Rahul Kanety

I. Introduction

I am submitting these comments in my individual capacity as a quality engineering professional with over 15 years of experience in medical device quality management systems, supplier quality engineering, and regulatory compliance across original equipment manufacturers, contract manufacturers, and component suppliers. I hold the ASQ Certified Quality Auditor (CQA) credential and an ISO 13485:2016 Lead Auditor certification. These comments reflect my own professional views and do not represent the position of my employer or any other organization.

I appreciate the opportunity to comment on the discussion paper “Considerations for the Regulation of Generative AI-Enabled Medical Devices” (the “Discussion Paper”), issued by the Digital Health Center of Excellence (DHCoE) within the Center for Devices and Radiological Health (CDRH). I recognize that the Discussion Paper is intended for discussion purposes only and does not represent draft or final guidance or a statement of CDRH’s proposed regulatory expectations. My comments focus on the quality-management-system and supplier-governance dimensions of generative artificial intelligence (GenAI)-enabled devices, an area directly relevant to my professional practice and to prior public comments I have submitted on FDA-2025-N-6075 (distributed manufacturing quality governance), FDA-2026-D-4272 (container closure systems and device constituent parts for biosimilar products), and FDA-2026-D-4692 (chemistry, manufacturing, and controls flexibilities for cellular and gene therapy products).

I.A Executive Summary: Three Core Recommendations

To help the Agency review this comment, the three principal recommendations are summarized here. Each is built on existing statutory and regulatory mechanisms, and each is developed in Section III.

1. Supplier governance through a master file (Questions 24 and 25; ISO 13485:2016 Clause 7.4). Treat externally supplied foundation models as critical outsourced software of unknown provenance (SOUP) under Clause 7.4. Define minimum content for a voluntary Foundation Model Device Master File (MAF), informed by 21 CFR 814.3(d) and 814.9(a) and, as the author’s own cross-center analogy, the Type V Drug Master File and the Section 506L Advanced Manufacturing Technologies program. The goal is to reduce repeated supplier assessments across sponsors.

2. Prespecified verification for GenAI PCCPs (Questions 22 and 23; FD&C Act Section 515C). Address the prespecification problem by having the PCCP commit to an automated regression verification method and quantitative acceptance bounds, not to the content of future model changes. FDA would still review and clear or approve the plan.

3. Quality-system anchoring for evaluation and drift (Questions 18, 19, and 21). Map benchmark suites and regression harnesses to design verification (Clause 7.3.6), clinician-in-the-loop evaluation to design validation (Clause 7.3.7), and postmarket drift monitoring to the feedback process (Clause 8.2.1), the CAPA subsystem (Clause 8.5.2), and the risk management file (ISO 14971:2019 Clause 10).

Supporting recommendations address independent third-party qualification (Question 16; Section III.B), alignment with FDA’s least burdensome obligations (Section III.E), and a remote-first pre-work model that reduces repeated on-site presence (Section III.G).

The complete formal public comment, with detailed analysis (Section III), the line-item recommendation table (Section IV), conclusion, references, and professional credentials, is provided in the attached 12-page PDF: Comment_FDA-2026-N-7874_Rahul_Kanety_MEM.pdf.

Docket No. FDA-2026-N-7874 | Comment of Rahul Kanety, MEM

Formal Public Comment Submission
Docket No.: FDA-2026-N-7874
Document Title: Considerations for the Regulation of Generative AI-Enabled Medical Devices:
Discussion Paper and Request for Feedback
Issuing Office: Center for Devices and Radiological Health (CDRH), Digital Health Center of Excellence
(DHCoE)
Regulatory Vehicle: Discussion Paper (pre-guidance stakeholder engagement; not draft or final guidance)
Submitted Via: Federal eRulemaking Portal (regulations.gov)
Comment Period Closes: October 19, 2026
Date: October 12, 2026

Reconciling Foundation Model Supplier Governance and the Quality Management System
Regulation (QMSR) With CDRH's Discussion Paper on Generative AI-Enabled Medical Devices

I. Introduction
I am submitting these comments in my individual capacity as a quality engineering professional with over
15 years of experience in medical device quality management systems, supplier quality engineering, and
regulatory compliance across original equipment manufacturers, contract manufacturers, and component
suppliers. I hold the ASQ Certified Quality Auditor (CQA) credential and an ISO 13485:2016 Lead
Auditor certification. These comments reflect my own professional views and do not represent the
position of my employer or any other organization.
I appreciate the opportunity to comment on the discussion paper “Considerations for the Regulation of
Generative AI-Enabled Medical Devices” (the “Discussion Paper”), issued by the Digital Health Center
of Excellence (DHCoE) within the Center for Devices and Radiological Health (CDRH). I recognize that
the Discussion Paper is intended for discussion purposes only and does not represent draft or final
guidance or a statement of CDRH's proposed regulatory expectations. My comments focus on the qualitymanagement-system and supplier-governance dimensions of generative artificial intelligence (GenAI)-
enabled devices, an area directly relevant to my professional practice and to prior public comments I have
submitted on FDA-2025-N-6075 (distributed manufacturing quality governance), FDA-2026-D-4272
(container closure systems and device constituent parts for biosimilar products), and FDA-2026-D-4692
(chemistry, manufacturing, and controls flexibilities for cellular and gene therapy products).

