Asma Khapra

See attached file(s)

Comment on FDA Discussion Paper: Regulation of Generative AI-Enabled Medical Devices

Comment on FDA Discussion Paper:
Considerations for the Regulation of
Generative AI-Enabled Medical Devices
Oct 11, 2026 · ​@Asma

Submission details
To: Food and Drug Administration, Center for Devices and Radiological Health

Docket No.: FDA-2026-N-7874

Re: Considerations for the Regulation of Generative AI-Enabled Medical Devices:
Discussion Paper and Request for Feedback

Submitted by: Asma Khapra, MD, board-certified gastroenterologist in clinical practice
for 20 years

I submit these comments as a practicing specialist physician. The views expressed are my
own and do not represent any institution or organization with which I am affiliated.

Summary of position
As a practicing gastroenterologist for 20 years, I see daily how patients and clinicians are
already using AI, and I support CDRH’s direction, with some important cautions. To make
CDRH's competency model work, I urge FDA to adopt the physician analogy in full, not
only at the point of entry. My recommendations are:

1. Treat initial competency assessment as the equivalent of board certification, followed
by ongoing requirements comparable to CME, Maintenance of Certification (MOC),
and periodic recredentialing.
2. Patient-facing functions should support education, visit preparation, and shared
decision-making with a clinician, but should not recommend a specific therapy for an
individual patient. Any that do should be placed in the highest-risk tier, regardless of
disclaimers.
3. Validate any function that delivers specialist-level recommendations against boardcertified specialists in that field, and assign elevated risk when it is intended for
generalist use.

Page 1 of 6
Comment on FDA Discussion Paper: Regulation of Generative AI-Enabled Medical Devices

4. Require sex-stratified performance evaluation as a premarket condition, with specific
testing for under-recognition of serious diagnoses in women.
5. Require approval by a licensed clinician before any prescription generated by a GenAIenabled device is issued. Review after the prescription is issued is an audit, not
oversight.

Risk framework (Questions 1 and 8)
The two-axis framework, device activity against consequence of error, is a good starting
point, and I support assigning higher risk as functions move toward directing or taking
action. I also agree with CDRH that adding a disclaimer such as "talk to your doctor"
should not lower a function's risk classification. In practice, patients act on specific,
personalized recommendations regardless of the caveat attached.

I recommend adding two dimensions:

Completeness of clinical context. A recommendation is only as safe as the history
behind it. A tool that suggests therapy without access to the full clinical history,
including but not limited to comorbidities, prior treatment failures, infection and
malignancy risk, and reproductive plans, should be considered higher risk than one
that integrates the complete record.
Clinician approval before any prescription. GenAI-enabled devices should not
autonomously prescribe or initiate therapy. A licensed clinician should review and
approve every prescription before it is issued. This requirement matters most for
therapies whose effects cannot be readily reversed, such as immunosuppressive or
biologic therapy, which commit a patient to months of exposure and can limit future
options through loss of response and immunogenicity. Irreversibility should also raise
the risk of a recommendation, because a recommendation that is acted on carries the
same consequences.

A pilot launched in Utah in October 2026 shows why this matters. Under a state
regulatory sandbox, an AI platform prescribes topical acne treatments. Clinicians review
prescriptions before issuance for the first 100 patients, after issuance for the next several
hundred, and less rigorously after that. The company has stated it is exploring birth
control and expanding to patients as young as 13.

Acne topicals are low risk. Hormonal contraception, which carries thrombotic risk and
depends on a complete history, is not, and neither is extending autonomous prescribing to
adolescents. Success in a low-risk entry point should not become the justification for

Page 2 of 6
Comment on FDA Discussion Paper: Regulation of Generative AI-Enabled Medical Devices

relaxed oversight in higher-risk therapy. Pre-issuance clinician approval should be the
floor.

Competency-based evaluation across the full lifecycle (Questions
7, 18, and 22)
The competency-based approach makes sense, and the physician comparison fits.
However, a physician's competence is not established once. Board certification is followed
by continuing medical education, MOC, and periodic recredentialing and privileging by
the institutions where we practice. These requirements exist because medical knowledge
changes and skills degrade. The same is true, and even more so, for GenAI-enabled
devices whose underlying models can change without the manufacturer's direction.

FDA should make this parallel explicit:

Initial certification: premarket benchmarking and clinical confirmation, as described in
the discussion paper.
Continuing education equivalent: a defined process for updating the device when
clinical guidelines change, with re-benchmarking on the affected content.
Maintenance of certification equivalent: periodic re-benchmarking on a fixed
schedule, not only after manufacturer-initiated changes.
Recredentialing equivalent: time-limited authorization or periodic attestation, with
higher-risk devices renewed more often.

I would caution against accepting reduced premarket evidence in exchange for
postmarket monitoring for any action-taking function, and for action-directing functions
in high-consequence areas. We do not grant physicians independent practice on the
expectation that errors will be caught afterward.

