SANCIAN LLC (Sancian Crawford)

SANCIAN LLC submits the attached comment in response to the Digital Health Center of Excellence discussion paper, Considerations for the Regulation of Generative AI-Enabled Medical Devices. The comment responds to discussion questions 16, 18, 21, 24, and 25, addressing the independence of third-party evaluation, the relationship between premarket evidence and postmarket monitoring, the allocation of responsibilities across the deployment ecosystem, changes initiated by third-party foundation model developers, and voluntary Foundation Model Master Files. A one-page summary is included.

SANCIAN LLC Comment on Docket No. FDA-2026-N-7874

SANCIAN LLC · FEDERAL HEALTH AI GOVERNANCE

Comment of SANCIAN LLC
Docket No. FDA-2026-N-7874

Considerations for the Regulation of Generative AI-Enabled Medical Devices: Discussion Paper and Request
for Feedback

Submitted by: SANCIAN LLC, Atlanta, Georgia
Dr. Sancian Crawford, PhD, DCM, MPH, Founder and Chief Executive Officer

SANCIAN LLC is a federal health artificial intelligence governance and implementation consultancy. It has submitted comments on Department of Health and Human Services docket HHS-ONC-2026-0001 and on Centers for
Medicare and Medicaid Services dockets CMS-2026-2344 and CMS-2026-2377.

Scope of this comment
This comment responds to discussion questions 16, 18, 21, 24, and 25. SANCIAN LLC does not address the
remaining questions.

The Center has stated that the discussion paper is for discussion purposes only, that it does not represent draft or final guidance, and that it is not intended to propose or implement policy changes. This
comment is written accordingly. Nothing below assumes that any approach described in the paper has
been adopted.

Summary of position
The discussion paper locates assurance in two places. The first is the manufacturer’s own evaluation and
monitoring. The second is the Center’s review of what the manufacturer submits. Both are necessary.
Neither reaches the party that administers the device to a patient.

That gap is widest where the paper itself identifies the hardest problem, which is a change to a device
initiated by a third-party foundation model developer. A change of that kind originates with a party
that has no relationship with the health care facility, travels through a manufacturer that does, and
arrives at a patient. The paper asks how the manufacturer can detect, evaluate, and respond to such
a change. That question is correct and incomplete. The facility is the party that decides whether the
device continues in clinical use tomorrow morning, and under the approaches described, the facility
learns nothing at the time of the change.

Question 24 identifies contractual mechanisms as one route to reasonable assurance. SANCIAN LLC
agrees and submits that this instinct is the most consequential in the paper. Among the mechanisms
discussed, the procurement agreement is uniquely positioned to operate on the deployment timeline
and to create enforceable information obligations between parties that may have no direct regulatory

Submitted for the public record. This comment does not constitute legal, regulatory, or clinical advice. Page 1 of 6
SANCIAN LLC Comment on Docket No. FDA-2026-N-7874

relationship.

Question 16: Independent third parties
Independence should be defined structurally rather than by credential. The paper already proposes
that expert adjudicators be structurally independent of the device sponsor and, where a third-party
model is incorporated, of that model’s developer. SANCIAN LLC supports that principle and submits
two extensions.

First, the principle should apply to the economic relationship and not only to the corporate one. Sponsor
compensation is the norm in conformity assessment and is not by itself disqualifying. What determines
whether independence holds is whether the arrangement preserves the evaluator’s ability to return an
adverse result. Accreditation to a defined scope, prespecified evaluation criteria, and the absence of a
mechanism by which an adverse finding jeopardizes future engagement are what carry independence
in practice. Where a third-party scheme is used, the integrity of the result depends on how the evaluator
is selected, scoped, and retained, not only on who owns it.

Second, independence should extend across the total product life cycle rather than terminating at authorization. If independent adjudication is appropriate to establish performance before market entry,
the same reasoning applies to the postmarket reassessment that the paper contemplates in questions 19
and 22, particularly where reassessment follows a change the sponsor did not initiate.

