Congress of Neurological Surgeons

See attached file(s)

Congress of Neurological Surgeons Letterhead FDA-2026-N-7874

CONGRESS OF NEUROLOGICAL SURGEONS
September 10, 2026

Submitted electronically via Regulations.gov

Re: Docket No. FDA-2026-N-7874 — Considerations for the Regulation of Generative AIEnabled Medical Devices: Discussion Paper and Request for Feedback

To the Center for Devices and Radiological Health:
As the voice of organized neurosurgery, the Congress of Neurological Surgeons (CNS) appreciates
the opportunity to comment on the Center for Devices and Radiological Health (CDRH) discussion
paper, “Considerations for the Regulation of Generative AI-Enabled Medical Devices: Discussion
Paper and Request for Feedback.” [1] We are a professional medical society dedicated to advancing
neurosurgical education, scientific exchange, and clinical practice. The CNS supports a regulatory
approach that protects patients while facilitating timely access to safe and effective innovation.
Neurosurgeons bring an important perspective to the evaluation of artificial intelligence (AI)-enabled
devices. Our field is one of the most technologically advanced in modern healthcare, and we routinely
are asked to be at the forefront of evaluating novel technologies for the treatment of diseases of the
human nervous system. This perspective is particularly relevant when device outputs inform decisions
about stroke, intracranial hemorrhage, spinal injury, tumors, epilepsy, and other conditions of the
nervous system. We are accustomed to recognizing that technical performance and clinical benefit
are related, but they are not interchangeable, and there is a distinct role for regulators, physicians,
industry, and patients in ensuring that the appropriate technologies are utilized in patient care.
Our comments focus on Section VI and Questions 18–24, with related recommendations addressing
Questions 6, 10, and 16. We recognize that the CDRH paper is intended to solicit discussion, does
not establish regulatory expectations, and does not determine whether additional legal authority would
be needed to implement the approaches under consideration. Our recommendations should be
understood in that context.

Summary of CNS’s position
The Congress of Neurological Surgeons recommends that the US FDA require participation in
a qualified, independently governed postmarket data system for generative AI (GenAI)-enabled
device functions that direct or take clinical action, or when relying on an incorrect output could
have moderate or severe consequences under the discussion paper’s two-axis framework. The
system could use an existing data program, a shared database, or linked data held by multiple
organizations. We further recommend formally studying Informational Non-Directive
technologies and existing non-device CDS systems, currently exempt from FDA regulation,
through similar data systems to better understand their potential risks and benefits.
Existing professional society data programs show how this type of monitoring can work. For
GenAI-enabled devices, a postmarket data system can also bring in expert clinicians to review
GenAI outputs and outcomes. The scope and intensity of monitoring should be proportionate
to the intended use and clinical risk. For these functions, participation in a qualified data
system should be a necessary, but not sufficient, condition for accepting greater premarket
uncertainty which in some cases may require premarket studies including randomized
controlled trials.
These recommendations build on established approaches in neurosurgery, vascular, orthopaedic, and
imaging practice. We believe that following these recommendations would strengthen the evidence
available to FDA, manufacturers, clinicians, and patients by GenAI use to downstream actions and
outcomes. This will ultimately build trust in these new technologies, and enable them to provide greater
benefit if they are proven to do so.

Congress of Neurological Surgeons Page 1 of 10
Congress of Neurological Surgeons Letterhead FDA-2026-N-7874

CNS offers seven specific recommendations: (1) require risk-based participation in a qualified data
system, (2) establish clear qualification criteria, (3) preserve manufacturer accountability, (4) connect
the data system with postmarket monitoring and change control, (5) use shared data to support
independent benchmarking and expert review, (6) assess both under-escalation and over-escalation,
and (7) coordinate FDA and Centers for Medicare & Medicaid Services (CMS) requirements without
relying exclusively on payment policy to sustain surveillance.

