Johnson & Johnson (Diane Johnson)

See attached Comments from Johnson & Johnson

ONE JOHNSON & JOHNSON PLAZA T +732-484-9407
Djohns13@its.jnj.com
NEW BRUNSWICK, N.J. 08933

October 17, 2026

Via Electronic Submission

Dockets Management Staff (HFA-305)
Food and Drug Administration
5630 Fishers Lane, Rm. 1061
Rockville, MD 20852

RE: Docket No. FDA-2026-N-7874, Considerations for the Regulation of Generative
AI-Enabled Medical Devices; Discussion Paper and Request for Feedback

Dear Dr. Tarver:

On behalf of the Johnson & Johnson Family of Companies, we respectfully submit the
following comments on the Discussion Paper, Considerations for the Regulation of
Generative AI-Enabled Medical Devices: Discussion Paper and Request for Feedback (the
“Discussion Paper”).1 We appreciate FDA's efforts to seek stakeholder input to help
clarify regulatory expectations for generative AI-enabled medical devices.

Johnson & Johnson is a global healthcare company focused on developing innovative
medicines and medical technologies that improve health outcomes for patients
worldwide. As healthcare becomes increasingly data-driven and technology-enabled,
Johnson & Johnson is integrating data, artificial intelligence, digital platforms, advanced
analytics, and connected ecosystems across research, development, manufacturing, and
patient care to improve how therapies and technologies are discovered, developed,
delivered, and optimized. In MedTech, this evolution extends beyond standalone
medical devices toward connected digital ecosystems that integrate devices, software,
data, AI, and clinical workflows to generate insights, support decision-making, and
enhance patient outcomes across the continuum of care.

We share FDA's objective of establishing an appropriate regulatory framework that
enables the responsible development and deployment of AI-enabled medical
technologies while maintaining safety and effectiveness. We believe a clear, risk-based,
and appropriately tailored regulatory approach can support continued innovation while
ensuring patients and healthcare providers benefit from advances in AI-enabled
healthcare technologies.

