North American Spine Society

See attached file(s)

Comments on the Regulation of Generative AI
Enabled Medical Devices
North American Spine Society AI Task Force

Docket FDA-2026-N-7874 | Draft dated October 2, 2026

Submitted to Food and Drug Administration, Center for Devices and Radiological Health

To the Center for Devices and Radiological Health:

The North American Spine Society appreciates the opportunity to comment on the FDA
discussion paper “Considerations for the Regulation of Generative AI-Enabled Medical Devices”.
We support a risk-based, total product life cycle approach that protects patients while allowing
useful technologies to reach clinical practice. Our comments address the areas in which a spine
specialty society can contribute most directly, principally Questions 1, 9, 18 through 21, 24, and
26.

The proposed framework appropriately emphasizes how directly a device influences or takes a
clinical action, the potential consequences of an incorrect output, competency testing, clinical
confirmation, and postmarket monitoring. We recommend that FDA also make clinical
auditability and decision provenance explicit across this framework. We further recommend a
risk-proportionate approach to auditability and a defined role for professional societies in
specialty-specific postmarket evaluation that does not dilute manufacturer accountability.

Summary of Recommendations
• Add clinical auditability and decision provenance as cross-cutting safety properties in risk
assessment, premarket evaluation, and postmarket monitoring, including version tracking
and proportionate re-evaluation when underlying models or configurations change.
• Scale the required degree of reconstructability to the clinical consequence, degree of
autonomy, reversibility of action, longitudinal complexity, and opportunity for human
review.
• Define a constructive role for professional societies in developing specialty-specific
benchmarks, identifying failure modes, supporting expert review, and detecting safety
signals, while keeping manufacturers responsible for their devices.

Clinical Auditability and Decision Provenance
FDA asks in Question 1 whether traceability to primary source materials should be represented
in the risk framework. Source traceability is important, but it does not fully address whether a
clinically consequential interaction can later be reconstructed. Clinical auditability should
answer a broader question: when an AI-assisted decision is reviewed after an unexpected
outcome, near miss, complaint, or change in device performance, can reviewers determine (i)
what information was available, (ii) what the device represented or concluded, (iii) what
recommendation or action followed, and (iv) whether and at what points human oversight
occurred?

FDA should distinguish auditability from transparency and explainability. Transparency describes
the system and its intended operation. Explainability attempts to describe why or how an
output was produced. Source traceability links an output to supporting materials. Auditability
determines whether the clinically material interaction can be reconstructed using verifiable
records. An AI-generated explanation may be useful, but it should not be treated as a faithful
record of the process that produced an output. FDA need not require disclosure or preservation
of proprietary model chain-of-thought to achieve clinical auditability.

For clinically consequential functions, a risk-proportionate record should permit identification
of:

• the relevant patient information available to the device and the provenance of material
source data;
• clinically material assertions, derived state, uncertainty, recommendations, and actions;
• the model and system version, relevant configuration, retrieval sources, and external tool
interactions;
• the user role and material human review, acceptance, rejection, or modification; and
• subsequent clinically significant state changes and outcomes when available.

FDA should clarify responsibilities for record capture, custody, retention, authorized access, and
associated costs across manufacturers and deploying institutions. Capture should be automated
wherever feasible and should not impose additional routine documentation requirements on
clinicians. Retention and access requirements should be proportionate to clinical risk and
support investigation while protecting patient privacy.

This requirement is particularly relevant in conditions requiring longitudinal care such as spine
care. A recommendation for continued observation at one time point and intervention at a later
time point may both be appropriate because symptoms, neurological findings, imaging,
treatment response, and patient preferences changed. Retaining only the two outputs does not
establish whether either was appropriate when made. The record must preserve the clinically
relevant state and evidence associated with each decision.