I.A Executive Summary: Three Core Recommendations
To help the Agency review this comment, the three principal recommendations are summarized here.
Each is built on existing statutory and regulatory mechanisms, and each is developed in Section III.
1. Supplier governance through a master file (Questions 24 and 25; ISO 13485:2016 Clause 7.4). Treat
externally supplied foundation models as critical outsourced software of unknown provenance (SOUP)
under Clause 7.4. Define minimum content for a voluntary Foundation Model Device Master File (MAF),
informed by 21 CFR 814.3(d) and 814.9(a) and, as the author's own cross-center analogy, the Type V
Drug Master File and the Section 506L Advanced Manufacturing Technologies program. The goal is to
reduce repeated supplier assessments across sponsors.

Page 1 of 12
 Docket No. FDA-2026-N-7874 | Comment of Rahul Kanety, MEM

2. Prespecified verification for GenAI PCCPs (Questions 22 and 23; FD&C Act Section 515C). Address
the prespecification problem by having the PCCP commit to an automated regression verification method
and quantitative acceptance bounds, not to the content of future model changes. FDA would still review
and clear or approve the plan.
3. Quality-system anchoring for evaluation and drift (Questions 18, 19, and 21). Map benchmark suites
and regression harnesses to design verification (Clause 7.3.6), clinician-in-the-loop evaluation to design
validation (Clause 7.3.7), and postmarket drift monitoring to the feedback process (Clause 8.2.1), the
CAPA subsystem (Clause 8.5.2), and the risk management file (ISO 14971:2019 Clause 10).
Supporting recommendations address independent third-party qualification (Question 16; Section III.B),
alignment with FDA's least burdensome obligations (Section III.E), and a remote-first pre-work model
that reduces repeated on-site presence (Section III.G).

II. Background and Purpose of the Comment
The Discussion Paper proposes a two-axis framework for organizing risk considerations for GenAIenabled devices, placing device activity on one axis and the severity of harm from relying on an incorrect
output on the other (Section IV). It also proposes a competency-based approach to premarket evaluation,
inspired at a high level by how human clinicians are evaluated and credentialed (Section V), and it
discusses scope maintenance and boundary adherence across multi-turn conversational interactions,
including drift that accumulates across individually in-scope turns (Section V, benchmark element S.2).
For postmarket monitoring, the Discussion Paper discusses periodic device re-benchmarking and periodic
sample-based clinician review of real-world outputs (Section VI.A). In Questions 24 and 25, CDRH also
seeks feedback on the feasibility of a voluntary Foundation Model Device Master File (MAF)
mechanism, under which foundation model developers and platform providers could submit structured
model or system cards to FDA under confidential seal, referenceable by device sponsors with the file
holder's authorization.
While the Discussion Paper thoughtfully addresses clinical evaluation methodology and conversational
risk, it does not yet ground these concepts in the Quality Management System Regulation (QMSR / 21
CFR Part 820), which became effective February 2, 2026 and incorporates ISO 13485:2016 by reference.
In practice, most device sponsors do not train foundation large language models (LLMs) or visionlanguage models (VLMs) from scratch; they fine-tune, orchestrate, or access closed-source or openweight models through cloud application programming interfaces (APIs). Where a device function
depends on such a model, that model functions as Software of Unknown Provenance (SOUP) under IEC
62304 and as a critical outsourced component subject to purchasing controls under ISO 13485:2016
Clause 7.4. This comment provides six recommendations, organized to respond directly to the Discussion
Paper's own numbered questions where applicable: (A) the Foundation Model MAF mechanism raised in
Questions 24–25; (B) supplier governance for third-party foundation models under Clause 7.4, responsive
to Question 16 (independent third-party qualification) and Question 24 (detecting and responding to thirdparty-initiated changes); (C) integration of competency-based evaluation with design controls under
Clause 7.3; (D) integration of postmarket monitoring with the CAPA subsystem under Clause 8.5.2 and
the risk management file under ISO 14971:2019, responsive to Questions 18, 19, and 21; (E) alignment of
these recommendations with FDA's statutory least burdensome obligations; and (F) a tiered changecategorization framework responsive to Question 22 (the boundary between a sponsor's quality
management system and FDA premarket review) and Question 23 (adapting PCCP concepts to GenAIenabled devices).