1 FDA, Considerations for the Regulation of Generative AI-Enabled Medical Devices:
Discussion Paper and Request for Feedback (Aug. 18, 2026),
https://www.fda.gov/media/194242/download [hereinafter the “Discussion Paper”].
GENERAL COMMENT
Across these questions, we encourage FDA to focus on performance under intended-use
conditions rather than competency determinations. GenAI performance is conditional
on users, inputs, workflows, deployment environments, model versions, and external
dependencies. Therefore, the relevant regulatory question is not whether a system has
demonstrated competency, but whether available evidence provides reasonable
assurance of safety and effectiveness under intended-use conditions.
Risk characterization should inform the nature and amount of evidence required, but
should not independently determine device classification, predicate eligibility,
submission pathway, or substantial-equivalence conclusions.
Q1. Two-Axis Risk Framework
Response: The two-axis framework may be a useful tool for describing and
characterizing GenAI-related risk, but that characterization does not determine or alter
a device’s regulatory classification. Regulatory device class is established independently
under the applicable statutory and regulatory framework according to the level of
regulatory control necessary to provide reasonable assurance of safety and
effectiveness. Therefore, a category assigned under the two-axis framework does not
establish Class I, II, or III status, reclassify an otherwise regulated device, create a new
classification regulation or product code, or independently determine whether the
applicable pathway is exemption, 510(k), De Novo, or PMA.
Predicate analysis under section 510(k) remains a separate substantial-equivalence
determination. A proposed predicate must be a legally marketed device eligible to serve
as a predicate. The new device must have the same intended use as the predicate and
either the same technological characteristics or different technological characteristics
that do not raise different questions of safety and effectiveness, supported by
appropriate information demonstrating substantial equivalence. FDA should avoid an
unduly narrow interpretation of predicate eligibility, intended use, or indications for use
that would unnecessarily exclude appropriate predicates on the basis that because a
device incorporates GenAI. A GenAI risk category or benchmark result should not by
itself disqualify an otherwise appropriate predicate, establish a new intended use, or
demonstrate or defeat substantial equivalence. Conversely, similarity in risk
categorization cannot substitute for the required substantial-equivalence analysis.
Risk characterization should be informed by the principles and considerations described
in IMDRF N81, the NIST AI Risk Management Framework, and established risk
management processes such as ISO 14971, together with other factors relevant to the
intended use and deployment context. Relevant factors may include intended users,
model characteristics (such as architecture, complexity, and training approach) and
 others reflected in the referenced documents and standards, as well as additional
considerations which may be device specific. These factors should guide the nature and
amount of evidence required without altering device classification or replacing
established regulatory analyses.
Q2. Directiveness of Informational Functions
Response: Directiveness should be treated as a continuum and analyzed as a potential
source of performance variation, not as a binary label. Sponsors should evaluate
whether wording, specificity, personalization, tone, context, and presentation
materially affect the likelihood that an output influences a clinically significant action.
Evaluation should use realistic inputs and apply acceptance criteria proportionate to the
consequences of an unacceptable output.
Q3. Patient-Facing Functions
Response: Patient-facing status alone should not determine risk. Rather, the
assessment should focus on the nature of the output, the clinical significance and
reversibility of the action it may influence, the degree of personalization and
directiveness, and whether timely professional review is realistically available. Evidence
requirements should be proportionate to these factors, including an assessment of the
potential for the GenAI output to adversely influence patient actions without
professional review. Where communication characteristics may materially affect
performance, sponsors should evaluate performance across representative user
populations and characterize relevant differences. Appropriate safeguards include
understandable disclosures of limitations and uncertainty, access to supporting
information where appropriate, escalation pathways, and restrictions on autonomous
treatment recommendations.
Q4. Generalist vs Specialist HCPs
Response: Specialty should be treated as a potential source of performance variation,
not a primary determinant of device risk or a proxy for competence. Sponsors should
identify the intended users and evaluate performance under representative tasks,
workflows, and review conditions. Subgroup analyses should characterize clinically
relevant differences only where expertise could affect detection or correction of errors.
Evidence requirements should be driven by task complexity and the consequences of
error.
Q5. Multi-Turn Conversational Risk
