Jesus Recio

Docket FDA-2026-N-7874
Considerations for the Regulation of Generative AI-Enabled Medical Devices: Discussion Paper and Request for Feedback

To the Digital Health Center of Excellence:

Thank you for opening this discussion. I’m a practicing certified registered nurse anesthetist in Tampa, Florida, and I’m working on independent methods for testing clinical AI. My comments address Questions 9, 10, 12, 13, 16, 20 and 26. They come from one setting, the operating room, where the monitor is the only way the clinician knows what the patient’s body is doing.

1. Add closed-loop physiologic simulation as a benchmarking method (Questions 9, 12, 13)

Section V.B.2 mentions virtual patient avatars. I’d ask the Agency to name closed-loop physiologic simulation as its own benchmarking method, one in which the simulated patient’s state responds to what the device does. A replay of recorded cases can’t show that. The newest anesthesia benchmark I’m aware of, AnesTRACE (arXiv 2609.32740, September 2026), says of its own design that model recommendations "do not change subsequent patient states." A device that adjusts a drug dose, followed by a patient who responds to the adjustment, is the case an agentic device has to be tested on.

On Question 13, a physiology engine answers the concern about synthetic data from models of the same class as the device. The patient is generated by mechanistic equations, so it can’t inherit the device’s blind spots. Open-source engines such as Pulse and BioGears run faster than real time, which makes thousands of repeated cases a day practical on ordinary hardware and supports the statistical power Question 12 asks about.

2. Test erroneous tool and sensor outputs by injecting faults (Question 26, Appendix A.1)

Element A.1 names recognition of erroneous tool outputs. I’d ask the Agency to add a specific method: during a simulated case, corrupt one instrument and score whether the device notices that the channels disagree, defers to a human, and avoids an irreversible action. Examples are a pulse oximeter that reads normal while airway pressure falls, or an infusion pump that delivers double the programmed rate. Instruments do fail this way in practice. CISA advisory ICSMA-25-030-01 describes a patient monitor with remote code execution and a hidden backdoor. For any agentic device that reads from or controls another device, the situation described in footnote 25, I’d treat this as a core test.

3. Independent third parties (Questions 10 and 16)

My answer to Question 16 is yes, with conditions. Sequestered test sets are the best response to the contamination and saturation described in Question 10, and sponsor-developed benchmarks invite optimization to the test. Three criteria I’d suggest. First, no equity, licensing or revenue link between the evaluator and the sponsor or the foundation model developer, which extends the adjudicator independence already described in Section V.B.2. Second, published test specifications with sequestered case content, and versioned tests, so that a re-benchmark after a model change (Questions 22 and 24) uses the same instrument. Third, more than one qualified evaluator and a public method any laboratory can reproduce, which answers the Agency’s concern about limiting competition.

Anesthesia became safer through monitoring standards that every hospital was held to, set independently of any one manufacturer. Clinical AI is at the same point.

4. Machine supervisory agents (Question 20)

A supervisory agent can help with postmarket monitoring. It should be benchmarked by the same independent procedure as the device it watches, and it shouldn’t come from the same model family as that device, since a shared blind spot would pass unseen.

Please let me know if you have any questions and/or concerns. I’m glad to provide more detail on any of the above.

Sincerely,

Dr. Jesus Recio, CRNA
Tampa, Florida