Page 2 of 12
 Docket No. FDA-2026-N-7874 | Comment of Rahul Kanety, MEM

III. Analysis and Recommendations

A. Structuring the Foundation Model Device Master File (MAF) by Analogy to Established
Cross-Center Mechanisms
In Questions 24 and 25, the Discussion Paper asks whether a voluntary Foundation Model MAF
mechanism, built on CDRH's existing Device Master File program, would be a feasible way for
foundation model developers to share technical information with FDA without disclosing proprietary
model details to individual device sponsors. Under 21 CFR 814.3(d), a master file is defined as “a
reference source that a person submits to FDA,” which “may contain detailed information on a specific
manufacturing facility, process, methodology, or component used in the manufacture, processing, or
packaging of a medical device”; under 21 CFR 814.9(a), such a master file becomes part of the
confidential PMA file to which the referencing sponsor need not be given direct access. The Discussion
Paper does not yet describe what categories of information a Foundation Model MAF should contain or
how a downstream sponsor's reference to it would be documented.
As my own cross-center analytical contribution, informed by my prior comments on Docket FDA-2026D-4692 regarding platform-technology designations, I note that CDER and CBER already operate an
analogous mechanism for sharing confidential platform information across multiple product submissions:
the Type V Drug Master File under 21 CFR 314.420(a)(5), and the related Advanced Manufacturing
Technologies (AMT) Designation Program under Section 506L of the FD&C Act (21 U.S.C. 356l).
Under these mechanisms, a platform or technology holder deposits detailed technical information with the
Agency once, and multiple sponsors reference that single filing by authorization rather than resubmitting
the same underlying technical data. I recommend that CDRH consider this cross-center precedent, while
recognizing it as an analogy rather than a direct statutory parallel, in defining the structural content
expectations for a Foundation Model MAF.

Section Discussion Paper Framing Proposed Addition Regulatory Justification

Questions Seeks feedback on the feasibility Define minimum content expectations 21 CFR 814.3(d) (master file
24-25 of a voluntary Foundation Model for a Foundation Model MAF: (1) definition); 21 CFR 814.9(a)
MAF mechanism, without dataset curation and provenance (confidentiality treatment); by
proposing specific content methodology, including known cross-center analogy, 21 CFR
requirements. limitations in clinical/demographic 314.420(a)(5) (Type V DMF) and
representation; (2) base-model FD&C Act Section 506L / 21
benchmark stability reports against U.S.C. 356l (AMT Designation
standardized evaluation sets; (3) Program).
baseline red-teaming and safetyalignment summaries; and (4) a
documented version-freezing and
change-notification commitment to
downstream sponsors who reference
the file.

B. Governing Third-Party Foundation Models as Critical Tier-1 Suppliers Under ISO
13485:2016 Clause 7.4
Section IV of the Discussion Paper discusses cloud-hosted, on-device, and hybrid deployment
architectures for GenAI-enabled devices as technical configurations, without addressing the purchasingcontrol and supplier-oversight expectations that apply once a device function depends on an externally
supplied foundation model. Under 21 CFR Part 820 (incorporating ISO 13485:2016 by reference) and
ISO 13485:2016 Clause 7.4.1, the sponsor remains responsible for ensuring that outsourced processes and
purchased components conform to specified requirements, with the degree of control proportional to risk.
In practice, sponsors cannot conduct traditional on-site quality audits of hyperscale cloud foundation

Page 3 of 12
 Docket No. FDA-2026-N-7874 | Comment of Rahul Kanety, MEM

model providers. Foundation models also differ from classical software of unknown provenance (SOUP).
Conventional SOUP, such as operating-system libraries or database drivers, can be bounded with static
analysis, code coverage, and deterministic unit tests. Those methods do not characterize the probabilistic
behavior of a large language model in a meaningful way. For foundation models, the evidence a sponsor
can reasonably be expected to hold is runtime input and output guardrails, documented acceptance bounds
on error rates measured against a prespecified benchmark, and change notification from the provider,
consistent with the software system testing activities in IEC 62304 Clause 5.7.

Section Discussion Paper Framing Proposed Addition Regulatory Justification

Section IV Describes deployment Clarify that a commercially supplied 21 CFR Part 820 / QMSR; ISO
architecture options (cloud, on- foundation model accessed via API or 13485:2016 Cl. 7.4 (Purchasing
device, hybrid) without hosted environment should be treated Controls); IEC 62304:2006/AMD
addressing purchasing controls as a critical outsourced software 1:2015 (SOUP); FDA Compliance
for the underlying foundation component (SOUP, per IEC 62304) Program 7382.850 (updated Feb.
model. subject to ISO 13485:2016 Clause 7.4 2, 2026), which directs field
purchasing controls. Recommend investigators to evaluate supplier
sponsors maintain a documented AI- controls under the QMSR-era
specific Quality Agreement defining inspection model.
change-notification thresholds (model
checkpoint deprecation, safety-filter
or system-prompt changes materially
affecting output distribution,
tokenizer changes, API deprecation
timelines).

Section IV Does not address how a sponsor Clarify acceptable alternative ISO 13485:2016 Cl. 7.4.1-7.4.3;
can satisfy supplier-evaluation verification evidence under ISO this is a recommended alternativeexpectations when a direct on-site 13485 Clause 7.4.1-7.4.2 where on- verification framework and not an
audit of a cloud foundation model site audit is impracticable, such as existing FDA position.
provider is not commercially independent third-party SOC 2 Type
available. II attestations, published model or
system cards, and sponsor-run
automated regression verification
executed against the live API.
Question 16 asks whether independent third parties should be involved in device benchmarking or clinical
confirmation, what qualification and independence criteria should apply, and what safeguards would
prevent third-party involvement from limiting competition. For the supplier-evaluation role described
above specifically (not clinical benchmarking), I recommend CDRH recognize accredited third-party
management-system certification — for example, certification to ISO/IEC 42001:2023 (Information
technology — Artificial intelligence — Management system) issued by a certification body accredited
under ISO/IEC 17021-1:2015 — as one qualifying form of independent verification that a foundation
model provider maintains documented AI governance processes. Because ISO/IEC 17021-1 accreditation
is itself a standardized, internationally recognized qualification mechanism administered by national
accreditation bodies rather than FDA, this approach would not require FDA to create or vet a new,
bespoke third-party qualification program, and would not advantage any single certification body.

