Lukas Block

Attached is a comment addressing Questions 1, 2, 5, 8, 10, 14, 18–21, 24 and 25. Its central points: directiveness should be evaluated as a property of repeated use rather than of a single output; benchmark results and clinician-panel comparators require demonstrated construct validity and a characterized reference-standard reliability before they can support market access; premarket uncertainty should be accepted case by case under existing guidance rather than for GenAI as a class; and the paper needs a defined boundary between purchasing a foundation model as a component and outsourcing the device’s design and development.

Public Comment
Docket No. FDA-2026-N-7874
Considerations for the Regulation of Generative AI-Enabled Medical Devices: Discussion
Paper and Request for Feedback

About the commenter
I am a senior consultant specializing in medical devices, with over ten years of experience
across the total product life cycle, including software as a medical device, AI/ML-enabled device
functions.

I advise medical device manufacturers professionally. I hold no financial interest in any
specific generative AI-enabled medical device, and no interest in the outcome of this
feedback process beyond the general interest of a practitioner in a workable regulatory
framework. This comment is submitted in a personal, expert capacity. The views expressed are
my own and are not submitted on behalf of my employer or of any client.

Scope of this comment
This comment comprises six sections addressing twelve of the consolidated discussion
questions in Appendix B directly, with relevance to five further questions. Each section is
labeled with the question(s) it answers and may be read independently.

• Section 1 — Questions 2 and 5 (relevant to Question 3): directiveness of informational
functions
• Section 2 — Questions 1 and 8: dimensions of, and use of, the two-axis risk framework
• Section 3 — Question 10 (relevant to Question 7): benchmark construct validity
• Section 4 — Question 14, in part: comparator and acceptance-criteria selection
• Section 5 — Questions 18, 19, 20 and 21 (relevant to Questions 22 and 23): postmarket
monitoring and the premarket/postmarket balance
• Section 6 — Questions 24 and 25 (relevant to Question 26): third-party foundation
models
Where a position rests on a hypothesis rather than on established evidence, this is stated
explicitly at the point it is made.

Summary of positions
1. Q2, Q5. Directiveness is not only a property of an individual output but of the interaction
over time; I hypothesize that a user’s discrimination between directiveness levels
degrades across repeated sessions, which no currently described evaluation element
would detect.
2. Q1, Q8. Reversibility of the resulting action and traceability of the output should be
represented as explicit dimensions, and the framework should be bound to a stated
evidentiary consequence if it is to inform the level of premarket evidence. I propose a
mapping.

Docket No. FDA-2026-N-7874 — Page 1
3. Q10. Benchmark performance should not be treated as evidence of clinical competency
absent demonstrated construct validity against the specific intended use; sponsordeveloped benchmarks require independent validation given the direct incentive to
optimize against them.
4. Q14. Any competency threshold should be accompanied by a characterization of the
reference standard’s own reliability, with acceptance criteria expressed relative to that
reliability floor. This extends established CDRH practice rather than creating a new
expectation.
5. Q18–Q21. The postmarket approaches described are largely existing practice, two of
them inherit unresolved defects, and the stakeholder reporting substrate is documented
to be unreliable. Uncertainty-shifting should remain case-level under existing guidance
rather than being answered at the level of a technology class.
6. Q24, Q25. For many GenAI-enabled devices the foundation model developer has
performed design and development rather than supplied a component, and no boundary
between the two is defined. Even on the component classification, all three controls that
make supplier opacity tolerable are absent, and a voluntary disclosure mechanism
cannot restore them.

Docket No. FDA-2026-N-7874 — Page 2
Section 1 — Directiveness of informational functions is a property of
the interaction over time
Answers Question 2 and Question 5; relevant to Question 3.

Position in brief
CDRH’s consideration that directiveness depends on the substance and context of an output —
not solely on words such as “recommend,” “should,” or “consider” — is supported by the
human–AI interaction literature. So is CDRH’s consideration that a “talk to your doctor” or “I am
not a medical professional” statement may not make an action-directing output less directive. I
offer one further point, as a hypothesis: the behavioral distance between the illustrative
directiveness levels may compress as a user accumulates successful interactions with
the function across sessions. If it does, an evaluation that characterizes directiveness at a
single point in an interaction would be structurally unable to detect it.

This is a different mechanism from the one Question 5 raises
The distinction matters, and I state it explicitly to avoid the impression that I am restating a
concern the paper already addresses.

