Healthcare Trust Institute (Tina O. Grande)

Attached please find the comments of the Health Trust Institute

Submitted via http://www.regulations.gov

October 15, 2026

Michelle E. Tarver, M.D., Ph.D., Director
Food and Drug Administration
Center for Devices and Radiological Health
10903 New Hampshire Ave
Building 66
Silver Spring, MD 20993
T
RE: Considerations for the Regulation of Generative AI-Enabled Medical Devices:

AF
Discussion Paper and Request for Feedback (FDA-2026-N-7874)

Dear Director Tarver:

The Healthcare Trust Institute (HTI) appreciates the opportunity to submit comments on
the August 2026 discussion paper entitled "Considerations for the Regulation of
Generative AI-Enabled Medical Devices: Discussion Paper and Request for Feedback"
issued by the Digital Health Center of Excellence within the Center for Devices and
Radiological Health (CDRH) within the U.S. Food and Drug Administration (FDA).

R
HTI is an alliance of healthcare organizations committed to promoting and implementing
effective protections for health information that engender trust in the healthcare system
and allow for the necessary exchange of health data to advance treatments, cures and
improved healthcare quality for individuals and populations. HTI members, which
include companies and organizations from across the U.S. healthcare economy, agree
that strong national standards for the protection of health information are critical to

D
engender trust in information sharing and spur medical innovation.
The discussion paper appropriately recognizes both the significant potential of
generative artificial intelligence (“GenAI”) to improve healthcare and the challenges that
these technologies present for traditional approaches to medical device regulation. We
support FDA’s efforts to develop a regulatory framework that protects patients while
allowing responsible innovation to continue.
Our comments focus on several broad principles that we believe should guide FDA’s
approach to GenAI-enabled medical devices. In particular, regulation should be risk-based
and proportionate, focused on the actual function and potential consequences of a
technology rather than on the fact that it uses AI. The use of GenAI, standing alone, should
not alter whether a particular software function meets the statutory definition of a medical
device, and FDA should continue to evaluate software at the individual-function level under
the applicable statutory criteria. The framework should be flexible and technology-neutral,
recognize the importance of human oversight, incorporate appropriate privacy, security,
transparency and accountability protections, and make meaningful use of post-market
monitoring and other total product lifecycle approaches. Above all, the regulatory
framework should avoid unnecessary or duplicative requirements that could delay or
prevent patients and providers from benefiting from useful technologies.
The Promise of Generative AI in Healthcare

AI is already transforming healthcare in many ways that can directly benefit patients. It
is being used to assist clinicians with diagnosis and treatment, identify abnormalities in
medical images, support pathology and radiology, improve clinical documentation,
summarize medical information, reduce medication errors, and help clinicians process
large amounts of information more quickly. AI can also support research and
development, including the discovery of new drugs and treatments.

T
GenAI has the potential to expand these benefits. Its ability to work with open-ended
inputs, generate natural language and other content, and adapt to different
circumstances may allow it to perform functions that would have been difficult or
impractical using earlier forms of software. FDA appropriately recognizes that these

AF
capabilities may result in more personalized outputs, improved adaptability to novel
inputs, enhanced interaction with users, and support for more complex tasks.
Ambient AI and other tools can reduce the administrative burden on clinicians and allow
them to spend more time interacting with patients. These benefits are not limited to
direct clinical decision-making. AI can improve the patient experience by helping
patients obtain information, understand complicated medical information, navigate
healthcare systems, schedule appointments, identify appropriate providers, and obtain
information about claims or other administrative matters. Many of these functions may
fall outside the medical-device framework, and their inclusion here is intended only to
illustrate the range of healthcare AI applications, not to suggest that use of GenAI

R
should bring otherwise non-device functions within FDA device jurisdiction.

These applications illustrate an important point for regulation: AI is not a single
technology and should not be treated as a single category of risk. The same underlying
technology may be used for a relatively low-risk administrative function in one setting

D
and for a substantially more consequential clinical function in another. The regulatory
response should reflect that distinction.
A Risk-Based and Proportionate Approach

We strongly support FDA’s stated commitment to a risk-based approach. FDA explains
that it does not regulate AI or GenAI as technology in the abstract, but regulates
products that meet the definition of a medical device and applies risk-based oversight
based on the controls necessary to provide reasonable assurance of safety and
effectiveness. We believe this principle should remain central as FDA develops its
approach to GenAI.
The mere presence of GenAI should not make a medical device high risk. The relevant
considerations should include what the device does, the intended use, the potential

T
AF
R
D
consequences of an incorrect output, the degree of human involvement and oversight,
the clinical context, and the extent to which a user can identify and address an
erroneous output before harm occurs.

