CorePatient, Inc. (Deborah Moore)

CorePatient, Inc. respectfully submits the attached public comment in response to the FDA’s August 2026 discussion paper, Considerations for the Regulation of Generative AI-Enabled Medical Devices, Docket FDA-2026-N-7874.

Our comment addresses clinical action governance, execution-time authorization, downstream dependencies, escalation, and evidence of completed clinical actions. It provides recommendations relevant to FDA Questions 1, 6, 19, 21, and 26.

Please see the attached PDF for our complete comments and references.

Deborah Moore
Founder and Chief Executive Officer
CorePatient, Inc.
Deborah@CorePatient.com

COREPATIENT / REGULATORY COMMENT

Comments on Considerations for the Regulation of
Generative AI-Enabled Medical Devices
Docket No. FDA-2026-N-7874 | October 13, 2026

Submitted by CorePatient, Inc. | Deborah Moore, Founder and Chief Executive Officer

Public comment on selected questions in the FDA Center for Devices and Radiological Health
discussion paper [2]

Executive Summary

CorePatient, Inc. appreciates the opportunity to comment on the FDA’s discussion paper,
Considerations for the Regulation of Generative AI-Enabled Medical Devices. CorePatient is
building and validating a vendor-neutral Clinical Action Governance platform focused on
clinically authorized actions, their timely execution, necessary next steps, and evidence of
what occurred across healthcare organizations, insurance organizations, and patients.
CorePatient does not originate clinical decisions. [1]

As GenAI-enabled medical devices begin to initiate or influence multistep activities, a
correct output or successful technical transaction does not necessarily establish that an
action remained appropriate when execution was attempted, that care reached the patient,
or that essential follow-up occurred. An earlier instruction may be superseded; an
interrupted action may be unsafe to retry without reassessing its authorization; and a
reported completion status may exceed what the available evidence supports.

Our comments address FDA Questions 1, 6, 19, 21, and 26. We recommend that FDA
consider, in a manner proportionate to device risk and intended use: execution-time
authorization and changing conditions; the consequences of under-escalation and overescalation; external dependencies and safeguards; accurate distinctions among initiated,
transmitted, completed, unresolved, and superseded actions; and postmarket evidence
from relevant clinical and organizational participants.

This is not a proposal to require any particular commercial platform, to place all healthcare
operations under FDA device regulation, or to hold manufacturers responsible for activities

© 2026 CorePatient, Inc. • FDA-2026-N-7874 Page 1
 COREPATIENT / REGULATORY COMMENT

beyond their reasonable control. It is a request that device risk evaluation and performance
claims accurately reflect consequential dependencies, changing circumstances, and the
limits of what can be verified.

The patient-safety question is whether an action remained authorized and appropriate,
what actually occurred, what still needed to happen, and what evidence supports those
conclusions. The following sections explain why those distinctions matter for GenAIenabled medical devices.

1. Why we are commenting

CorePatient, Inc. is building and validating a vendor-neutral Clinical Action Governance
platform designed to help ensure that clinically authorized actions are carried out at the
right time, with the appropriate next steps, across healthcare organizations, insurance
organizations, and patients. The objective is to help ensure that intended care reaches the
patient, that subsequent observations are captured where available, and that reliable
evidence of what occurred is preserved.

We are commenting because generative AI-enabled medical devices are moving beyond
providing information. Some can direct decisions, initiate orders, use external tools, or
participate in multistep clinical activity. That progression raises an important safety
question: what happens after an output is generated, particularly when the next action
depends on a clinician, another organization, a payer, or the patient?

The FDA discussion paper appropriately recognizes action-directing and action-taking
functions, agentic AI, changing clinical context, and postmarket performance. Our
recommendation builds on those concerns. For device functions whose intended use
involves initiating or directing consequential clinical actions, evaluation should distinguish
whether a device function worked technically from whether the intended clinical action
was authorized, remained appropriate when execution was attempted, progressed to the
patient, and was supported by reliable evidence. [1]

This is not a proposal to place all healthcare operations under FDA device regulation, or to
make a device manufacturer responsible for every act or omission by an independent
provider, insurer, or patient. It is a request to consider foreseeable dependencies when
assessing the safety of the particular regulated device function.

