshold, exclude it and document why.
Maintain chain of custody. Every dataset should carry a documented lineage from source institution through IRB approval, de-identification, labeling, and inclusion in training. The FDA will ask for this. Have the answer ready.
Validate on data you did not train on, from sites you did not train at. Multi-site, temporally distinct validation is the standard the FDA is converging toward. If your validation dataset is a random 20% holdout from the same distribution as training, plan for questions.
Document your failures. A submission that shows where the algorithm fails, and explains the data characteristics associated with those failures, demonstrates the kind of self-awareness the FDA rewards with faster review cycles.
Plan for post-market data quality. If you file a PCCP, you are committing to ongoing data collection and validation. Build the infrastructure for that commitment before you file.
The DTI Engine scores every record 0 to 100 across eight dimensions before your AI model sees it. If your team is building an AI diagnostic device and needs audit-ready data provenance for FDA 510(k) submission, talk to the SuperTruth commercial team. Schedule a conversation or call (215) 918-4140.
Further reading:
Sources
Jason Alan Snyder
Co-founder of SuperTruth and Artists & Robots, and an inventor on the Data Trust Index patents. Twenty-plus years building technology inside Interpublic Group. He writes here nearly every day on data trust, provenance, and what AI should be allowed to act on, and publishes essays on his Substack.
About SuperTruth · LinkedIn · Substack · jasonalansnyder.com
See it in practice
DTI scores the record, not the patient.
8 dimensions. 0 to 100. Travels with every record permanently.