• Question 5 describes a device-side mechanism: the output itself migrates from nondirective to action-directing over the course of a conversation, so that the device’s
behavior is emergent across the exchange. Device-side degradation across a
conversation is documented: a systematic review reports accuracy falling from 82% on
clinical vignettes to 62.7% in multi-turn dialogue [11]. The described benchmarking
elements address this — multi-turn interaction and degradation across long
conversations are both within scope.
• The mechanism I describe is user-side and operates across sessions: the output
may remain at a constant, modest level of directiveness, while the user’s discrimination
between levels degrades through repeated successful exposure. Nothing about the
device changes. What changes is the user.
Because within-conversation drift is already in scope, I do not repeat that point. The gap I am
identifying is cross-session habituation, which no benchmarking element described in the paper
would detect, because each benchmarking interaction begins with a naive user.

The mechanism
The four illustrative outputs — general information, connection of general practice to the user’s
circumstances, endorsement of a specific action, and a specific instruction — are readily
distinguishable on first exposure. As a function is perceived as reliable, the effort a user invests
in verifying each output declines, and the user increasingly extracts only the actionable core
while ceasing to discriminate between a general-information framing and an explicit
endorsement. Two levels that are clearly distinct in a single reading may converge to the same
behavioral signal in sustained use.

Evidence, and where it stops

Docket No. FDA-2026-N-7874 — Page 3
Three strands of literature support the components of this mechanism. I mark clearly where the
evidence ends and the hypothesis begins.

(a) Framing shifts reliance independently of accuracy. Randomized experiments show that
the presentation of AI advice changes user reliance even when the underlying factual content is
held constant, and can shift the distribution of errors without changing aggregate accuracy [4, 5,
6]. Directiveness is therefore a risk-relevant property that aggregate performance metrics will
not reveal. This supports the approach in Question 2: wording, specificity, personalization and
context are appropriate modifiers, and lexical markers alone are not a sufficient basis for
classification.

(b) Static warnings habituate with repetition. A longitudinal study combining functional
imaging, eye-tracking and a three-week field experiment found that adherence to repeated
warnings declined substantially over time; warnings that varied in appearance also declined, but
markedly less [2]. The effect of a static statement observed on first exposure is therefore not a
reliable estimate of its effect in sustained use.

(c) Verification effort governs reliance, and fixed assistance does not sustain user
engagement. Automation bias is associated with the cognitive effort of verification — the lower
the effort to accept, the stronger the effect — and occurs even in single-task settings [1].
Reliance on an advisor perceived as reliable increases over successive decisions [7]. Work on
adaptive decision support further finds that fixed, always-on assistance produces worse
outcomes than assistance that varies, and is associated with reduced independent user
engagement [8]. I note that [8] does not measure longitudinal accumulation of over-reliance
directly; it supports the narrower proposition that invariant assistance is inferior to varied
assistance, which is consistent with, but does not establish, the mechanism I describe.

What the literature does not establish is the specific convergence claim: that the behavioral
distance between the graded directiveness levels erodes with repeated successful exposure.
The framing studies are cross-sectional; the habituation evidence concerns warnings rather
than graded advice. I therefore present this as a testable hypothesis, not a settled finding.

Implication for evaluation
Device benchmarking as described is high-throughput but not inherently longitudinal, and each
benchmarking interaction begins with a user who has no history with the device. A singleexposure evaluation will, by construction, score the four illustrative outputs as distinct, and may
credit a low-directiveness framing as an effective mitigation — while the distinction erodes in
real use. This also bears on Question 3: where a user lacks the domain knowledge to evaluate
an output independently, there is no countervailing mechanism by which the user would reestablish the distinction once it has collapsed.

Recommendations
1. Treat directiveness as a distinct, tested construct within the risk assessment — not
inferable from lexical markers, and not visible in aggregate accuracy metrics (Question
2).

Docket No. FDA-2026-N-7874 — Page 4
2. Do not assume that the effect of a static disclaimer, such as “talk to your doctor” or “I am
not a medical professional,” observed on first exposure persists under repeated
exposure. Credit such statements as risk controls only to the extent that a sustained
effect has been demonstrated, and only where their presence in the output is assured; in
current practice they are frequently absent, with their presence in generative model
outputs having fallen from 26.3% in 2022 to under 1% in 2025 [3] (Question 2).
3. Extend the concern in Question 5 from within-conversation drift to cross-session use.
Evaluation expectations for informational functions should not structurally exclude
repeated-exposure effects; where feasible, favor designs in which the simulated user
has prior exposure to the device, and designs that vary presentation over time.
4. Encourage the corresponding study: a longitudinal design testing whether the behavioral
distance between the illustrative directiveness levels compresses with repeated
successful exposure. Recommendation 3 asks only that evaluation not exclude the
effect by construction; Recommendation 4 asks that the effect itself be tested.

Docket No. FDA-2026-N-7874 — Page 5
Section 2 — Dimensions of the risk framework, and binding it to an
evidentiary consequence
Answers Question 1 and Question 8.

