CROSS Global Research & Strategy (Shakira J. Grant)

See attached file(s)

October 10, 2026

Food and Drug Administration
Center for Devices and Radiological Health
Digital Health Center of Excellence
10903 New Hampshire Avenue
Silver Spring, MD 20993

RE: FDA-2026-N-7874: Considerations for the Regulation of Generative AI-Enabled
Medical Devices: Discussion Paper and Request for Feedback
Submitted electronically via Regulations.gov

To Whom It May Concern:

I am Dr. Shakira J. Grant, founder and CEO of CROSS Global Research & Strategy, LLC
(“CROSS Global”), and I appreciate the opportunity to provide comments on the U.S. Food
and Drug Administration’s (FDA) request for feedback, Considerations for the Regulation of
Generative AI-Enabled Medical Devices: Discussion Paper and Request for Feedback (the
“Discussion Paper”). I am encouraged by the FDA’s commitment to involving broad
stakeholder input in how generative AI (GenAI)-enabled medical devices should be
regulated.

I am a quadruple board-certified U.S. physician whose primary specialties are medical
oncology and hematology. I am also an AI and health policy researcher and the founder
and CEO of CROSS Global, an advisory firm that provides consultative services to health
care organizations and to developers of AI tools, to guide the governance and responsible
AI frameworks used when AI is implemented in health care settings. My practice focuses on
helping companies conduct risk assessments and evaluate proposed tools and products,
offering a clinical lens at the intersection of research and policy.

I am a member of the Coalition for Health AI (CHAI), where I serve on several working
groups and contribute to national frameworks for AI governance, including responsible AI,
across the health care life cycle. I am a published author, and I have provided thought
leadership on evaluating AI-enabled systems for bias and on the strategies needed to
address it. I bring the perspective of a physician with frontline clinical experience, technical
knowledge of AI systems with patient-facing indications, and an AI governance and policy
lens. My comments below are offered from that perspective.

CROSS Global Research & Strategy, LLC 1
Overall Comments
The Discussion Paper lays out a detailed premarket pathway for GenAI-enabled medical
devices to enter the market. That pathway is anchored on a two-axis framework that
positions a device’s activity, or autonomy, against the consequences of relying on an
incorrect output, and it is paired with a discussion of postmarket monitoring. The FDA
recognizes that the two depend on each other, stating that:

“to ensure continued safety and effectiveness of GenAI-enabled devices, it may be
important for premarket evidence to be complemented by postmarket evidence
gathered through robust device performance monitoring approaches.”
(Discussion Paper, Section II, pp. 2–3)

I applaud the FDA for taking this first step toward thinking through how this complex field
could be regulated. My main concern is the gap between what is proposed for market entry
and what is proposed after it. The Discussion Paper describes the premarket pathway in
considerable detail and contemplates accepting greater premarket uncertainty.
Postmarket surveillance is described at a much higher level, and the interval before it takes
effect is likely to vary widely across indications and use cases. That leaves a significant time
dependency in which harm can occur and go undetected.

My comments are organized into seven areas where further development by the FDA
would be most helpful:

 Section 1: The Time-Dependency Gap Between Market Entry and Postmarket Detection
(Discussion Paper Sections II and VI; Questions 18 and 19)
 Section 2: Reframing the Risk Framework (Section IV; Questions 1, 2, and 8)
 Section 3: Consumer- and Public-Facing Tools Versus Tools Used by Health Care
Professionals (Section IV; Questions 3 and 5)
 Section 4: Defining Postmarket Surveillance and a Shared Reporting System (Section
VI; Questions 19 and 21)
 Section 5: The Role of Independent Third-Party Evaluators (Section V.D.2; Question 16)
 Section 6: Equity, Representativeness, and Synthetic Data (Sections V.B and V.C;
Questions 10 and 13)
 Section 7: Licensing and the Competency-Based Approach (Section V; Question 7)