C. Reconciling Competency-Based Evaluation With ISO 13485 Clause 7.3 Design Controls
and IEC 62304 Verification
Section V of the Discussion Paper proposes a competency-based approach to premarket evaluation,
explaining that because GenAI-enabled devices, like clinicians, can ingest broad and varied information
and produce open-ended responses, evaluation should draw on a combination of structured assessment of
underlying knowledge and reasoning and supervised practice with progressively greater independence,

Page 4 of 12
 Docket No. FDA-2026-N-7874 | Comment of Rahul Kanety, MEM

rather than exhaustive testing of every possible scenario. Benchmark element S.2 (“Scope maintenance
and boundary adherence”) further addresses whether a device recognizes and appropriately responds to
attempts to use it outside its intended scope, including prompt injection and multi-turn conversations
where cumulative drift carries the interaction out of scope. This approach is a reasonable response to the
non-deterministic nature of GenAI outputs, but it must still be reconciled with the objective, documented
verification expectations of 21 CFR 820.30 and ISO 13485:2016 Clause 7.3.6, which require that design
outputs be verified against design inputs through objective evidence.
It would also help to state which design-control activity each part of the competency approach
corresponds to. The structured assessment of knowledge and reasoning, together with the benchmark
suites and automated regression harnesses described below, is design verification under ISO 13485:2016
Clause 7.3.6: objective evidence that outputs meet the specified design inputs, including guardrail
requirements. Supervised practice with progressively greater independence, where clinicians evaluate the
integrated system under representative conditions, corresponds to design validation under Clause 7.3.7:
evidence that the finished device meets user needs and intended use. Keeping the two apart would help
avoid treating algorithmic regression testing as a substitute for clinical evaluation.

Section Discussion Paper Framing Proposed Addition Regulatory Justification

Section V Proposes competency-based Clarify that competency benchmark ISO 13485:2016 Cl. 4.2.3, 7.3.4,
evaluation (structured suites, adversarial/edge-case prompt 7.3.6, 7.3.8; IEC
knowledge/reasoning assessment sets, and hallucination or scope- 62304:2006/AMD 1:2015 Cl. 5.7
plus supervised, progressively violation scoring rubrics constitute (Software System Testing).
independent practice) without Design Outputs under ISO 13485
mapping this methodology to Clause 7.3.4 and should reside in the
design-control documentation medical device file (Clause 4.2.3).
requirements. Require that sponsors implement
repeatable, automated regression test
harnesses, with pre-specified
quantitative pass/fail error bounds,
executed prior to design transfer
(Clause 7.3.8).

Section V, Identifies scope maintenance and Require pre-specified multi-turn ISO 13485:2016 Cl. 7.3.6, 7.3.8.
benchmar multi-turn conversational drift as adversarial stress testing (including
k S.2 an evaluation priority, without prompt-injection and gradual-drift
specifying a pre-market testing scenarios) as part of design
protocol. verification, with documented
pass/fail criteria, prior to design
transfer.

D. Anchoring Postmarket Drift Monitoring to the CAPA Subsystem and the Risk
Management File
Section VI.A of the Discussion Paper discusses postmarket monitoring approaches, including periodic
device re-benchmarking against updated test sets and periodic sample-based clinician review of realworld device outputs (Question 19), and asks whether these approaches can be facilitated by machinebased supervisory agents (Question 20) and what roles clinicians, institutions, and other stakeholders
should play without diffusing manufacturer accountability (Question 21). The Discussion Paper also asks
under what conditions FDA might accept greater premarket uncertainty in exchange for greater reliance
on postmarket monitoring (Question 18). These are appropriate monitoring mechanisms and reasonable
premarket/postmarket trade-off questions, but the Discussion Paper does not yet connect any of them to
the manufacturer's existing postmarket quality-system obligations under the QMSR.

Page 5 of 12
 Docket No. FDA-2026-N-7874 | Comment of Rahul Kanety, MEM

Section Discussion Paper Framing Proposed Addition Regulatory Justification

Section Proposes periodic re- Clarify that postmarket monitoring ISO 13485:2016 Cl. 8.2.1, 8.5.2;
VI.A benchmarking and sample-based data (re-benchmarking results, ISO 14971:2019 Cl. 10; FDA
clinician review as postmarket clinician-review findings, and Compliance Program 7382.850.
monitoring approaches, without detected scope violations) should feed
connecting these activities to the directly into the manufacturer's
manufacturer's feedback and feedback process (ISO 13485 Clause
CAPA processes. 8.2.1) and, where a pre-specified
quantitative performance-degradation
threshold is crossed, trigger a
documented corrective action
investigation (Clause 8.5.2).
Emergent failure modes identified
postmarket should be traced to the
device's risk management file (ISO
14971:2019 Clause 10, PostProduction Activities) to confirm
whether existing risk controls remain
adequate.
On Question 18, I recommend that greater reliance on postmarket monitoring be accepted in exchange for
reduced premarket evidence only where the sponsor's quality system can demonstrate, at the time of
submission, that the monitoring program described above is already operational and auditable —
specifically, that the feedback (Clause 8.2.1) and CAPA (Clause 8.5.2) pathways, the quantitative driftthreshold triggers, and the risk management file traceability described in this section are implemented and
ready to execute from the device's commercial launch date, not designed only after an FDA request. A
monitoring plan that exists only on paper at the time of clearance provides materially weaker assurance
than one a sponsor can demonstrate is already running in a comparable deployment.