Question 1 — two additional dimensions, and why these two
Of the candidate dimensions identified in Question 1, I support the inclusion of two, and explain
below why I do not propose the other two.

• Reversibility of the resulting action. I anticipate the objection that conventional
severity scales already account for reversibility, in that a permanent injury is scored
above a transient one. That is reversibility of the harm. The dimension I propose is
reversibility of the action — whether the step the user takes in reliance on the output can
be undone before harm occurs. An incorrect output that prompts a titration reviewable at
the next visit and one that prompts an irreversible procedure may map to the same harm
severity while differing entirely in whether a downstream correction is available at all.
This is a property of the action pathway, not of the injury, and it is not captured by
severity.
• Traceability of the output to primary source materials. A traceable output can be
independently verified by a user with the means and motivation to do so; an untraceable
one cannot. Traceability is the practical mechanism by which an incorrect but authenticseeming output may be detected, and it therefore interacts directly with the confabulation
risk the paper identifies and with the user-capability consideration in Question 3.
I do not propose the remaining two candidates as axes of the framework. Availability of
downstream safeguards is properly a risk control rather than a hazard dimension; representing it
as an axis would fold the mitigation into the characterization of the underlying risk and obscure
the residual risk the framework is meant to express. Time pressure of the deployment setting is
an attribute of the use environment rather than of the device function, and is better addressed
within the intended use and use-specification than as a dimension of a device-level framework.

Question 8 — binding position to consequence
Question 8 asks how the framework might be considered within the competency-based
approach to help determine the level of evidence needed for a premarket submission. I take that
question at face value and propose a mapping rather than observing that one is absent. The
value of the framework depends on it: if position informs the level of evidence but no mapping is
stated, two reviewers may place the same function in the same region and still reach different
conclusions about the evidence required, which defeats the stated purpose of supporting
consistent thinking about risk.

The mapping below is offered as a starting point for discussion, not as a settled proposal. It
uses the activity categories and the confirmation approaches described in the paper.

Framework region Indicative clinical confirmation Benchmarking emphasis
tier

Docket No. FDA-2026-N-7874 — Page 6
 Informational, non- Retrospective evaluation Safety and communication
directive; low elements; directiveness
consequence of an characterization
incorrect output

Informational, action- Retrospective evaluation with Adds clinical proficiency and
directing; low to moderate shadow deployment generalizability; repeated-exposure
consequence testing per Section 1

Action-taking under HCP Shadow deployment with clinician Full proficiency and
supervision; moderate adjudication generalizability; subgroup
consequence performance

Action-taking under HCP Standardized interactions and Full set, with adversarial and
supervision; high clinician adjudication; prospective safety-behavior probing
consequence study where the comparator
permits

Fully autonomous action- Prospective study; randomized Full set including agentic capability
taking; any consequence comparison where feasible evaluation
above minimal

A mapping of this kind also constrains the incentive to optimize a function’s characterization
rather than its safety. Where a proxy determines a regulatory outcome, the proxy becomes an
object of optimization — the same dynamic identified in Section 1 in relation to directiveness
labels and in Section 3 in relation to benchmarks. A stated mapping makes the consequence of
a placement explicit and therefore reviewable.

Recommendations
1. Represent reversibility of the resulting action, and traceability of the output, as explicit
dimensions (Question 1). Reversibility of the action is distinct from reversibility of the
harm already captured in severity.
2. State the mapping from framework position to evidentiary consequence, at minimum to
the corresponding tier of clinical confirmation (Question 8), consistent with the analogous
credibility frameworks cited in the paper.
3. State explicitly that the framework is a starting heuristic and not a classification
instrument, to prevent its use as a de facto determinant of risk class in the absence of
validation.

Docket No. FDA-2026-N-7874 — Page 7
Section 3 — Benchmark construct validity and optimization to the test
Answers Question 10; relevant to Question 7.
This section addresses one of two concerns regarding the competency-based approach. The
companion concern, regarding the reliability of the proposed performance comparators, is in
Section 4.

Position in brief
Question 10 asks how a sponsor should establish that benchmark performance predicts safe
and effective real-world behavior, and what role sponsor-developed benchmarks should play
given concerns around independence and optimization to the test. My position: developing a
model to perform well on a test is a different activity from developing a model to fulfil a
clinical intended use, and the divergence between the two is documented rather than
speculative. No amount of care in constructing the test removes it, because the test is a proxy
and the proxy becomes the optimization target.

