.png){kind=logo}
The FDA marked its 120th anniversary this year with an FDA Voices essay by Acting Commissioner Kyle A. Diamantas, "The FDA at 120: A Long, Distinguished History Protecting Americans." The piece lands on a deliberate juxtaposition: 2026 is the nation's 250th year and the FDA's 120th, meaning Americans have relied on the agency for nearly half of the country's existence. For anyone building a medical device, a SaMD product, or an AI-enabled system, this history is more than trivia. Today's regulatory framework is largely a stack of responses to specific failures and identified gaps, and understanding why each layer exists is the best way to anticipate where oversight of emerging technologies is heading. Below is the arc of that history, corrected and consolidated, and what it means for developers now.
From patent medicines to a federal watchdog (1906 to 1938)
The FDA's regulatory role began with the Pure Food and Drugs Act of 1906, which authorized the Bureau of Chemistry, the FDA's immediate predecessor, to act against contaminated, misbranded, and dangerous foods and medicines. The agency did not receive its present name until 1930. The 1906 law targeted the "patent medicine" trade by prohibiting false or misleading statements on product labels, but it had gaps from the start: when the makers of Dr. Johnson's Cancer Cure advertised that they could cure any cancer, the government found the law did not clearly reach therapeutic claims. A 1912 amendment (the Sherley Amendment) fixed that, extending the false-and-misleading standard to therapeutic claims, though it still required the government to prove an intent to defraud, a difficult enforcement burden the 1938 Act later removed. It established the foundation for truthful-promotion enforcement that continues today.
The early agency also proved out the public health playbook still in use. In 1919 and 1920 it traced a series of botulism deaths in New York, Michigan, and Ohio to canned California olives and, working with state and local officials, pulled the product from shelves in what is sometimes described as the first national food recall, decades before a 2011 law gave the FDA mandatory recall authority. In 1929, FDA investigators traced illnesses in the Washington, D.C. area to fruitcakes baked with flour contaminated by arsenic pesticide residue and recovered every loaf.
The limits of the 1906 law were made vivid by the FDA's 1930s traveling exhibit known as the "American Chamber of Horrors," which documented 100 dangerous, deceptive, or worthless products the agency still had no authority to remove from the market, including cosmetics that caused hair loss, blindness, and permanent neurological damage. That public case, combined with the 1937 Elixir Sulfanilamide tragedy that killed more than 100 people, produced the Federal Food, Drug, and Cosmetic Act of 1938. The FD&C Act required evidence of drug safety before marketing, authorized factory inspections, and, for the first time, brought medical devices and cosmetics under federal law.
Building the device framework (1938 to 1976)
Under the 1938 Act, devices were policed only for adulteration and misbranding; there was no premarket review. Two threads pulled the framework forward. The first was the evidence standard: in the early 1960s, FDA medical officer Dr. Frances Oldham Kelsey refused to approve thalidomide despite its wide use abroad, sparing the United States the birth-defect tragedy that followed elsewhere and cementing the principle that marketing claims must be backed by rigorous evidence. The second was technology outrunning the statute: the Radiation Control for Health and Safety Act of 1968 gave the government authority to set performance standards for radiation-emitting electronic products such as X-ray equipment, an early example of device-specific regulation. In 1970 the Cooper Committee, an expert panel reviewing mounting device injuries, recommended a dedicated, risk-based framework for devices rather than treating them like drugs.
Reports of pacemaker failures, followed by congressional hearings on the thousands of injuries associated with the Dalkon Shield intrauterine device, supplied the final push. The Medical Device Amendments of 1976, signed on May 28, 1976, created the system developers still work within: risk-based classification into Class I, II, and III; premarket approval (PMA) for the highest-risk devices; premarket notification (510(k)) based on substantial equivalence; the Investigational Device Exemption for clinical studies; and manufacturing, registration, listing, and adverse event obligations.
Five decades of iteration (1976 to 2026)
Nearly every statute since 1976 has refined that foundation, usually in response to a specific gap:
- 1982: FDA merges its device and radiological health bureaus into the Center for Devices and Radiological Health (CDRH).
- 1990, Safe Medical Devices Act: after the Bjork-Shiley heart valve fractures, Congress adds user-facility adverse event reporting, device tracking, mandatory recall authority for devices, a statutory definition of substantial equivalence, and the Humanitarian Device Exemption.
- 1992, Mammography Quality Standards Act: federal accreditation, certification, inspection, and quality requirements for mammography facilities. Separately, the Medical Device Amendments of 1992 harmonized medical device adverse event reporting standards across manufacturers, user facilities, and distributors.
- 1997, FDAMA: the least burdensome principle, third-party 510(k) review, and the De Novo pathway for novel low-to-moderate-risk devices.
- 2002, MDUFMA: device user fees, oversight of reprocessed single-use devices, and the Office of Combination Products.
- 2007, FDAAA: the mandate for a Unique Device Identification system (implemented by rule starting in 2013) and electronic registration.
- 2012, FDASIA: the direct De Novo pathway and broader international harmonization.
- 2016, 21st Century Cures Act: the Breakthrough Devices Program codified, the Humanitarian Device Exemption cap doubled to 8,000 patients, and certain low-risk software functions carved out of the device definition.
- 2017, FDARA: risk-based inspections, independent classification of accessories, and a real-world evidence pilot for devices.
- 2020, CARES Act: device shortage reporting during public health emergencies.
- 2022, FDORA: cybersecurity requirements for "cyber devices" under section 524B, statutory authority for Predetermined Change Control Plans, remote regulatory assessments, and diversity action plans for certain clinical studies.