In particular, there is an important distinction between an AI system that assists a
clinician by identifying information, suggesting possibilities, organizing relevant data, or
making a recommendation for a qualified professional to consider, and a system that
independently makes a consequential decision without meaningful human involvement.
AI-assisted clinical decision support can augment the capabilities of clinicians without
replacing their judgment. Regulation should recognize that distinction rather than
treating all AI-assisted decision-making as equivalent. At the same time, human
involvement should not be treated as a guarantee that an application is low risk. A
nominal human review requirement may provide little protection if the human reviewer
lacks the information, expertise, time, or ability to meaningfully evaluate the AI output.
Conversely, some AI applications may be capable of providing significant benefits with

T
relatively limited risk even where they perform sophisticated functions. The
appropriate inquiry therefore should be whether the overall system has appropriate
safeguards in light of its actual use and potential consequences. For AI used to inform
clinical care decisions, those safeguards should preserve meaningful clinician
oversight and should support, rather than replace, clinical judgment.

AF
We believe FDA’s proposed risk-based approach provides a useful foundation because
it recognizes that regulatory requirements should vary according to risk. The greater the
potential for material patient harm, the stronger the applicable safeguards should be.
Lower-risk applications should not be subjected to requirements designed for the
highest-risk uses simply because they rely on the same underlying technology.
Regulation Should Be Flexible and Technology-Neutral

A flexible regulatory approach is particularly important for GenAI because the

R
technology is evolving rapidly. FDA recognizes that GenAI-enabled devices may accept
open-ended inputs, generate variable outputs, and change over time as models,
prompts, retrieval strategies, guardrails, orchestration and interfaces are modified. FDA
also recognizes that it may not be practical to evaluate every conceivable input and
output before a device is deployed.

D
These characteristics make overly prescriptive regulation especially problematic.
Requirements that are tied too closely to a particular technology, model architecture,
testing methodology or development practice may quickly become obsolete. They may
also discourage beneficial modifications and improvements to existing systems. This is
particularly important in healthcare, where AI tools may be refined continuously based
on clinical experience, new evidence, changing populations and improvements in
technology. A regulatory framework should permit responsible iteration rather than
creating incentives to leave a system unchanged simply because modifications could
trigger substantial new regulatory requirements.

FDA should therefore establish durable principles and outcome-oriented expectations
rather than detailed technical requirements wherever possible. Manufacturers and other
entities responsible for demonstrating device safety and effectiveness should have
flexibility to demonstrate safety and effectiveness using methods appropriate to the
particular technology, intended use and level of risk. Healthcare organizations
deploying third-party technologies should remain responsible for appropriate
implementation and clinical governance consistent with their role, rather than assuming
obligations assigned to the developer or manufacturer. This approach is consistent with
FDA’s own recognition that new methodologies may be needed to evaluate GenAIenabled devices and that least-burdensome principles should inform their evaluation.
Evidence and Evaluation Should Be Proportionate to Risk

The unique characteristics of GenAI mean that traditional approaches to software
testing may not always be appropriate. FDA recognizes that the range of possible inputs
and outputs may be too large for exhaustive testing and is considering approaches that
combine benchmarking with clinical confirmation.

T
We support the general concept that evaluation should focus on whether a device
demonstrates the capabilities necessary for its intended use rather than attempting to
test every conceivable scenario. However, the amount and type of evidence required
should be proportionate to risk. For higher-risk clinical applications, extensive clinical

AF
testing and, where appropriate, multisite or real-world validation may be appropriate.
For others, a combination of performance testing, established clinical standards, expert
review, real-world evidence, and post-market monitoring may provide a more
meaningful and efficient basis for demonstrating safety and effectiveness. The
regulatory framework should allow these different forms of evidence to be used where
scientifically appropriate.

Similarly, benchmarking can be useful, but benchmarks should not become de facto
regulatory requirements that are applied without regard to the particular device. FDA
itself recognizes potential limitations of publicly available benchmarks, including data

R
contamination, saturation and lack of representativeness of real-world conditions. A
benchmark should be relevant to the intended use and patient population and should
provide meaningful information about real-world performance. The goal should be
meaningful evidence—not simply more evidence. Requiring manufacturers to generate
large quantities of testing data that do not materially improve confidence in safety or
effectiveness would increase costs without necessarily improving patient protection.