This is not an argument against benchmarking. Benchmarks are well suited to what they can
demonstrate: knowledge floors, safety-behavior probing such as refusal, prompt-injection and
adversarial testing, regression testing across model versions, and a baseline for postmarket rebenchmarking. My position is that benchmark performance can support a market-access
decision only where (i) construct validity for the specific intended use has been demonstrated,
(ii) the test data are protected against contamination and repeated reuse, and (iii) the
benchmark still discriminates between candidate systems — and that it cannot substitute for
practice-representative clinical confirmation. Condition (ii) has a direct CDRH precedent:
guidance on the clinical performance assessment of computer-assisted detection devices
discourages repeated use of test data, and describes a firewall insulating algorithm developers
from test data, an audit trail of test-data access, a limit on the number of times a case may be
used, and separate reporting of performance on previously used and never-used cases [18].
The recommendations below apply these conditions.

Evidence
• Construct validity is not established. Benchmarks derived from examination content
do not necessarily capture the real-world tasks they are intended to represent, and
analysis against real clinical data reports significant gaps in construct validity [9]. A
systematic review found that only 5% of 761 evaluation studies assessed real patientcare data, and that reporting for 26% of the benchmarks reviewed was too incomplete to
assess their methodological quality [11].
• The optimization dynamic is measurable. Construction of a parallel benchmark
matched in difficulty to an established public set found accuracy drops of up to 8
percentage points on the fresh items, consistent with contamination of the public set
[10]. The domain in that study is grade-school mathematics rather than medicine; I cite it
for the mechanism, which is domain-independent, and not as direct evidence about
medical benchmarks.

Docket No. FDA-2026-N-7874 — Page 8
 • The knowledge–practice gap is measured. A systematic review of 39 benchmarks
reports performance in the range of 84–90% on knowledge-style examination content
against 45–69% on practice-based tasks — for example 45.82% on a difficult publishedcase benchmark and 69.67% on a virtual electronic health record task set [11].
On saturation: examination-style performance in the high-80s to low-90s on licensingexamination content [11] is already close to the ceiling of what such an instrument can
discriminate. A benchmark on which nearly all candidate systems succeed cannot separate safe
from unsafe systems, irrespective of its construct validity.

Why this differs from the human analogue
Clinical credentialing is not a single examination. A licensing examination is followed by
supervised training and continuing professional oversight — peer review, supervision, licensure
consequences — that detects and responds when practice falls short of what the examination
suggested. It is that ongoing layer which keeps the gap between passing a test and practising
safely bounded. The competency-based approach adopts the examination but not the ongoing
layer. The manufacturer-side mechanisms that might fill that role — complaint handling, adverse
event reporting, recall — are triggered by harm that has been detected and reported, operate
more slowly, and rely on a channel with documented under-reporting (Section 5). I flag this gap
as warranting consideration, without taking a position on how it should be closed.

Recommendations
1. Do not treat benchmark performance as evidence of clinical competency absent
demonstrated construct validity against the specific intended use of the device.
2. Where sponsor-developed benchmarks are used, require independent evidence of
construct validity, given the direct incentive to optimize against a test the sponsor also
designs.
3. Weight practice-representative evaluation above knowledge-style benchmarking. The
measured knowledge–practice gap is precisely the region in which a device may pass
the benchmark and fail in use.
4. Treat benchmark saturation as disqualifying for gating purposes: a benchmark that no
longer discriminates between candidate systems provides no evidence relevant to a
market-access decision.

Docket No. FDA-2026-N-7874 — Page 9
Section 4 — Reference-standard reliability and the auditability of
acceptance criteria
Answers Question 14, in part — specifically the definition and justification of the
applicable standard where a clinician panel serves as comparator. I do not address the
generalist/specialist question or human-AI team performance.
This section is the companion to Section 3. Together they address two components of the
competency-based approach: the validity of the test, and the reliability of the standard against
which the test is scored.

Position in brief
Question 14 asks how the applicable standard should be defined and justified — specifically,
the standard of care as against the performance of a median clinician in practice. Both
comparators carry a reliability problem that is measurable but, as described, unmeasured.
Unless that reliability is characterized and reported, an acceptance criterion built on either is not
auditable.

The problem with each comparator
• Panel consensus reflecting the standard of care. A consensus process resolves the
inter-rater variance that would otherwise measure the reliability of the reference. The
more the process smooths toward consensus, the less the resulting reference reflects
the variability of real practice; the less it smooths, the noisier the target. Either way the
variance is a property of the reference that should be reported rather than eliminated.
• The median clinician in practice. This anchors the device to typical performance rather
than to correct performance, and it is only well defined where practice is unimodal. For
genuinely contested decisions — disproportionately the decisions where an incorrect
output carries consequence — there is no meaningful median to measure against.