E. Aligning These Recommendations With FDA's Statutory Least Burdensome Obligations
Sections 513(a)(3)(D) and 513(i)(1)(D) of the FD&C Act (21 U.S.C. 360c(a)(3)(D) and (i)(1)(D)) direct
FDA to consider, in consultation with the applicant, the least burdensome appropriate means of evaluating
device safety and effectiveness that would have a reasonable likelihood of resulting in a favorable
determination. I recommend that CDRH frame the recommendations above explicitly as a leastburdensome implementation of the Discussion Paper's goals, for four reasons.
First, regulatory burden should be tiered to clinical consequence rather than applied uniformly. For
software functions meeting the clinical decision support criteria of Section 520(o)(1)(E) of the FD&C Act
(21 U.S.C. 360j(o)(1)(E)) — where the healthcare professional can independently review the basis for a
recommendation — the input/output guardrails and postmarket override tracking described in Sections
III.B–III.D above should generally be sufficient, without requiring the more extensive premarket clinical
validation appropriate for autonomous or diagnostic-driving functions. Second, the Foundation Model
MAF mechanism discussed in Section III.A is itself a least-burdensome mechanism: it shifts the burden
of documenting upstream model provenance and red-teaming to the party best positioned to produce that
information once, rather than requiring every downstream sponsor to independently reconstruct it. Third,
the supplier-governance and design-control recommendations in Sections III.B and III.C do not propose a
new, AI-specific quality system; they map GenAI-specific risks onto purchasing controls (Clause 7.4),
design outputs (Clause 7.3.4), and verification (Clause 7.3.6) that sponsors already operate under the
QMSR, which avoids imposing duplicative compliance infrastructure. Fourth, the automated regression
test harnesses recommended in Section III.C are a less burdensome verification method than exclusive
reliance on manual clinician sampling, because they can execute a substantially larger number of test

Page 6 of 12
 Docket No. FDA-2026-N-7874 | Comment of Rahul Kanety, MEM

scenarios per release cycle at lower marginal cost, while still producing the documented, objective
evidence that Clause 7.3.6 requires.
I recommend that CDRH state expressly, in any future draft guidance building on this Discussion Paper,
that these QMS-anchored recommendations are intended to operate within the existing Part 820/ISO
13485 framework and are not intended to establish a separate or additional quality system solely for
GenAI-enabled devices.

F. A Tiered Change-Categorization Framework Responsive to Questions 22 and 23
Question 22 asks whether there are categories of change to a GenAI-enabled device that might not
significantly affect safety or effectiveness, that might be appropriately managed within a sponsor's quality
management system rather than requiring FDA premarket review, or that might be appropriate for
inclusion in a Predetermined Change Control Plan (PCCP). Question 23 asks how PCCP concepts might
be adapted for GenAI-enabled devices when the nature or scope of future modifications cannot be fully
prespecified in the way a traditional PCCP anticipates. I recommend CDRH consider the following
illustrative, non-binding three-tier change-categorization framework, built on the architectural controls
described in Sections III.A through III.D above, as a starting point for future guidance.
These proposals operate within the statutory framework for predetermined change control plans. Section
515C of the FD&C Act (21 U.S.C. 360e-4), added by section 3308 of the Food and Drug Omnibus
Reform Act of 2022, provides that a manufacturer need not submit a supplemental PMA or a new 510(k)
for a change that is consistent with a PCCP that FDA has approved or cleared [20]. Nothing below
changes FDA's role: a PCCP would still be reviewed and cleared or approved by FDA, and the tiers
describe how changes would be categorized, not who decides.
The framework resolves the Question 23 difficulty — that specific future foundation-model updates
cannot be individually prespecified — by prespecifying the verification method rather than the content of
each change: a PCCP for a GenAI-enabled device can commit in advance to running any qualifying
change through the sponsor's automated regression test harness (Section III.C) against the original
competency benchmark suite and prespecified acceptance bounds, even though the substance of a future
model checkpoint update is not yet known at authorization time.

Tier Illustrative Change Type Suggested Regulatory Pathway

1 — Managed Infrastructure changes with no effect on output Documented under the sponsor's existing designentirely within distribution: API endpoint migration with an change control procedure (ISO 13485 Clause
the QMS (no identical, version-locked model; logging/telemetry 7.3.9), gated by a zero-drift (or pre-specified
FDA notification) enhancements; non-clinical UI copy edits; tolerance) result from the automated regression
inference hardware changes verified bit-exact or harness described in Section III.C.
within pre-specified tolerance.