Section 1: The Time-Dependency Gap Between Market Entry and
Postmarket Detection
(Discussion Paper Sections II and VI; Questions 18 and 19)

In Section VI, the FDA describes a trade-off it is considering:

“CDRH is considering whether it is appropriate to accept greater premarket
uncertainty regarding a GenAI-enabled device’s benefit-risk profile through
greater reliance on postmarket monitoring.” (Section VI, p. 19)

CROSS Global Research & Strategy, LLC 2
I understand the challenge the FDA raises in Section II. For devices with broad intended
uses or open-ended inputs and outputs, “it may be unreasonable to evaluate every
conceivable input that the device might encounter during deployment” (Section II, p. 2). I
would argue that this is also a reason to regulate the scope of a device’s intended use more
tightly before it enters the market. The same applies after market entry, when even broader
uses of a device may be identified. The FDA will need to ensure that those uses are
monitored.

The central problem is the time between market entry and effective surveillance. Once a
product enters the market, it may already be directing the care of individual patients or of
an entire population. Without robust postmarket surveillance systems, it is hard to detect
when harm has occurred. Two causes concern me in particular: an AI solution being used in
a way it was never intended to be used, and drift that develops as the model ages and the
population it serves changes. The Discussion Paper describes periodic device
benchmarking “on a defined cadence and after defined triggering events” (Section VI.A, p.
19) but does not say what that cadence should be. The interval before harm is detected is
therefore highly variable, and harm could go unidentified for months or even years.

This pattern is familiar from other parts of health care. Obermeyer and colleagues found
that a widely used commercial algorithm, which used health care costs as a proxy for
health needs, systematically underestimated the needs of Black patients, and that bias was
identified only through retrospective analysis of the data [1]. Similarly, in claims processing
and prior authorization, harm was identified only by looking back at patterns in the data,
after care that could have been lifesaving had been inappropriately denied. A 2024 report
from the U.S. Senate Permanent Subcommittee on Investigations found that three large
Medicare Advantage insurers denied post-acute care, including care in rehabilitation
facilities, at rising rates while relying on automated tools [2], and a federal court has allowed
claims to proceed in a lawsuit alleging that an algorithm was used in place of physician
judgment to deny post-acute care to older adults [3].

I recommend that the FDA define the expected surveillance interval, scaled to a device’s
risk tier, and treat the period immediately after market entry as the period of greatest need
for monitoring. Monitoring should also continue over the long term. Its intensity could be
de-escalated, and the interval between reviews lengthened, as performance and risk of
harm stabilize and the tool continues to function as intended, based on data that are
collected and measured independently. Without a defined approach, accepting greater
premarket uncertainty may simply defer risk onto the patients and populations the device
serves.

Section 2: Reframing the Risk Framework
(Discussion Paper Section IV; Questions 1, 2, and 8)

Section IV proposes a two-axis framework as a possible organizing heuristic. The
framework:

CROSS Global Research & Strategy, LLC 3
 “places device activity on one axis and the ‘consequences,’ or severity of harm of
relying on an incorrect device output, on the other.” (Section IV, p. 5)

I appreciate that the FDA is offering a heuristic, but I believe the framework is too simple. It
does not capture the complexity of rolling out AI in real-world settings. I recommend four
changes.

Define harm for different stakeholders
The consequences axis depends on how harm is ascribed, and stakeholders define harm
differently. The Discussion Paper illustrates the axis with an individual-level example: “An
incorrect recommendation about an over-the-counter remedy for a minor symptom is
meaningfully different from an incorrect recommendation about adjusting an insulin dose”
(Section IV, p. 6). For a physician or clinician, harm to a single patient is severe and
consequential, and even one death carries consequences. A payer, on the other hand, may
view as severe the harm from a system that inappropriately adjudicates services at the
population level, affecting thousands or even millions of insured persons. The framework
should state how individual-level and population-level harm are each represented, and it
should account for the differential impact of harm on some communities compared with
others. For example, in rural or underserved communities, harm may compound with other
factors, such as limited access to health care, that are outside the scope of the Discussion
Paper’s lens.