The auditability point
The reference standard carries its own uncertainty, and that uncertainty sets a limit on what any
comparison against it can show. If qualified clinicians agree with one another on a task only
85% of the time, a reported “92% agreement with the expert panel” does not mean what it
appears to mean: part of any residual disagreement reflects instability in the reference rather
than error by the device, and a high agreement figure may reflect alignment with one resolution
of a contested case rather than correctness. The paper does not specify how the reliability of
the reference should be measured, reported, or reflected in acceptance criteria. Without it, a
claim that a device meets the standard of care cannot be meaningfully interpreted.

This extends existing CDRH practice rather than creating a new expectation
CDRH already treats reference-standard uncertainty as something to be characterized and
carried into the analysis. Its guidance on the clinical performance assessment of computerassisted detection devices expects confidence intervals to account for truth variability alongside
reader and case variability, asks sponsors using multiple clinical truthers to describe how their
interpretations are combined and how inconsistencies between them are accounted for, and

Docket No. FDA-2026-N-7874 — Page 10
identifies an imperfect reference standard as a source of bias [18]. The recommendations below
therefore extend established practice to a new device category rather than introducing a new
expectation.

Recommendations
1. Require that any competency threshold be accompanied by a characterization of the
reference standard’s own reliability — inter-rater agreement measured on the specific
task, reported alongside the device result.
2. Express acceptance criteria relative to that reliability floor rather than as absolute
agreement percentages, so that reported performance cannot claim precision the
comparator does not support.
3. Where the comparator is a contested clinical decision with no unimodal practice pattern,
require justification of why a central-tendency comparator is appropriate at all, or the use
of an alternative basis of evaluation.

Docket No. FDA-2026-N-7874 — Page 11
Section 5 — Postmarket reliance is largely existing practice, not yet
demonstrated to be reliable, and not adequate to carry transferred
uncertainty
Answers Questions 18, 19, 20 and 21; relevant to Questions 22 and 23.

Position in brief
Question 18 asks under what conditions it may be appropriate to accept greater premarket
uncertainty through greater reliance on postmarket monitoring, and what characteristics of a
monitoring program would justify reduced premarket evidence. My position is that those
characteristics are not met by the approaches as currently described, for three independent
reasons, and that the existing device-general framework for accepting premarket uncertainty
already supplies the appropriate discipline for answering the question.

1. The proposed postmarket approaches are largely existing practice (Question 19)
Periodic re-benchmarking and performance degradation monitoring are, in substance, baseline
expectations for any competently deployed AI model, irrespective of regulatory status. I support
both and consider them appropriate. But if the postmarket obligations offered in exchange for
reduced premarket evidence are activities a competent manufacturer would perform in any
event, the exchange contemplated in Question 18 is not a genuine one: a reduction in
premarket evidence would be granted against an increase in postmarket obligation that is
largely nominal.

2. Two of the proposed mechanisms inherit unresolved defects (Questions 19 and
20)
• Sample-based clinician review relies on the same class of comparator addressed in
Section 4 and inherits the same unquantified reference-standard reliability. Relocating
the assessment to the postmarket phase does not resolve it: agreement among the
reviewers remains uncharacterized, and the resulting judgment is no more auditable
than a premarket threshold built on the same basis.
• Machine-based supervisory agents (Question 20) raise a circularity that the question
itself anticipates in referring to the evaluation and reliability of the supervisory agent. A
supervisory agent built on the same class of technology inherits the same constructvalidity limitations, the same susceptibility to drift, and the same confabulation failure
mode as the function it supervises. No independent basis has been offered for placing
greater confidence in the supervisor than in the supervised function. Until the reliability of
the supervisory agent is established independently, such an agent cannot be counted as
additional postmarket assurance.

3. The stakeholder reporting substrate is documented to be unreliable (Question 21)
I raise this specifically in relation to Question 21, and not in relation to the three approaches in
Question 19, which are sponsor-driven and active. Question 21 asks what roles clinicians,
healthcare institutions, professional societies and other stakeholders might appropriately play in
postmarket monitoring, and how those roles might be structured without diffusing manufacturer

Docket No. FDA-2026-N-7874 — Page 12
accountability. Insofar as those roles include reporting, a prior question needs answering:
whether the reporting substrate functions well enough to carry additional weight.

The Agency’s own characterization of its passive surveillance data is that reports may be
incomplete, inaccurate, untimely, unverified or biased, and that incidence cannot be determined
from the system alone owing to under-reporting [12]. Analysis of mandatory reporting has found
that a substantial share of manufacturer reports — from the population legally obliged to report
— miss the reporting deadline, with a further share arriving more than six months late and a
material proportion carrying missing or invalid dates [13]. Voluntary reporters are under no
comparable obligation.