2 — Within a Foundation-model checkpoint updates within the Permitted under a PCCP whose pre-specified
pre-authorized version-freezing commitment described in the modification protocol is the regression-harness
PCCP Foundation Model MAF (Section III.A); safety- verification method itself (not the specific future
filter or system-prompt adjustments; scheduled change), with results against the original
RAG knowledge-base/reference-corpus refreshes. benchmark suite and acceptance bounds
documented in the design history file before
deployment.

3 — Requires Change in the underlying foundation-model Outside the scope of any PCCP; requires a new or
new premarket architecture or family; removal or material supplemental premarket submission with updated
submission weakening of an ingress or egress guardrail layer; competency-based evaluation evidence under
expansion of intended use or clinical scope; a shift Section V.
in the device's position on the Section IV two-axis

Page 7 of 12
 Docket No. FDA-2026-N-7874 | Comment of Rahul Kanety, MEM

Tier Illustrative Change Type Suggested Regulatory Pathway

risk framework.

Illustrative application. Consider a GenAI-enabled device that drafts clinical summaries and
recommendations for clinician review, using a third-party hosted foundation model. In Tier 1, the sponsor
migrates to a new cloud endpoint running the same version-locked model. Regression testing across the
competency suite shows output within the prespecified tolerance, and the change is recorded under design
change control (ISO 13485 Clause 7.3.9) with no FDA notification. In Tier 2, the model provider releases
an updated checkpoint. Under an authorized PCCP, the sponsor runs the update through the prespecified
regression harness, confirms that accuracy remains within the authorized error bounds and that safety
guardrails are intact, and files the verification record in the design history file before deployment. In Tier
3, the sponsor moves the device from clinician-reviewed recommendations to autonomous entry of orders
into the electronic record without clinician confirmation. This changes the device's position on the Section
IV two-axis risk framework and falls outside any PCCP, so a new or supplemental premarket submission
would be needed. This example is illustrative and is not intended to describe any particular product.
I recommend the final framework make explicit that the tier classification decision, and its supporting
rationale, be documented in the design history file and available for FDA review, consistent with ISO
13485:2016 Clause 7.3, and that a sponsor's internal classification remain subject to FDA audit during
inspections conducted under Compliance Program 7382.850.

G. Front-Loading Oversight: A Remote-First Pre-Work Model That Reduces the Need for
Repeated On-Site Presence
The recommendations above work best if FDA can review sponsor evidence early and remotely, and
reserve on-site presence for verification and for-cause situations. GenAI-enabled devices depend on
cloud-hosted foundation models, so an inspector cannot walk a line and see the controlling process. The
controlling evidence is already digital: regression-harness results, supplier quality agreements, change
logs, and drift-monitoring data. I recommend CDRH consider the following illustrative, non-binding
model, which builds on Questions 18, 22, 23, 24, and 25 and on existing FDA mechanisms rather than
creating new ones.
1. Agree the verification method before the data exist. Through the Q-Submission Program [18], a
sponsor can ask FDA to give feedback on the regression-harness verification method, the benchmark
suite, and the acceptance bounds that would form the prespecified modification protocol in a PCCP
(Section III.F). Agreeing the method up front means later changes are judged against criteria both sides
have already seen.
2. Review foundation-model supplier evidence once, not at every sponsor. If a Foundation Model MAF
(Section III.A) holds the provider's dataset provenance, benchmark stability, red-teaming summary, and
version-freezing commitment, FDA can assess that evidence in one place and sponsors can reference it.
This avoids repeating the same supplier assessment at each sponsor's site or in each submission.
3. Use records requests in advance of, or in lieu of, an inspection. Section 704(a)(4) of the FD&C Act (21
U.S.C. 374(a)(4)) authorizes FDA to request records and other information in advance of or in lieu of an
inspection, and FDA treats such requests as a form of Remote Regulatory Assessment [19]. For a GenAIenabled device, the records that matter most are electronic and can be exchanged this way: regressionharness logs, quality agreements with change-notification thresholds, the tier classifications from Section
III.F, and drift-monitoring trend reports tied to the CAPA subsystem.

Page 8 of 12
 Docket No. FDA-2026-N-7874 | Comment of Rahul Kanety, MEM

4. Reserve on-site presence for verification. FDA would keep its inspection authority and its ability to
inspect for cause. On-site visits would then confirm what the remote record review could not: that the
harness is run as documented, that change control is followed in practice, and that the records reflect
actual operations. I am not suggesting FDA give up any authority. The aim is to make each on-site visit
shorter and better targeted.
Sponsors would also benefit from fewer repeated visits, and the model fits the least burdensome
principles discussed in Section III.E. Two cautions apply. Records requests under section 704(a)(4) must
be proportionate and well scoped, and sponsors would need clear expectations on format, confidentiality,
and response time. Evidence about trade secrets and the foundation model provider's proprietary data
would need the same confidentiality protection that applies to master files [3,4].

Pre-work element What FDA could review Existing mechanism What stays on-site or for
remotely cause

Agree the verification Regression-harness design, Q-Submission Program [18]; Confirmation that the agreed
method benchmark suite, acceptance PCCP method is followed in practice
bounds

Review supplier Foundation Model MAF Master file concept (21 CFR Sponsor-level supplier controls
evidence once content: provenance, 814.3(d), 814.9(a)) and incoming verification
benchmark stability, versionfreezing commitment

Routine records review Regression logs, quality FD&C Act 704(a)(4) records Spot verification of records
agreements, tier classifications, requests; Remote Regulatory against operations; for-cause
drift trend reports Assessments [19] inspection

IV. Line-Item Summary of Recommendations
The table below consolidates the recommendations in Section III for ease of Agency review.

