Steven Zhao

See attached file(s) Supplemental comment (Round 3) — executable-language upgrade. Builds on my comments posted 2026-09-15 (comment id FDA-2026-N-7874-0093), in parallel docket FDA-2025-N-6224 (-0013), and my Round-2 supplemental comment posted 2026-09-30 (comment id FDA-2026-N-7874-0122). For each of the four operational constructs from Round 2 — (1) entity-level registration spine, (2) evidence-gated state transitions, (3) named silent-failure patterns, (4) human-authorized capability expansion — this comment supplies illustrative regulatory language that can be written into draft guidance, plus a runnable proof: a self-contained demonstration script (attached, standard library only) whose self-checks pass with exit code 0, confirming each construct is mechanically expressible. All four reuse machinery regulated industry already operates: versioning, change management, audit trails, designated authorities. Together they give executable form to the postmarket-monitoring and continuous-oversight themes that recur most strongly across this docket’s comments. See attached PDF for full text and proposed language. Submitted in my individual capacity; drafted with AI tools and reviewed and approved by me, who takes full responsibility for the content.

Supplemental Comment (Round 3 — executable-language upgrade) — Docket No.
FDA-2026-N-7874
Docket: FDA-2026-N-7874 — Considerations for the Regulation of Generative AI-Enabled Medical Devices:
Discussion Paper and Request for Feedback (FDA / CDRH / DHCoE; released August 18, 2026) Comment period
closes: October 19, 2026 (verified October 16, 2026) Submitter type: Individual (no organizational affiliation)
Submitter: Steven Zhao — independent medical device regulatory practitioner Nature: This comment builds on (a)
my first comment in this docket, posted September 15, 2026 (comment id FDA-2026-N-7874-0093), (b) my
comment in parallel docket FDA-2025-N-6224 (comment id FDA-2025-N-6224-0013), and (c) my Round-2
supplemental comment on agentic AI and foundation models, posted September 30, 2026 (comment id
FDA-2026-N-7874-0122). This Round-3 comment does not repeat prior substance; it upgrades the four operational
recommendations from "proposed approach" to proposed regulatory language plus a runnable proof, so the
constructs can be taken directly into draft guidance text.

Document note: drafted with AI tools and reviewed and approved by the named submitter, who takes full
responsibility for its content. The mechanisms below are implemented in a small, runnable state-machine
demonstration (not a medical product); no clinical claim is made or implied. The demonstration is referenced as
supporting evidence only.

---

Why this comment exists
In my Round-2 comment I recommended four operational constructs for agentic AI-enabled devices: (1) an
entity-level registration spine, (2) evidence-gated state transitions, (3) named silent-failure patterns, and (4)
human-authorized capability expansion. A reviewer cannot act on "recommended approach" alone — draft guidance
needs language that can be written into text, and a reviewer should be able to confirm the construct is mechanically
expressible. This comment supplies both: for each construct, an illustrative regulatory language snippet and a
runnable proof (command + exit code + artifact) showing the construct executes as described.

---

1. Entity-level registration spine — proposed language + proof
Illustrative regulatory language (for the sections addressing change control and postmarket oversight).

Each agentic AI-enabled device shall maintain a configuration record identifying, for each constituent entity — the
orchestrating agent, the model(s) it invokes, the external tools and data sources it is authorized to call, and the
datasets used to qualify the configuration — its identity, version, and authorized permissions. Any deviation from the
recorded configuration after clearance shall be a detectable, reportable event. Registration events and configuration
changes shall be recorded in a hash-chained audit trail.

Runnable proof. A minimal implementation registers four entity classes and verifies the chain:

== evidence_gated_state_machine · self-check == [PASS] entity registration spine: 4 entities registered, chain
verifiable [PASS] evidence-gated transition (model update, evidence met): GRANTED [PASS] evidence-gated
transition (tool change, evidence unmet): DENIED + receipt recorded [PASS] capability expansion without human
authorization: DENIED [PASS] capability expansion with human authorization: GRANTED (authority != capability)
[PASS] silent-failure detectors: population drift / expired input / path deviation all fire [PASS] return-to-service:
granted only through a new evidence-carrying transition == audit trail: 5 receipts, chain depth 5 == RESULT: all
self-checks passed (constructs behave as proposed)

Exit code: 0.

