Main Street Foundation Center for Regulatory Analysis and Engagement (Andrew Langer)

Attached are comments from the Main Street Foundation Center for Regulatory Analysis and Engagement.

MEMORANDUM

To: Hon. Robert F. Kennedy, Jr, Secretary of Health and Human Services
Hon. Kyle Diamantas, Acting Commissioner, US Food and Drug
Administration
From: Andrew Langer, President, Main Street Foundation
Date: October 18, 2026
Re: Comments on the Department of Health and Human Services Food and Drug
Administration Request for Feedback on the Discussion Paper,
“Considerations for the Regulation of Generative AI-Enabled Medical
Devices,” Docket #FDA-2026-N-7874, Published August 18, 2026

Below are comments of the Main Street Foundation’s Center for Regulatory Analysis and
Engagement (CRAE) in response to the Department of Health and Human Services Food and
Drug Administration, Request for Feedback on the Discussion Paper, “Considerations for the
Regulation of Generative AI-Enabled Medical Devices,” Docket #FDA-2026-N-7874, Published
August 18, 2026 (https://www.regulations.gov/document/FDA-2026-N-7874-0001).

CRAE is a project of the Main Street Foundation, a recently-formed non-profit, non-partisan
501(c)(3) research and education foundation. Our mission is to bring a disciplined, commonsense perspective to the regulatory process, one grounded in real-world experience, sound
science, and rigorous economic analysis. We work to ensure that the costs, risks, and benefits of
regulatory proposals are evaluated transparently and accurately, and that the voices, interests,
and freedoms of Americans, particularly small businesses and working families, are
meaningfully represented in regulatory debates. Above all, we focus on outcomes: regulations
should address real problems, function effectively in practice, and improve conditions on the
ground—not exacerbate the challenges they are intended to solve.

Introduction

The Center for Regulatory Analysis and Engagement (CRAE) welcomes the Food and Drug
Administration’s early engagement on the regulation of generative artificial intelligence-enabled
medical devices. CRAE supports transparent, proportionate, evidence-based regulation that
protects patients while allowing beneficial technologies to reach the people who need them. This
discussion presents an opportunity to consider how regulatory policy can support affordable,
timely access to effective medical care. Expanding patients’ practical access to competent care
should inform the assessment of technological benefits, clinical risks, and appropriate regulatory
burdens.

The challenge is fundamentally one of medical abundance: increasing the capacity to meet
patients’ needs effectively. Constraints on clinician time, appointment availability, and access to
specialized expertise can leave patients waiting for assessment or treatment. Administrative work
consumes resources that could otherwise support direct care, clinical preparation, and follow-up.
Greater abundance means more useful medical attention and appropriate services, delivered
when needed. It should be measured through improvements in access and patient benefit, rather
than the volume of documentation, automated interactions, or unnecessary medical utilization.

Advancing technologies can contribute to this additional capacity through documentation
assistance, synthesis of medical records, clinical decision support, and appropriately validated
automation. These functions differ in their purposes, capabilities, and risks, and their evaluation
should reflect those differences. A tool that reduces clerical work may free time for appointments
and patient conversations; another may support faster review or more reliable follow-up. Such
improvements can contribute to affordability, but technical capability alone does not establish
clinical benefit. Evaluation should examine whether the deployed technology produces useful
improvements in care.

Continuity remains an essential consideration as care increasingly spans multiple providers and
settings. Longstanding patient-provider relationships can support trust, accumulated clinical
understanding, and recognition of changes over time. Patients also seek episodic, on-demand,
and virtual care because of convenience, availability, coverage arrangements, and other
circumstances. Reliable, portable clinical information can help an unfamiliar clinician understand
a patient’s history, medications, prior findings, and unresolved needs. That informational
continuity can strengthen care across settings, while remaining distinct from the therapeutic
relationship and professional responsibility developed through ongoing personal care.

An ethical approach must connect patient welfare, autonomy, harm prevention, and fair access.
The relevant harms include erroneous recommendations, omitted care, inappropriate reassurance,
and avoidable delays in obtaining treatment. Ethical responsibility therefore extends across
developers, deploying institutions, and clinicians, each of whom influences the conditions under
which a technology serves patients. Expectations of zero risk provide an inadequate standard for
evaluating either medical practice or medical technology. Decisions should instead consider
clinically meaningful benefits, foreseeable harms, available alternatives, uncertainty, and the
safeguards necessary for responsible use.