Patient-facing functions: a clinical example from IBD (Questions 3
and 5)
Patient-facing tools that personalize treatment decisions carry much higher risk than
clinician-facing ones. I see this directly in my IBD practice. In the past year, some of my
patients have arrived having used general-purpose AI tools to decide which biologic or
advanced therapy they should receive. In my experience, many of those conclusions have

Page 3 of 6
Comment on FDA Discussion Paper: Regulation of Generative AI-Enabled Medical Devices

been substantially wrong. These tools may fall outside FDA's device oversight, but they
show the failure mode that any patient-facing GenAI device must be built and tested to
prevent.

The error is not usually a factual mistake about a drug. It is the omission of context that
only a full clinical evaluation provides. Biologic selection in IBD depends on disease
phenotype and extent, prior therapies and reasons for failure, infection and malignancy
history, cardiovascular and thrombotic risk, extraintestinal manifestations, pregnancy
plans, and insurance and access constraints. A patient describing their condition in a chat
cannot supply this information completely, and the tool has no reliable way to know what
is missing.

This is CDRH's concern about conversational drift, playing out in real life. These
exchanges often begin as general questions ("what are the treatment options for Crohn's
disease?") and end as a personalized recommendation ("which one is right for me?").

In practice, that means three things. Any patient-facing tool that moves toward picking a
therapy should be treated as action-directing and high consequence. Benchmarking
should test whether the tool realizes critical history is missing and holds off on a
recommendation until it has it. And risk should be judged across the whole conversation,
not one answer at a time.

GenAI clinical decision tools are best used primarily for clinician use, where a trained
professional can evaluate the output in context. Patient-facing functions are best suited
to education, visit preparation, and care navigation, which I fully support. The line should
be drawn at personalized treatment selection, not at access to information.

Generalist use of specialist-domain AI (Questions 4 and 14)
Using AI to have a generalist function as a specialist is risky, and it should be classified
that way. Primary care physicians are essential partners in IBD care: early recognition,
referral, vaccination, and health maintenance. But they are not trained to interpret the
nuances of these conditions, and an AI tool doesn't change that. Think of reading
endoscopic and histologic disease activity, telling active inflammation apart from
overlapping functional symptoms, sequencing advanced therapies, or managing drug
levels. As a specialist, I can tell when an AI answer is subtly wrong. A generalist relying on
the same answer often can't, and that is exactly the independent-review problem CDRH
describes.

Page 4 of 6
Comment on FDA Discussion Paper: Regulation of Generative AI-Enabled Medical Devices

My ask is simple: benchmark specialist-level tools against specialists, not generalists or a
median clinician. If a tool is meant for generalists, it should flag when an answer needs
specialist review, recommend referral, and state clearly in its labeling that it does not
replace a specialist consult.

Access matters, especially where specialists are scarce. But the answer is tools that get
patients to the right specialist faster, not tools that stand in for one.

Gender-based performance and the risk of dismissing women's
symptoms (Questions 9 and 13; Element R.2)
Gender should be an explicit, required dimension of subgroup evaluation. Women were
historically underrepresented in clinical research; until 1993, FDA guidance excluded most
women of childbearing potential from early-phase trials. Much of the clinical literature
and documentation that GenAI models learn from reflects that history. I worry these
models will repeat what I already see in practice: women's symptoms get dismissed, and
serious diagnoses get missed.

In gastroenterology, women's symptoms overlap with gynecologic and functional
conditions, and it is easy to write their symptoms off as benign. A tool that repeats this
pattern could look fine on average while consistently under-escalating for women. This is
the scenario element E.2 describes as premature diagnostic closure.

Specifically, FDA should require that:

Sex-stratified performance be reported for every benchmarking element, with
prespecified acceptance criteria for each sex rather than aggregate results alone.
Benchmarks include scenarios specifically designed to detect under-escalation and
dismissal of serious conditions in women.
Evaluation account for pregnancy, lactation, and reproductive planning, which directly
affect treatment selection in conditions such as IBD.
Synthetic data not be used to fill gaps in women's data without validation against real
patient data. A model of the same class may reproduce the same bias the evaluation is
meant to detect.

Page 5 of 6
Comment on FDA Discussion Paper: Regulation of Generative AI-Enabled Medical Devices

Conclusion
Generative AI can improve access and support clinical care, and I appreciate CDRH's early
engagement with practicing clinicians. If FDA models AI evaluation on physician
credentialing, it should apply the full standard we are held to: initial certification,
continuing education, maintenance of certification, and recredentialing. It should also
recognize that the greatest risks arise where the user cannot judge the output, as when
patients select their own therapy or generalists make specialist decisions, and where
models may underperform for women. Above all, no GenAI-enabled device should issue a
prescription without a clinician's approval first.

Thank you for the opportunity to comment.

Page 6 of 6