Consider a tiered approach modeled on the EU AI Act
I recommend that the FDA consider extrapolating from the European Union’s AI Act, which
sorts AI systems into four risk categories: unacceptable, high, limited, and minimal [4]. A
similar tiered approach, rather than a simple two-axis structure, would stratify the intensity
of premarket evidence and postmarket surveillance by risk from the outset.

Anchor the severity scale to established harm ratings
The severity scale should be anchored to established harm rating scales. That would give
the FDA and developers a benchmark for measuring the scale of harm, especially across
different audiences and stakeholders. Risk definitions also need to be settled before the
competency-based approach in Section V is developed further, because that approach
would use the two-axis framework to inform “the nature, rigor, and amount of evidence
needed” (Section V.A, p. 11).

Separate levels of autonomy
As agents move closer to the center of the health care system, the framework needs a clear
separation of how systems are judged depending on whether they are fully autonomous,
semi-autonomous, or working in conjunction with a human. Figure 1 already distinguishes
health care professional (HCP)-supervised action-taking functions from fully autonomous
ones. I recommend treating these configurations as distinct categories, each with its own
evidence and oversight expectations.

CROSS Global Research & Strategy, LLC 4
Section 3: Consumer- and Public-Facing Tools Versus Tools Used
by Health Care Professionals
(Discussion Paper Section IV; Questions 3 and 5)

The Discussion Paper recognizes that patient-facing and HCP-facing functions raise
different considerations. It notes that “HCPs may be better equipped than patients to
interpret an output in context, to recognize its limitations, and to integrate it with other
clinical information” (Section IV, p. 8), and Question 3 asks whether delivering clinical
information to users “who lack the domain knowledge needed to independently evaluate
the output” should be considered higher risk (Section IV, p. 8; Question 3).

Stratify by audience
I agree that this distinction matters, and I recommend that the FDA elevate it from a
consideration within the consequences axis to a dimension of the framework in its own
right. Stratifying by whether a GenAI tool is primarily consumer- or public-facing, or
intended for use by a health care professional, would help determine risk. A health care
professional can pair a tool’s output with medical and systems knowledge that mitigates
the risk the same tool carries when it is used by a general audience. I appreciate that the
FDA wants to preserve public autonomy. The public also needs guardrails to ensure these
systems are used appropriately.

Distinguish education from medical advice, and define escalation pathways
For public-facing tools, careful attention is needed to the types of information a tool
provides and how it is moderated. The Discussion Paper recognizes that directiveness “may
depend on the substance and context of the output” and that a “talk to your doctor”
statement may not make a patient-facing function any less directive (Section IV, p. 7). I
support this view and urge the FDA to draw a clear line between content that is clearly
educational and a system that offers patients medical advice they will act on, either
immediately or later. A clear escalation pathway is also needed for recognizing when a tool
is operating outside the scope it was intended for, so that the public is protected from
information or medical advice that no human has supervised.

Gate multi-turn conversations
The Discussion Paper observes:

“A device may begin by performing an informational function and migrate, over
the course of a conversation, to an action-directing function.” (Section IV, p. 8)

I agree. In the public domain, a conversation that begins as information can readily escalate
into a diagnosis, or into actions a patient could take that read as medical advice. Because
that escalation is difficult to assess and cannot be enforced turn by turn, we need clear
gating around the public, consumer-facing use of these tools, kept distinct from
professional-facing tools, so that what a patient receives as information is separated from
what constitutes medical advice.