D
The Total Product Lifecycle Is Particularly Important for GenAI

We strongly support FDA’s emphasis on a total product lifecycle (“TPLC”) approach. For
GenAI, it may be particularly difficult to establish through premarket testing alone how a
system will perform in all of the circumstances it may encounter after deployment. FDA
appropriately recognizes that performance may change over time and that premarket
evidence may need to be complemented by post-market monitoring.
Post-market monitoring can therefore be an important component of a risk-based
regulatory framework. Manufacturers, developers, and deploying healthcare
organizations, consistent with their respective roles and ability to control the technology,
should have appropriate processes for identifying material changes in performance,
including issues such as unexpected outputs, performance degradation, model drift,
and other problems that may emerge in actual use. At the same time, post-market
obligations should also be proportionate. Monitoring requirements for a low-risk
application should not be equivalent to those for a system whose output can directly
determine a significant clinical intervention. FDA should allow manufacturers and
healthcare organizations to develop monitoring approaches appropriate to their
respective responsibilities, their ability to control or modify the system, and the
particular technology and risk profile.

A well-designed TPLC approach can also support innovation. Rather than requiring
every change to a GenAI-enabled device to undergo the same level of premarket
review, FDA should distinguish between changes that could materially affect safety or
effectiveness and routine improvements that do not. Appropriate change-control

T
mechanisms can allow responsible innovation while preserving appropriate regulatory
oversight.
Privacy, Security, Transparency and Accountability

Risk management for GenAI-enabled medical devices should also incorporate privacy

AF
and cybersecurity considerations. Healthcare AI systems may process highly sensitive
health information, and the consequences of unauthorized access, inappropriate
disclosure or manipulation of data can be significant.
Privacy and security should therefore be incorporated into the design and deployment of
AI systems through appropriate administrative, technical and physical safeguards, data
minimization, appropriate limitations on data use, access controls, cybersecurity
protections and workforce training. These protections should be risk-based and should
build on existing healthcare privacy and security requirements rather than creating
duplicative regulatory obligations. For HIPAA covered entities, FDA and other federal

R
agencies should avoid establishing parallel AI-specific privacy regimes that duplicate or
conflict with established HIPAA privacy and security obligations. Where prescriptive AIspecific transparency, disclosure, or opt-out requirements are contemplated, existing
obligations applicable to covered entities should be recognized and duplicative
requirements avoided.

D
Transparency is similarly important to maintaining trust in AI. Patients and clinicians
should have meaningful information about the nature and appropriate use of an AIenabled system, including its limitations where those limitations are material to safe use.
Users should not be misled about whether they are interacting with an AI system or
relying on AI-generated information where that information is material to safe or
appropriate use of the technology. Transparency expectations should be calibrated to
clinical risk, the nature of the interaction, and operational feasibility. At the same time,
transparency should not become a requirement to disclose proprietary algorithms,
source code, detailed training data or other commercially sensitive information where
such disclosure would provide little practical benefit to patients or clinicians. The
objective should be meaningful transparency, not disclosure for its own sake.
Requirements should provide users with information they can understand and use while
protecting legitimate intellectual property and security interests.

Accountability should be clearly allocated according to the role each entity plays in the
AI lifecycle and the functions it controls. Developers and manufacturers should remain
responsible for appropriate design, development, validation, and product-level
performance, while healthcare organizations should be responsible for appropriate
selection, configuration, implementation, clinical governance, and monitoring within
their deployment environment. Healthcare organizations deploying third-party products
should not be treated as developers solely because they configure or use those
products in clinical workflows. Responsibility should not be shifted to patients simply
because an AI system is involved in their care.
Patients Should Not Bear the Responsibility for Managing AI Risk

T
Patients should remain at the center of AI regulation, but that does not mean that
patients should be required to evaluate the safety or appropriateness of every AI
application used in their healthcare. It would be impractical to require patient consent for
every use of AI in healthcare. AI may be incorporated into many aspects of care and
healthcare administration, including functions that patients may never see or even know

AF
involve AI. Requiring an individual consent process each time AI is used could create
substantial administrative burdens without necessarily providing meaningful protection.
Similarly, broad patient opt-out requirements could have unintended consequences.
Healthcare organizations may not have the operational ability to provide the same
service differently for individual patients depending on whether they have opted out of a
particular AI-enabled function. In some circumstances, the practical result could be
elimination of the service for everyone rather than creation of a meaningful alternative
for a single patient.