Artifact: the demonstration script evidence_gated_state_machine.py, attached to this submission as a second
attachment (self-contained, standard library only; exit code 0 = constructs behave as proposed, 1 = broken and not
citable). The output above is a verbatim capture of an actual run (re-verified October 16, 2026). FDA staff and other
stakeholders can reproduce every output shown above by running the attached script on any standard Python 3
installation; a failed run would itself disqualify the demonstration. The same machinery (versioning, supplier control,
audit trail) is what regulated industry already operates; this shows it extends to agent/tool/dataset entities without
new legal authority.

---

2. Evidence-gated state transitions — proposed language + proof
Illustrative regulatory language (for the change control discussion).

A change that affects the deployed configuration — model update, tool or data-source change, dataset refresh,
capability expansion, or return to service after a monitoring pause — is a state transition. The transition is valid only
when its pre-declared evidence requirements are satisfied. If a requirement is unmet, the transition does not occur
and a denial receipt is recorded; this condition is binary and inspectable, not a post-deployment judgment call.
Return to service occurs only through a new evidence-carrying transition, not by passage of time.

Runnable proof. The demonstration encodes per-transition-type evidence requirements and a gate that raises a
denial receipt on unmet evidence:

• Model update with version_manifest + benchmark_rerun present → GRANTED.

• Tool change with source_provenance present but regression_results missing → DENIED, receipt recorded
(invalidity, not discouragement).

• Return to service only through a new evidence-carrying transition → GRANTED.

This gives FDA a binary, inspectable condition instead of a judgment made after deployment — exactly the property
that keeps postmarket pause authorities meaningful for self-adjusting systems.

---

3. Named silent-failure patterns — proposed language + proof
Illustrative regulatory language (for the postmarket monitoring discussion).

Sponsors of agentic and continuously adjusting devices shall monitor for, at minimum, the following silent-failure
patterns: (a) population drift with stable headline accuracy; (b) an external tool, database, or dataset still invoked
after moving outside its declared validity window; and (c) agent behavior that completes tasks through workflows
outside its declared operating envelope. Detection of any pattern shall itself be a governed transition (pause, roll
back to last valid configuration, re-verify, resume only through the evidence-carrying transition mechanism
described for change control).

Runnable proof. Three detectors return True on the named patterns:

• detect_population_drift(0.97, 0.86) → drift detected (headline held, subgroup degraded).

• detect_expired_input("2026.09.01", "2026.10.01") → expired input detected.

• detect_path_deviation({"read_only","lookup"}, {"read_only","external_record_write"}) → path deviation detected.

Listing these patterns in guidance gives sponsors a concrete checklist and reviewers a common vocabulary for
postmarket plans.

---

4. Human-authorized capability expansion — proposed language + proof
Illustrative regulatory language (for the discussion of agentic AI oversight).
Capability expansion into a higher-impact tier is a human-authorized transition. The technical ability to perform an
action shall be kept distinct from the standing authorization to perform it. The highest permission tiers (e.g., direct
clinical influence) default to denied and are grantable only by the human authority designated in the sponsor's
quality system; each tier crossing is a transition with a receipt.

Runnable proof. The gate separates authority from capability:

• Capability expansion with tier_crossing_justification but human_authorized=False → DENIED.

• The same transition with human_authorized=True → GRANTED, receipt records the distinct human authority.

This keeps "machine requests, human decides" at exactly the points where error consequences step up in kind, and
is auditable: each tier crossing is a transition with a receipt.

---

5. Alignment with recurring themes in this docket
Across the comments in this docket, postmarket monitoring and continuous oversight recur as the strongest area of
industry focus, alongside clarity of responsibility and independent review. The four constructs above are built around
that same axis: the evidence-gated state machine turns postmarket monitoring into a governed, inspectable process
rather than a reporting obligation, and the named silent-failure patterns give sponsors and reviewers a common
checklist for continuous oversight. In that sense this comment is less a new proposal than an executable translation
of themes the record already emphasizes — supplied so the Agency can take them into draft guidance as
reviewable provisions.

---

6. Closing
The four constructs — an entity registration spine, evidence-gated state transitions, named silent-failure patterns,
and human-authorized capability expansion — are mutually reinforcing and deliberately conservative: each reuses
machinery (versioning, change management, audit trails, designated authorities) that regulated industry already
operates. This comment supplies, for each, language that can be written into draft guidance and a runnable
demonstration (exit code 0) confirming the construct is mechanically expressible. That combination — proposed text
plus executable proof — is what lets the Agency move from "interesting idea" to "reviewable provision."