CROSS Global Research & Strategy, LLC 5
Section 4: Defining Postmarket Surveillance and a Shared
Reporting System
(Discussion Paper Section VI; Questions 19 and 21)

Section VI.A offers three examples of postmarket approaches: periodic device
benchmarking, periodic sample-based clinician review, and performance degradation
monitoring. These are helpful starting points, but a much more robust effort is needed to
define what postmarket surveillance looks like. I recommend that the FDA specify:

 the interval at which a tool is expected to be surveilled;
 the parties that own the surveillance; and
 a reporting mechanism.
Clarify ownership and sustainability
The performance degradation example states that “[t]he sponsor monitors for performance
degradation (e.g., drift)” (Section VI.A, p. 20). Sponsor-led monitoring may serve the short
term, but it does not account for long-term use: if a company goes out of business or is
acquired, it is unclear where that responsibility goes. It would help for the FDA to clarify
whether “sponsor” in this context refers to the AI vendor or to the health system that has
adopted the solution. Likewise, periodic sample-based clinician review will be difficult to
sustain given the number of use cases, and the differences in performance across settings,
that a clinician panel would need to assess.

Coordinate the ecosystem
Section VI.B states that the FDA “seeks to understand what roles and responsibilities these
stakeholders may play for various approaches to postmarket monitoring.” Multiple
stakeholders could take ownership or play a role, including clinicians, physicians,
professional societies, ethics boards, and health care systems themselves. Their efforts need
to be coordinated to avoid duplicated work and missed opportunities to detect harm,
consistent with the concern in Question 21 that these roles be structured without diffusing
manufacturer accountability.

Establish a shared adverse-event-style reporting system
The FDA already operates adverse event reporting systems for other product types: the
FDA Adverse Event Reporting System (FAERS) for drugs and the Manufacturer and User
Facility Device Experience (MAUDE) database for medical devices. Due to recent
consolidation, these systems are now combined under the FDA Adverse Event Monitoring
System (AEMS) [5]. Similar to FAERS, MAUDE, and now AEMS, I recommend a comparable
but separate reporting system for GenAI-enabled devices, built as a public-private
partnership with organizations experienced in health care security and threat intelligence.
Such organizations can already report, identify, and monitor potential harms and threats,
and a system built with them would feed a coordinated pool that can flag tools in near real
time.

CROSS Global Research & Strategy, LLC 6
Section 5: The Role of Independent Third-Party Evaluators
(Discussion Paper Section V.D.2; Question 16)

Section V.D.2 seeks input on “what role(s), if any, independent third parties might play in
the premarket evaluation approach,” and Question 16 asks whether such parties should be
involved in some or all aspects of the competency-based approach. I fully support the use
of independent third-party evaluators and believe they have a role to play in both the
premarket and postmarket phases.

In the premarket phase, independent evaluators provide a way for consistent standards to
be applied to what developers build. They can help push for requirements such as
including subpopulation metrics before a tool is accepted, and for a minimum amount of
data before a tool is considered for entry into the pathway. In the postmarket phase,
independent monitors can help develop standards and guidelines in a coordinated way,
and can help ensure that different health systems and other users of these tools follow the
necessary guidelines. They would also strengthen the ecosystem available to surveil these
systems across different demographics and populations.

Question 16 also asks what safeguards are needed to prevent third-party participation from
“limiting competition or preventing innovation.” I recommend that evaluators and the
frameworks they apply be coordinated, so that too many differing opinions, evaluations,
and frameworks do not hinder progress.

Section 6: Equity, Representativeness, and Synthetic Data
(Discussion Paper Sections V.B and V.C; Questions 10 and 13)

The Discussion Paper conditions the use of synthetic data on its being representative:

“CDRH is considering that synthetically generated data modeled on real patient
data could potentially supplement evaluation, assuming such synthetic data is
representative of the environment in which the device is intended to be
deployed.” (Section V.C.1, p. 16)

That assumption carries significant weight, and I believe we should test it rather than
assume it.

Define representativeness
Representativeness needs a concentrated definitional effort. It should guide development
and not be assumed. This points to the need for a more robust premarket framework that
specifies the minimum amount of data considered representative, including subpopulation
reporting, before a tool can gain market entry.