Response: Single-output testing may be insufficient when intended use includes multiturn interaction. Evaluation should sample realistic conversational trajectories and
assess clinically significant unacceptable behavior over the full exchange, such as
 cumulative influence, foreseeable escalation pathways, and drift from non-directive
information to action-directing advice. Sequence length and context should be
prespecified, and results should distinguish turn-level from conversation-level
performance, with appropriate characterization of uncertainty.
Q6. Under-Escalation vs Over-Escalation
Response: Under-escalation and over-escalation are clinically distinct and should not be
collapsed into a symmetric or combined error metric. Sponsors should define each
endpoint separately and apply acceptance criteria reflecting its consequences, disease
severity and prevalence, and downstream pathway. FDA should not presume that either
direction is inherently preferable; the acceptable balance should be justified for the
intended use and based on the considerations listed above.
Q7. Competency-Based Approach
Response: We support rigorous evaluation of GenAI-enabled devices. However, the
results of such evaluations should be used to assess performance under intended-use
conditions rather than to establish a generalized competency designation. GenAI
performance may vary based on users, inputs, workflows, deployment environments,
model versions, and external dependencies. Accordingly, a competency label should not
substitute for intended-use-specific evidence or be treated as a durable categorical
conclusion.
FDA should instead expect an intended-use-specific evaluation that defines clinically
significant unacceptable outputs or actions; identifies the intended-use population and
relevant sources of variation; estimates performance and uncertainty; evaluates
consistency, clinically relevant subgroup differences, and performance boundaries; and
compares the resulting estimates with risk-proportionate acceptance criteria. The same
performance framework should be reassessed throughout the lifecycle rather than
converted into a competency label.
A limitation of a generalized competency framework is that it may convert the results of
finite testing into a categorical conclusion even though performance may vary across
intended-use conditions. The regulatory question is therefore not whether a system has
demonstrated competency, but whether available evidence adequately supports safe
and effective performance under those conditions throughout the device life-cycle. A
limitation of a generalized competency framework is that it may convert the results of
finite testing into a categorical conclusion even though performance may vary across
intended-use conditions.
 Q8. Using the Two-Axis Framework Within Competency Models
Response: We do not recommend embedding the two-axis framework within a
competency model. Risk characterization should instead inform the evidence needed to
evaluate performance. Greater consequences or stronger action-directing influence
may justify more stringent acceptance criteria, more representative evidence, larger or
otherwise better-justified samples, and greater statistical confidence. The regulatory
conclusion should concern whether applicable performance criteria are met, not
whether the model has attained competency.
Q9. Benchmarking Structure
Response: FDA should not combine clinical knowledge and analytic capabilities, safety
behaviors, robustness, and generalizability into a single competency score because
these represent distinct dimensions of performance. Benchmarks should instead
generate evidence that addresses prespecified and distinct evaluation questions.
Sponsors should justify representativeness, endpoints, sample size, reference standards,
subgroup analyses, and uncertainty, and demonstrate with appropriate confidence that
clinically significant unacceptable-output rates satisfy applicable risk-based acceptance
criteria. Subgroup evaluation should address clinically relevant sources of performance
variation where appropriate.
Security, privacy, confidentiality, and data integrity should be addressed through
applicable legal and regulatory controls, system architecture and governance,
supplemented by measurable, risk-based evaluation appropriate to the intended use.
Q10. Benchmark Validity
Response: Benchmark validity should mean that the evaluation supports a scientifically
justified inference to the intended-use population, not that a score perfectly predicts
every real-world outcome outside that intended use. Sponsors should prespecify the
target population and outcome of interest, account for patient and user characteristics,
case mix, disease severity, inputs, setting, and workflow, and characterize uncertainty
and material sources of variation. External or clinical evidence is warranted when the
ability to generalize to intended-use conditions cannot otherwise be supported.
Q11. Clinical Confirmation
Response: A separate clinical-confirmation stage should not be automatic. Clinical data
are one possible source of evidence used to support the relationship between evaluation
performance and performance under real-world intended-use conditions, rather than to
confirm competency. Additional evidence may be appropriate if generalizability,
workflow representation, setting variability, consequence severity, or statistical
precision remains inadequate. Depending on the evidentiary question, potentially
 relevant approaches may include retrospective evaluation or shadow deployment with
