SARA, Society for AI in Regulatory Affairs (Kay-Uwe Clemens)

On behalf of SARA (Society for AI in Regulatory Affairs), please find attached our comment on Docket No. FDA-2026-N-7874, "Considerations for the Regulation of Generative AI-Enabled Medical Devices: Discussion Paper and Request for Feedback".
The comment answers Questions 1, 3, 5, 9, 10, 14, 15, 20, 22 to 24 and 26.

SARA · SOCIETY FOR AI IN REGULATORY AFFAIRS · PUBLIC COMMENT

Comment on FDA's discussion paper on
generative AI-enabled medical devices
Docket No. FDA-2026-N-7874. "Considerations for the Regulation of Generative AI-Enabled Medical
Devices: Discussion Paper and Request for Feedback". Based on the SARA expert round of 8 October
2026.

SUBMITTED BY CONTACT QUESTIONS ANSWERED
SARA, Society for AI in Kay-Uwe Clemens Q1, Q3, Q5, Q9/Q10, Q14/Q15,
Regulatory Affairs kay-uwe.clemens@certhub.de Q20, Q22 to Q24, Q26

TO DATE
Dockets Management Staff (HFA-305) October 18, 2026
Food and Drug Administration
5630 Fishers Lane, Rm. 1061
Rockville, MD 20852

Re: Docket No. FDA-2026-N-7874, "Considerations for the Regulation of Generative AI-Enabled Medical
Devices: Discussion Paper and Request for Feedback"

Dear Sir or Madam,

SARA welcomes the opportunity to comment on CDRH's discussion paper. We appreciate that FDA is asking these
questions early and in the open, before guidance is drafted. Our comment answers only the questions our members
discussed in depth, and adds how the European Union currently handles comparable issues under the MDR, the
IVDR and the AI Act.

1 · BACKGROUND

About SARA and this comment

SARA (Society for AI in Regulatory Affairs) is an independent, international community of regulatory affairs and
quality professionals. It was initiated by Hoodin (Sweden) and CertHub (Germany) to help professionals apply AI
responsibly through shared experience and open discussion.

This comment is based on an online expert round held on October 8, 2026, with participants from medical device
manufacturers, regulatory consultancies and AI software providers in Europe, Asia, the United States and Canada. It
reflects the views expressed by participants. It is not regulatory advice and does not represent the position of any
participant's employer. It contains no confidential information, no patient data and no unpublished submission
details.

Where we refer to EU rules, we do so as a reference point, not as a model to copy. The AI Act's high-risk
requirements for AI in medical devices apply from August 2, 2028 (Regulation (EU) 2026/1744), while obligations for
providers of general-purpose AI models already apply. EU experience with the AI Act in medical devices is therefore
still limited.

SARA · Society for AI in Regulatory Affairs · Comment on Docket FDA-2026-N-7874 Page 1 of 7
2 · OVERVIEW

Summary of recommendations

Patient safety must remain the first consideration, and requirements should allow manufacturers to serve
several jurisdictions with one documentation; we therefore encourage FDA to align internationally. Within
that frame, we support the competency-based approach. Most of what it needs already exists in quality
management practice; what is new is the technology in the loop, not the principles.

1 Treat scope adherence as an engineered, verifiable control (Q5, Q20). Conversational drift is best
handled by guardrails plus an independent check of each output before it reaches the user.
Manufacturers should show that these controls fit the intended use and that they hold over time.

2 Keep the two-axis risk framework simple (Q1). Fold additional factors such as reversibility or
downstream safeguards into where a function sits on the existing axes, rather than adding axes.

3 Use benchmarks at two stages (Q9, Q10). First to justify the choice of foundation model(s) for the
intended use, then to validate the finished device against prespecified acceptance criteria.
Benchmarks should be versioned and allowed to evolve.

4 Anchor comparators in ground truth where it exists (Q14, Q15). Clinician panels are most useful as
adjudicators for borderline outputs, not as the primary comparator.

5 Prespecify the test, not the change (Q22 to Q24). A fixed, device-specific regression test set with
action limits, re-run after every change, including changes initiated by the foundation model developer
or a model being retired.

6 Address what the paper leaves out (Q3, Q26). Patient-facing GenAI that delivers a therapy over
weeks, and agentic devices that act on the patient's behalf in other software, need dedicated
consideration.

3 · PRINCIPLES

General comments

Patient safety comes first One documentation for International alignment
Every consideration in this several jurisdictions Because this is a global topic, we
comment is subordinate to the GenAI-enabled devices are encourage FDA to align its
safety of the patient. Where speed developed and used globally. approach with other regulators, for
of access, innovation or the Manufacturers should be able to example through IMDRF, building
burden on manufacturers compete demonstrate safety and on its joint work with Health
with safety, safety must prevail. effectiveness with one body of Canada and the MHRA on Good
evidence that serves several Machine Learning Practice and on
jurisdictions. Diverging predetermined change control
requirements add cost without plans.
adding safety, and they delay
patient access.