The central concern is not only whether a device generates a correct output. It is whether
an action remains authorized and appropriate when execution is attempted, whether the
necessary handoffs occur, and whether the patient ultimately receives the intended care.

© 2026 CorePatient, Inc. • FDA-2026-N-7874 Page 2
 COREPATIENT / REGULATORY COMMENT

Prospective governance and evidence of what happened afterward are complementary
safety considerations. Neither can be replaced by a record showing that software
completed a task.

2. Question 1: Risk assessment must consider the action, its timing, and what follows

We support a function-specific, risk-proportionate approach. The consequences of an AIenabled device output cannot always be understood from the output alone. A
recommendation, an order, and an action that is actually delivered to the patient are
different events. So are a clinician’s authorization and a payer’s coverage determination.
Neither should be mistaken for evidence that treatment occurred.

The proposed two-axis framework, which considers the degree of device activity and the
consequences of relying on an incorrect output, is a useful starting point. We do not believe
those two axes, standing alone, capture every material risk for functions that initiate or
direct consequential actions. The risk can also depend on whether the action remains
authorized when execution is attempted, how quickly circumstances may change, whether
a harmful action can be reversed, what safeguards exist beyond the device, and what the
device can reliably observe about execution. These should be explicit risk modifiers within
the proposed framework, rather than necessarily requiring a third axis. [1]

Risk assessment should consider, as relevant to the device’s intended use, whether the
function provides information, directs an action, or initiates one; who has clinical
authority; whether the action is time-sensitive or reversible; and what happens when
information or authorization changes between recommendation and attempted execution.

A clinically appropriate action at 9:00 a.m. may not remain appropriate at 10:00 a.m. A new
result, a revised order, a change in the patient’s condition, or a conflicting instruction may
change what should happen next. The evaluation question is not simply whether the device
correctly generated an instruction. It is whether the device function, within its intended
use, appropriately handles the conditions under which that instruction is acted upon.

For example, two functions may produce equally accurate instructions with similar
potential consequences, yet operate in very different circumstances. One may act
immediately under continuous clinician supervision. Another may initiate a sequence that
is carried out later, after a patient’s condition or the responsible clinician’s instruction has
changed. The second function may face an additional execution-time risk that output
accuracy alone will not reveal. A risk assessment should consider that difference when it is
reasonably foreseeable within the function’s intended use.

© 2026 CorePatient, Inc. • FDA-2026-N-7874 Page 3
 COREPATIENT / REGULATORY COMMENT

Where a device function depends on another system or organization, FDA could consider
whether testing identifies the point at which the device’s own responsibility ends, what
downstream assumptions are necessary for safe use, and how uncertainty or failure is
communicated. A transmitted order should not be represented as completed care merely
because a technical transaction succeeded.

This distinction matters most when conditions change between the original instruction and
its execution. A subsequent clinical decision may supersede an earlier one. A device
function that continues a multistep process without accounting for that change may create
risk even if each individual technical operation performs as programmed. The appropriate
safeguard will depend on the device function and its control over execution. It may involve
stopping a device-controlled action, requesting renewed clinical review, or accurately
communicating that the action cannot be confirmed as safe to proceed.

3. Question 6: Under-escalation, over-escalation, and the missed handoff

Under-escalation and over-escalation have different consequences, and both deserve
explicit evaluation. Under-escalation may mean that a device fails to identify the need for
clinical attention, fails to convey that need, or produces an escalation that never reaches
someone able to act. Over-escalation may result in unnecessary treatment, avoidable
emergency utilization, alarm burden, and diversion of clinical attention.

These two error types should not be collapsed into a single accuracy score or treated as
clinically interchangeable. We recommend characterizing them separately by clinical
setting, patient population, urgency, foreseeable severity of harm, reversibility, and the
availability of a timely human response. For a time-critical emergency, failure to direct
needed care may carry consequences fundamentally different from an unnecessary
recommendation to seek evaluation for a low-acuity condition. Conversely, repeated
unwarranted escalation can create unnecessary interventions, resource burdens, and alert
fatigue. The appropriate balance should be supported by clinical evidence and the device
function’s intended use, not a uniform trade-off applied across settings.