There is a further consideration specific to GenAI-enabled devices. Passive reporting depends
on a user recognizing that something has gone wrong. Where the failure mode is a fluent,
authentic-seeming output that the user lacks the means to evaluate independently — the
confabulation risk the paper identifies, and the user-capability concern in Question 3 — the error
is by construction less likely to be recognized, and therefore less likely to be reported. Underreporting would be expected to be most severe for precisely the failure modes that
matter most. I am aware of no mechanism proposed in the paper, and no basis in the historical
record, on which to expect better stakeholder reporting for GenAI-enabled devices than for the
device population that produced the current surveillance data. Stakeholder roles that depend on
spontaneous reporting are therefore unlikely to provide the assurance that a reduction in
premarket evidence would require.

4. Uncertainty-shifting should remain a case-level determination (Question 18)
I do not accept as a premise that premarket controls are inadequate for GenAI-enabled devices.
The default remains that a device demonstrates a reasonable assurance of safety and
effectiveness before market access, as for any other device.

The Agency already has a device-general mechanism for this trade. Existing guidance
describes when it may be appropriate to accept greater premarket uncertainty balanced by
postmarket controls, and how data collection may be shifted from the premarket to the
postmarket setting while still meeting the statutory standard [14, 15]. That mechanism is
conditional and bounded: it is applied in specifically justified circumstances, decided case by
case on the totality of valid scientific evidence, and paired with defined postmarket obligations,
transparency and accountability.

Question 18 asks under what conditions such an approach might be appropriate, which is not in
itself a categorical proposal. My concern is that the question as framed invites an answer at
the level of a technology class, and the answer should remain at the level of the
individual device under the existing guidance. A class-level answer would treat the reason a
device is difficult to evaluate — continuous change, and limited visibility into third-party
components — as the justification for tolerating the resulting uncertainty, rather than as a
reason for closer scrutiny. It would also place GenAI-enabled devices on a more permissive
footing than devices addressing unmet needs in small populations, for which the existing
conditional mechanism was designed.

Docket No. FDA-2026-N-7874 — Page 13
I therefore propose that uncertainty-shifting retain its existing structure:

1. The manufacturer demonstrates — rather than asserts — that appropriate premarket
controls leave residual uncertainty regarding the device’s safety and performance that
cannot reasonably be resolved before market access.
2. Only where that is demonstrated may a targeted uncertainty-reduction plan using market
data be invoked.
3. That plan, including its endpoints, data sources, analysis methods and decision criteria,
forms part of the initial submission and is authorized in advance. Consistent with point 3
above, the plan specifies active data collection; it may not rely on spontaneous
stakeholder reporting as its primary evidence source.

Note on predetermined change control plans (Questions 22 and 23)
A pre-authorized, bounded change-control plan reviewed at the time of submission is the
appropriate mechanism for the plan described above, and I support its use in that role. I note for
completeness that the predetermined change control plan mechanism is established in statute
and is not specific to artificial intelligence, and that it does not exempt changes from review: the
plan itself, including the modifications, the methodology and the impact assessment, is reviewed
and authorized in advance, and changes outside the authorized envelope continue to require a
new submission [16]. The general, cross-device-type guidance on predetermined change
control plans remains in draft [17]. I recommend that it be finalized, so that AI-enabled devices
do not operate on a comparatively more permissive footing merely as a consequence of the
order in which guidance documents were finalized.

Summary
The postmarket reliance contemplated in Question 18 is, as presently described, largely not
new (point 1), not yet demonstrated to be reliable (points 2 and 3), and not adequate to carry
the residual uncertainty that would be transferred to the deployed population (point 4). I
recommend that the existing conditional framework be applied to GenAI-enabled devices case
by case, rather than a class-level alternative.

Docket No. FDA-2026-N-7874 — Page 14
Section 6 — Foundation models: component classification and the
boundary with outsourced design
Answers Questions 24 and 25; relevant to Question 26.

Position in brief
Question 24 asks how a manufacturer can detect, evaluate and respond to changes initiated by
a third-party foundation model developer, and what contractual, technical or change-control
mechanisms could provide reasonable assurance. The question presupposes that the
foundation model is a purchased component. I submit that this classification is itself the issue
requiring attention: for many GenAI-enabled devices the foundation model developer has
performed the design and development of the device’s core clinical-reasoning capability,
which is an outsourced design activity rather than a component purchase — and no
boundary between the two is defined.

Why the classification matters
The two classifications carry different obligations. A supplier of components to a finished device
manufacturer is not itself subject to the finished-device requirements; the manufacturer
compensates through purchasing controls. Outsourced processes are treated differently: under
the quality management system standard now forming the FDA baseline, an organization that
outsources a process affecting product conformity retains responsibility for the conformity of that
process and must ensure control over it.