I. Strengthen active, outcome-linked post-market surveillance
CNS supports CDRH’s total product life cycle (TPLC) approach. Exhaustive premarket testing of openended GenAI-enabled devices is scientifically rigorous and in some cases may be necessary, but in
many cases is impractical for GenAI and GenAI-enabled devices. The paper identifies a unique role
for postmarket evidence. However, greater reliance on that evidence is justified only when the
necessary monitoring infrastructure is operational, capable of detecting clinically important failures,
connected to a timely response, and appropriately overseen by expert clinicians who are best situated
to assess both model outputs and device outcomes. [1]
Published evidence illustrates limitations of relying on medical device reports alone. Babic and
colleagues examined the Manufacturer and User Facility Device Experience (MAUDE) database for
823 AI/ML-enabled devices cleared between 2010 and 2023. They identified 943 reports, more than
98% of which concerned fewer than five devices. [2] The findings concern ML-enabled devices in
general, and they underscore the difficulty of assessing real-world AI performance through a reporting
system without adequate buy-in from regulators: missingness, vague and misleading information,
inadequate event classification.
Collecting postmarket data on GenAI presents several challenges. A manufacturer may hold device
configuration and inference records, while a healthcare institution holds the related clinical decisions
and patient outcomes. Linking these records is necessary to assess how often the device was used,
when its outputs were accepted or overridden, and whether performance differed by version, site, or
patient subgroup. A shared database or linked data system can support the three approaches in
Section VI.A: periodic re-benchmarking, sample-based clinician review, and performance degradation
monitoring.
The paper’s clinician-competency analogy, while imperfect, also justifies ongoing assessment similar
to the maintenance of certification that we routinely ask of physicians. For devices, independent, ongoing reporting of real-world performance can complement premarket evaluation and FDA oversight,
and be done in a way that does not imply professional licensure or substitution for regulatory
authorization.

II. Build on existing professional society data programs
There is ample precedent for collecting postmarket data through programs administered by
professional societies. These programs can support regulatory oversight and provide access to
clinicians who can review GenAI outputs and outcomes. The same principles can be applied through
a shared database or linked data system. Any new effort should use or connect with existing data
programs when practical, rather than duplicate them.

Transcatheter aortic valve replacement (TAVR)
The 2012 CMS national coverage determination required participation in a prospective, national,
audited data program that consecutively enrolled TAVR patients, accepted all manufactured devices,
and followed patients for at least one year. [4] These design features connected access to treatment
with systematic evidence generation. They also illustrate the importance of specifying the denominator
(total cases performed), follow-up, data quality, and clinical questions that the data program must
address to aid in regulation.

Congress of Neurological Surgeons Page 2 of 10
Congress of Neurological Surgeons Letterhead FDA-2026-N-7874

A comparable approach appears in the 2016 CMS coverage determination for percutaneous left atrial
appendage closure, which specified a prospective, national, audited data program, consecutive
enrollment, and follow-up of at least four years. [5] The Vascular Implant Surveillance and
Interventional Outcomes Network (VISION), developed through the Society for Vascular Surgery
Patient Safety Organization and the Medical Device Epidemiology Network (MDEpiNet), further
demonstrates how clinical data can be linked with Medicare claims to support longer-term device
surveillance. [6]

Orthopedic and Novel AI Efforts (ASSESS-AI)
The FDA-sponsored ICOR program provides another example of collaboration across data
organizations, including distributed approaches that allow participants to retain control of their data.
[7] These experiences support using established clinical infrastructure rather than creating a separate,
duplicative reporting system for every device.
More recently, the American College of Radiology (ACR) has extended postmarket data monitoring to
imaging AI through Assess-AI. ACR describes monitoring of model inputs, versioning, and
concordance with radiology reports, together with site and subgroup comparisons and reporting to
institutional AI governance programs. [8] This is relevant infrastructure for the present discussion.
Linking imaging performance information with downstream neurosurgical decisions, treatment timing,
and outcomes could provide a more complete assessment of clinical impact. Such linkage should be
collaborative and interoperable, rather than organized around duplicative specialty-specific data
collection.

