Chad Holland

Docket FDA-2026-N-7874. Comment on the discussion paper "Considerations for the Regulation of Generative AI-Enabled Medical Devices", Questions 26, 20 and 10.

I am an independent developer in Oklahoma. I build an open-source research prototype that decides ALLOW, DEFER or REFUSE for an AI agent’s proposed action, and a separate verifier that re-checks each decision (github.com/holland202/sovereign-veritas). It is not a medical device, and I make no clinical claims. My comments are about evaluation methods, drawn from synthetic experiments whose predictions were registered before they were run. The code and outputs are public.

1. Question 26 and Appendix A.1 (agentic devices): evaluate the action boundary, not only the plan.
A.1 lists tool-failure handling and oversight checkpoints. I suggest adding three competencies, each of which failed in my own system while every individual model output was correct:
(a) Safe retry after an unknown outcome. When a tool call’s effect lands but its reply is lost, a naive retry repeats the effect. I measured 2 effects for 1 intended action. Reserving an idempotency key before execution brought this to 1 effect: 0 doubled effects in 330 races between separate processes, while a deliberately broken version doubled 100 of 100.
(b) Effect without a record. An action can succeed while its log entry fails to save (measured: 1 effect, 0 records). An audit trail alone then cannot tell "never ran" from "ran, unrecorded".
(c) Reported versus observed outcome. The device’s report of what it did should be checked against an independent observation of the downstream state, by a component the device does not control. I am designing this test with an outside case author, who is writing the cases before any implementation exists.

2. Question 20 (machine-based supervisory agents): require evidence that the supervisor can fail.
A supervisory agent that has never been shown to flag a known-bad case has not shown that it can. I suggest requiring, for each supervisory check, a planted defect that the check must catch, plus a test that removing the check makes some evaluation case fail. In my verifier, each of 27 checks is switched off in turn and must cause a test to fail. Building this exposed a blind spot in my own tooling: a check whose tests were skipped had looked the same as a check that worked.

3. Question 10 (construct validity of benchmarks): show that the benchmark reaches the product.
This week I applied the same method to two open-source agent-security test suites, as an outside reviewer. In one benchmark, only 69 of 245 tests exercised the product plugged into it. The rest always tested a built-in reference product, including its false-positive test, which a test adapter that flags everything still passed. In one conformance suite, 28 of 54 rejection checks could be removed from its reference verifier and every case still passed. One of them was a proof-of-possession signature check that the suite’s documentation says it covers. Neither finding shows that any product is unsafe. Both show that a passing score can be uninformative in ways the score itself does not reveal. I suggest that sponsor benchmarks report (i) which cases actually exercise the device under test and (ii) for each safety-relevant check, a case the device fails if that check is removed.

4. Question 16 (independent third parties): name the level of independence.
These are different claims: someone else re-runs the sponsor’s tests; someone else writes cases without seeing the implementation; someone else implements the specification from documents alone and compares outputs. I suggest submissions state which level was reached.

Limits: everything above is synthetic, in software, and mostly measured on a Linux container and continuous integration, not on clinical systems. These comments concern evaluation methods only.

Disclosure: AI assistance was used throughout this work, including in drafting this comment (Claude Opus 5.5, by Anthropic). I directed the work, reviewed this comment, and take responsibility for its content.

Chad Holland
Independent developer, Oklahoma
github.com/holland202