human review for lower-risk uses, prospective observation with adjudication for
intermediate-risk uses, and prospective studies for autonomous or higher-risk uses. No
particular study design should be presumed solely from a generalized risk category.
Sponsors should prespecify how evidence sources will be combined and avoid
unnecessary patient exposure when existing evidence already provides adequate
confidence.
Q12. Statistically Meaningful Performance Measurement
Response: Performance should be expressed as an estimate with an appropriate
measure of uncertainty, not as a categorical competency determination. The statistical
approach should be tailored to the device’s intended use and the consequences of an
incorrect output rather than treated as a single standardized formula applicable to all
GenAI use cases. The analysis should specify the intended-use population, clinically
meaningful endpoint(s), representative sampling scheme, sample-size justification,
observed estimate, confidence or credible interval, clinically relevant sources of
variation, and applicable risk-based acceptance criteria.
When multiple observations arise from the same patient (or user, conversation,
deployment environment, prompt family, or model version), the protocol should identify
the relevant unit of analysis, such as outputs, cases, conversations, task chains, or
actions, and account for dependence(s).When stochastic generation may materially
affect performance, the evaluation should justify the number and conditions of
repeated generations for the same or equivalent inputs, and account for within-input
dependence.
Clinically distinct and higher-risk failure types should be evaluated separately rather
than combined into an overall performance measure that could mask important
differences. Relevant subgroup analyses should also be prespecified and reported
separately where aggregate results may obscure clinically meaningful performance
variation. The endpoints, acceptance thresholds, sample size, and required level of
statistical confidence should be proportionate to the intended use and the
consequences of an unacceptable output.
For example, if a device produces 50 clinically significant unacceptable outputs in 5,000
evaluation cases, the observed rate is 1%, but that observed rate should not be treated
as the known population parameter; the uncertainty surrounding it should also be
quantified. Depending on the evidentiary question, sponsors may use frequentist
confidence intervals, including upper confidence bounds, or Bayesian approaches with
justified prior assumptions and appropriate characterization of posterior uncertainty.
Real-world and synthetic observations (see below) should not be pooled without
addressing differences in underlying data-generation assumptions, dependence,
 weighting, and potential shared bias because naïve combination can produce
misleading precision.
Q13. Synthetic Data
Response: Synthetic data may supplement evaluation for rare events, underrepresented
conditions, edge cases, and safety stress testing, but sponsors should establish fitness
for the specific outcome of interest. They should compare relevant characteristics with
the intended-use population, characterize generation uncertainty, prevent leakage, and
analyze synthetic and real-world results separately when pooling is not justified. Data
generated by the same or a closely related model may reproduce assumptions and
biases, including subgroup disparities, that the evaluation is intended to detect.
Sponsors should also consider whether synthetic data adequately represent clinically
relevant interactions, workflows, and contextual factors that may affect performance
under intended-use conditions. Synthetic data are most persuasive when anchored to
an independently validated baseline; FDA should allow sponsors to determine the
appropriate mix of synthetic and real-world data based on the intended use, risk profile,
and evidence needed to demonstrate safe and effective performance.
Q14. Comparators for Open-Ended Outputs
Response: Comparators should be selected to evaluate performance for the intended
use, not to establish a generic competency level. Depending on the claim, the relevant
comparator may be qualified clinicians, standard care, accepted technology, or a
human-AI team. Human-AI team performance is particularly relevant when the device is
intended to augment rather than replace clinical decision-making. The protocol should
prespecify the comparison, endpoint, adjudication method, noninferiority or superiority
margin where applicable, and uncertainty.
For endpoints requiring expert judgment, protocols should prespecify reviewer
qualifications, blinding where feasible, management of disagreements, and assessment
of inter-rater reliability.
Q15. Comparison With Care Without the Device
Response: Comparison with the likely care pathway without the device may estimate
clinical utility or incremental benefit, but it should not be a universal safety criterion.
FDA should expect such a comparison only when it addresses a claim or unresolved
uncertainty relevant to safety or effectiveness. The comparator and statistical
hypothesis should reflect the intended pathway, which may include unaided clinician
judgment, existing software, delayed consultation, or no intervention. Superiority to
unaided care should not be required categorically.
 Q16. Third-Party Evaluators
Response: We do not recommend mandatory third-party evaluation or certification.