A further distinction is necessary. Generating an alert, delivering it, obtaining
acknowledgment, and establishing that an appropriate response occurred are not the same
event. Each may have different evidence and different limitations. A device may
successfully send a time-sensitive escalation while the receiving service is unavailable or
the patient is unable to follow the instruction.

We recommend that evaluation scenarios, where applicable to the device function, include
delayed delivery, unavailable recipients, conflicting information, changing patient

© 2026 CorePatient, Inc. • FDA-2026-N-7874 Page 4
 COREPATIENT / REGULATORY COMMENT

conditions, failed handoffs, and uncertainty about whether the escalation was resolved.
Testing should assess how the device represents the status and limitations of its own
actions, without assuming that it can compel an independent clinician or organization to
respond.

Evaluation should also distinguish whether the device produced the correct escalation
decision from whether its communication was delivered and whether a response could be
verified. A manufacturer may be able to test the first two without controlling the third. If a
time-sensitive escalation remains unconfirmed, that uncertainty should not silently be
treated as successful resolution. Depending on the device function and available controls,
appropriate behavior may include a defined retry, a warning that delivery or response is
unverified, or a request for human review. These are examples of possible evaluation
considerations, not universal requirements for all devices.

These are not only hypothetical workflow concerns. Research on ambulatory test-result
follow-up has documented failures to complete follow-up and communicate results,
including in electronic environments. The significance for device evaluation is not that an
AI-enabled device causes every downstream failure. It is that foreseeable handoff and
follow-through failures may affect the safety of a device function that relies on those steps.
[4]

4. Question 26: Agentic AI makes prospective governance more important

Question 26 is especially relevant because agentic systems may plan and execute multistep
tasks, use external tools, and act with fewer opportunities for human review. [1] As the
number of steps and participants increases, a successful sequence of tool calls can create a
misleading impression that a clinical obligation has been completed.

Clinical Action Governance is not simply information transport, task tracking, or a
retrospective audit trail. The governance question continues as an action moves toward
execution: who has authority for the action, whether that authority and the relevant
conditions still apply, what status can actually be established, and which obligation
remains open. This is distinct from originating a clinical decision. It also differs from
assuming that a successful tool call, notification, or workflow status proves that care was
delivered. The distinction is especially important when an agentic device function spans
multiple steps or crosses organizational boundaries.

Consider a device function that, within its intended use and after appropriate clinical
review, initiates a specialist referral. The referral is transmitted, but the receiving office has
not accepted it. Coverage authorization is pending, scheduling is unavailable, or the patient

© 2026 CorePatient, Inc. • FDA-2026-N-7874 Page 5
 COREPATIENT / REGULATORY COMMENT

cannot obtain the appointment. The technical transaction may have succeeded. The
consultation has not necessarily occurred. The next step may be administrative or patientfacing rather than clinical, but it can still determine whether the patient receives care.

This example assumes a hypothetical GenAI-enabled software function that qualifies as a
regulated medical device. The referral illustrates a foreseeable downstream dependency,
not an assertion that ordinary referral software or scheduling systems are necessarily
medical devices. The manufacturer’s evaluation should address the aspects of the referral
process that are relevant to the regulated function’s intended use and performance claims,
while identifying the limits of its visibility into independent clinical and administrative
activities.

A different risk arises when an action should no longer proceed. For example, an AIenabled device function may have initiated a time-sensitive clinical sequence after clinician
authorization, but a new result or revised clinical instruction may change the appropriate
next step before the sequence is executed. The safety question is whether the function, to
the extent it controls the action, recognizes the changed condition and responds
appropriately, rather than completing an outdated instruction simply because it was
previously authorized.

A related concern arises when a device-controlled step fails or is interrupted and the
system attempts to retry or resume it. A retry should not be presumed safe solely because
the original action was authorized. If a patient’s condition, an order, or the responsible
clinician’s instruction has changed, the device function may need to recheck applicable
conditions or seek renewed authorization before continuing, to the extent supported by its
intended use and available controls. Evaluation should distinguish recovery from a
technical failure from permission to proceed under current clinical conditions. The
objective is not to prohibit appropriate retries, but to avoid treating a stale instruction as
continuing authority.