Accordingly, CRAE encourages FDA to preserve clear functional boundaries, scale evidence to
clinical risk, use realistic performance comparators, and require meaningful oversight where
appropriate. Effective monitoring and predictable pathways for updates can support continued
improvement, while accountability should reflect each participant’s knowledge, control, and
ability to prevent harm. The framework should also preserve competition and feasible
participation by smaller developers. These principles can guide an approach that protects
patients, supports innovation, and enables timely access to technologies that demonstrably
expand the availability and effectiveness of medical care.

Executive Summary

The Center for Regulatory Analysis and Engagement (CRAE) supports an approach to
generative AI-enabled medical devices that expands access to effective care while protecting
patients. FDA’s preliminary discussion paper provides an opportunity to develop proportionate
evaluation methods before establishing regulatory expectations. The governing objective should
be greater capacity to meet medical needs safely, affordably, and promptly. CRAE recommends
a framework that recognizes technological benefits, evaluates clinically meaningful risks, and
preserves clear responsibility throughout development and deployment.

• Make medical abundance an explicit evaluation objective. Consider expanded access,
affordability, and clinically useful capacity when evaluating benefits and burdens within
FDA’s authority. Examine whether technologies improve appointment availability,
clinician attention, appropriate treatment, and follow-up. Increased documentation or
utilization alone should not establish patient benefit.
• Preserve statutory and functional boundaries. Distinguish regulated medical-device
functions from documentation, information management, and other functions outside
device oversight. Assess intended use and actual functionality, including relevant
interactions within multifunction products. The presence of generative AI should not
independently determine regulatory status.
• Assess risk in its clinical context. Consider the consequences of incorrect outputs,
independence of action, reversibility, time sensitivity, detectability of errors, and
available safeguards. Account for intended users and deployment conditions. Evaluate
how conversations may progress from general information to consequential clinical
direction.
• Support portable clinical continuity. Encourage reliable access to relevant histories,
medications, allergies, prior findings, and unresolved needs across care settings. Preserve
source information, dates, visible uncertainty, and correction processes. Distinguish
historical findings from current examinations, and identify responsibility for pending
results, referrals, and follow-up.
• Translate Hippocratic principles into measurable protections. Evaluate harms arising
from erroneous action, omitted care, inappropriate reassurance, excessive refusal, and
delay. Consider benefits, uncertainty, and realistic alternatives without imposing zero-risk
expectations. Ethical commitments should inform testing, monitoring, correction, and
accountability.
• Protect patient agency and sensitive information. Provide understandable information
when AI materially influences care, including relevant limitations and opportunities for
clinical review. Support meaningful choices concerning ambient recording and secondary
data use, with feasible alternatives where appropriate. Address confidentiality,
manipulation, and undisclosed commercial influence.
• Evaluate the deployed system and clinical workflow. Assess the user-facing product,
including its prompts, retrieval methods, tools, safeguards, and interface. Foundationmodel performance alone cannot establish the performance of the complete device.
Where clinicians use the system, evaluate the relevant human-AI interaction.
• Use realistic performance comparators. Select comparisons appropriate to intended
use, including existing clinical practice, specialist review, and clinician-AI teams. Where
justified, consider delayed or unavailable care. Comparators should reflect patients’
actual alternatives without using inadequate access to excuse preventable harm.
• Scale clinical confirmation to risk. Permit retrospective evaluation, shadow
deployment, standardized encounters, and qualified clinician review when these methods
provide adequate evidence. Require prospective studies where warranted by clinical
consequences or unresolved uncertainty. Explain how sponsors should select and justify
appropriate evidence pathways.
• Validate benchmarks and synthetic data. Address contamination, optimization to tests,
representativeness, and clinically relevant subgroup performance. Allow justified
specialized benchmarks and appropriately independent assessment. Synthetic data may
supplement evaluation where suitable, but its relevance and limitations require validation;
neither benchmarks nor synthetic data should automatically establish clinical safety.
• Pair justified premarket flexibility with proportionate monitoring. Consider greater
reliance on postmarket evidence when risks can be detected and addressed promptly.
Establish appropriate reassessment schedules, triggering events, reporting mechanisms,
and corrective actions. Evaluate supervisory AI where used, and preserve identifiable
manufacturer responsibility.
• Establish predictable pathways for updates. Scale reassessment to the significance of
changes in clinical behavior, intended use, or risk. Clarify the application of
predetermined change control plans and the treatment of changes outside those plans.
Address third-party model updates through appropriate notification, testing, version
management, and recovery arrangements.
• Make human oversight operationally feasible. Ensure that supervising clinicians have
adequate information, training, time, and authority to intervene. Evaluate automation
bias, alert fatigue, and opportunities for appropriate override. Clinician signoff alone
should not be treated as evidence that effective supervision occurred.
• Connect accountability to knowledge and control. Recognize developers’
responsibilities for their systems, institutions’ responsibilities for deployment, and
clinicians’ responsibilities for reasonable clinical use. Support records and reporting that
permit investigation and correction. FDA should clarify its role without assuming
authority to comprehensively determine malpractice standards or professional liability.
• Preserve competition and feasible participation. Examine cumulative testing,
monitoring, and documentation burdens on smaller developers and resource-constrained
practices. Support qualified, competitive assessment options and practical interoperability
consistent with privacy and security. Provide usable examples and guidance, and avoid
unnecessary certification barriers or vendor dependence.
• Match agentic safeguards to the consequences of action. Distinguish recommendations
from execution, including orders, record changes, and treatment-related actions. Establish
appropriate permissions, checkpoints, auditability, and recovery processes. Test tool
failures and adversarial inputs while permitting proportionate autonomy for suitably
validated tasks.
• Develop future policy transparently and lawfully. Maintain the distinction between
this exploratory paper and enforceable requirements. Explain the legal foundations of
future approaches, identify any need for additional authority, and provide appropriate
opportunities for public input. Use implementation experience to refine requirements and
allow reasonable transitions.
Taken together, these recommendations place patient welfare and medical abundance at the
center of responsible innovation. Clear boundaries, relevant evidence, meaningful oversight, and
proportionate accountability can support both protection from harm and access to beneficial care.
CRAE urges FDA to develop a workable framework that enables responsible deployment,
measures actual performance, and accommodates continued improvement as technologies and
clinical experience evolve.

