Bipartisan Policy Center (Zach Gaumer)

See attached file(s)

VIA ELECTRONIC SUBMISSION

October 19, 2026

Acting Commissioner Kyle Diamantas, J.D.
Food and Drug Administration
Center for Devices and Radiological Health (CDRH)
The Digital Health Center of Excellence (DHCoE)
Attention: FDA-2026-N-7874

RE: Considerations for the Regulation of Generative AI-Enabled Medical Devices: Discussion
Paper and Request for Feedback

Dear Acting Commissioner Diamantas:

The Bipartisan Policy Center appreciates the opportunity to submit comments on the U.S. Food and
Drug Administration Considerations for the Regulation of Generative AI-Enabled Medical Devices:
Discussion Paper and Request for Feedback (“FDA’s Discussion Paper”). We commend the FDA for
its attention to the opportunities and risks these technologies present, and for its willingness to
hear from organizations like BPC.

BPC and its advocacy affiliate, BPC Action, are unique in their approach to solving the nation’s most
pressing issues. As the only organization working across the full political spectrum on domestic
issues, BPC brings together diverse perspectives to craft policies that lower the everyday cost of
living for families, expand opportunities, and strengthen the American economy.

BPC's Health Program is dedicated to moving the U.S. toward a more cost-effective, evidencebased health care system. We develop policy solutions focused on strengthening and sustaining
Medicare and Medicaid, continuing the shift toward value, addressing inefficiencies and misaligned
incentives within the health care system, and responsibly leveraging technology and innovation.
Our comments reflect BPC's extensive research and findings from interviews with health care
leaders and policy experts. They reflect BPC staff views and do not necessarily represent the official
positions of BPC's founders, board of directors, or members of our Future of Health Advisory Board.

BPC supports the FDA's goal of a risk-based, least-burdensome approach that gives patients
timely access to safe and effective generative AI device functions. This letter responds to select
questions included in the FDA’s Discussion Paper and is informed by BPC conversations with a
wide range of experts.
Key Points
• New authorities: Several approaches in the FDA's Discussion Paper will require new
authority from Congress.
• Agency capacity: Implementing these approaches will require sufficient FDA staffing and
technical expertise.
• Risk assessment: Risk assessment for generative AI should account for the expertise of the
intended user and their ability to contextualize clinical information.
• Premarket evaluation: AI models may perform differently when they recognize they are
being tested. Benchmarking should therefore be paired with some form of clinical
confirmation, proportionate to risk. Independent third-party evaluation is also important.
The FDA could build on its Accreditation Scheme for Conformity Assessment, which relies
on accredited evaluators, after first developing consensus standards for generative AI.
• Postmarket monitoring: Greater reliance on postmarket monitoring will require shared
infrastructure—among health systems, manufacturers, and the FDA—and more flexible
change control plans.

Statutory Authority and Agency Capacity
The FDA's Discussion Paper notes that it does not address whether the approaches it describes fall
within the agency's existing legal authorities. Several of the more promising proposals, including
greater reliance on postmarket monitoring, likely depend on authorities the FDA does not currently
have. BPC's forthcoming recommendations will call on Congress to provide them, including
authority to:
• Permit conditional or time-limited marketing authorization tied to postmarket evidence
generation, beyond the conditions the FDA may impose on Class III devices through
premarket approval
• Proactively collect real-world performance data
• Run time-limited regulatory sandboxes

Implementing these approaches will also require sufficient FDA staffing and technical expertise.
We encourage the FDA to identify for Congress the authorities and resources needed to implement
the approaches in this paper, including through technical assistance as Congress considers
reauthorization of the Medical Device User Fee Amendments.