We encourage FDA to consider evaluation criteria that distinguish the following, when
relevant to the intended device function:

 An AI-generated proposal from an action authorized by the responsible clinician or
other appropriate authority.
 Clinical authorization from payer coverage or payment authorization.
 An action that was appropriate when first proposed from one that remains permissible
and timely when execution is attempted.
 Successful technical transmission or tool execution from the intended clinical service
reaching the patient.

© 2026 CorePatient, Inc. • FDA-2026-N-7874 Page 6
 COREPATIENT / REGULATORY COMMENT

 A recorded status from evidence sufficient to support a claim of completion.
 A completed step from the next unresolved, changed, or superseded clinical or
nonclinical obligation.

These distinctions matter before, during, and after execution. Before an action, the relevant
question may be whether changed circumstances require review or prevent the action
from proceeding. During execution, the issue may be a failed handoff or a dependency that
remains unresolved. Afterward, the issue may be whether the next necessary action
occurred and what evidence exists. We are not suggesting that every device can or should
gate external actions in real time. That depends on the regulated function, technical
integration, available information, and legally applicable authority.

A further safety issue arises when the first step has occurred but the next necessary step
has not. A clinically indicated intervention may be performed, yet monitoring, review of a
resulting finding, patient instructions, or follow-up may remain outstanding. In timesensitive circumstances, an unresolved status is not merely a documentation gap. It may be
a reason for the responsible party to determine whether further attention or escalation is
required. Neither the governance environment nor the device should be presumed to make
an independent clinical decision outside its authorized function.

A governance approach can receive relevant information through direct entry or
confirmation by authorized clinicians or through integration with external systems. These
are different ways information can become available; neither, by itself, grants authority to
control a medical device. Where a device or other system does not support prospective
intervention, monitoring and accurate communication of uncertainty may be the relevant
safeguard.

The origin of information, the authority to act on it, and the technical ability to affect
execution are three separate questions. A clinician-entered instruction may require
verification of its scope and currency. An integrated device event may be accurate as a
record of a technical step without establishing current clinical authorization or completion
of care. The governance assessment should not treat receipt of data as permission to act, or
connectivity as the ability to hold or redirect a device-controlled action.

Clinical Action Governance is relevant through two participation pathways. An authorized
clinician may enter or confirm a device-related observation, instruction, or action in the
governance environment. Alternatively, relevant information may arrive through an
authorized outside-in integration with the device or another clinical system. Both pathways
can inform the status of an intended action and its next steps. They do not confer device
control by themselves. Prospective intervention is possible only where the integration,

© 2026 CorePatient, Inc. • FDA-2026-N-7874 Page 7
 COREPATIENT / REGULATORY COMMENT

clinical authority, and execution controls actually permit it. Where those conditions are
absent, the responsible response may be to identify uncertainty, notify the appropriate
party, or preserve evidence that an action remains unresolved.

For FDA evaluation, the relevant question is not whether one particular integration model
is adopted. It is whether the regulated function’s risk assessment accurately identifies the
information, authorization, safeguards, and external dependencies on which its intended
operation relies. Where an external safeguard is part of the manufacturer’s stated risk
controls or performance claims, its availability, limitations, and foreseeable failure
conditions should be appropriately characterized.

5. The patient, the payer, and the clinical organization are not interchangeable

Clinical care crosses boundaries that software does not erase. A physician may order care,
an insurer may determine coverage, another organization may schedule or perform the
service, and the patient may need transportation, instructions, follow-up, or another
practical step before care is received. Each participant has different responsibilities and
different evidence of what happened.

Payer authorization does not establish clinical appropriateness, and a clinical order does
not establish payer approval. Neither establishes delivery. Patient-reported completion or
difficulty accessing care may be important evidence, but it should be represented with its
source and limitations. The absence of confirmation is not proof that care did not occur.
Conversely, an administrative record of success is not proof that it did.

These distinctions should matter when a regulated GenAI-enabled device function is
intended to interact with or direct actions through those participants. They are not a
request for FDA to regulate ordinary insurance administration or all care coordination
software as medical devices.

These practical steps can determine whether care reaches the patient. A coverage decision
may be necessary but not sufficient. A scheduled visit may be necessary but not sufficient.
Patient communication may be necessary but not sufficient. For the device functions
covered by this consultation, FDA should consider whether their intended use and
performance claims accurately reflect these dependencies, rather than treating each
administrative milestone as proof of clinical completion.