# Discussion Paper Section / Current Discussion Focus Recommended Addition
Topic (paraphrased)

1 Questions 24-25: Foundation Seeks feedback on a voluntary Define minimum MAF content (dataset
Model MAF Foundation Model Device Master File provenance, benchmark stability, redmechanism, without specific content teaming summary, version-freezing
expectations. commitment), informed by 21 CFR
814.3(d)/814.9(a) and, by cross-center
analogy, the Type V DMF and AMT
Designation Program frameworks.

2 Section IV: Deployment Discusses cloud/on-device/hybrid Classify externally supplied foundation
Architecture deployment as a technical configuration models as critical Tier-1 outsourced
question. software (SOUP) under ISO 13485
Clause 7.4; require documented AI
Quality Agreements with defined
change-notification thresholds.

3 Section IV: Supplier Does not address verification pathways Clarify acceptable alternative
Verification when on-site supplier audit is verification evidence (SOC 2 Type II,
impracticable. model/system cards, automated API
regression testing) under ISO 13485 Cl.
7.4.1-7.4.3.

4 Section V: Competency-Based Proposes clinician-credentialing-inspired Recognize competency rubrics and
Evaluation competency evaluation without design- adversarial test suites as Design Outputs
control documentation mapping. (Cl. 7.3.4) in the medical device file (Cl.

Page 9 of 12
 Docket No. FDA-2026-N-7874 | Comment of Rahul Kanety, MEM

# Discussion Paper Section / Current Discussion Focus Recommended Addition
Topic (paraphrased)

4.2.3); require automated regression
harnesses with quantitative error bounds
before design transfer (Cl. 7.3.8).

5 Section V, S.2: Identifies multi-turn conversational drift Require pre-specified multi-turn
Scope/Boundary Adherence and scope maintenance as an evaluation adversarial stress testing with
priority. documented pass/fail criteria as part of
design verification.

6 Section VI.A: Postmarket Proposes periodic re-benchmarking and Connect monitoring data to the feedback
Monitoring sample-based clinician review. process (Cl. 8.2.1) and CAPA subsystem
(Cl. 8.5.2); trace emergent failure modes
to the risk management file (ISO
14971:2019 Cl. 10).

7 Statutory Framing: Least Discussion Paper does not frame its State expressly that QMS-anchored
Burdensome proposals against FDA's statutory least recommendations operate within the
burdensome obligations. existing Part 820/ISO 13485 framework;
tier premarket rigor to clinical
consequence per the Sec. 520(o)(1)(E)
CDS criteria; recognize the Foundation
Model MAF and automated regression
harnesses as least-burdensome
verification mechanisms.

8 Questions 22-23: QMS vs. Asks whether change categories exist Adopt, within the FD&C Act Sec. 515C
Premarket Review, PCCP that could be managed within a QMS or PCCP framework, a three-tier changeAdaptation a PCCP, and how PCCP concepts could categorization framework (QMS-only;
be adapted when future modifications within a pre-authorized PCCP; requires
cannot be fully prespecified. new submission); resolve the
prespecification problem by committing
a PCCP to a prespecified verification
method (the automated regression
harness) rather than prespecified change
content.

9 Question 16: Independent Asks what qualification/independence Recognize accredited certification to
Third-Party Qualification criteria should apply to third-party ISO/IEC 42001:2023 (by a body
involvement, and how to avoid limiting accredited under ISO/IEC 17021competition. 1:2015) as one qualifying, non-exclusive
form of independent verification of a
foundation model provider's AI
governance.

10 Questions 18, 22-25: Review Does not address how FDA and sponsors Adopt a remote-first pre-work model:
and Oversight Model could exchange verification evidence agree the verification method via the Qearly and remotely, or how repeated on- Submission Program; review foundationsite presence could be reduced. model supplier evidence once through
the MAF; use records requests under
FD&C Act 704(a)(4) in advance of or in
lieu of inspection; reserve on-site visits
for verification and for cause.

V. Conclusion
The Discussion Paper represents a thoughtful initial step toward a regulatory framework for generative
AI-enabled medical devices, and I commend CDRH and the Digital Health Center of Excellence for
seeking stakeholder input at this early, pre-guidance stage. The recommendations above are intended to

Page 10 of 12
 Docket No. FDA-2026-N-7874 | Comment of Rahul Kanety, MEM

help bridge the Discussion Paper's clinical and algorithmic framing with the quality-system and suppliergovernance obligations that now apply to all medical device software under the QMSR: structuring the
proposed Foundation Model MAF mechanism with reference to CDRH's existing master file provisions
and, by analogy, established cross-center platform-filing precedents; governing third-party foundation
models as critical outsourced suppliers under ISO 13485 Clause 7.4; anchoring competency-based
evaluation in documented design verification under Clause 7.3; connecting postmarket drift monitoring to
the CAPA subsystem and risk management file; framing these recommendations explicitly within FDA's
statutory least burdensome obligations under Sections 513(a)(3)(D) and 513(i)(1)(D) of the FD&C Act;
proposing a tiered change-categorization framework directly responsive to Questions 22 and 23 regarding
the boundary between a sponsor's quality management system and FDA premarket review; and proposing
a remote-first pre-work model that lets FDA review verification evidence early and reserve on-site
presence for verification and for-cause situations. I have organized these comments, where applicable,
around the Discussion Paper's own numbered questions (Questions 16, 18, 19, 21, 22, 23, 24, and 25) in
the hope that doing so makes this submission more directly useful to the Agency's internal review
process. I would be pleased to provide additional information or clarification regarding any of these
comments.

