An FDA Warning Letter Says a New AI Model or a Move to the Web Can Require a New 510(k). Ask Your Vendors What Changed.
In a Sept. 1 warning letter, the Food and Drug Administration said a new machine-learning model, a move to a web platform and a platform migration each required a new 510(k) for a CT vertebral fracture tool. Practices should ask whether each vendor update still matches its clearance.
A software update from an artificial intelligence vendor can be a regulatory event. A Food and Drug Administration warning letter dated Sept. 1 makes that point about one product, a tool that assesses vertebral fractures on CT scans.
The agency's Center for Devices and Radiological Health told O.N. Diagnostics that version 3.0.0 of its VirtuOst VFA software is adulterated and misbranded, according to an Oct. 9 analysis by the law firm Orrick. AuntMinnie reported the letter on Oct. 7. We could not find the letter itself on FDA's website, so the details below come from those two accounts.
What the letter says
VirtuOst VFA was cleared under 510(k) K171435, which FDA's database shows was decided on Aug. 3, 2018. After a March 2026 inspection, FDA concluded that version 3.0.0 went beyond that clearance. Orrick said the agency cited sections 501(f)(1)(B) and 502(o) of the Federal Food, Drug, and Cosmetic Act and the 510(k) rule at 21 C.F.R. 807.81(a)(3)(i).
AuntMinnie reported that FDA asked the company to stop commercial distribution of version 3.0.0 until it addresses the issues in the letter. Orrick said the letter also cites violations of the Quality Management System Regulation, including corrective action and supplier controls, and of Medical Device Reporting requirements.
Three changes, each on its own
Orrick wrote that FDA cited three changes that each independently required a new 510(k). The first was a new machine-learning model for vertebral landmarking. FDA reasoned that a model trained on different data, built on a different architecture or optimized for a different objective may perform differently across patient populations, imaging equipment and clinical settings, and said the change "fundamentally changes how the device performs, fails, and affects patients." The agency warned that inadequate validation could lead to missed or delayed diagnoses and overreliance on the software's output.
The second was the move from a desktop application to a web platform, which Orrick said introduced network-exposed attack surfaces and authentication risks; the company acknowledged during the inspection that it expanded its "cyberattack surface area." The third was a migration of the underlying technology platform, which required re-verification and re-validation of the whole codebase, including third-party libraries. FDA noted it had not reviewed the product's software bill of materials.
The agency's concern was not whether the update was meant as an improvement. It was whether the marketed software still matched what FDA reviewed.
What the company says
A spokesperson told AuntMinnie that O.N. Diagnostics is completing verification and validation of a revised version "that removes the machine-learning functionality identified in the warning letter" and adds updated cybersecurity controls. The company said VirtuOst VFA remains available for clinical care through its existing in-house service; the accounts do not say which software version that service runs.
Neither account describes patient harm, a recall or evidence that version 3.0.0 performed worse than the cleared version. The obligations fall on the manufacturer, not on the practices that use the product.
What practices should do now
Radiology groups and practices that use AI tools can put the questions to each vendor in writing. Which software version are we using, and which version did FDA clear? Since clearance, has the vendor swapped or retrained a model, or moved the product from local installation to a web or cloud platform? Our checklist for evaluating any AI tool covers the rest of that conversation.
For each such change, ask whether the vendor filed a new 510(k), documented a decision that none was needed, or relies on a predetermined change control plan. Orrick noted that a plan authorized under section 515C of the act allows pre-specified, validated modifications without a new 510(k). For web-hosted tools, also ask for current cybersecurity documentation and a software bill of materials.
Contract renewal or the next vendor review is a reasonable time to ask. Request notice before any release that changes a model or the hosting architecture, so the question is answered before the update reaches your reading room.
Reported, fact-checked and edited by The Script Pad's editorial staff.
This article is for professional education and does not replace clinical judgment. Treatment decisions should be based on the individual patient and current guidelines.