Two cautions. Third-party participation should not become a substitute for the deploying facility’s ability to evaluate the device in its own population and against its own patients. A certificate issued by a
qualified evaluator describes performance under the conditions of evaluation. It does not describe performance in a given hospital. Third-party schemes should also be designed so that the cost and access
structure does not foreclose smaller developers, which would reduce the diversity of available devices
without improving the safety of any of them.

Question 18: Premarket uncertainty and postmarket reliance
Accepting greater premarket uncertainty in exchange for greater postmarket monitoring is a defensible
trade in principle. It is not a neutral one, and the conditions matter more than the ratio.

Premarket evaluation is a determination made by a public body, on a record, before patients are exposed.
Postmarket monitoring as described in the paper is largely an activity conducted by the manufacturer
and reported to the Center. Substituting the second for the first moves assurance from a contemporaneous public determination to a retrospective private one, and it transfers residual risk to patients and to
the facilities that treat them.

SANCIAN LLC submits that the trade is appropriate only where three conditions hold. The monitoring
program must be defined before authorization rather than described in general terms. Its thresholds
and triggering events must be specified in advance, so that a monitoring result has a consequence that
is known before the result arrives. And the evidence the monitoring produces must be available to
the deploying facility, in a form and on a timeline that allow the facility to act on it. Monitoring that
produces evidence only for the manufacturer and the Center does not reduce the uncertainty the facility
is being asked to absorb. It relocates it.

Submitted for the public record. This comment does not constitute legal, regulatory, or clinical advice. Page 2 of 6
SANCIAN LLC Comment on Docket No. FDA-2026-N-7874

There are device types for which the trade does not appear appropriate under any monitoring design.
Where a function takes autonomous action at the high-consequence end of the paper’s framework, the
facility cannot observe the error before the harm occurs. In that configuration, postmarket monitoring
documents a harm rather than preventing one, and the premarket evidentiary burden should not be
reduced on the strength of it.

Question 21: Ecosystem roles and manufacturer accountability
Accountability diffuses when a responsibility is described as shared without being assigned. It does not
diffuse when roles are allocated according to what each party is positioned to observe and able to act
upon.

Those positions are distinct and not interchangeable. The manufacturer can observe the behavior of
the device and the components it is built from. The deploying facility can observe clinical effect in its
own population, in its own workflow, and among its own clinicians. By default, neither party observes
the other’s domain. Information-sharing arrangements can extend visibility across that boundary, and
where they exist they should be recognized and encouraged. What the allocation of responsibility cannot
do by itself is create visibility that no such arrangement provides. A monitoring architecture that asks
the manufacturer to detect population-specific degradation it has no access to, or asks the facility to
detect model-level change it is not told about, will fail regardless of how the obligations are written.

The protection against diffusion is therefore specificity rather than restraint. Each role should carry a
named party, a defined trigger, and a defined action. Professional societies, standards bodies, and publicprivate consortia can contribute the methods by which these roles are performed, and that contribution
is valuable. They should not be assigned the obligations themselves, because they are not positioned to
perform them and cannot be held to them.

Manufacturer accountability is preserved, not weakened, by assigning the facility a defined role. A
facility that receives timely and actionable information and fails to act has made its own decision. A
facility that receives nothing has not.

Question 24: Changes initiated by third-party foundation model developers
This is the question on which the regulatory approach to these devices will succeed or fail, and SANCIAN
LLC urges the Center to consider the full path such a change travels.

Detection by the manufacturer is necessary and insufficient. Under the approaches described, a change
originating with a foundation model developer is detected by the manufacturer, evaluated by the manufacturer, and reported to the Center. The facility that is administering the device to patients during
that interval is not party to any step. Its first indication that the device has changed may be a change in
what the device tells its clinicians.

SANCIAN LLC submits that the Center should treat the deploying facility as a necessary recipient of
information about upstream change, and that the obligation should attach at two points in the chain.