© 2026 CorePatient, Inc. • FDA-2026-N-7874 Page 8
 COREPATIENT / REGULATORY COMMENT

6. Postmarket evaluation: Evidence must match the claim

The discussion paper appropriately considers performance beyond premarket testing. [1]
For a device function that initiates or directs clinical actions, the meaning of a postmarket
performance measure depends on what it actually observes. A tool-call log can establish
that a tool was called. An acknowledgment can establish receipt. A clinical record can
establish that a particular event was documented. None of those facts, standing alone,
necessarily establishes that intended care reached the patient. [3]

Where feasible and proportionate to risk, performance assessment should distinguish
confirmed completion, missing confirmation, contradictory evidence, and actions
superseded by later clinical decisions. It should identify the source of evidence and avoid
treating an unknown outcome as either a success or a failure. Patient observations and
reports may help complete the picture, with appropriate attention to reliability, privacy,
and consent.

An earlier obligation may also be legitimately superseded by a later clinical decision. A
status model that treats every unperformed original instruction as a failure can
misrepresent appropriate care, while one that silently marks it complete can conceal what
actually occurred. Where relevant to the regulated device function, evaluation should
distinguish a confirmed action, an unresolved action, a failed action, and an action
appropriately superseded by a subsequent authorized decision. Supporting evidence
should make clear which conclusion can be established and which remains uncertain.

We recognize the limits of manufacturer visibility and control. A device manufacturer
cannot necessarily obtain independent proof of care delivery in another organization. That
limitation should be made explicit in the device’s performance claims and evaluation
design rather than hidden behind a single completion status. FDA could consider whether
relevant downstream dependencies are adequately characterized, whether foreseeable
failure conditions are tested, and whether postmarket evidence supports the claims being
made about the regulated function.

This distinction also matters for how performance is reported. A manufacturer may
reasonably establish that its device generated an appropriate recommendation, issued a
message, or executed an authorized device-controlled step. It should not be expected to
verify every later event in an independent organization. At the same time, a performance
claim should not imply confirmed downstream care delivery when the device lacks
evidence of that outcome. The evaluation can be rigorous about what is observable without
assigning responsibility for events outside the manufacturer’s control.

© 2026 CorePatient, Inc. • FDA-2026-N-7874 Page 9
 COREPATIENT / REGULATORY COMMENT

FDA Questions 19 and 21 raise related issues for postmarket evaluation and the roles of
clinicians, healthcare institutions, professional societies, standards-setting bodies, and
other stakeholders. Evidence from these participants may help characterize whether a
device-initiated action reached the appropriate recipient, whether a foreseeable handoff
failed, or whether a later decision changed the required next step. Such evidence should be
attributed to its source and evaluated for reliability, completeness, privacy, and the limits
of the device manufacturer’s visibility. External participation can inform postmarket
understanding without replacing the manufacturer’s responsibility for its own regulated
function or converting independent care-delivery activities into device-controlled
operations.

7. Requested FDA consideration

We ask CDRH to consider the following when developing future approaches for GenAIenabled device functions that initiate, direct, or coordinate consequential clinical actions:

These recommendations are directed to the evaluation of GenAI-enabled device software
functions within their intended use and reasonably foreseeable conditions. They are not a
proposal to classify Clinical Action Governance generally as a medical device function. The
regulatory status of any particular software function depends on its actual intended use
and functionality. They are also not a request to impose a universal external governance
platform, mandate direct device integration, or transfer responsibility for independent
clinical and administrative activities to device manufacturers.

For higher-risk, action-taking or multistep device functions, FDA should also consider
whether safeguards outside the device may be relevant to safe operation. Depending on
intended use, these may include authorized clinician review, organizational controls,
integration-supported governance, or other external mechanisms. The existence of an
external safeguard should not be assumed merely because a device transmits information
to another system. Nor should its presence be treated as a substitute for the device
manufacturer’s own required risk controls.

 Recognize clinical authorization, timing, technical execution, care delivery, subsequent
observation, and supporting evidence as distinct considerations when relevant to
intended use and risk.

Use the proposed device-activity and consequence framework as a starting point, while
explicitly considering execution-time authorization, time pressure, reversibility,
downstream safeguards, and the limits of outcome verification as potential risk modifiers.