Lessons for GenAI-enabled devices
These precedents demonstrate the value of independent governance, clinically meaningful data, and
durable participation mechanisms enabled by CMS. On the other hand, there are emerging precedents
of existing technologies, currently used as clinical decision support (CDS) without regulatory oversight,
consistently not seeing their real world applications match manufacturer’s claims. [9] A key challenge
moving forwards will be re-examining the non-device CDS exemption’s four-point test. The four-point
test criteria, at best, seem arbitrary as modern chatbots can also seamlessly analyze imaging data
and signals, and are increasingly uninterpretable despite having reasoning streams or being able to
“explain” their thinking.

III. Recommendations

Recommendation 1. Require risk-based participation in a qualified data system
Questions 18, 19, 21, and 22
CNS recommends mandatory participation in a qualified postmarket data system for GenAI-enabled
device functions that are action-directing or action-taking, or that have moderate or severe
consequences if an incorrect output is relied upon. Similarly, we further recommend that Informational
Non-Directive technologies, including non-device CDS that is currently unregulated, should be formally
studied through similar data systems to better understand their potential risks and benefits.
FDA should identify the applicable legal mechanism for each device category, which in most cases
already exists and is employed by FDA in the regulation of existing medical technologies. Potential
mechanisms include post-market surveillance orders under section 522 of the Federal Food, Drug,
and Cosmetic Act where the statutory criteria are met; post-approval study or other approval conditions
for premarket approval devices; and appropriately established special controls for relevant class II
device types. Section 522 and approval-condition authorities have defined scopes and are not
interchangeable. [10] A Predetermined Change Control Plan (PCCP) may incorporate relevant
monitoring and acceptance criteria, but is not equivalent to an independent postmarket data
requirement. [11] Where existing authority is insufficient, FDA should identify that limitation and
engage legislators and other stakeholders on an appropriate implementation approach.

Congress of Neurological Surgeons Page 3 of 10
Congress of Neurological Surgeons Letterhead FDA-2026-N-7874

For devices subject to the proposed requirement, the data system’s core functions should be
operational at commercial launch: data agreements, common data elements, device and version
identification, capture procedures, follow-up plans, and response responsibilities. A commitment to
establish monitoring later should not support a reduction in premarket evidence.
Participation in a data system alone should not universally justify accepting greater premarket
uncertainty. FDA should consider whether important harms can even be detected before they become
widespread, whether corrective action can occur promptly, and whether residual uncertainty is
compatible with a reasonable assurance of safety and effectiveness. For high-consequence functions
with limited opportunity for human intervention or a risk of irreversible harm, post-market monitoring
should not substitute for traditional and necessary premarket clinical evidence including randomized
controlled trials. Any adjustment in evidence requirements should be specific to the device, intended
use, and demonstrated capabilities of its monitoring program. As a specialty that routinely handles
diseases that involve irreversible harm, the CNS welcomes the opportunity to work with the FDA in
establishing guidelines for this.
CNS also recommends distinguishing the duration of a payer’s evidence-development requirement or
regulatory timelines from the continuing need to monitor device safety and effectiveness. Rapid and
frequent changes to a GenAI-enabled device’s model, prompts, retrieval components, guardrails, or
deployment configuration may create continuing evaluation needs. Surveillance should not depend
exclusively on a particular reimbursement policy or regulatory timeline, but be adaptable based upon
underlying design choices with regards to software and model updates.

Recommendation 2. Establish criteria for qualified data systems
Questions 19 and 21
CNS recommends clear qualification criteria informed by established postmarket data programs. [4]
At a minimum, a qualified data system should address the following:
Governance and Independence. Governance should include relevant professional societies, with
documented independence from device manufacturers and foundation model developers.
Governance should include appropriate clinical, patient, methodological, and institutional
perspectives. FDA and CMS participation should be invited where appropriate and permissible.
Industry participation should not confer control over adjudication, publication, or access to identifiable
patient or site data.
Comprehensive capture of evidence. The data system should be designed to capture a core record
for every in-scope encounter in which the device is used at participating sites, including outputs that
are not acted upon. The denominator should also account for failed invocations and no-alert results
where relevant. Completeness should be measurable, and it is advisable to include the gathering of
unstructured records to further enable post-hoc review. Therefore detailed record review and outcome
adjudication should use prespecified, risk-proportionate sampling, provided the sampling frame is
retained and the limitations are reported, but it is advisable that data logging and storage enable posthoc assessments.
Versioning at Inference. Each record should identify the device and deployed version, including
identifiers sufficient to distinguish the underlying model(s), harness(es), relevant prompt(s), and any
other retrieval, guardrail, and orchestration configurations. Secure, versioned configuration references
or hashes may avoid unnecessary duplication of proprietary content. The data system should report
when a component’s identity cannot be reliably established, rather than imply complete traceability.