Section IV: Considerations for the Assessment of Risk for Generative AI-Enabled Devices

Question 1: Two-Axis Risk Framework; Question 3: Patient-Facing Functions; Question 4: HCPFacing (Generalist vs. Specialist) GenAI-Enabled Functions
BPC supports the FDA’s goal to establish a regulatory framework for generative AI that is
proportionate to the risk of a given device function. We agree that risk assessment should consider
how independently a device acts and the consequences of relying on an incorrect output. We
recommend the agency also account for the expertise of the end user and their ability to
contextualize clinical information.
The same device function may carry different risks depending on whether the user can provide
complete, clinically relevant information and interpret the output. Patient-facing tools, for example,
are not inherently riskier and can enhance patient engagement and self-management. However,
depending on the clinical consequences and the safeguards in place, risk may be greater when
users lack the medical expertise to input full clinical context or interpret an output. Similarly,
nonspecialists may have the most to gain from AI-enabled clinical decision support, but they may
also be more prone to automation bias, the tendency to accept an AI output without scrutiny.

We recommend that the FDA account for the intended user—for example, a patient, generalist
clinician, or specialist—and their expected ability to put clinical information in context. Federal law
already recognizes this distinction for clinical decision support software. The exclusion in section
520(o)(1)(E) of the Federal Food, Drug, and Cosmetic Act (FD&C Act) applies only to software that
provides recommendations to health care professionals and enables them to independently review
the basis for those recommendations. Software that provides recommendations directly to
patients does not qualify for this exclusion.

The FDA could illustrate in guidance, with examples, how user type affects risk, giving
manufacturers more predictable guidance on where their product falls. Instructions for use could
identify the expertise the device assumes and when a patient user should seek input from a
clinician or specialist. The FDA should also clarify how manufacturers are expected to update
instructions and the device itself as real-world use reveals how different users interact with it, and
how those updates will reach current users.

Section V: A Competency-Based Approach for Premarket Evaluation of Generative AI-Enabled
Devices
Questions 7, 9, and 13: Benchmarking and Synthetic Data

BPC supports the FDA’s inclusion of clinical confirmation alongside nonclinical device
benchmarking to assess competency premarket. While benchmarking can efficiently test a device
across many scenarios, strong performance on structured tests does not always translate into
sound real-world clinical judgment. Clinical decisions are often made with incomplete or evolving
information and under time pressure. Research suggests that exam-style validation may
overestimate AI’s clinical readiness and that frontier models can often distinguish evaluations from
real-world use, which may cause performance during testing to differ from performance in practice.
Since benchmarking is often not sufficient, it is important to use some form of clinical
confirmation, proportionate to risk.

Questions 14 and 15: Comparators

When possible, evidence standards should compare AI to current standard of care and level of
access to services, rather than an idealized model of care that may not be available in practice.

Two recent reports from the Peterson Health Technology Institute (PHTI) support this approach.
PHTI found that the realistic alternative to a generative AI tool may often be low-quality care or no
care at all. For example, the alternative to a clinical-grade chatbot for many patients may be an
unskilled therapist, an unvalidated consumer chatbot, or no treatment at all. AI-enabled care that
is deployed in conditions where access to care is limited and outcomes are measurable can
improve health outcomes, expand access, and lower spending.

Comparing devices with the care patients would otherwise receive would better reflect their realworld benefit and give developers clearer expectations about the evidence they need. This should
not lower the bar for safety. Devices should still meet minimum performance standards regardless
of the alternative.

Question 16: Independent Third Parties

Most experts we spoke with supported involving independent third parties in some or all aspects of
a competency-based approach. Some favored a model in which the FDA recognizes accrediting
bodies that certify third-party evaluators. Federal programs already use similar approaches. Under
the FDA's Accreditation Scheme for Conformity Assessment (ASCA), FDA-recognized accreditation
bodies approve testing laboratories, whose results inform authorization decisions for certain
devices. The Office of the National Coordinator for Health Information Technology certifies health IT
products through accredited testing laboratories and certification bodies.

Building on ASCA would require ASCA-accredited testing laboratories to test devices against FDArecognized consensus standards, and we are not aware of any FDA-recognized consensus
standards for generative AI competency. We recommend the FDA prioritize developing these
standards, including in collaboration with standards development organizations.

Any third-party process would need to be streamlined and efficient. The FDA should consider the
added cost and time that third-party evaluation could introduce and the risk that outside reviewers
may lack insight into how a device is configured and deployed. To limit these burdens, some experts
suggested periodic audits rather than ongoing review, and making participation voluntary, as it is
under ASCA. The FDA could also scale third-party involvement to device risk.