Between the foundation model developer and the manufacturer, the agreement should provide advance
notice of changes that may affect behavior relevant to the device’s intended use, in time for the manuSubmitted for the public record. This comment does not constitute legal, regulatory, or clinical advice. Page 3 of 6
SANCIAN LLC Comment on Docket No. FDA-2026-N-7874

facturer to evaluate the change before it reaches clinical use. The paper observes that model developers
may have limited incentive to disclose safety-relevant information. That observation argues for the obligation to be contractual, because a voluntary disclosure regime asks for cooperation precisely where the
incentive runs the other way.

Between the manufacturer and the deploying facility, the procurement agreement should provide notice
of the change and the result of the manufacturer’s re-evaluation, delivered before the changed configuration is in clinical use, and in a form the facility can act on. The facility does not need the model’s
internals. It needs to know that the device it authorized is not the device it is now running, and what
the manufacturer’s reassessment showed.

The Center asked whether contractual, technical, or predetermined change control plan mechanisms
could provide reasonable assurance. These are complementary rather than equivalent, and they address different problems. Technical controls such as version identification and behavioral monitoring
are necessary and should be expected. A predetermined change control plan can establish prospective
criteria for evaluating certain categories of change, including categories of change a sponsor cannot individually specify in advance. What it cannot do on its own is compel a third-party foundation model
developer to provide timely notice that a change has occurred, or carry an obligation to the deploying
facility. The contractual mechanism addresses that different problem, which is the transmission of
information across organizational boundaries and on the timeline on which the facility must decide
whether to continue clinical use. A contractual obligation can also be drafted to survive termination or
modification of the commercial relationship, providing continuity that a voluntary commitment may
not.

Question 25: Foundation Model Master Files
A voluntary master file would improve the consistency of premarket review, and SANCIAN LLC supports
the concept for that purpose. Two limitations should be recognized before it is relied upon more broadly.

The first is the incentive asymmetry the paper itself identifies. A voluntary, confidential program asks
the party with the least commercial incentive to disclose safety-relevant information to do so, with no
counterparty positioned to verify what was disclosed or to notice what was omitted. Participation is
likely to be highest among developers whose disclosures carry the least risk to them, which is the inverse
of where the information is most needed. If the Center proceeds, it should consider what completeness
commitments and update obligations would accompany participation, since a master file that is current
at submission and stale thereafter may be worse than none, insofar as it conveys assurance that has
expired.

The second is structural. Information in a master file is held confidentially by the Center and is available
to a sponsor only with the file holder’s authorization. The facility treating the patient is outside that
arrangement entirely. The result is an assurance structure in which the model developer knows what it
changed, the Center may know what the model is, the manufacturer knows what it tested, and the only
party actually administering the device to a patient knows none of it.

SANCIAN LLC submits that the master file concept is most durable when paired with a deployer-facing
disclosure path. The information need not be the same in both directions, and it should not be. The

Submitted for the public record. This comment does not constitute legal, regulatory, or clinical advice. Page 4 of 6
SANCIAN LLC Comment on Docket No. FDA-2026-N-7874

Center requires technical depth for review. The facility requires far less, and requires it in a different
form. What the facility needs is the identity and version of the underlying model, notice when that
version changes, and the result of the manufacturer’s reassessment of the change. Delivered through
the device’s labeling or through the procurement agreement, that information provides a minimum
basis for the facility to exercise the judgment it is already accountable for exercising.

Closing
SANCIAN LLC appreciates the Center’s decision to seek early input on these questions and the candor
of the discussion paper in identifying the limits of existing approaches. The treatment of third-party
foundation model change in question 24 identifies a problem that the premarket and postmarket mechanisms discussed elsewhere in the paper do not resolve on their own, and the reference to contractual
mechanisms in that question points toward the instrument best suited to it.

Respectfully submitted,

Dr. Sancian Crawford, PhD, DCM, MPH
Founder and Chief Executive Officer
SANCIAN LLC

ATTACHMENT

One-page summary of this comment follows.

Submitted for the public record. This comment does not constitute legal, regulatory, or clinical advice. Page 5 of 6