Congress of Neurological Surgeons Page 4 of 10
Congress of Neurological Surgeons Letterhead FDA-2026-N-7874

Outputs, Actions, and Outcomes. Common data elements should link device outputs to relevant
clinical actions, the timing of those actions, and prespecified patient outcomes. Reference standards
and adjudication procedures (e.g. human review procedures) should match the clinical question.
Follow-up completeness, missing data, and linkage quality should be reported. Outcome associations
should not be interpreted as causal evidence without an appropriate study design.
Subgroup and setting performance. The data system should support evaluation across clinically
relevant demographic and clinical subgroups, healthcare settings, and intended user groups, including
the populations. Reports should include denominators and uncertainty estimates and should
distinguish insufficient evidence from evidence of comparable performance.
Independent audit and qualified review. Published standards should address completeness,
accuracy, timeliness, data provenance, and linkage reliability. Independent audits should occur on a
defined schedule. Automated extraction, interoperable data elements, and federated approaches
should be used where feasible to reduce institutional burden without compromising evaluability. Prespecified qualifications for expert reviewers of GenAI technology are a critical requirement, as many
model outputs and outcomes assessments will require expert review and adjudication.
Transparent reporting. The data system should provide participating sites with timely feedback and
publish aggregate, appropriately de-identified, version-specific findings on a defined cadence. Public
reports should explain sample sizes, follow-up, risk adjustment where appropriate, and material
limitations. Reporting rules should protect privacy and avoid misleading comparisons when a version
has limited exposure.
Privacy and appropriate site protections. Data collection should be limited to what is necessary for
linkage, evaluation, and oversight, with appropriate security and data-use agreements. The governing
framework should distinguish protected patient safety work product held within the data system from
original clinical records and other separately maintained information. [12]
Regulatory access and operational continuity. Governance agreements should provide for timely
FDA access to relevant analyses and supporting data for signal assessment. They should also define
data retention, continuity during transitions between vendors or data systems, and a process for
maintaining monitoring if a participating organization withdraws.

Recommendation 3. Preserve manufacturer accountability and incentives for expert evaluators
Question 21
Similar to existing postmarket data efforts as noted above, there are distinct roles for all stakeholders
that are ensured by the FDA and, in some cases, by CMS. The data system independently measures
and reports performance, FDA exercises regulatory oversight, and the manufacturer remains
responsible for its device and applicable regulatory obligations. CMS participation in such efforts can
further encourage development of and participation in the data system.
Manufacturers remain responsible for required medical device reporting, investigation of signals
identified through the data system, corrective action, and communication with FDA and affected users.
[3] Surveillance plans should specify notification and response timelines according to the potential
severity of a signal. Institutions and clinicians should retain their respective clinical, reporting, and
data-governance responsibilities. The data system should have an independent escalation process so
that urgent concerns do not depend solely on a manufacturer’s willingness to act.

Congress of Neurological Surgeons Page 5 of 10
Congress of Neurological Surgeons Letterhead FDA-2026-N-7874

Funding arrangements should include support for sustainable, independent evaluation. In some cases,
particularly for chatbots, these evaluations will require clinician time and expert resources for manual
review of outputs. Manufacturer contributions may be appropriate, but should not be associated with
obtaining favorable findings or unrestricted access to patient or institution-level data. Fees, conflicts
of interest, and analytical governance must be transparent, and overseen by FDA. The qualification
framework should permit multiple qualified operators, including existing data-program operators and
cross-specialty collaborations, rather than establish an exclusive operator or an unnecessary barrier
for smaller developers and participating practices.