R
Patients also may not understand the consequences of opting out. An AI-enabled
system may provide a service more quickly, identify information that might otherwise be
missed, or reduce administrative burdens. A patient who opts out may therefore receive
a materially different experience without fully understanding the implications. The better
approach is to place responsibility on the organizations and professionals deploying AI
to ensure that appropriate safeguards are in place. Patients should receive meaningful

D
information and education where appropriate, and transparency regarding AI use may
be incorporated into broader care-setting communications or general consent
processes where appropriate, rather than requiring individualized consent for each AIenabled function. The regulatory system should not shift the burden of AI governance
onto the individual patient.
Reliance on Recognized Frameworks and Standards

FDA should, where appropriate, encourage the use of recognized national frameworks
and voluntary consensus standards, including industry-developed and provider-tested
approaches. Such frameworks should remain flexible and voluntary and should not
become additional conditions of clearance or otherwise displace applicable statutory
and regulatory requirements. Organizations are increasingly developing governance
and risk-management programs for AI, and requiring them to satisfy multiple
overlapping frameworks can create substantial compliance costs without necessarily
improving outcomes.
Risk-management frameworks such as the NIST AI Risk Management Framework
provide a useful foundation because they are designed to address AI risks without
prescribing a single technological solution. Similarly, recognized standards can provide
consistency in areas such as testing, risk assessment, security, data governance and
performance monitoring. The use of established frameworks should not mean that
compliance with a framework automatically establishes safety or effectiveness. Rather,
it should provide a flexible means for organizations to demonstrate that they have
implemented appropriate processes for identifying and managing risks.

T
This approach would also promote consistency across the healthcare sector and reduce
the risk of fragmented requirements. Healthcare organizations already operate under
extensive federal and state regulatory requirements. New AI requirements should
complement those frameworks rather than create overlapping or conflicting obligations.

AF
Innovation and Patient Protection Are Not Competing Goals

The objective of AI regulation should not be to eliminate all risk. No medical
technology—and no healthcare decision-making process—is entirely free of risk. The
objective should be to identify and manage material risks in a manner proportionate to
the potential benefits and harms.
This is particularly important because AI has the potential to address some of the
longstanding challenges in the healthcare system. It can help clinicians manage increasing
volumes of information, improve access to expertise, reduce administrative burdens,

R
support earlier identification of disease, and enable more efficient delivery of care.
Excessively burdensome regulation could delay these benefits, particularly for smaller
developers and healthcare organizations that lack the resources to navigate complex
regulatory requirements.

FDA’s discussion paper appropriately recognizes the need for a “nimble” approach and

D
emphasizes least-burdensome principles and timely access to safe and effective
devices. We encourage FDA to maintain that focus as its thinking develops.
A regulatory framework that is flexible, risk-based and grounded in evidence can
protect patients while allowing responsible innovation. Conversely, a framework that is
overly prescriptive, technology-specific or duplicative could discourage investment,
slow development and make it more difficult for patients and providers to benefit from
useful technologies.
Conclusion

Generative AI presents both important opportunities and legitimate challenges for
healthcare. FDA’s discussion paper provides a valuable opportunity to develop a
regulatory approach that recognizes both.
We support a framework that is risk-based, proportionate, flexible, technologyneutral and focused on the total product lifecycle. The level of regulatory scrutiny
should reflect the actual function of a device, the consequences of an incorrect output,
the degree of meaningful human oversight and the overall clinical context—not simply
the fact that the device uses GenAI.

The framework should encourage meaningful evidence of safety and effectiveness
while avoiding unnecessary testing that does not materially improve patient protection. It
should permit responsible innovation and iterative improvement, incorporate appropriate
privacy and cybersecurity safeguards, provide meaningful transparency, and make
appropriate use of post-market monitoring. Recognized national frameworks and
standards should be leveraged where appropriate to promote consistency and avoid
duplicative requirements.

T
Most importantly, AI regulation should keep patients at the center. Patients should
benefit from AI that is trustworthy, secure, transparent and appropriately governed,
while clinicians should be able to use AI to augment their expertise and improve the

AF
delivery of care. A thoughtful regulatory framework can achieve these objectives without
imposing unnecessary barriers to innovation.

We therefore encourage FDA to continue developing a regulatory approach that places
the strongest safeguards around applications presenting the greatest risks while
allowing lower-risk applications to develop and improve. Such an approach will best
serve both patient safety and the broader goal of making healthcare more effective,
accessible and responsive.
Thank you for your consideration of our comments. Please do not hesitate to contact
me at tina@hctrustinst.com or 202-750-1989 if you have any questions.

R
Sincerely,

D
Tina O. Grande
President, Healthcare Trust Institute