Anchor Point Health Foundation (Lois Sonstegard)

I. The Central Problem: Verified Attestation

We submit these comments on behalf of Anchor Point Health Foundation, a nonprofit focused on the governance architecture of patient care between clinical encounters. The core problem predates generative AI: the absence of a verified attestation layer between AI outputs and the care decisions those outputs influence.

Two federal programs illustrate both failure modes. CMS’s WISeR model demonstrates adjudication without attestation — AI making binding prior authorization determinations with no independent verification, producing documented failures including an 83-day response delay and 5,944 denials in three months (EFF/STAT/Fierce Healthcare, September 2026). The B2F sensing model demonstrates the inverse: pattern recognition producing signals with no governance layer to determine what those signals authorize.

The governance gap is quantified. Clearwater’s 2026 Benchmark found only 8.6% of healthcare organizations can verify their AI inventory. A September 2026 Imprivata report found 72% admit AI tools deploy without IT approval at least occasionally. A framework built on documented governance will produce compliance on paper and risk in practice.

II. Responses to Specific Questions

On the Competency-Based Framework (Q7, 10, 11–12): Physician credentialing works because it combines documented competency with ongoing independent review. The proposed framework includes benchmarking and clinical confirmation but does not specify who conducts that review or under what independence requirements. We recommend an independent review body for AI systems above a defined threshold on the risk grid — analogous to Medicare Advantage independent review organizations, adapted for AI failure modes.

On Postmarket Monitoring (Q18): We recommend caution about lighter premarket packages in exchange for postmarket monitoring until monitoring infrastructure is itself verified. Where 72% of organizations report unauthorized AI deployments and fewer than 9% can verify their inventory, postmarket data will be incomplete at many sites.

On Third-Party Model Changes (Q24): When a foundation model changes and device behavior shifts, the question is not only whether the change was disclosed, but who determined the changed model remained within approved parameters — and whether that determination was independent. We recommend requiring documented adjudication by an independent reviewer before a changed model is treated as approved for continued use.

On LLM-as-Judge (Q10): An LLM adjudicator trained on the same data distribution as the device being evaluated cannot function as an independent reviewer. Independence requires epistemic separation — the adjudicator must identify failure modes the device cannot see. We recommend FDA define independence requirements addressing training data provenance, not only organizational separation.

III. The Accreditation and State Law Layer

AI governance requirements are arriving simultaneously from AAAHC v45 (surveys on/after December 15, 2026), Joint Commission RUAIH certification, California’s thirty AI laws, Alabama SB 63 (October 1), and Colorado’s law (January 1, 2027) — each without a common attestation standard. A federal attestation standard would reduce patchwork compliance burden while strengthening the regulatory framework.

IV. Between-Visit AI Governance

The average patient spends 8,756 hours per year outside clinical settings. AI systems operating here produce outputs requiring human adjudication in environments where no adjudicator has been identified. We recommend FDA require documentation of the accountability structure into which between-visit AI outputs flow, including the named responsible party and their authority to act.

V. Summary of Recommendations

1. Establish attestation infrastructure as a first-order regulatory requirement — documented governance is not verified governance.
2. Require independent review bodies for high-risk AI applications above a defined threshold on the risk grid.
3. Define independence requirements for LLM adjudicators based on training data provenance, not only organizational separation.
4. Condition the premarket/postmarket trade-off on verified monitoring infrastructure.
5. Coordinate with accreditation bodies to establish a common attestation floor.
6. Extend governance requirements to between-visit AI applications, including documentation of accountability structures.

Respectfully submitted,
Lois Sonstegard, PhD
Nursing Educator, St. Catherine University
Founder, Anchor Point Health Foundation
anchorpointhealthfoundation.org
See attached file(s)

COMMENT ON FDA DISCUSSION PAPER
Docket No. FDA-2026-N-7874
Generative Artificial Intelligence-Enabled Medical Devices
Submitted October 8, 2026

Submitted by:
Lois Sonstegard, PhD
Nursing Educator, St. Catherine University
Founder, Anchor Point Health Foundation
anchorpointhealthfoundation.org