Recommendation 4. Connect data systems with monitoring and change control
Questions 19, 20, 22, 23, and 24
CNS supports all three post-market approaches described in Section VI.A. Periodic re-benchmarking
should include both stable reference sets, which permit comparison over time, and independently
selected contemporary cases, which assess the population actually encountered. Dataset shift is a
major source of concern, as models are static and clinical environments are dynamic. Clinician review
can use a pre-specified sample drawn from the full set of cases captured by the data system, with
appropriate representation of high-consequence presentations and relevant subgroups. Reviewers
should be qualified for the clinical task and independent of the manufacturer and underlying model
developer.
Performance degradation monitoring should evaluate clinically meaningful measures against the premarket baseline and subsequent validated configurations. The plan should specify the routine cadence
and event-based triggers, such as safety signals, material changes in the patient population or
workflow, and changes to the device or its dependencies. Analyses should account for missing
outcomes, changing case mix, and the exposure needed to detect a clinically important deterioration.
Prespecified thresholds should prompt investigation and, where appropriate, notification, additional
testing, restrictions, rollback, or suspension of use. For changes managed through a PCCP, measures
drawn from the data system can support assessment of continued performance. FDA’s PCCP
guidance describes planned modifications, the methodology for their development, validation, and
implementation, and assessment of their impact. [11]
For Question 23, a prespecified performance envelope is a useful monitoring component, not a
substitute for defining the permissible scope of change. The evaluation should consider both the nature
of the modification, its potential clinical impact, and it’s ease of assessment. Stable average
performance could conceal deterioration in a safety-critical task or patient subgroup, or be
undetectable without large sample sizes.
For third-party foundation models, manufacturers should combine contractual notification
commitments with technical controls, such as reliable version identifiers, version pinning where
available, configuration logs, and documented procedures for testing and rollback. Data from the
system can help identify unexpected performance changes and support investigations, but may not
be able to detect all changes, unannounced updates, hidden model revisions, and other vendor-lead
modifications. These limitations should be reflected in the device’s monitoring and suppliermanagement plans.
Machine-based supervisory agents may help scale review, but should themselves be independently
evaluated for the tasks they perform, including against qualified clinician adjudication and relevant
patient outcomes. Concordance with another model alone is insufficient, and studies have shown
notable biases when models assess other models. Machine-based supervisory agents themselves
should be included in the data system using standardized data structures that include versions,
findings, missed signals, and escalation decisions as well as means, datasets, and other approaches
used to validate the supervisory agent itself. Automated review should supplement, rather than
displace, independent clinical assessment of safety-critical concerns.

Congress of Neurological Surgeons Page 6 of 10
Congress of Neurological Surgeons Letterhead FDA-2026-N-7874

Recommendation 5. Support independent benchmarking and adjudication
Questions 10 and 16
A data system involving professional societies can provide a multi-institutional sampling frame for
sequestered evaluation datasets and, uniquely, access to clinically qualified adjudicators. Studies
have shown that model evaluation is dependent upon qualified clinician adjudicators. Benchmark
cases should be selected under prespecified criteria, held apart from model development, versioned,
and refreshed as clinical practice and deployment populations change. Access controls and refresh
policies can reduce contamination and saturation, but do not eliminate these risks or establish
representativeness by themselves.
Sponsors should still demonstrate why the selected benchmark measures the capabilities relevant to
the intended use and how its results relate to clinical performance. A benchmark based on the data
system should describe participating sites, sampling methods, patient representation, adjudication,
and known gaps. A geographically distributed data system should not be presumed nationally
representative without supporting evidence to that effect (e.g. urban vs rural populations).
CNS supports FDA’s exploration of qualified third-party roles, including approaches informed by the
Accreditation Scheme for Conformity Assessment (ASCA) and Medical Device Development Tool
(MDDT) programs. [1] Professional societies and other organizations, including existing data-program
operators, should be eligible where they meet the applicable qualifications and independence criteria.
Society affiliation alone should not establish qualification, and participation should not confer authority
to approve a device.