I appreciate the Agency's engagement and would welcome the agentic-AI portion of the framework developing
along lifecycle-complete lines.

Submitted in my individual capacity, without organizational affiliation. Drafted with AI tools; reviewed and approved
by the named submitter, who takes full responsibility for the content.

© 2026 Steven Zhao. All rights reserved.

Annex A — Runnable Evidence: Evidence-Gated State Machine
Supporting evidence for the supplemental public comment (Round 3) submitted by Steven Zhao to FDA docket
FDA-2026-N-7874 (Considerations for the Regulation of Generative AI-Enabled Medical Devices).

1. Purpose

This annex provides a small, self-contained, executable reference implementation of the four operational constructs
proposed in the comment: (1) an entity-level registration spine (agent / model / tool / dataset, versioned and
hash-chained); (2) evidence-gated state transitions (a lifecycle-affecting transition is invalid when its declared
evidence is unmet); (3) named silent-failure patterns (e.g., stable headline accuracy with degraded subpopulation
performance); and (4) human-authorized capability expansion (authority is distinct from capability, and a
tier-crossing change requires a distinct human authorization receipt).
This is a state-machine demonstration, not a medical device or a software-as-a-medical-device product, and it
makes no clinical claim. It uses only the Python standard library. Its purpose is to show that each construct is
mechanically expressible in a small, testable implementation that the regulated industry's existing tooling — design
controls, change management, audit trails, and designated authorities — can already host.

2. How to run

Save the full source code in Section 4 as evidence_gated_state_machine.py (the plain-text copy attached alongside
this PDF is byte-identical and may be used directly), then run:
python evidence_gated_state_machine.py

Exit code 0 means every self-check passed (the constructs behave as proposed); exit code 1 means a self-check
failed. Tested with Python 3 on Windows; no third-party packages are required.

3. Observed output (re-run on 2026-10-17, Python 3, exit code 0)
== evidence_gated_state_machine - self-check ==
[PASS] entity registration spine: 4 entities registered, chain verifiable
[PASS] evidence-gated transition (model update, evidence met): GRANTED
[PASS] evidence-gated transition (tool change, evidence unmet): DENIED + receipt recorded
[PASS] capability expansion without human authorization: DENIED
[PASS] capability expansion with human authorization: GRANTED (authority != capability)
[PASS] silent-failure detectors: population drift / expired input / path deviation all fire
[PASS] return-to-service: granted only through a new evidence-carrying transition
== audit trail: 5 receipts, chain depth 5
== RESULT: all self-checks passed (constructs behave as proposed)

4. Full source code

The listing below is the complete, byte-for-byte content of evidence_gated_state_machine.py (also attached as a
plain-text file for direct execution).
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""
evidence_gated_state_machine.py
================================
Minimal, runnable reference implementation of the four operational constructs
proposed in the supplemental public comment to FDA docket FDA-2026-N-7874
(Agentic AI & Foundation Models):

1. Entity-level registration spine (agent / model / tool / dataset, versioned + hash-chained)
2. Evidence-gated state transitions (a transition is INVALID when its evidence is unmet)
3. Named silent-failure patterns (stable headline accuracy but degraded subgroup, etc.)
4. Human-authorized capability expansion (authority != capability; tier-crossing needs a human receipt)

This is a STATE-MACHINE DEMONSTRATION, NOT a medical product. It makes no
clinical claim. It exists to show that the proposed constructs are expressible
in a small, testable implementation that manufacturers' existing tooling
(design controls, change management, audit trails) can host.

License: Apache-2.0. This demonstration script is supporting evidence for the
accompanying public comment (Round 3, docket FDA-2026-N-7874); the accompanying
comment text itself is all rights reserved and not covered by this license.

