Discretion is a policy. Exclusion is a statute.

Two phrases turn up across FDA’s digital-health guidance and read, on a fast skim, like the same idea: a software function “excluded from the definition of a device,” and a product “subject to FDA’s enforcement discretion.” Both mean a company can build and sell the thing without a 510(k), a De Novo, or a quality-system inspection standing in front of it. They do not rest on the same authority, and the difference determines how much notice a company gets before that protection changes.

An exclusion Congress wrote

Section 520(o)(1)(E) of the FD&C Act — added by the 21st Century Cures Act in 2016 — carves certain Clinical Decision Support (CDS) software functions out of the device definition entirely, provided all four of its conditions hold: the software does not analyze medical images, in vitro diagnostic signals, or patterns from a signal acquisition system; it displays, analyzes, or prints medical information; it is meant to support or recommend, not dictate, a decision about prevention, diagnosis, or treatment; and it is built and labeled so a clinician can independently review the basis for its output rather than relying on it outright. FDA’s current CDS guidance, revised January 6, 2026, works entirely inside those four conditions — refining what “independently review” means in practice. It does not, because it cannot, move the line itself. That line is statutory. Changing it takes an act of Congress, the same one that drew it.

A discretion FDA wrote

General Wellness: Policy for Low Risk Devices — also revised January 6, 2026, superseding FDA’s September 2019 version — runs on a different mechanism entirely. A product intended only for general wellness use that presents low risk does not stop being a device under this policy. FDA’s own description of what the guidance does is narrower than an exemption: the agency states it does not intend to examine whether a qualifying product meets the device definition at all, or, if it does, whether it complies with the requirements that would follow — registration, listing, the quality system regulation, adverse event reporting. That is a decision about where FDA points its attention, not a finding about what the product legally is. Nothing in the guidance asks Congress, or anyone else, to agree.

An exclusion is a fact about the statute. Discretion is a fact about the agency’s current intentions — current being the operative word.

The same January revision shows both moving at once

FDA’s CDS guidance did something else worth naming precisely, because it shows the two mechanisms are not mutually exclusive on the same product. Software that fails the fourth 520(o)(1)(E) criterion — it gives a single, specific recommendation rather than information a clinician independently weighs — does not automatically become a regulated device with no further recourse. The January 2026 revision adds a new enforcement-discretion layer for exactly that case: certain single-recommendation CDS tools, meeting FDA’s other non-device criteria, now get the discretion treatment instead. A tool can therefore sit outside FDA’s device definition by statute for one feature and inside it — but currently unenforced — for another, on the same guidance page, under two mechanisms with two different lifespans.

What doesn’t distinguish them

A Federal Register notice announcing either kind of guidance looks identical from the outside: same document type, same “Guidance for Industry and Food and Drug Administration Staff; Availability” title convention, same docket mechanics. FDA Radar’s own Federal Register adapter files any such notice under one category — FDA Guidance — regardless of what the document inside actually changes; the pipeline has no field for “statutory exclusion” versus “enforcement discretion,” because neither the Federal Register nor openFDA structures that distinction as data anywhere a machine can read it. It lives in the guidance’s own prose, paragraph by paragraph, which is exactly why reading the document itself is not optional.

Whether a specific product falls inside the statutory exclusion, inside a discretion policy, or inside neither is a determination for whoever is classifying that product against the guidance text — this is regulatory intelligence and method describing where two mechanisms differ, never regulatory advice about where any specific product lands. What the distinction buys a regulatory team is a more honest question to ask about its own low-risk products: not just “are we covered,” but “covered by a statute, or covered by FDA’s current willingness to look the other way.”