How to use this checklist
Each row pairs a claim you will hear in a digital health pitch with the evidence that should back it and the primary source that defines the bar. Ask for the document, not a summary. If a company cannot produce it, record the gap plainly rather than inferring it exists.
This is not legal or regulatory advice; consult qualified counsel.
The 10-point claim-to-evidence matrix
| # | Claim | Evidence to request | Source |
|---|---|---|---|
| 1 | “FDA cleared / authorized” | The K or DEN number, matched to the trade name, company and indications in FDA's database | FDA 510(k) database; FDA De Novo database |
| 2 | “Not a device / wellness only” | The written intended-use statement, compared with FDA's wellness and device-software policies | FDA, General Wellness policy; FDA, Policy for Device Software Functions and Mobile Medical Applications |
| 3 | “Our CDS is exempt” | A criterion-by-criterion walk-through against FDA's CDS guidance | FDA, Clinical Decision Support Software guidance |
| 4 | “The AI model is validated” | Verification, analytical and clinical validation (V3) evidence, kept separate | Goldsack JC et al., V3, npj Digit Med 2020;3:55 |
| 5 | “The prediction model performs well” | A TRIPOD+AI-conformant report, including external validation | Collins GS et al. TRIPOD+AI. BMJ 2024;385:e078378. doi:10.1136/bmj-2023-078378 |
| 6 | “Early clinical evaluation is done” | A DECIDE-AI-conformant study report of live clinical use | Vasey B et al., DECIDE-AI, Nat Med 2022 |
| 7 | “Secure / cyber-ready” | SBOM, threat model and the premarket cybersecurity content FDA describes | FDA, Cybersecurity in Medical Devices guidance |
| 8 | “HIPAA compliant” | The security risk analysis, signed BAAs and safeguards mapped to the Security Rule | 45 CFR Part 164 Subpart C (HIPAA Security Rule) |
| 9 | “Certified EHR integration / DSI transparency” | The ONC certification criteria actually certified, including decision-support source attributes | 45 CFR 170.315; HTI-1 final rule (Federal Register, Jan 9, 2024) |
| 10 | “Responsible AI governance” | Documented AI risk management mapped to a named framework | NIST AI RMF 1.0 (NIST AI 100-1) |
What it means for investors
- Verify regulatory status yourself. FDA's databases are public; a K or DEN number that doesn't match the product or indication is a finding.
- Separate the three kinds of validation. Technical verification, analytical validation and clinical validation answer different questions; one does not stand in for another.
- Treat “HIPAA compliant” as a set of documents. The risk analysis and BAAs either exist or they don't.
- Ask which framework governance maps to. A policy that names no framework is hard to test.
Go deeper
Sources (accessed October 27, 2026)
- FDA 510(k) database
- FDA De Novo database
- FDA, General Wellness policy
- FDA, Policy for Device Software Functions and Mobile Medical Applications
- FDA, Clinical Decision Support Software guidance
- Goldsack JC et al., V3, npj Digit Med 2020;3:55
- Collins GS et al. TRIPOD+AI. BMJ 2024;385:e078378. doi:10.1136/bmj-2023-078378 (cited by standard reference)
- Vasey B et al., DECIDE-AI, Nat Med 2022
- FDA, Cybersecurity in Medical Devices guidance
- 45 CFR Part 164 Subpart C (HIPAA Security Rule)
- 45 CFR 170.315
- HTI-1 final rule (Federal Register, Jan 9, 2024)
- NIST AI RMF 1.0 (NIST AI 100-1)
Related resources
Frequently asked questions
How do I check an FDA clearance claim?
Search FDA's 510(k) or De Novo database for the K or DEN number, then match the trade name, company and indications for use to the claim.
Is a wellness product exempt from FDA?
Only if its intended use fits FDA's general wellness policy. Compare the written intended-use statement to the policy; this is not legal advice.
What does an investor-grade AI validation package include?
Separate verification, analytical and clinical validation evidence, a TRIPOD+AI-style report with external validation for prediction models, and a DECIDE-AI-style report for early live use.
Scope it in 30 minutes
Book a scoping call and we'll name the smallest engagement that moves you forward. Most teams start with the fixed-scope Initial Audit.
Book a 30-min scoping callPrefer to write? Send a short note.