Proportionality and the unregulated alternative. Participants repeatedly raised one trade-off. If the evidentiary bar
for GenAI-enabled devices becomes too high, patients and clinicians will not stop using GenAI; they will turn to
general-purpose tools outside any regulatory oversight, which is worse for patient safety. Today it is comparatively
easy for AI products to stay in non-regulated space. We encourage FDA to weigh each requirement against this
alternative, in line with its least burdensome principles.

A familiar model: scope of practice. One participant suggested viewing a GenAI-enabled device as a new kind of
clinical resource. Clinicians are also bound by roles, responsibilities and scope of practice; a specialist does not

SARA · Society for AI in Regulatory Affairs · Comment on Docket FDA-2026-N-7874 Page 2 of 7
operate outside their domain. FDA's competency-based approach follows the same logic, and existing healthcare
practice on credentialing and supervision may offer useful parallels.

Distinguish types of AI. Discussing GenAI as one category made several questions hard to answer precisely. A
device that only generates responses differs in risk from one that changes data or acts in other systems. We
recommend that future guidance distinguish these types explicitly (see Q26).

4 · SECTION IV OF THE PAPER

Risk framework

Q1 Are two risk axes enough?
POSITION

Agree, with clarification. Additional dimensions such as reversibility, downstream safeguards, time pressure
and traceability matter. Adding them as separate axes, however, risks a framework that is overly prescriptive
and hard to apply consistently over time.
RECOMMENDATION

Keep the two axes and describe how each additional factor shifts a function's position on them. For example,
the absence of downstream safeguards could move a function up the consequences axis. This keeps
classification consistent while still capturing these factors.
EU REFERENCE POINT

Under MDR Rule 11 (Annex VIII), only the consequence of the information drives classification. Human oversight,
safeguards and traceability appear as design obligations in the AI Act rather than as classification criteria. Time
pressure has no equivalent.

Q3 Patient-facing functions
POSITION

The paper should state its scope for patient-facing therapeutic GenAI. The paper discusses patient-facing
informational functions, but it is built around single interactions in a clinical decision support setting: a device
analyzes an input and informs a clinician, who decides whether to trust it. GenAI-enabled devices that deliver
a therapeutic regimen directly to patients over weeks raise different questions, such as fidelity of delivery
over time and the choice of an appropriate sham comparator.
RECOMMENDATION

State explicitly whether patient-facing therapeutic GenAI is in scope, and if not, where FDA intends to
address it.

SARA · Society for AI in Regulatory Affairs · Comment on Docket FDA-2026-N-7874 Page 3 of 7
 Q5 Conversations that drift
POSITION

Drift is primarily a guardrail and monitoring problem. The device should recognize when a conversation
approaches or crosses its intended scope or reliability limits, and then redirect or escalate. Risk should be
assessed at the most consequential point a realistic conversational trajectory can reach, not at its starting
point.

Two control layers were discussed:

1. Scope guardrails that keep the primary model within the intended use.
2. An independent output check that screens each response before it is shown, for example to detect a
treatment recommendation from a device intended only to inform, and suppresses it with an explanation.
One participant's organization already runs every generated output through a second model with a
different role as a reliability check.

The method of control is familiar quality management practice: define upper and lower action limits, measure
continuously, and act when results approach a limit. What is new is applying it to generated language, where
measurement methods still need to be developed.
RECOMMENDATION

Characterize intended use together with the guardrails that enforce it. Ask manufacturers to show that the
guardrails match the intended use, to measure their effectiveness over time, and to define action limits for
drift. This maps directly onto benchmarking element S.2 (scope maintenance and boundary adherence).
EU REFERENCE POINT

The intended purpose is declared up front (MDR Art. 2(12)), and where several classification rules apply, the
strictest one decides (MDR Annex VIII, 3.5). Behavior outside the intended purpose is treated as foreseeable
misuse. We found no EU provision addressing conversational trajectories as such.

SARA · Society for AI in Regulatory Affairs · Comment on Docket FDA-2026-N-7874 Page 4 of 7
5 · SECTION V OF THE PAPER

Competency-based premarket evaluation

Q9 · Q10 Benchmarks as evidence
POSITION

Support, as a framework for verification and validation. Participants read the proposed structure as a lifescience version of the evaluation suites ("evals") already established for general AI models. Such a
framework gives manufacturers, reviewers and auditors a shared reference, which we expect to make
reviews more predictable.

We see two distinct uses:

1. Model selection (verification). Manufacturers often lack a full picture of how available foundation models
perform on different tasks, and may choose an unsuitable model for the intended use. Public, healthcarerelevant benchmarks would let them justify the choice of one or several models and document the
rationale.
2. Device validation. The finished device, with its prompts, retrieval and guardrails, is then tested against
prespecified acceptance criteria derived from the intended use.

