Monika Ahuja
Themes it raises
FDA questions it names
Q1 · The two-axis risk frameworkQ2 · The spectrum of device activityQ5 · Multi-turn conversations that migrateQ9 · The benchmarking structureQ19 · Postmarket performance evaluationQ21 · Clinicians, institutions and societiesQ24 · Third-party foundation model changesQ26 · Agentic devices
The comment as filed
Docket No. FDA-2026-N-7874
Considerations for the Regulation of Generative AI-Enabled Medical Devices: Discussion Paper and Request for Feedback
Submitted by: Monika Ahuja, healthcare data and AI architect. Individual comment; views are my own.
SUMMARY
The two-axis framework evaluates what a device outputs. It does not yet account for where that output travels after generation, who receives it, or who is accountable once someone acts on it. In deployed settings, that downstream path often determines the risk. I recommend that the Food and Drug Administration (FDA) treat output traceability as a risk dimension and reference existing interoperability standards that already carry most of the needed metadata.
1. ADD OUTPUT TRACEABILITY AND DOWNSTREAM ROUTING AS A RISK DIMENSION (Q1, Q2, Q5)
- The same output changes risk as it moves. A summary that stays with the drafting clinician is non-directive. The same content, aggregated into a score that reaches a service line, quality committee, or board, can direct decisions the original user never saw.
- Recommendation: risk characterization should include intended recipients, intended routing (point of care versus aggregated or administrative use), and whether each recipient can independently verify the output.
- For multi-turn devices (Q5), assess directiveness where the output is consumed, not only where it is generated.
2. EVALUATE THE CONFIGURED SYSTEM, NOT ONLY THE FOUNDATION MODEL (Q9, Q24)
- Users experience prompts, retrieval sources, guardrails, interface, and routing layered on a foundation model. Benchmark results for the base model do not predict the behavior of the configured system.
- Recommendation: direct benchmarking and clinical confirmation at the configured system, and record foundation model identity and version as a component, so third-party model changes (Q24) are detectable at the level of each output.
3. MAKE PROVENANCE MACHINE-READABLE AND INTEROPERABLE (Q19, Q21, Q24)
- Existing standards already supply most of this. Health Level Seven (HL7) International’s AI Transparency on Fast Healthcare Interoperability Resources (FHIR) implementation guide (Standard for Trial Use (STU) 1 ballot) defines the AIAST ("AI asserted") security label at the resource and element level, plus Provenance, Device, and model-card references. Core FHIR Provenance can record author and verifier; AuditEvent can record who accessed a record.
- Recommendation: recognize or reference these standards as a means for manufacturers to label AI-influenced outputs, carry model version and model card, and support sample-based clinician review and degradation monitoring across institutions.
- The implementation guide states it is "not the intent of this project to provide the governance for transparency reporting expectations." A future FDA policy can supply the expectation the standard leaves open.
4. BIND ACCOUNTABILITY TO THE RECORD WITHOUT DIFFUSING MANUFACTURER RESPONSIBILITY (Q21)
- For each AI-influenced output, deploying institutions need to know who received it, who accepted or rejected it, the highest level of the organization it reached, and who owns the impact. Without that, the clinician and institutional roles in postmarket monitoring are hard to operationalize, and accountability blurs.
- Recommendation: manufacturers should enable and document the structural hooks (machine-readable fields and standard metadata, for example a verifier in Provenance) so institutions can bind recipient and acceptance without custom engineering. Accountability for device performance stays with the manufacturer.
5. FOR AGENTIC DEVICES, RETAIN THE PLAN AND INTERMEDIATE STEPS (Q26)
- If only the final output is retained, reviewers cannot see which step failed, which tool was invoked, or where a human could have intervened.
- Recommendation: acceptance criteria for agentic devices should include retention of the plan, steps, tool calls, inputs, and points of human review, linked to the provenance of the final output.
CLOSING
A label shows that AI was involved. It does not show where that influence went or who answers for it. Building output traceability into the risk framework, and anchoring it in existing interoperability standards, would close that gap without inventing a new metadata model. Thank you for the opportunity to comment.