Recommendation 6. Assess both under-escalation and over-escalation
Question 6 and benchmarking element S.1
CNS agrees that both directions of escalation error should be evaluated and that their consequences
are not necessarily equivalent. Evaluation should use clinically justified, prespecified criteria for when
escalation is warranted, together with downstream actions and outcomes. These criteria should be
established by independent, clinical experts chosen by professional societies based on their
contribution to the relevant literature. Relevant criteria may include missed or delayed treatment,
unnecessary emergency evaluation or procedures, time to appropriate care, and patient harm. Linked
data can support estimation of these measures in a defined population, including cases in which no
alert or escalation occurred. Independent clinical adjudication is important because the action actually
taken is not necessarily the appropriate reference standard. Event rates should be reported separately,
with clinical context and uncertainty, rather than collapsed into an average that could obscure rare but
severe failures.

Recommendation 7. Coordinate FDA and CMS approaches
Question 21
CNS recommends coordination between FDA and CMS on common data elements, qualification of
data systems, and evidence requirements. Where appropriate under CMS’s authorities and the
relevant payment or coverage program, participation in a qualified data system could reinforce
evidence generation and institutional participation. Where both agencies rely on the same data,
aligned requirements should reduce duplicate collection and unnecessary administrative burden.
Payment policy should complement, rather than serve as the sole basis for, continuing safety
surveillance. FDA should identify a legally appropriate mechanism and duration for monitoring each
relevant device category, including how monitoring would continue if a coverage or payment
requirement changes. Participation and funding arrangements should also avoid creating
disproportionate barriers for smaller institutions or limiting patient access to beneficial care.

Congress of Neurological Surgeons Page 7 of 10
Congress of Neurological Surgeons Letterhead FDA-2026-N-7874

IV. A proposed CNS feasibility study
CNS proposes a feasibility study for a neurosurgical AI database and benchmark. The study would
identify common data elements, assess institutional data-access agreements, and determine how
expert clinicians could review AI outputs and safety signals. It should use or connect with existing
neurosurgical data programs and other data sources whenever possible, rather than create a
competing program.
CNS would welcome discussions with FDA’s Digital Health Center of Excellence and MDEpiNet about
governance, data quality, independence, and ways to work with existing MDEpiNet data programs and
other established data systems. The pilot’s feasibility assessment can also investigate data
completeness, linkage accuracy, site burden, follow-up timeliness, and the ability to investigate
actionable safety signals.

Conclusion
CNS supports a risk-based, least burdensome approach that combines appropriate premarket
evaluation with sustained assessment of real-world safety and effectiveness. For the GenAI-enabled
device functions identified in this comment, qualified, independent data systems that connect AI use
with patient outcomes should be a required component of that approach, implemented through legally
appropriate mechanisms and proportionate monitoring requirements.
The central principle is that greater reliance on post-market evidence must be matched by a credible
ability to generate and act on that evidence. Professional societies can contribute clinical
expertise, independent adjudication, and sound data governance without assuming the
manufacturer’s regulatory responsibilities. CNS welcomes continued collaboration with FDA and
other stakeholders to develop this infrastructure in a manner that protects patients, supports
responsible innovation, and strengthens clinical care.
Thank you for considering these comments. Please direct questions to David Berg (dberg@cns.org).

Respectfully submitted,

Martina Stippler
Brian Nahed
Douglas Kondziolka
Eric Karl Oermann

Congress of Neurological Surgeons Page 8 of 10
Congress of Neurological Surgeons Letterhead FDA-2026-N-7874

References
Online sources accessed September 10, 2026. Historical coverage determinations are cited as precedents, not
as statements of current coverage policy.