Run:
python evidence_gated_state_machine.py
Exit code 0 = all self-checks passed (the constructs behave as proposed).
Exit code 1 = a self-check failed (the demonstration is broken, do NOT cite).
"""

import hashlib
import json
import sys
from dataclasses import dataclass, field
from enum import Enum, auto
from typing import Dict, List, Optional, Tuple

class DenialReceipt(Exception):
"""Raised when a lifecycle-affecting transition's evidence requirement is
unmet. The transition does NOT occur; a denial receipt is recorded.
This is the 'invalidity, not discouragement' property."""

class EntityKind(Enum):
AGENT = auto()
MODEL = auto()
TOOL = auto()
DATASET = auto()

@dataclass
class Entity:
kind: EntityKind
identity: str # e.g. "orchestrator", "gpt-class", "imaging-db"
version: str # e.g. "v1.0", "rev-Q3"
permissions: Tuple[str, ...] = () # what this entity may do inside the device
_hash: str = field(default="", repr=False)

def materialize(self, prev_hash: str) -> str:
payload = json.dumps(
{"kind": self.kind.name, "identity": self.identity,
"version": self.version, "permissions": list(self.permissions)},
sort_keys=True,
).encode("utf-8")
self._hash = hashlib.sha256(prev_hash.encode("utf-8") + payload).hexdigest()[:16]
return self._hash

class Registry:
"""Entity-level registration spine. Each registration event and each
configuration change leaves a hash-chained record (audit trail)."""

def __init__(self) -> None:
self.entities: Dict[Tuple[str, str, str], Entity] = {}
self.chain: List[str] = ["genesis"]

def register(self, e: Entity) -> str:
h = e.materialize(self.chain[-1])
self.chain.append(h)
self.entities[(e.kind.name, e.identity, e.version)] = e
return h

def contains(self, kind: EntityKind, identity: str, version: str) -> bool:
return (kind.name, identity, version) in self.entities

def verify_chain(self) -> bool:
"""Re-walk the chain; returns True iff every link is consistent."""
prev = "genesis"
for e in self.entities.values():
recomputed = e.materialize(prev)
if recomputed != e._hash:
return False
prev = e._hash
return True
class Transition(Enum):
INITIAL_ACTIVATION = auto()
 MODEL_UPDATE = auto()
TOOL_CHANGE = auto()
DATASET_REFRESH = auto()
CAPABILITY_EXPANSION = auto()
RETURN_TO_SERVICE = auto()

# Per-transition-type evidence requirements, pre-declared by the sponsor.
EVIDENCE_REQUIREMENTS: Dict[Transition, List[str]] = {
Transition.INITIAL_ACTIVATION: ["nonclinical_benchmark", "clinical_confirmation"],
Transition.MODEL_UPDATE: ["version_manifest", "benchmark_rerun"],
Transition.TOOL_CHANGE: ["source_provenance", "regression_results"],
Transition.DATASET_REFRESH: ["validity_window", "representativeness"],
Transition.CAPABILITY_EXPANSION: ["tier_crossing_justification"],
Transition.RETURN_TO_SERVICE: ["reverification_evidence", "recovery_rationale"],
}

class Gate:
"""Evidence-gated state transitions. The operational core of change control:
every lifecycle-affecting change is a transition; a transition is GRANTED
only when its declared evidence requirements are satisfied."""

def __init__(self, registry: Registry) -> None:
self.registry = registry
self.receipts: List[dict] = []

def attempt(
self,
transition: Transition,
evidence: Dict[str, object],
human_authorized: bool = False,
) -> dict:
required = EVIDENCE_REQUIREMENTS[transition]
missing = [r for r in required if not evidence.get(r)]

if missing:
receipt = {"transition": transition.name, "status": "DENIED",
"missing": missing, "human_authorized": human_authorized}
self.receipts.append(receipt)
raise DenialReceipt(
f"transition {transition.name} DENIED - unmet evidence: {missing}")

# Bright-line rule: capability expansion is a human-authorized transition.
if transition is Transition.CAPABILITY_EXPANSION and not human_authorized:
receipt = {"transition": transition.name, "status": "DENIED",
"missing": ["human_authorization"], "human_authorized": False}
self.receipts.append(receipt)
raise DenialReceipt(
"capability expansion DENIED - authority != capability; "
"human authorization required")

receipt = {"transition": transition.name, "status": "GRANTED",
"evidence": [r for r in required], "human_authorized": human_authorized}
self.receipts.append(receipt)
return receipt