I. Make Medical Abundance an Explicit Regulatory Objective

Medical abundance means expanding the capacity to deliver effective care when patients need it.
For generative AI-enabled medical devices, relevant benefits may include earlier assessment,
appropriate treatment, dependable follow-up, and additional clinician attention. These outcomes
should guide consideration of how a device contributes to patient welfare. Technical accuracy,
processing speed, and benchmark performance provide important evidence, but they do not
independently establish that patients receive better or more accessible care. Evaluation should
connect demonstrated capabilities to clinically meaningful improvements within the device’s
intended use.

Several pathways can translate technological improvements into additional clinical capacity.
Documentation assistance can reduce clerical work, record synthesis can improve preparation,
decision support can aid assessment, and validated automation can perform suitable tasks. Their
contributions will vary across specialties, practice sizes, patient populations, and deployment
settings. Time saved in one workflow may be offset by verification, correction, or integration
demands elsewhere. FDA should therefore recognize potential efficiency benefits while
examining whether the complete system and its implementation make those benefits reasonably
achievable.

Where relevant to a device’s claimed benefits, evaluation should consider measures such as
clinician time saved, appointment availability, completed follow-up, and appropriate clinical
outcomes. Assessments should also account for burdens imposed on patients and practices,
including additional review, unnecessary escalation, and implementation costs. Such measures
can help explain whether an asserted improvement represents useful capacity rather than shifted
workload. Their role should remain proportionate: informing applicable benefit-risk assessments
does not require FDA to establish reimbursement policy, regulate prices, or demand
comprehensive economic studies for every device.

CRAE recommends that FDA expressly consider substantiated access benefits and deployment
burdens where relevant to decisions within its statutory authority. Safety and effectiveness
remain governing responsibilities, and access considerations should strengthen the assessment of
patient benefit. Unnecessary regulatory delay also has consequences when patients continue to
face unavailable appointments, fragmented information, or delayed assessment. A proportionate
framework should weigh relevant uncertainty against realistic alternatives, identify safeguards
necessary for responsible use, and avoid burdens that postpone beneficial care without providing
a corresponding patient protection.
II. Preserve Clear Functional and Legal Boundaries

Regulatory assessment should begin with a software function’s intended use and actual
capabilities. Recording an encounter, transcribing speech, retrieving records, and summarizing
information present different questions from interpreting clinical findings, recommending
treatment, or executing consequential actions. Those distinctions require attention to how each
function operates and is represented to users. The use of generative AI alone should not
determine regulatory status. FDA should explain how applicable device definitions and statutory
exclusions govern these functions, including circumstances in which summarization materially
influences clinical decisions.