FDA and manufacturers should retain their established responsibilities. Independent
evaluation may add value for defined evidentiary questions when methods, datasets,
qualifications, and uncertainty analyses are transparent. Any use should be voluntary
and proportionate to the intended use and evidentiary question and should not create
disproportionate cost or access barriers or become a separate determination of
regulatory device class.
Q17. Postmarket Monitoring (General)
Response: Targeted postmarket evidence may address residual uncertainty when it can
do so reliably. Monitoring should update the understanding of clinically significant
performance and detect meaningful changes associated with model updates,
population or input shift, subgroup disparities, drift, security behavior, or external
dependencies. Monitoring programs should also account for changes in utilization,
reporting behavior, deployment environment, and model versions that may affect
interpretation of observed performance.
Plans should prespecify measures, denominators, thresholds or control limits, cadence,
escalation criteria, CAPA, reporting, and links to change control. They should also
address incomplete outcome ascertainment and the minimum event frequency that can
reasonably be detected within the monitoring period. The purpose is continuing
performance evaluation, not continued proof of competency.
Q18. Postmarket Monitoring (Additional Conditions)
Response: Reduced premarket evidence should be considered only when residual
uncertainty can be bounded and reliably addressed through a credible postmarket plan.
Supporting controls may include traceable versions, incident response, rollback or safestate capability, and suspension of affected functions when thresholds are crossed. This
approach is most appropriate for lower- to moderate-risk, assistive, human-in-the-loop
uses with predefined metrics, drift thresholds, reporting, and enforceable follow-up. It is
generally inappropriate for autonomous or time-critical uses in which errors may cause
irreversible harm before detection. These considerations concern the risk of the
intended use and the evidentiary strategy, not the device’s formal regulatory class.
Q19. Approaches to Postmarket Performance Evaluation
Response: FDA should favor periodic statistical reassessment over categorical rebenchmarking. Programs may monitor clinically meaningful event rates, changes in
inputs and outputs, population drift, overrides, complaints, adverse events, subgroup
performance, and system security and integrity. Cadence and alert limits should be risk8
 based, with prespecified analyses to determine whether applicable performance criteria
continue to be met and whether observed changes exceed expected statistical variation.
Q20. Machine-Based Supervisory Agents
Response: A machine-based supervisory agent may provide an additional control, but
its benefit should be demonstrated rather than presumed. Evaluation should determine
whether the agent meaningfully reduces residual risk, assess relevant operating
characteristics such as sensitivity and false-alert rates, and evaluate performance under
foreseeable correlated failure modes. Thresholds and resulting actions should be
prespecified, discordant or high-risk cases may require human review, and significant
changes to either system should trigger reassessment of both individual and combined
performance.
Q21. Roles of Clinicians, Institutions, Societies, and Stakeholders in Postmarket
Monitoring
Response: Responsibility should be assigned to the party able to control the relevant
source of risk. Manufacturers remain accountable for device performance, risk
management, surveillance, complaints, CAPA, reporting, and change evaluation. Health
care institutions are responsible for local implementation, workflow integration,
deployment monitoring, and controls supporting use as intended. Clinicians remain
responsible for appropriate professional review, decisions to override or question
outputs, and reporting identified problems. Professional societies, credentialing
organizations, licensing authorities, and health care facilities retain responsibility for
training, credentialing, and standards of practice. FDA should distinguish evaluation of
device performance from professional competency oversight.
Q22. Scaling Re-Benchmarking and Evidence to Modification Impact
Response: The extent of re-evaluation should scale with a modification’s expected effect
on safety and effectiveness, not with a need to re-establish competency. Sponsors
should assess affected populations, endpoints, safety-critical behaviors, dependencies
such as foundation models or retrieval systems, and whether the change remains within
an authorized Predetermined Change Control Protocol (PCCP) boundary. Changes with
limited potential impact may be managed within the quality system, while changes with
plausible material effects should receive targeted testing or FDA review, as applicable.
Rather than presuming the presence of a human in the workflow as a risk control,
human oversight should be evaluated to assess the actual control of risk. Where
oversight is relied upon, the evidence should demonstrate that appropriately qualified
users can understand relevant limitations, independently evaluate the basis for material
outputs or actions, timely intervene or override the system, and document
consequential decisions.
 Q23. Adapting PCCP Concepts for GenAI When Future Modifications Cannot Be Fully
Prespecified
