Lunit Inc.

Lunit Inc. respectfully submits the attached comments in response to FDA Docket No. FDA-2026-N-7874, “Considerations for the Regulation of Generative AI-Enabled Medical Devices: Discussion Paper and Request for Feedback.” Please see the attached PDF for Lunit’s complete comments.

COMMENTS OF LUNIT INC.
Docket No. FDA-2026-N-7874
To Division of Dockets Management (HFA-305), U.S. Food and Drug Administration
Docket FDA-2026-N-7874
Re Considerations for the Regulation of Generative AI-Enabled Medical Devices: Discussion Paper and
Request for Feedback (August 2026)
Submitted by Lunit Inc.
Submitted October 16, 2026

I. Executive Summary
Lunit Inc. respectfully supports the regulatory direction contemplated in the FDA Center for Devices and
Radiological Health (CDRH) Discussion Paper. Importantly, the Discussion Paper expressly states that it is for
discussion purposes only and does not itself establish draft or final guidance or final regulatory expectations. Lunit
therefore supports the framework as a sound policy direction for future guidance and implementation, not as a claim
that the framework is already binding law or settled FDA policy.
Lunit develops AI solutions for medical imaging and foundation models that may serve as upstream components in
downstream AI applications. This experience gives Lunit a direct technical and commercial interest in how FDA
distinguishes upstream foundation-model components from finished medical devices and allocates regulatory
responsibility across that boundary.
The central principle is straightforward: consistent with Section V.A of the Discussion Paper, FDA should evaluate
the final user-facing medical device as configured and intended for real-world deployment, rather than the
foundation model standing alone. Consistent with Section VII.A, sponsors should remain responsible for
independently demonstrating the safety and effectiveness of their own device built on a foundation model.
Lunit also supports the contemplated voluntary Foundation Model Device Master File (MAF) mechanism. A wellstructured, confidential, version-specific MAF can reduce duplicative requests for upstream information, protect
proprietary information, and improve FDA visibility without turning submission of a model file into authorization of the
model for a clinical use. The voluntary nature of the MAF should be paired with a clear sponsor-side floor: a sponsor
that uses a foundation model without an MAF should still be responsible for independently characterizing and
validating the incorporated model to the extent relevant to the finished device.

II. Support for the Framework Contemplated in the Discussion Paper
A. The final configured device is the correct unit of premarket evaluation
The Discussion Paper recognizes that GenAI-enabled device behavior can depend on the underlying model as well
as prompts, retrieval strategies, guardrails, orchestration logic, and user interface. It further proposes that the final
user-facing device, as configured and intended for real-world use, be evaluated rather than the foundation model
standing alone. Lunit agrees with this approach because clinically meaningful performance is a property of a
particular configuration used for a particular intended purpose, population, and setting—not merely a property of a
parameter set in isolation.
This does not minimize the importance of the upstream model. The model may materially influence safety and
effectiveness, and it must therefore be appropriately characterized. But the regulatory question is not simply
whether the upstream model has medical knowledge or latent pattern-recognition ability. The question is how the
completed device, including its controls and context of use, performs for its labeled purpose. The contemplated
competency-based approach is well suited to this problem because it can test the relevant competencies of the
deployed configuration without attempting to enumerate every possible open-ended input.

B. Sponsor accountability aligns with the Discussion Paper
Lunit agrees with the approach contemplated in Section VII.A of the Discussion Paper that submission or
reference to a Foundation Model MAF would not constitute authorization of the underlying model for a device
intended use, and that sponsors would remain responsible for independently demonstrating the safety and
effectiveness of their own device built on a foundation model.
This approach is consistent with Section V.A, which contemplates evaluation of the final user-facing device, as
configured and intended for real-world use, rather than the foundation model standing alone. Together,
Sections V.A and VII.A provide a coherent allocation of regulatory review and accountability: FDA evaluates
the clinically configured device for its intended use and risk, while the sponsor remains responsible for the
safety and effectiveness of that device.
This is also consistent with FDA treatment of off-the-shelf (OTS) software. FDA’s 2023 OTS Software guidance
explains that sponsors using OTS software in a medical device should provide appropriate documentation
concerning development, verification, and validation. In practical terms, using a third-party software component
does not eliminate the finished-device manufacturer’s responsibility for the performance of the finished product.

C. A voluntary Foundation Model MAF addresses upstream-information problems without
confusing transparency with authorization
Lunit supports the contemplated Foundation Model MAF because it can create a structured, confidential channel for
information that may otherwise be difficult for a downstream sponsor or FDA reviewer to obtain, including model
identity and lineage, relevant architecture information, training-data provenance at an appropriate level, healthcarerelevant evaluations, subgroup performance, known limitations and failure modes, safety constraints and guardrails,
cybersecurity controls, and update-notification commitments.
The MAF should remain clearly separated from device authorization. The value of the mechanism depends on
developers being able to disclose safety-relevant information without creating an inference that the disclosure itself
establishes a clinical intended use or authorizes the underlying model. At the same time, the MAF should be
versioned, updateable, and linked to model releases so that reviewers and sponsors can determine what
information applies to the version actually incorporated in the device.

D. Lifecycle change controls should manage upstream model evolution
Foundation models can change more quickly than traditional medical software. The appropriate response is not to
freeze innovation at the upstream layer; it is to control how changes enter the finished device. Lunit supports
baseline benchmarking, risk-based re-benchmarking, supplier agreements, model-version pinning, advance notice
of material changes where feasible, regression testing, rollback capability, and PCCPs for eligible modifications to
the finished device.
FDA’s August 2025 final PCCP guidance is especially relevant. It describes PCCPs as a mechanism included in a
marketing submission for an AI-enabled device to define planned modifications, the methodology used to develop,
validate, and implement them, and their impact, so that appropriate modifications can be managed without a new
marketing submission for every change. This framework is naturally sponsor-centered because the intended use
and authorized device remain the reference point for the change-control decision.