© 2026 CorePatient, Inc. • FDA-2026-N-7874 Page 10
 COREPATIENT / REGULATORY COMMENT

 Include foreseeable changes in clinical conditions, permissions, and downstream
dependencies in risk-proportionate evaluation of multistep and agentic functions.

Evaluate under-escalation and over-escalation separately, using clinically relevant
consequences and operating conditions rather than a single undifferentiated performance
measure.

 Distinguish device-controlled actions from activities dependent on clinicians, payers,
outside organizations, or patients, without assigning unsupported responsibility to
manufacturers.
 Consider precision in device performance claims. A successful technical transaction
should not be characterized as delivered clinical care unless the evidence supports that
description, and the limits of what the device can observe should be clear.
 Consider whether postmarket assessment appropriately characterizes unresolved or
uncertain downstream outcomes, within the limits of FDA authority, manufacturer
control, privacy, and data availability.

Where the intended device function depends on multistep execution, distinguish an
initiated action, a confirmed device-controlled step, an unresolved downstream
dependency, and a verified outcome in both testing and performance claims.

Consider, where appropriate to the intended use and risk, how manufacturers identify and
evaluate reliance on external safeguards, including clinician review and organizational or
integration-supported governance. Evaluation should address what the safeguard is
expected to do, which party controls it, whether it is available in reasonably foreseeable
operating conditions, and what happens when it is absent or cannot be verified. This should
remain technology-neutral and should not presume that any particular external platform is
required.

In considering postmarket evaluation under Questions 19 and 21, distinguish
manufacturer-observed device performance from additional evidence supplied by
clinicians, institutions, patients, or other authorized participants. Consider how such
evidence can improve understanding of foreseeable dependencies without diluting
manufacturer accountability or assuming universal access to downstream records.

When evaluating a device-controlled retry or resumed multistep action, consider whether
authorization and relevant operating conditions may have changed since the original
instruction. Where appropriate, assess how the function handles superseded instructions
and how its performance reporting distinguishes an unresolved obligation from one
legitimately replaced by a later clinical decision.

© 2026 CorePatient, Inc. • FDA-2026-N-7874 Page 11
 COREPATIENT / REGULATORY COMMENT

The goal is straightforward. The right clinical action must remain the right action when it is
carried out, the next step must not be lost, and the patient must not disappear from view
once a device reports success. Governance is important because it helps distinguish what
was intended, what was authorized, what happened, what still needs to happen, and what
the evidence can actually establish.

For that reason, we encourage FDA to consider whether evaluation of relevant GenAIenabled device functions distinguishes prospective authorization and timing, the devicecontrolled technical action, foreseeable handoffs, the next necessary clinical or nonclinical
step, and the evidence supporting any claim of completion. This would make safety
evaluation more informative without extending device regulation to every organization or
person involved in care.

Thank you for the opportunity to comment on this discussion paper.

References

[1] U.S. Food and Drug Administration, Center for Devices and Radiological Health.
Considerations for the Regulation of Generative AI-Enabled Medical Devices: Discussion
Paper and Request for Feedback. August 2026. https://www.fda.gov/media/194242/download
[2] U.S. Food and Drug Administration. Considerations for the Regulation of Generative AIEnabled Medical Devices: Discussion Paper and Request for Feedback, public docket
instructions. https://www.fda.gov/medical-devices/digital-health-center-excellence/
considerations-regulation-generative-ai-enabled-medical-devices-discussion-paper-andrequest
[3] U.S. Food and Drug Administration. Request for Public Comment: Measuring and
Evaluating Artificial Intelligence-enabled Medical Device Performance in the Real-World.
2025. https://www.fda.gov/medical-devices/digital-health-center-excellence/request-publiccomment-measuring-and-evaluating-artificial-intelligence-enabled-medical-device
[4] Callen JL, Westbrook JI, Georgiou A, Li J. The failure to follow-up test results for
ambulatory patients: a systematic review. Journal of General Internal Medicine.
2012;27(10):1334–1348. https://doi.org/10.1007/s11606-011-1949-5
Submitted by
Deborah Moore
Founder and Chief Executive Officer
CorePatient, Inc.
Email: Deborah@CorePatient.com

© 2026 CorePatient, Inc. • FDA-2026-N-7874 Page 12