Where a device’s clinical behavior is overwhelmingly determined by the foundation model, and
the manufacturer’s own design contribution consists of scaffolding, retrieval, guardrails and user
interface built on top of that capability, the design records document the wrapper while the
determinative design activity sits outside them. Had the same capability been developed inhouse, or by a controlled design subcontractor, the full design and development obligations
would attach. Classifying it as a component obtains the design contribution while those
obligations do not apply.

This concern is graded, and I state the gradation explicitly: it is acute for devices in which the
model determines most of the clinical behavior — including the agentic devices addressed in
Question 26, where autonomous multi-step action and tool use further increase the model’s
determinative role — and it is weaker for devices in which the model performs a narrow,
bounded function and the manufacturer’s own design work is the substantive part of the device.
The absence of any defined threshold between these cases is the gap I am identifying.

Even on the component classification, the compensating controls are absent
(Question 24)
Off-the-shelf software is routinely and appropriately incorporated into medical devices without
the supplier being subject to device requirements, and FDA guidance addresses how
manufacturers are expected to handle such software. This is acceptable because three
compensating controls substitute for direct oversight of the supplier:

Docket No. FDA-2026-N-7874 — Page 15
 1. Change notification — an agreement under which the supplier notifies the manufacturer
of changes to the product, so that the manufacturer can determine whether the change
affects the finished device.
2. Verifiability — the component’s behavior can be established by testing against specified
requirements.
3. Configuration control — the manufacturer can identify and qualify a specific version, and
re-qualify before adopting a new one.
A third-party foundation model accessed as a service removes all three simultaneously. Change
notification is absent, and the paper itself observes that model developers may have limited
incentive to disclose safety-relevant information. Verification is undermined by opacity and nondeterminism: testing establishes a snapshot that a subsequent undisclosed update may
invalidate, and the effect of such an update cannot be determined analytically. Configuration
control is absent where the model is updated server-side, outside the manufacturer’s
configuration management — a model identified only by a service endpoint cannot satisfy the
software-of-unknown-provenance configuration identification expectations of the recognized
software life cycle standard, which require the item to be identified by title, manufacturer and
unique version. It is not the opacity of the supplier that is without precedent — that is ordinary
for off-the-shelf software. It is the simultaneous removal of all three controls that make supplier
opacity tolerable.

From a quality management standpoint the situation is otherwise unambiguous: a supplier has
changed a critical component of the device, without notice, in a manner whose effects cannot be
determined analytically. Verification is required to re-establish conformity before continued use.

On voluntary Foundation Model Master Files (Question 25)
A voluntary Foundation Model MAF would address the first of the three controls above —
visibility of the model and, potentially, of changes to it. It does not address verifiability or
configuration control. More fundamentally, a voluntary disclosure mechanism cannot substitute
for a binding change-notification obligation, and Question 25 identifies the reason directly:
model developers may have limited incentive to disclose safety-relevant information. A
mechanism whose usefulness depends on voluntary participation by a party with a disclosed
incentive not to participate is unlikely to provide a dependable basis for premarket review.

An alternative mechanism: the binding route taken in another jurisdiction (Question
25)
Question 25 asks whether there are alternative mechanisms CDRH should consider for
obtaining information about underlying foundation models. I note that the European Union has
addressed the same structural problem by making the disclosure binding rather than voluntary:
the AI Act requires written agreements between providers and third parties supplying
components used in high-risk AI systems, specifying the information and assistance needed for
compliance, and imposes documentation obligations on providers of general-purpose AI models
toward downstream providers who integrate them. I do not suggest that CDRH adopt that
instrument. I note only that a major jurisdiction, facing the same asymmetry of information and

Docket No. FDA-2026-N-7874 — Page 16
incentive, concluded that a binding obligation on the model provider was necessary, and that a
voluntary US mechanism would place manufacturers subject to both regimes in the position of
obtaining by contract in one market what is obtained by regulation in the other.

An unresolved decision under misaligned incentives
Where an undisclosed third-party model change is detected, the manufacturer faces a decision
between restricting availability of the device until re-verification is complete, and maintaining
availability while verification proceeds. The first carries the harm of withdrawing a beneficial
device; the second carries the harm of continued exposure to a device whose critical
component has changed with unknown effect. These are not commensurable, and I note that
the paper accepts non-commensurability in an analogous context in Question 6. I observe that
this decision currently sits with the party whose commercial interest favors continued availability,
and that no predefined basis for making it is proposed. A response protocol agreed in advance
— before any change occurs — would at least remove the decision from the moment of
commercial pressure. I flag this as a matter warranting consideration, without taking a position
on the mechanism.