VI. References
1. U.S. Food and Drug Administration, Center for Devices and Radiological Health, Digital Health Center
of Excellence. Considerations for the Regulation of Generative AI-Enabled Medical Devices: Discussion
Paper and Request for Feedback (Docket No. FDA-2026-N-7874, August 18, 2026).
2. Code of Federal Regulations, Title 21, Part 820 — Medical Devices; Quality System Regulation
Amendments (Quality Management System Regulation / QMSR), effective February 2, 2026.
3. Code of Federal Regulations, Title 21, Section 814.3(d) — Definitions (master file).
4. Code of Federal Regulations, Title 21, Section 814.9(a) — Confidentiality of data and information in a
premarket approval application (PMA) file.
5. Code of Federal Regulations, Title 21, Section 314.420(a)(5) — Drug Master Files, Type V Master
Files.
6. Federal Food, Drug, and Cosmetic Act, Section 506L (21 U.S.C. 356l) — Advanced Manufacturing
Technologies Designation Program.
7. International Organization for Standardization. ISO 13485:2016, Medical Devices — Quality
Management Systems — Requirements for Regulatory Purposes (Clauses 4.2.3, 7.3, 7.4, 8.2.1, 8.5.2).
8. International Organization for Standardization. ISO 14971:2019, Medical Devices — Application of
Risk Management to Medical Devices (Clause 10, Post-Production Activities).
9. International Electrotechnical Commission. IEC 62304:2006/AMD 1:2015, Medical Device Software
— Software Life Cycle Processes (SOUP; Clause 5.7, Software System Testing).
10. U.S. Food and Drug Administration. Compliance Program 7382.850, Inspection of Medical Device
Manufacturers (updated February 2, 2026).
11. Federal Food, Drug, and Cosmetic Act, Sections 513(a)(3)(D) and 513(i)(1)(D) (21 U.S.C. 360c(a)(3)
(D), (i)(1)(D)) — Least Burdensome statutory requirements.
12. Federal Food, Drug, and Cosmetic Act, Section 520(o)(1)(E) (21 U.S.C. 360j(o)(1)(E)) — Clinical
decision support software exclusion criteria.

Page 11 of 12
 Docket No. FDA-2026-N-7874 | Comment of Rahul Kanety, MEM

13. International Organization for Standardization / International Electrotechnical Commission. ISO/IEC
42001:2023, Information Technology — Artificial Intelligence — Management System.
14. International Organization for Standardization. ISO/IEC 17021-1:2015, Conformity Assessment —
Requirements for Bodies Providing Audit and Certification of Management Systems — Part 1:
Requirements.
15. Rahul Kanety, public comment submitted on Docket No. FDA-2025-N-6075 (distributed
manufacturing quality governance).
16. Rahul Kanety, public comment submitted on Docket No. FDA-2026-D-4272 (container closure
systems and device constituent parts for biosimilar products).
17. Rahul Kanety, public comment submitted on Docket No. FDA-2026-D-4692 (chemistry,
manufacturing, and controls flexibilities for cellular and gene therapy products).
18. U.S. Food and Drug Administration. Requests for Feedback and Meetings for Medical Device
Submissions: The Q-Submission Program. Guidance for Industry and FDA Staff (final, May 2025;
Docket FDA-2018-D-1774).
19. Federal Food, Drug, and Cosmetic Act, Section 704(a)(4) (21 U.S.C. 374(a)(4)) — Requests for
records or other information in advance of or in lieu of an inspection; and U.S. Food and Drug
Administration, Remote Regulatory Assessments guidance.
20. Federal Food, Drug, and Cosmetic Act, Section 515C (21 U.S.C. 360e-4) — Predetermined change
control plans for devices; added by Section 3308 of the Food and Drug Omnibus Reform Act of 2022
(Pub. L. 117-328).

VII. Author Background & Professional Credentials
This comment is submitted in an individual capacity by an active industry Quality Assurance and
Engineering professional specializing in medical device quality systems, software/hardware compliance,
and supplier quality governance.
● Author: Rahul Kanety, MEM
● Education: Master of Engineering Management.
● Experience: Over 15 years in medical device quality management systems, supplier quality
engineering, and regulatory compliance across original equipment manufacturers, contract manufacturers,
and component suppliers.
● Certifications: ASQ Certified Quality Auditor (CQA); ISO 13485:2016 Lead Auditor.
Disclaimer
This comment reflects the personal professional analysis and technical opinions of the author and does
not represent the official views, positions, or endorsements of any past or present employer. It is
submitted in an individual capacity as an independent technical expert.

Page 12 of 12