1. U.S. Food and Drug Administration. Considerations for the Regulation of Generative AI-Enabled Medical
Devices: Discussion Paper and Request for Feedback. August 2026. Docket No. FDA-2026-N-7874.
2. Babic B, Cohen IG, Stern AD, Li Y, Ouellet M. A general framework for governing marketed AI/ML medical
devices. npj Digital Medicine. 2025;8:328. doi:10.1038/s41746-025-01717-9. Source
3. 21 CFR § 803.50. If I am a manufacturer, what reporting requirements apply to me? Source
4. Centers for Medicare & Medicaid Services. National Coverage Determination 20.32: Transcatheter Aortic
Valve Replacement (TAVR). Version 1, effective May 1, 2012. Historical coverage determination. Source
5. Centers for Medicare & Medicaid Services. National Coverage Determination 20.34: Percutaneous Left Atrial
Appendage Closure (LAAC). Version 1, effective February 8, 2016. Source
6. Medical Device Epidemiology Network. Vascular Implant Surveillance and Interventional Outcomes Network
(VISION). Program description. Source
7. Medical Device Epidemiology Network. ICOR program description. Source
8. American College of Radiology. Assess-AI: Algorithm Performance Monitoring. Source
9. Vishwanath, K., Alyakin, A., Ghosh, M. et al. General-purpose large language models outperform specialized
clinical AI tools on medical benchmarks. Nat Med 32, 2405–2409 (2026). https://doi.org/10.1038/s41591026-04431-5
10. 21 CFR § 814.82. Postapproval requirements. Source
11. U.S. Food and Drug Administration. Marketing Submission Recommendations for a Predetermined Change
Control Plan for Artificial Intelligence-Enabled Device Software Functions: Guidance for Industry and Food
and Drug Administration Staff. August 2025. Source
12. 42 CFR §§ 3.20 and 3.206. Definitions; confidentiality of patient safety work product. Source
13. NeuroPoint Alliance. Organizational overview and data programs. Source

Congress of Neurological Surgeons Page 9 of 10
Congress of Neurological Surgeons Letterhead FDA-2026-N-7874

Appendix. Responses keyed to FDA discussion questions
This table maps the recommendations in this comment to the numbered questions in Appendix B of the
discussion paper. Questions not listed are outside the scope of this comment.

FDA question CNS response

6 — Escalation Measure under-escalation and over-escalation separately using prespecified
errors clinical criteria, a complete denominator, and linked actions and outcomes.
Preserve applicable individual-event reporting. Recommendation 6.

10 — Benchmark Use sequestered, versioned, refreshed test sets drawn from the data system,
validity with documented sampling, adjudication, construct validity, and limitations. The
source of the data alone does not establish validity or representativeness.
Recommendation 5.

16 — Independent Make professional societies and other organizations, including existing datathird parties program operators, eligible when they meet transparent competence and
independence criteria; avoid exclusive operators or automatic qualification.
Recommendations 3 and 5.

18 — Premarket An operational qualified data system is necessary, but not sufficient, for reduced
uncertainty premarket evidence within the proposed monitoring scope. High-consequence,
irreversible risks may require stronger premarket clinical confirmation.
Recommendation 1.

19 — Monitoring and Combine re-benchmarking, independent clinician review, and degradation
cadence monitoring using a defined denominator. Prespecify routine cadence, changerelated triggers, safety thresholds, and response procedures.
Recommendations 2 and 4.

20 — Supervisory Independently evaluate supervisory agents, retain auditable version and
agents decision records, assess missed and correlated failures, and maintain human
oversight. Model-to-model agreement alone is insufficient. Recommendation 4.

21 — Stakeholder Societies provide independent measurement and reporting; manufacturers
responsibilities retain regulatory obligations; institutions retain their responsibilities. Use lawful
data protections, appropriate FDA access, and coordinated FDA/CMS
implementation. Recommendations 1–3 and 7.

22 — Evaluation Scale evaluation to the modification’s nature and clinical risk, including safetyafter changes critical tasks and subgroups. Measures from the data system supplement
validation and do not determine authorization by themselves. Recommendation
4.

23 — Uncertain Use a prespecified performance envelope as a monitoring tool, not as
future modifications authorization for unspecified changes. Maintain the boundaries of the authorized
PCCP and applicable change-control requirements. Recommendation 4.

24 — Third-party Combine contractual notification with reliable version identity, configuration
model changes records, testing, and rollback procedures. Signals from the data system support
investigation but do not guarantee detection or establish causation.
Recommendations 2 and 4.

Congress of Neurological Surgeons Page 10 of 10