# --- Silent-failure detectors (postmarket monitoring vocabulary) -----------

def detect_population_drift(headline_accuracy: float, subgroup_accuracy: float,
threshold: float = 0.05) -> bool:
"""Stable headline accuracy but degraded subpopulation performance."""
return (headline_accuracy - subgroup_accuracy) > threshold

def detect_expired_input(validity_window_end: str, current_date: str) -> bool:
"""A tool/dataset still in use but outside its declared validity window."""
return current_date > validity_window_end

def detect_path_deviation(declared_envelope: set, observed_trajectory: set) -> bool:
"""Agent completes tasks through workflows outside its declared envelope."""
return not observed_trajectory.issubset(declared_envelope)

def demo() -> None:
print("== evidence_gated_state_machine - self-check ==")
# 1) Entity registration spine + hash-chained audit trail
 reg = Registry()
reg.register(Entity(EntityKind.AGENT, "orchestrator", "v1.0",
permissions=("read_only",)))
reg.register(Entity(EntityKind.MODEL, "gpt-class", "v1.0"))
reg.register(Entity(EntityKind.TOOL, "imaging-db", "2026.09",
permissions=("lookup",)))
reg.register(Entity(EntityKind.DATASET, "qual-set", "rev-Q3"))
assert reg.verify_chain(), "audit chain must be consistent after registration"
assert reg.contains(EntityKind.TOOL, "imaging-db", "2026.09")
print(" [PASS] entity registration spine: 4 entities registered, chain verifiable")

# 2) Evidence-gated transition - GRANTED path
gate = Gate(reg)
r1 = gate.attempt(Transition.MODEL_UPDATE,
{"version_manifest": "manifest.json",
"benchmark_rerun": "pass@0.98"})
assert r1["status"] == "GRANTED"
print(" [PASS] evidence-gated transition (model update, evidence met): GRANTED")

# 2b) Evidence-gated transition - DENIED path (invalidity, not discouragement)
denied = False
try:
gate.attempt(Transition.TOOL_CHANGE, {"source_provenance": "ok"})
# regression_results missing -> must raise
except DenialReceipt as e:
denied = True
assert "regression_results" in e.args[0]
assert denied, "unmet evidence MUST deny the transition (binary, inspectable)"
assert gate.receipts[-1]["status"] == "DENIED"
print(" [PASS] evidence-gated transition (tool change, evidence unmet): DENIED + receipt recorded")

# 3) Human-authorized capability expansion - DENIED without human authority
denied2 = False
try:
gate.attempt(Transition.CAPABILITY_EXPANSION,
{"tier_crossing_justification": "move to direct-clinical-influence"},
human_authorized=False)
except DenialReceipt:
denied2 = True
assert denied2, "capability expansion without human authority MUST be denied"
print(" [PASS] capability expansion without human authorization: DENIED")

# 3b) GRANTED once a distinct human authority grants it
r2 = gate.attempt(Transition.CAPABILITY_EXPANSION,
{"tier_crossing_justification": "move to direct-clinical-influence"},
human_authorized=True)
assert r2["status"] == "GRANTED" and r2["human_authorized"] is True
print(" [PASS] capability expansion with human authorization: GRANTED (authority != capability)")

# 4) Silent-failure detectors - named patterns return True
assert detect_population_drift(0.97, 0.86), "subgroup drift must be detected"
assert detect_expired_input("2026.09.01", "2026.10.01"), "expired input must be detected"
assert detect_path_deviation({"read_only", "lookup"},
{"read_only", "external_record_write"}), \
"path deviation must be detected"
print(" [PASS] silent-failure detectors: population drift / expired input / path deviation all fire")

# 5) Return-to-service only through the gate (non-monotonic re-qualification)
r3 = gate.attempt(Transition.RETURN_TO_SERVICE,
{"reverification_evidence": "rerun-pass",
"recovery_rationale": "monitored condition cleared"})
assert r3["status"] == "GRANTED"
print(" [PASS] return-to-service: granted only through a new evidence-carrying transition")

print(f"== audit trail: {len(gate.receipts)} receipts, chain depth {len(reg.chain)}")
print("== RESULT: all self-checks passed (constructs behave as proposed)")

if __name__ == "__main__":
try:
demo()
except AssertionError as exc:
print(f"[FAIL] self-check FAILED: {exc}")
sys.exit(1)
except DenialReceipt as exc:
print(f"[FAIL] unexpected denial: {exc}")
sys.exit(1)
sys.exit(0)
5. License and responsibility

The demonstration script is released under the Apache License, Version 2.0, as stated in its header. The
accompanying comment text itself is all rights reserved and is not covered by that license. Submitted in my
individual capacity; this annex was drafted with AI tools and reviewed and approved by me, and I take full
responsibility for its content.