A single product may combine device functions with functions outside medical-device oversight.
For example, an application might document an encounter, organize historical records, and
provide diagnostic support through separate but interacting capabilities. FDA should evaluate
interactions that could affect the safety or effectiveness of a regulated function, including errors
introduced through shared information or interfaces. That assessment should remain connected to
the relevant device function and applicable authority. Integration within one application should
not automatically subject every component to identical regulatory treatment or evidentiary
expectations.

Predictable examples would help developers and providers understand these boundaries before
making substantial investments. FDA should address ambient scribes, longitudinal patient
summaries, diagnostic assistance, care triage, and medication recommendations, including
products combining these capabilities. Examples should explain how personalization,
conversational context, and progression across multiple exchanges affect assessment. They
should also clarify the significance of disclaimers: a statement encouraging consultation with a
clinician may inform user understanding, but cannot independently establish regulatory status or
neutralize the clinical consequences of otherwise directive functionality.

Future policy should clearly identify the legal authority supporting each regulatory expectation
and distinguish approaches available under existing law from those requiring additional
authority. Applicable statutory exclusions must remain effective as technology evolves. Because
this discussion paper seeks preliminary input, its concepts should not become de facto
submission requirements or compliance obligations before the appropriate public process occurs.
Clear explanations, opportunities for comment, and reasonable implementation arrangements
would support lawful oversight while giving developers, clinicians, and patients greater
confidence in the framework’s boundaries.

III. Refine Risk Assessment Around Clinical Consequences and Actual Use

FDA’s proposed two-axis framework offers a useful starting point for assessing generative AIenabled medical devices. The clinical consequences of an incorrect output and the degree of
independence with which a system directs or performs an action are relevant dimensions of risk.
A general informational response presents different concerns from an autonomous action
affecting treatment. The framework should organize evaluation while preserving attention to
intended use, workflow, and safeguards. Its categories should support reasoned assessment rather
than operate as automatic classifications detached from deployment conditions.
Additional considerations should refine that assessment, including whether an action is
reversible, how quickly harm could occur, whether errors are detectable, and whether
downstream safeguards can prevent injury. Deployment environments and cumulative effects
also matter: individually modest errors may become consequential when repeated across
encounters or combined within a sequence of actions. FDA should identify how these factors
modify evidence expectations. Uncertainty warrants investigation and proportionate precautions,
but should remain distinguishable from demonstrated danger when determining the controls
necessary to protect patients.

Assessment of intended users should examine relevant knowledge, health literacy, interface
design, and the practical ability to evaluate outputs. Patient-facing functions may require
different explanations and safeguards from clinician-facing functions, but patient use should not
automatically establish elevated risk. Likewise, the presence of a clinician does not
independently ensure effective protection. Relevant expertise, available time, and access to
supporting information influence whether review can identify an error. Testing should reflect
those conditions and assess whether intended users understand limitations and respond
appropriately.

Conversational testing should examine realistic exchanges in which a system moves from
general information toward personalized or consequential advice. Evaluation should consider the
cumulative interaction, including changing symptoms, incomplete histories, repeated prompting,
and attempts to obtain recommendations beyond the intended use. Manufacturers should
establish understandable boundaries and provide appropriate clarification, redirection, or
escalation when those boundaries are reached. FDA should match expectations to demonstrated
behavior and clinical consequences, using evidence from representative interactions to determine
whether safeguards remain effective throughout the conversation.

IV. Support Portable Clinical Continuity Across Care Settings

An ongoing patient-provider relationship can provide accumulated clinical knowledge, trust, and
opportunities to observe changes that may be difficult to recognize during an isolated encounter.
Familiarity with a patient’s circumstances, treatment preferences, and previous responses can
inform interpretation of new concerns. Medical AI should support these relationships by
reducing administrative demands and making relevant information easier to review. Evaluation
should consider whether a technology strengthens the clinician’s ability to understand and serve
the patient over time, including through more dependable preparation and follow-up.

Patients also obtain care through on-demand appointments, urgent care, virtual visits, and
multiple specialty practices. These patterns may reflect availability, convenience, coverage,
geography, or clinical need; they should not be attributed broadly to generational preferences
without supporting evidence. When a clinician is unfamiliar with the patient, missing or
fragmented information can complicate assessment. Technologies that make reliable clinical
context available across authorized care settings may improve these encounters while preserving
patients’ ability to maintain an established relationship where desired and available.