III. Recommended FDA Approach and Detailed Recommendations
Recommendation 1: Carry forward the component / final-device framework into future guidance
FDA should preserve the principle that a general-purpose foundation model ordinarily functions as an upstream
component when it is supplied for incorporation, adaptation, or development and is not represented as a standalone
clinical product. This principle should be expressed as an intended-use and factual inquiry, not as a blanket safe
harbor based solely on a developer label such as “research use.”
Guidance should identify non-exclusive indicators. A foundation model is more likely to function as an upstream
component when it makes no clinical performance claims for unadapted clinical use; is not represented as ready for
standalone clinical deployment; is supplied for incorporation or adaptation by a responsible downstream entity; and
is not offered as a turnkey clinical application. Conversely, a model marketed as ready for clinical deployment,
carrying diagnostic claims, or advertising validated clinical performance for unadapted use should be analyzed as a
device under existing law.
Recommendation 2: Maintain single-point finished-device accountability while strengthening supplier
controls
• Require sponsors to identify the exact foundation-model version used in the cleared or approved configuration.
• Expect supplier agreements to address change notification, version control, documentation access, incident
cooperation, and rollback or continued access to the prior version where feasible.
• Require the sponsor to assess model changes through prespecified testing and to prevent unvalidated updates
from reaching clinical production.
Recommendation 3: Establish a practical, durable Foundation Model MAF
• Use a structured template so model developers can provide consistent information and reviewers can compare
releases.
• Include model identity and lineage; architecture summary; training-data provenance at an appropriate level;
healthcare-relevant evaluation; subgroup results; known limitations and failure modes; safety constraints and
guardrails; cybersecurity practices; update policy; and notification commitments.
• Make records version-specific and updateable, with a clear change history and effective date for each model
release.
• Confirm explicitly that an MAF filing does not constitute authorization of the underlying model for a device
intended use.
• Keep participation voluntary, while requiring the finished-device sponsor to carry the evidence burden when no
MAF is available.
Recommendation 4: Clarify that transparency mechanisms should not become unintended classification
triggers
FDA should make clear that supplying accurate technical information to sponsors or FDA—whether through an
MAF, model card, system card, security documentation, or safety report—does not by itself establish clinical
intended use. The classification question should remain fact-specific and grounded in objective intent, claims, and
deployment posture.

IV. Selected Responses to the Discussion Questions Most Directly Relevant to
Foundation Models
Q7 — Competency-based approach
Supported. Competency-based evaluation should be applied to the final user-facing device, with scope scaled to
intended use and risk.
Q17 — Vision-language models
The same framework can apply to imaging VLMs, with additional attention to image-grounded traceability,
measurement fidelity, scanner/protocol/site generalizability, and consistency of report structure.
Q22 — Scaling re-benchmarking
Scale to expected safety/effectiveness impact. Weight or behavior changes should generally trigger rebenchmarking of affected competencies; infrastructure-only changes may be managed within the sponsor’s quality
management system when justified.
Q23 — PCCPs when changes cannot be fully prespecified
Prespecify the evaluation methodology, acceptance criteria, trigger logic, and rollback procedure rather than trying
to enumerate exact future model changes.
Q24 — Third-party model changes
Combine contractual notice, version pinning, access to change information, automated regression testing, change
detection where feasible, and sponsor-side re-benchmarking/PCCP gates.
Q25 — Foundation Model MAFs
Support the voluntary MAF concept. Make it structured, versioned, updateable, confidential, and clearly nonauthorizing. If no MAF exists, the finished-device sponsor should still be able to establish safety and effectiveness
using its own verification and validation.
V. Conclusion and Requested Agency Action
Lunit respectfully urges CDRH to preserve and develop the architecture contemplated in the Discussion Paper:
evaluate the final user-facing device for its intended use and risk; keep final-device safety and effectiveness
accountability with the responsible finished-device sponsor; use a voluntary, confidential, versioned Foundation
Model MAF to improve upstream transparency; and use supplier controls, re-benchmarking, postmarket monitoring,
and PCCPs to manage third-party model changes.
This approach is not deregulatory. It is an allocation of regulatory effort toward the point where clinical risk is
realized, coupled with strong control over how upstream models enter the finished device and lifecycle mechanisms
capable of responding to technology change. It is therefore more likely to preserve both patient protection and the
pace of responsible medical AI innovation.
For the foregoing reasons, Lunit respectfully requests that FDA (1) carry forward the Discussion Paper’s finaldevice-centered framework into future guidance; (2) clarify intended-use indicators distinguishing upstream
foundation-model components from standalone medical devices; (3) establish a practical voluntary Foundation
Model MAF with explicit non-authorization status; and (4) strengthen sponsor-side supplier, version, rebenchmarking, and PCCP controls.
Respectfully submitted,
Lunit Inc.

Authorities and References
1. FDA, Considerations for the Regulation of Generative AI-Enabled Medical Devices: Discussion Paper and
Request for Feedback, August 18, 2026, Docket FDA-2026-N-7874.
2. FDA, Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial
Intelligence-Enabled Device Software Functions: Guidance for Industry and Food and Drug Administration Staff,
August 2025.
3. FDA, Off-The-Shelf Software Use in Medical Devices: Guidance for Industry and Food and Drug Administration
Staff, August 2023.
4. 21 CFR 801.4 (intended use) and 21 CFR 820.3(a) (including current component and finished-device definitions
under the QMSR effective February 2, 2026).