Section VI: Postmarket Monitoring for Generative AI-Enabled Devices
Questions 18 and 19: Greater Reliance on Postmarket Monitoring
BPC agrees that accepting greater premarket uncertainty through greater reliance on postmarket
monitoring can be appropriate for some generative AI-enabled device functions. However, the
FDA's current authorities limit its ability to take this approach. As described in our introduction, the
FDA has limited ability to authorize a device on a conditional or time-limited basis outside the
premarket approval pathway for Class III devices, and limited ability to collect real-world
performance data.

We recommend the FDA work with Congress to establish time-limited regulatory sandboxes in
which the agency can test conditional authorization on a small scale. Conditions could include
limited deployment, use restrictions, required monitoring, and postmarket evidence generation,
with authorization ending if predetermined conditions are not met. Each sandbox should have a
defined exit, and the FDA should report publicly on what it learns and use learnings to inform future
regulatory pathways.

In addition to the three proposed postmarket monitoring approaches (periodic device
benchmarking, sample-based clinician review, and performance degradation monitoring), the
agency should consider testing the systematic capture of clinician modifications (i.e., when a
clinician changes an AI output) as a continuous system quality and real-world performance signal.

Questions 20 and 21: Roles in Postmarket Monitoring and Supervisory Agents
Effective postmarket monitoring will require participation from clinicians, health systems,
professional societies, standards-setting bodies, and manufacturers. Experts we spoke with
identified a core challenge: no single party has both the resources and the information to do it
alone. Many health systems, particularly lower-resourced and rural providers, lack the capacity for
ongoing monitoring. Manufacturers, meanwhile, often lack access to the real-world data needed to
assess how their devices perform after deployment.

Public-private partnerships and shared infrastructure can help bridge this gap while keeping
manufacturers accountable for the safety and effectiveness of their devices. For example,
aggregated outcome data registries and federated health networks could enable health systems
that use the same AI-enabled medical device to share de-identified data. Shared infrastructure
could also reduce the burden on any single organization, particularly lower-resourced and rural
providers that lack capacity for ongoing monitoring.

Supervisory agents may also help, and the Advanced Research Projects Agency for Health (ARPAH) Agentic AI-EnableD CardioVascular CAre TransfOrmation (ADVOCATE) program is developing a
disease-agnostic "supervisory" AI agent that monitors clinical AI systems in real time and flags
unsafe recommendations. Such tools are early but could make continuous monitoring more
feasible as they mature.

Question 23: Predetermined Change Control Plans (PCCPs)
BPC recommends that the FDA conduct and publish a case study demonstrating effective PCCP
approaches, with particular attention to considerations for nondeterministic, generative AI.
Evidence on how well PCCPs work for generative AI-enabled devices is limited. A recent crosssectional study found that only 43 of 794 AI-enabled medical devices authorized between 2023 and
2025, or about 5%, had an FDA-authorized PCCP—although informal analyses indicate that the
number of devices incorporating PCCPs has increased consistently since 2025. The barriers to
PCCP adoption are not well understood. A case study would clarify what works, identify barriers to
uptake, and inform whether changes to guidance or statute are warranted. The FDA took a similar
step when it published case examples on the use of real-world evidence in device regulatory
decisions.

We also recommend the FDA work with Congress to allow manufacturers to add or update a PCCP
after a device is authorized, without a new 510(k) or a premarket approval supplement. This would
partially address the challenge that, for generative AI, the nature and scope of future modifications
often cannot be fully predicted at the time of authorization. This change would likely require action
by Congress because the statute (FD&C Act section 515C, 21 U.S.C. 360e-4) ties PCCPs to a 510(k)
notification or a premarket approval application or supplement.

Conclusion
BPC appreciates the opportunity to comment on the FDA’s Discussion Paper and commends the
FDA for seeking public input early in the development of its approach. We look forward to
continuing to engage with the agency as it refines its framework. Please do not hesitate to contact
us if you would like to connect with BPC’s Health Program staff for additional information.

Sincerely,

Zach Gaumer
Vice President, Health Program
Bipartisan Policy Center