Risk Proportionate Requirements
The FDA's framework assesses risk using two questions: How directly does the device influence
or take a clinical action, and how serious could the harm be if its output is wrong? Auditability is
better treated as a safeguard matched to that risk, rather than as a third risk axis. As the
potential harm and degree of autonomy increase, the device should preserve a more complete
record of what occurred. A lower-risk informational tool may need only the source material,
output, and system version. A system that recommends treatment, initiates an order, controls
another device, or executes multiple steps should also record the clinically relevant state,
material tool interactions, human review, and resulting action. Reversibility, time pressure,
longitudinal complexity, and the realistic opportunity to detect and correct an error should
further determine the level of detail required.
For agentic systems addressed in Question 26, each clinically consequential transition should
leave an inspectable record. This is important when an agent plans multiple steps, calls external
tools, retrieves changing information, or acts before a clinician can review each intermediate
step. Acceptance criteria should address whether the system records the sequence of material
inputs, state changes, tool use, oversight checkpoints, outputs, and actions at a level sufficient
for investigation. For clinically consequential autonomous actions, demonstrated auditability
should be a prerequisite, with the required detail proportionate to the potential harm and scope
of autonomy.

Postmarket Monitoring and the Role of Professional Societies
Periodic re-benchmarking, sample-based clinician review, and performance degradation
monitoring can identify population-level changes. They should be complemented by case-level
investigation of clinically significant failures, near misses, and unexpected behaviors. Aggregate
monitoring may show that performance changed. An auditable record can help determine
whether an event arose from the model, missing or incorrect source data, retrieval, a tool
interaction, workflow integration, human use, or a post-deployment modification.

Professional societies can contribute specialty expertise and access to clinicians who understand
the variety of real-world uses and the clinical significance of different errors. Their appropriate
roles may include:

• defining specialty-specific use cases, realistic clinical scenarios, and failure taxonomies;
• helping develop benchmarks, adjudication criteria, and qualifications for expert review
panels;
• supporting registries, structured reporting, and signal detection where suitable data and
governance exist;
• identifying changes in practice patterns, standards of care, or workflows that may affect
device performance; and
• educating clinicians about appropriate use, limitations, reporting pathways, and emerging
safety signals.

These activities should supplement, not replace, manufacturer obligations. Manufacturers
should remain responsible for required monitoring, investigation, corrective action, change
management, and regulatory reporting. The FDA should define clear responsibilities, minimum
data access, privacy protections, conflict-of-interest safeguards, and sustainable resourcing
when professional societies participate. Society involvement should not create an unfunded
expectation that a voluntary professional organization will operate a manufacturer's safety
system.

Third Party Models and Post Deployment Change
For devices built on third-party foundation models, the record should identify the model and
system version used for each clinically consequential interaction and should preserve material
configuration information. Manufacturers should have mechanisms to detect and assess
changes to the underlying model, prompts, retrieval architecture, orchestration logic, guardrails,
and tools. A material change should trigger evaluation that is proportionate to its expected
clinical effect, with more extensive re-benchmarking or clinical review when the change affects
safety-critical behavior.

Version records and audit logs should be usable for clinical investigation, rather than serving
only as infrastructure logs. FDA should consider whether manufacturers can reproduce or
otherwise meaningfully reconstruct a representative interaction under the configuration active
at the time. Where exact technical reproduction is not feasible, the retained clinical decision
provenance should still permit review of the evidence, derived clinical state, output, human
response, and resulting action.

Proposed Regulatory Element
Clinical Auditability and Decision Provenance. Whether the device preserves sufficient,
temporally ordered, versioned, and verifiable information to permit meaningful reconstruction
of clinically consequential outputs and actions, including relevant source inputs, clinically
material derived state and uncertainty, recommendations or actions, model and system
configuration, external tool interactions, human oversight, and subsequent clinically significant
state changes.

We appreciate the FDA's effort to develop a flexible framework for generative AI-enabled
devices. Making clinical auditability and decision provenance explicit would strengthen
prospective safety evaluation, postmarket learning, and the fair allocation of responsibility as
these systems become more capable and more autonomous.

Respectfully submitted,

North American Spine Society