Response: PCCPs should define testable change boundaries rather than attempt to
enumerate every future modification. Boundaries may specify performance and safety
floors, maximum allowable changes in clinically significant failure rates, affected
populations or subgroups, and triggers for additional review. In addition, PCCP
boundaries should be:
• sufficiently specific and reviewable at authorization;
• linked to defined verification and validation methods;
• traceable to individual and cumulative risk assessments; and
• incapable of authorizing a change that materially alters intended use or
introduces a new question of safety or effectiveness without further FDA review
Plans should address relevant external dependencies, including foundation-model,
retrieval, guardrail, and tool-use changes. Crossing an authorized boundary or detecting
performance beyond expected variation should trigger reassessment, corrective action,
or FDA notification as appropriate.
Q24. Managing Third-Party Foundation Model Changes
Response: Sponsors should manage third-party foundation model changes through a
combination of supplier oversight, contractual controls, validation testing, performance
monitoring, and change-management processes. The specific controls should be
proportionate to the risk and the degree of influence the sponsor has over the thirdparty model. Where direct access to the underlying model is not available, sponsors
should rely on commercially reasonable mechanisms such as provider notifications of
material changes, model versioning information, release notes, testing environments,
pre-deployment validation, post-deployment monitoring, and incident escalation
procedures.
Each change should receive reassessment proportionate to the clinical risk of the
affected intended use; this assessment is distinct from determining the device’s
regulatory class. For intended uses with greater potential consequences, manufacturers
should retain sufficient deployment control to prevent unvalidated updates from
affecting device behavior before appropriate evaluation is completed.
Q25. Voluntary Foundation Model MAFs
Response: Voluntary foundation-model assessment frameworks may provide useful
information about architecture, training, limitations, update practices, and risk
management, but they should not substitute for evidence on finished-device
performance under intended-use conditions. Their evidentiary weight should depend on
relevance, transparency, version match, independence, and applicability to the device.
 FDA should not make authorization depend on disclosures that may be proprietary,
inconsistent, or unavailable; manufacturers remain responsible for addressing residual
uncertainty.
Q26. Additional Considerations for Agentic GenAI Devices
Response: Agentic systems require action-level, as well as output-level evaluation.
Sponsors should define the authorized action space and evaluate representative multistep task chains, tool use, external-system interactions, escalation behavior,
unauthorized actions, risk-proportionate human-review windows, and actions that may
be difficult or impossible to reverse.
Key outcomes may include the probability of a clinically significant unacceptable action,
conditional failure probabilities across a task chain, cumulative chain-failure risk,
successful human intervention, and variation across representative environments.
Evidence and controls should scale with autonomy and consequence rather than the
“agentic” label itself.
OVERALL RECOMMENDATION
FDA should replace the proposed competency-based framework with a risk-based
performance evaluation framework grounded in statistical estimation and quantified
uncertainty, applied consistently across premarket evaluation, postmarket monitoring,
modifications, PCCPs, and third-party model changes.
Benchmark, laboratory, simulated, synthetic, clinical, and postmarket evidence should
be viewed as complementary sources of evidence rather than sequential competency
gates. The amount and type of evidence should be determined by the intended use,
clinical significance of potential errors, residual uncertainty, and available mitigations.
Risk characterization should inform evidentiary expectations but should not
independently determine device classification, predicate eligibility, substantialequivalence conclusions, or regulatory pathway.
The framework should support prespecified clinically significant unacceptable outputs
or actions; representative evaluation under intended-use conditions; risk-proportionate
acceptance criteria; appropriate characterization of uncertainty; separate assessment
of clinically distinct failure modes; evaluation of relevant sources of variation; and
lifecycle monitoring proportionate to the device’s risks and remaining uncertainty.
The central regulatory question should be: What clinically significant unacceptable
outputs or adverse actions may occur under intended-use conditions, what are their
probabilities and consequences, and how likely are those to occur?
 Johnson & Johnson supports the MDMA and AdvaMed positions on the Discussion
Paper. In addition, J&J looks forward to serving as a resource and contributing to
ongoing discussions regarding the future regulation of generative AI-enabled medical
devices. If you have any questions or if we can provide additional information, please
contact Diane Johnson at djohns13@its.jnj.com.

Sincerely,

Diane Johnson
Senior Director of U.S. Regulatory and Global Digital Health Policy
Johnson & Johnson MedTech