I. Introduction and Perspective
We submit these comments on behalf of Lois Sonstegard, PhD, and Anchor Point
Health Foundation, a nonprofit organization focused on the governance architecture of
patient care between clinical encounters. Our work addresses what we have termed the
between-visit governance gap: the 8,756 hours per year the average patient spends
outside the clinical setting, during which no named party holds accountability for their
care trajectory.
We write because the questions raised in this discussion paper are not only relevant to
how the FDA regulates generative AI-enabled medical devices. They surface a
structural problem that predates generative AI and will persist regardless of which
regulatory approach the agency adopts: the absence of a verified attestation layer
between the outputs AI systems produce and the care decisions those outputs
influence.
Two recently documented federal programs illustrate this problem from opposite
directions. CMS's Wasteful and Inappropriate Service Reduction (WISeR) model — an
AI prior authorization pilot operating in six states since January 2026 — demonstrates
adjudication without attestation: an AI system making binding determinations about care
access with no independent verification body, no structured appeals comparable to
Medicare Advantage, and documented failures including an 83-day response delay and
5,944 denials in the first three months (EFF, September 2026; STAT, September 2026;
Fierce Healthcare, September 2026). The B2F (Bridge to F___) sensing model
demonstrates the inverse: clinical sensing without adjudication — pattern recognition
that produces signals with no governance layer to determine what those signals
authorize.
Together, these programs document both failure modes of the same missing
architecture. The FDA discussion paper is an opportunity to name that architecture and
begin building toward it.
II. The Verification Gap Is the Central Problem
The discussion paper's competency-based evaluation framework — benchmarking,
clinical confirmation, postmarket monitoring — is a meaningful step. But it addresses
the evaluation of AI systems at the point of deployment. It does not address whether
governance of those systems, once deployed, can be verified by an independent party.
This distinction matters because the governance gap is now quantified. Clearwater's
2026 Healthcare AI Governance Benchmark found that only 8.6% of healthcare
organizations can verify their AI inventory through automated discovery. A September
2026 Imprivata report found that 72% of respondents admit AI tools are deployed
without IT approval at least occasionally. These are not edge cases. They describe the
operational baseline in which generative AI-enabled medical devices will function.
The implication is direct: a regulatory framework built on documented governance —
policies approved, committees chartered, contracts updated — will produce compliance
on paper and risk in practice. The 91.4% of organizations that cannot verify their AI
inventory will not be able to demonstrate that a generative AI device is operating within
its approved parameters, that outputs are being reviewed as intended, or that
postmarket monitoring data is complete.
We therefore urge the FDA to treat attestation infrastructure — the mechanisms by
which governance can be independently verified — as a first-order regulatory
requirement, not a downstream concern.

III. Responses to Specific Discussion Paper Questions

On the Competency-Based Framework (Questions 7, 10, 11–12)
The competency-based approach is sound in its structure. Physician credentialing
works because it combines documented competency with ongoing independent review.
The framework proposed here includes benchmarking and clinical confirmation but does
not specify who conducts that review, under what independence requirements, or
through what accountability structure.
We recommend the FDA consider requiring an independent review body for AI systems
operating above a defined threshold on the two-axis risk grid (high directiveness or
severe consequence). This body should be structurally analogous to existing
independent review organizations in the Medicare Advantage appeals process, adapted
for AI-specific failure modes. Its function would be to verify that the AI system is
operating within its approved parameters, that output review is occurring as
documented, and that postmarket monitoring data is being collected and acted upon.
Without an independent verification body, the competency framework produces
attestation only from the party with a commercial interest in the device's approval. That
is not attestation — it is disclosure.

On Postmarket Monitoring and Premarket Trade-offs (Question 18)
The discussion paper asks whether FDA should accept greater premarket uncertainty in
exchange for robust postmarket monitoring. We recommend caution about this trade-off
until postmarket monitoring infrastructure is itself verified.
Postmarket monitoring is only as reliable as the systems that collect, transmit, and
review its data. In the current environment — where 72% of organizations report
unauthorized AI deployments and fewer than 9% can verify their AI inventory —
postmarket monitoring data from many sites will be incomplete, inconsistently collected,
or generated by AI systems operating outside their approved configurations.
A lighter premarket package accepted in exchange for robust postmarket monitoring
assumes the monitoring will be robust. That assumption should be verified, not
assumed, before the trade-off is formalized.

On Third-Party Foundation Model Changes (Question 24)
The paper identifies third-party model updates — a vendor changing a cloud-based
model without sponsor awareness — as a change-control problem. We agree this is a
significant risk, and we add a governance dimension the paper does not fully address.
When a foundation model changes and the device's behavior shifts accordingly, the
question is not only whether the change was disclosed. The question is who had the
authority to determine that the changed model remained within the device's approved
parameters — and whether that determination was made by an independent party or by
the vendor with a financial interest in the change.
We recommend that for foundation model changes affecting devices above the risk
threshold, a documented adjudication by an independent reviewer be required before
the changed model is treated as approved for continued use. This is the verification
layer that WISeR lacked and that the competency framework currently does not specify.