GenAI in medicine is new enough that no benchmark set will be right from the start. Benchmarks should be
versioned and periodically revised as real-world results accumulate. A living benchmark family also reduces
the effect of contamination and saturation raised in Q10.
RECOMMENDATION

Name which benchmark families FDA would recognize, and how they will be maintained, so that
manufacturers and reviewers work from the same reference.
EU REFERENCE POINT

In the EU, conformity is shown mainly through harmonised standards, which give a presumption of conformity
(MDR Art. 8(1); AI Act Art. 40(1)). The AI Act asks the Commission to encourage benchmarks and measurement
methods (Art. 15(2)) and requires test data that allow an independent evaluation (Art. 3(32)) and fit the setting of
use (Art. 10(4)). Construct validity of benchmarks and sponsor-built benchmarks are not addressed.

Q14 · Q15 Comparators
POSITION

Anchor performance in an objective reference standard where one exists. In participants' experience, FDA
has historically asked for comparison against a ground truth, such as outcome data or a more definitive test,
rather than against treatment as usual. We see no reason why GenAI changes this: the question remains how
accurate the output is. A "median clinician on a busy day" is therefore a weak primary comparator.

Clinician panels remain valuable in a different role: as a standing adjudication group for borderline or openended outputs where no ground truth exists, and to guide decisions on how to improve the device.
DISSENT

One participant questioned whether a separate comparator is needed at all if benchmarks and acceptance
criteria tied to the intended use are robust, and raised concerns about scaling clinician-based comparison
to a large number of devices.

EU REFERENCE POINT

Clinical evaluation is measured against the state of the art in medicine (MDR Annex XIV, Part A, 1) and must
consider alternative treatment options (MDR Art. 61(3)(c)), which comes close to the counterfactual described in
Q15. Clinician panels, median clinicians and human-AI team performance are not addressed.

SARA · Society for AI in Regulatory Affairs · Comment on Docket FDA-2026-N-7874 Page 5 of 7
6 · SECTIONS VI AND VII OF THE PAPER

Lifecycle, foundation models and agentic AI

Q20 Machine-based supervisory agents
POSITION

Support, with the supervisor treated as part of the device. A second model that checks outputs is already
used in practice (see Q5). It works best when its role differs from the primary model's: the primary model is
restricted to the given scope, while the checking model may draw on broader sources to test reliability.
RECOMMENDATION

Require that the supervisory agent's own performance is evaluated and monitored, including its rate of
missed and false alarms.

Q22 · Q23 Change control
POSITION

The established principles of change control apply; the technology in the loop is new. Manufacturers
already verify that a changed device still meets acceptance criteria derived from its intended use. That logic
carries over. The tension is speed: AI developers improve models continuously, and patients should benefit
from improvements quickly.

Where future changes cannot be listed in advance, we suggest prespecifying the verification instead of the
change:

1. A fixed, device-specific set of test cases, derived from the premarket benchmark baseline.
2. Defined action limits for each critical measure.
3. A re-run of the test set after every change, whatever its source.
4. Changes within the limits are managed in the quality system; results that reach an action limit trigger
review and, where required, notification of FDA.

Q24 Changes initiated by the foundation model developer
POSITION

Treat model updates and model retirement as foreseeable events. A device is qualified on the model version
available at submission. Providers retire older versions, sometimes within months, and a newer version is not
guaranteed to perform better on a specific task. Participants have seen successive versions of the same
commercial model score worse on independent accuracy tests before later versions recovered.
DISSENT AND RESOLUTION

One participant argued that version changes within the same model family rarely alter core behavior. The
group agreed that this does not need to be assumed either way: the regression test set described under
Q22 shows whether the device still meets its acceptance criteria.

RECOMMENDATION

Accept a combination of contractual notice of updates and retirement dates, technical version pinning where
available, and the regression test approach above as reasonable assurance.

SARA · Society for AI in Regulatory Affairs · Comment on Docket FDA-2026-N-7874 Page 6 of 7
 Q26 Agentic GenAI-enabled devices
POSITION

Agentic devices carry a distinct and higher risk profile. The same model becomes agentic when it is given
tool access, for example through an API or a protocol for connecting to other software, and permission to act.
A patient-facing agent might act on the patient's behalf in third-party applications on their phone or
computer. Users often do not know what access they grant, and changes made by an agent are hard to trace,
even for experienced users. This is a form of drift that goes beyond the conversation.
RECOMMENDATION

For agentic devices, expect a clear definition of permitted actions and access, a complete and reviewable log
of actions taken, and the ability to reverse actions where possible.

7 · CLOSING

Closing

We thank CDRH for opening this discussion before drafting guidance. Many of the questions have no settled answer
on either side of the Atlantic, and we believe they are best answered together with the people who build, review and
use these devices. SARA would welcome the opportunity to contribute further, for example to a public workshop or
to work on benchmark development.

Respectfully submitted,

Kay-Uwe Clemens and Marcus Emne

On behalf of SARA, Society for AI in Regulatory Affairs

CONTRIBUTORS
This comment was developed with contributions from SARA members.

SARA · Society for AI in Regulatory Affairs · Comment on Docket FDA-2026-N-7874 Page 7 of 7