Recommendations
1. Define where component sourcing ends and outsourced design and development begins
for devices built on third-party foundation models. Absent that boundary, the design
activity most determinative of the device’s clinical behavior may fall outside design
controls by virtue of its classification.
2. Where the foundation model is determinative of clinical behavior, require that the
corresponding design and development obligations attach, irrespective of whether the
capability was developed in-house, by a controlled subcontractor, or obtained as a
service.
3. Do not rely on a voluntary disclosure mechanism as the principal means of addressing
third-party model change (Question 25). Where a foundation model is a critical
component, a binding change-notification obligation and a predefined response protocol
are the controls the situation requires.

Docket No. FDA-2026-N-7874 — Page 17
References
1. Lyell, D., & Coiera, E. (2017). Automation bias and verification complexity: a systematic
review. Journal of the American Medical Informatics Association, 24(2), 423–431. [link]
2. Vance, A., Jenkins, J. L., Anderson, B. B., Bjornn, D. K., & Kirwan, C. B. (2018). Tuning Out
Security Warnings: A Longitudinal Examination of Habituation Through fMRI, Eye Tracking,
and Field Experiments. MIS Quarterly, 42(2), 355–380. [link]
3. Sharma, S., Alaa, A. M., & Daneshjou, R. (2025). A longitudinal analysis of declining medical
safety messaging in generative AI models. npj Digital Medicine, 8:592. [link]
4. Scharowski, N., et al. (2023). Exploring the effects of human-centered AI explanations on
trust and reliance. Frontiers in Computer Science, 5. [link]
5. Strunk, J., Nissen, A., & Smolnik, S. (2025). The Effect of Framing AI Characteristics on Trust
and Reliance. ICIS 2025 Proceedings. [link]
6. Schemmer, M., Kühl, N., Benz, C., Bartos, A., & Satzger, G. (2023). Appropriate Reliance on
AI Advice: Conceptualization and the Effect of Explanations. ACM IUI ’23. [link]
7. Leffrang, D., Bösch, K., & Müller, O. (2023). Do People Recover from Algorithm Aversion? An
Experimental Study. HICSS-56. [link]
8. Buçinca, Z., Swaroop, S., Paluch, A. E., Murphy, S. A., & Gajos, K. Z. (2026). Offline
Reinforcement Learning for Adaptive Support in AI-Assisted Decision-Making. ACM
Transactions on Computer-Human Interaction. doi:10.1145/3815418. [link]
9. Alaa, A., Zack, T., et al. (2025). Medical Large Language Model Benchmarks Should
Prioritize Construct Validity. arXiv:2503.10694. [link]
10. Zhang, H., et al. (2024). A Careful Examination of Large Language Model Performance on
Grade School Arithmetic (GSM1k). Advances in Neural Information Processing Systems 37.
arXiv:2405.00332. [link]
11. Gong, E. J., Bang, C. S., Lee, J. J., & Baik, G. H. (2025). Knowledge-Practice Performance
Gap in Clinical Large Language Models: Systematic Review of 39 Benchmarks. Journal of
Medical Internet Research, 27:e84120. [link]
12. U.S. Food and Drug Administration. openFDA — Device Adverse Event Reports (MAUDE):
data caveats and limitations. [link]
13. Everhart, A. O., et al. (2025). Timeliness and completeness of medical device adverse event
reporting to the US Food and Drug Administration. BMJ. [link]
14. U.S. Food and Drug Administration (2019). Consideration of Uncertainty in Making BenefitRisk Determinations in Medical Device Premarket Approvals, De Novo Classifications, and
Humanitarian Device Exemptions — Guidance for Industry and FDA Staff. [link]
15. U.S. Food and Drug Administration (2015). Balancing Premarket and Postmarket Data
Collection for Devices Subject to Premarket Approval — Guidance for Industry and Food
and Drug Administration Staff. [link]
16. Section 515C of the Federal Food, Drug, and Cosmetic Act (Predetermined Change Control
Plans for Devices), as added by the Food and Drug Omnibus Reform Act of 2022. [link]

Docket No. FDA-2026-N-7874 — Page 18
17. U.S. Food and Drug Administration (2024). Predetermined Change Control Plans for
Medical Devices — Draft Guidance for Industry and Food and Drug Administration Staff.
[link]
18. U.S. Food and Drug Administration. Clinical Performance Assessment: Considerations for
Computer-Assisted Detection Devices Applied to Radiology Images and Radiology Device
Data in Premarket Notification (510(k)) Submissions — Guidance for Industry and Food and
Drug Administration Staff. [link]

Docket No. FDA-2026-N-7874 — Page 19