On LLM-as-Judge Methodology (Referenced in Q10)
The paper raises whether an independent LLM can adjudicate test sets, noting that
"expert adjudicator independence expectations would still be applicable when the expert
adjudicator is itself an LLM." We support this principle but flag a practical risk.
An LLM adjudicator trained on the same data distribution as the device being evaluated
cannot function as an independent reviewer in any meaningful sense. Independence
requires not only structural separation but epistemic separation — the adjudicator must
be capable of identifying failure modes the device itself cannot see. This is the same
principle that requires human peer reviewers to be external to the institution whose work
they evaluate.
We recommend the FDA define independence requirements for LLM adjudicators that
address training data provenance, not only organizational separation from the device
sponsor.
IV. The Accreditation and State Law Layer Requires Coordination
AI governance for healthcare organizations is arriving simultaneously from multiple
directions: AAAHC v45 standards adding AI governance expectations for surveys on or
after December 15, 2026; the Joint Commission's RUAIH certification pathway;
California's thirty AI laws enacted in the 2026 session; Alabama SB 63 effective October
1; and Colorado's law effective January 1, 2027.
Each of these creates governance requirements without a common attestation
standard. A health system operating across state lines is currently managing a
patchwork of requirements that may conflict, overlap, or create compliance obligations
that crowd out substantive governance work.
The FDA discussion paper is an opportunity to establish what verified governance
requires before this patchwork hardens. A federal attestation standard — specifying
what independent verification means, who can conduct it, and what it must demonstrate
— would both strengthen the regulatory framework for generative AI medical devices
and provide a common floor that reduces patchwork compliance burden for health
systems.
We note that accreditation bodies may reach organizational AI governance before CMS
rulemaking does. If attestation standards arrive through accreditation rather than
regulation, the FDA framework should be designed to recognize and build on those
standards rather than duplicate them.

V. The Between-Visit Governance Gap as a Generative AI Risk
The discussion paper focuses appropriately on AI-enabled medical devices in clinical
settings. We ask the FDA to also consider the governance implications of generative AI
operating in the space between clinical encounters.
The average patient spends approximately 8,756 hours per year outside clinical
settings. AI systems that monitor, advise, or recommend during this period — remote
monitoring platforms, AI-assisted care navigation, generative AI patient communication
tools — operate in an environment with no named accountability structure. There is
typically no identified party with the legal and practical authority to act on AI-generated
signals between visits.
This is not a device design failure. It is a governance architecture failure: AI systems
producing outputs that require human adjudication, operating in a setting where no
adjudicator has been identified or authorized. The competency framework addresses
device performance. It does not address the accountability structure into which device
outputs flow.
We recommend the FDA consider requiring, for AI devices operating in between-visit
settings, documentation of the accountability structure that will receive and act on
device outputs — including the named party, their authority, and the conditions under
which they are expected to act.
VI. Summary of Recommendations
1. Establish attestation infrastructure as a first-order regulatory requirement.
Documented governance is not verified governance. The FDA framework should specify
independent verification requirements, not assume that documentation constitutes
attestation.
2. Require independent review bodies for high-risk AI applications. For devices
operating above a defined threshold on the risk grid, an independent verification body
— structurally analogous to existing independent review organizations — should be
required to verify operational compliance on a defined schedule.
3. Define independence requirements for LLM adjudicators. Independence requires
epistemic separation, not only organizational separation. Training data provenance
should be part of the independence standard.
4. Condition the premarket/postmarket trade-off on verified monitoring infrastructure.
Accept lighter premarket packages only where postmarket monitoring capability has
itself been independently verified.
5. Coordinate with accreditation bodies to establish a common attestation floor. A
federal standard that accreditation requirements can build on is preferable to parallel,
potentially conflicting, frameworks.
6. Extend governance requirements to between-visit AI applications. Require
documentation of the accountability structure into which between-visit AI outputs flow,
including the named responsible party and their authority to act.

We appreciate the agency's commitment to seeking public input before formalizing
policy approaches. The questions raised in this discussion paper are consequential. We
are available to discuss any aspect of these comments at the agency's convenience.

Respectfully submitted,

Lois Sonstegard, PhD
Nursing Educator, St. Catherine University
Founder, Anchor Point Health Foundation
anchorpointhealthfoundation.org
References
Electronic Frontier Foundation. (2026, September). New records reveal problems with
Medicare's AI prior authorization experiment.
https://www.eff.org/deeplinks/2026/09/new-records-reveal-problems-medicares-ai-priorauthorization-experiment
Fierce Healthcare. (2026, September). Delays, tech failures abound in CMS WISeR AI
prior-auth pilot documents. https://www.fiercehealthcare.com/regulatory/delays-techfailures-abound-cms-wiser-ai-prior-auth-pilot-documents-show
Clearwater. (2026). Closing the AI governance gap: 2026 healthcare benchmark
findings. https://clearwatersecurity.com/upcoming-webinars/closing-the-ai-governancegap-2026-healthcare-benchmark-findings-october-22-100-pm-et/
Imprivata. (2026, September 18). Healthcare's agentic AI boom is outpacing security
governance. MedTech Dive. https://www.medtechdive.com/news/healthcares-agenticai-boom-is-outpacing-security-governance-report/830749/
STAT News. (2026, September 15). Medicare's AI prior authorization pilot had a rushed
launch and delayed care. https://www.statnews.com/2026/09/15/medicare-wiser-aiprior-authorization-pilot-rushed-launch-delayed-care/