Recognize the limits of synthetic data
Synthetic data may not represent populations historically missing from large swaths of
data, and it may not be possible to replicate those populations even with synthetic

CROSS Global Research & Strategy, LLC 7
approaches. Question 13 itself asks what safeguards would mitigate the risk that synthetic
data “reproduces the very performance gaps the evaluation is intended to detect,
particularly for underrepresented subgroups.” I share that concern. Synthetic data may not
capture all of the needed perspectives.

Monitor for differential harm with communities
A tool may enter the market indicated for a specific set of use cases and then be used in
populations it was never tested on, introducing new forms of harm that go undetected.
When public-private partnerships for surveillance are established, they should include
communities with a history of being underserved. Those communities can readily identify
where a specific GenAI tool is likely to pose challenges in their population. Monitoring for
differential harm with a community-centered approach has to begin with how
representativeness is defined and with those partnerships.

Section 7: Licensing and the Competency-Based Approach
(Discussion Paper Section V; Question 7)

Section V describes a competency-based approach to premarket evaluation that is:

“inspired, at a high level, by how human clinicians are evaluated and
credentialed, but would be adapted for the technical, practical, and legal
considerations applicable to the regulation of medical devices.” (Section V, p. 10)

The Discussion Paper describes this approach as “competency-based regulation modeled
on medical training, licensure examinations, supervised practice, periodic reevaluation, and
public reporting,” and it draws on authors who propose “a licensure-like framework” for
autonomous GenAI (Section V, p. 10).

As a licensed physician who has practiced at the bedside for 17 years, I am concerned that
ascribing licensure, or licensure-like evaluation, to these tools does not account for the
complexity of making medical decisions. Medical decision-making rests on more than the
ability to pass an exam or score highly on a test. The Discussion Paper itself reports the
accountability concern raised by Freyer et al., that “human clinicians face professional, legal,
and reputational consequences when expected standards are not met” (Section V, p. 10). An
examination-based analogy does not, by itself, provide that accountability.

I strongly recommend that the FDA seek the input of multiple stakeholders on the
implications of licensing these tools, as a separate item with an open comment period. That
input should cover what licensing could mean for the physician and clinician community
and for how people view the health care system. It should also cover the risk of eroding
trust and relationship-building between patients and communities that remain skeptical
about AI being used in their care.

CROSS Global Research & Strategy, LLC 8
Closing
I appreciate the FDA’s effort to assemble this comprehensive Discussion Paper and to seek
public and multi-stakeholder input on how GenAI-enabled medical devices should be
regulated. The Discussion Paper contains several important ways in which that regulation
could be achieved. I recommend that the FDA consider the comments herein and offer
additional clarity across the seven areas noted. Thank you for your time and for your work
on this effort.

Sincerely,

Dr. Shakira J. Grant, MBBS, MSCR
Founder and CEO, CROSS Global Research & Strategy, LLC
ABIM Board Certified Hematologist-Oncologist

References
[1] Obermeyer Z, Powers B, Vogeli C, Mullainathan S. Dissecting racial bias in an algorithm used to
manage the health of populations. Science. 2019;366(6464):447–453. doi:10.1126/science.aax2342.
[2] U.S. Senate Permanent Subcommittee on Investigations, Committee on Homeland Security and
Governmental Affairs, Majority Staff. Refusal of Recovery: How Medicare Advantage Insurers
Have Denied Patients Access to Post-Acute Care. October 17, 2024.
https://www.hsgac.senate.gov/wp-content/uploads/2024.10.17-PSI-Majority-Staff-Report-onMedicare-Advantage.pdf
[3] Estate of Gene B. Lokken et al. v. UnitedHealth Group, Inc. et al., Memorandum Opinion and Order
(D. Minn. Feb. 13, 2025).
[4] Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying
down harmonised rules on artificial intelligence (Artificial Intelligence Act).
[5] U.S. Food and Drug Administration. FDA Adverse Event Monitoring System (AEMS).
https://www.fda.gov/safety/fda-adverse-event-monitoring-system-aems

CROSS Global Research & Strategy, LLC 9