- 2026, Quality Management System Regulation: FDA's revised 21 CFR Part 820 became effective on February 2, 2026, incorporating ISO 13485:2016 by reference and aligning FDA's inspection approach with the updated regulation.
The emerging technology chapter: SaMD, AI/ML, and XR
The newest layer of this history is being written for software. FDA has regulated software in and as devices for decades, but the modern era starts with the IMDRF Software as a Medical Device (SaMD) framework, developed from 2013 onward, which FDA adopted as the shared vocabulary for standalone software with a medical purpose. The 21st Century Cures Act then drew the statutory boundary around which software functions are devices at all, and CDRH stood up the Digital Health Center of Excellence in 2020. The Software Precertification pilot ran from 2017 to 2022 and, while it did not become a program, its lessons about organization-level trust and lifecycle oversight visibly shaped what followed.
For AI and machine learning, the pace has quickened: a 2019 discussion paper on regulating adaptive ML-based SaMD, the 2021 AI/ML Action Plan, joint Good Machine Learning Practice principles with Health Canada and the UK's MHRA in 2021, transparency principles in 2024, final guidance on Predetermined Change Control Plans in December 2024 (reissued August 18, 2025), and January 2025 draft guidance on lifecycle management and marketing submissions for AI-enabled device software functions. The FDA's public list of AI-enabled devices contained more than 1,500 authorization entries as of its June 16, 2026 update, the large majority in radiology and nearly all through the 510(k) pathway (FDA notes the list is non-comprehensive and periodically updated). PCCPs are the historically notable move: they allow specified, planned modifications that would otherwise generally require a new marketing submission to be implemented without one, provided each change remains consistent with the FDA-authorized plan. Generative AI is the next frontier, and FDA's Digital Health Advisory Committee devoted its first meeting to exactly that question.
Extended reality is following the same arc. FDA's public list of AR/VR-enabled devices contained 115 authorization entries as of June 16, 2026, spanning surgical planning and navigation, rehabilitation, and behavioral health. The 2021 De Novo authorization of EaseVRx (now RelieVRx), a prescription home-use virtual reality system for chronic low back pain, showed that immersive therapeutics can clear the evidence bar. CDRH runs a dedicated Medical Extended Reality research program to build the evaluation science for issues these devices raise, including cybersickness, human factors in immersive environments, and image quality in head-mounted displays. None of this required an XR statute: classification, De Novo, Breakthrough designation, and special controls absorbed the new technology, exactly as the 1976 framework was designed to do.
What 120 years of history means for developers
Regulation often follows harm. Many layers of the framework, from 1906 to section 524B cybersecurity requirements, were responses to specific, well-documented failures; others, like user fees and international harmonization, addressed efficiency, emerging risks, and gaps in authority. If you want to predict the next requirement, look at where emerging technologies are producing incidents and near-misses today: model drift, biased performance across subgroups, ransomware on connected devices, and opaque AI claims are the patent medicines of this era.
Classification anchors the strategy, but it is not the whole strategy. The Cooper Committee's 1970 insight, that devices need proportionate rather than uniform oversight, still shapes the framework. Regulatory strategy starts with intended use and indications for use, whether the product is a device at all, its classification and product code, and the applicable premarket pathway, with predicate analysis when a 510(k) is the route, whether the product is a scalpel, a segmentation algorithm, or a VR therapeutic.
Novelty has dedicated tools. De Novo classification, Breakthrough Device designation, and PCCPs exist precisely because Congress and FDA kept meeting technologies the existing categories did not fit. They serve different purposes: De Novo is a classification and marketing route for novel low-to-moderate-risk devices, Breakthrough is a voluntary designation layered onto a PMA, 510(k), or De Novo submission, and a PCCP is a change-control mechanism reviewed within a marketing submission. Treated as first-class strategic options, they can improve regulatory efficiency when their eligibility criteria fit the product.
Evidence expectations evolve with technology and risk. Dr. Kelsey's thalidomide decision is the founding story FDA tells about itself, and the essay repeats the lesson: claims must be backed by the best evidence possible. For AI-enabled and XR devices, developers should anticipate risk- and use-specific expectations around dataset representativeness, subgroup performance, transparency to users, human factors, and lifecycle monitoring, balanced against FDA's statutory least burdensome principles.
Lifecycle oversight is the direction of travel. The center of regulatory gravity has moved steadily from the point of market entry to the whole product lifecycle: postmarket surveillance in 1990, UDI in 2007, real-world evidence pilots in 2017, and PCCPs plus cybersecurity update obligations in 2022. Build your quality system and monitoring plan for that reality from day one.
The bigger picture
The anniversary essay closes with FDA's forward priorities: supporting American innovation in medicine and technology, advancing health security against biological and cybersecurity threats and supply chain vulnerabilities, removing barriers that delay access to safe and effective products, and addressing the root causes of chronic disease. Every one of those touches device developers, and the essay's framing ("prepared to move at the speed of science") is consistent with the direction of recent digital health policy. For a deeper look at how the current framework applies to AI products, see our posts on AI/ML device regulation in the US and EU and how to create an FDA Predetermined Change Control Plan.
How Cosm Can Help
Cosm helps medical device, SaMD, and AI/ML companies turn regulatory history into regulatory strategy: classification and pathway analysis, De Novo and 510(k) submissions, Breakthrough designation requests, PCCP development, cybersecurity documentation, and quality systems built for lifecycle oversight. If you are bringing an AI-enabled or XR product to market and want a partner who knows how the framework evolved and where it is going, contact us at info@cosmhq.com or visit cosmhq.com.
Disclaimer - https://www.cosmhq.com/disclaimer