An AI scribe documenting the current encounter performs a different function from a
longitudinal assistant synthesizing information across previous encounters. Products may
combine these capabilities, but their evaluation should distinguish the accuracy of encounter
documentation from the reliability of historical synthesis. A useful longitudinal summary might
identify relevant diagnoses, medications, allergies, prior treatment responses, and unresolved
clinical concerns. Its value depends on selecting information appropriate to the encounter while
preserving access to underlying records when the clinician needs to verify or investigate further.

Information-quality safeguards should make the provenance, date, and limitations of clinically
relevant content apparent. Historical examination findings must remain distinguishable from
current observations, and patient-reported information should be identified appropriately.
Summaries should reveal material gaps and conflicting records rather than imply completeness
or certainty that the available information cannot support. Patients and authorized professionals
need workable correction processes. Systems should also address propagation of errors,
including circumstances in which an inaccurate AI-generated statement is repeatedly
incorporated into later records and acquires unwarranted credibility.

Responsibility must travel with the clinical information through explicit, workable arrangements
for pending results, referrals, medication reconciliation, and follow-up. Providers and deploying
institutions should establish who receives outstanding tasks, how receipt is confirmed where
appropriate, and what happens when a handoff fails. FDA should consider these workflow
dependencies where they bear on a device’s safe and effective use, while respecting the
boundaries of its authority. Even a comprehensive, accurate summary cannot ensure continuity
unless an identifiable participant remains accountable for the necessary next action.

V. Translate Hippocratic Principles Into Measurable Patient Protections

Hippocratic principles provide a foundation for evaluating medical AI through beneficence,
nonmaleficence, autonomy, and justice. These principles call for advancing patient welfare,
avoiding preventable harm, respecting informed choices, and considering fair access to
beneficial care. Their implementation depends on decisions by developers, deploying
institutions, clinicians, and regulators. Software does not acquire professional conscience
through an instruction to behave ethically. Responsible development requires translating ethical
commitments into defined capabilities, operational safeguards, and accountable practices
appropriate to the system’s intended clinical role.

Evaluation should examine harms arising from both action and omission. Dangerous
recommendations, missed escalation, inappropriate reassurance, and failure to identify necessary
follow-up can each threaten patient welfare. Excessive refusal or indiscriminate referral may also
impose avoidable delay, expense, and burdens on clinical capacity. A system’s apparent caution
therefore cannot independently establish safety. Testing should assess whether its responses
support appropriate action under realistic conditions, including when clarification, timely
escalation, or acknowledgment of insufficient information would better protect the patient from
foreseeable injury.

Clinical choices often involve competing risks whose significance depends on probability,
severity, reversibility, and uncertainty. Evaluation should reflect these dimensions while
accounting for patient preferences, available alternatives, and the circumstances of care. A lowprobability catastrophic outcome may warrant safeguards different from those appropriate to a
common, readily reversible inconvenience. Numerical measures can inform comparison, but
cannot resolve every ethical question through a single aggregate score. Acceptance criteria
should explain relevant tradeoffs and preserve protections that cannot be offset merely by
stronger average performance elsewhere.

Patient agency requires understandable disclosure when AI materially influences care, including
information about its role, relevant limitations, and opportunities for professional review.
Ambient recording and secondary uses of sensitive information warrant meaningful choices and
feasible alternatives where appropriate. Confidentiality protections should extend across
collection, storage, access, and subsequent processing. Systems should also guard against
manipulative communication and undisclosed commercial influence over recommendations.
These safeguards should help patients make informed decisions without forcing them to master
technical details or accept unnecessary information uses to obtain care.

Ethical commitments become credible when they can be examined through relevant tests,
ongoing monitoring, correction processes, and accessible mechanisms for reporting harm and
seeking redress. Evaluation should investigate performance across clinically relevant subgroups
and identify limitations affecting particular populations or settings. Access benefits deserve
consideration, but limited alternatives should not excuse avoidable deficiencies or establish
permanently inferior expectations for underserved patients. FDA should encourage evidence that
a device offers meaningful benefit with appropriate protections, while ensuring that ethical
assurances remain connected to observable performance and accountable conduct.

VI. Use Competency-Based Evaluation with Realistic Comparators

Competency-based evaluation should examine the complete user-facing device in the
configuration intended for deployment. Prompts, retrieval methods, external tools, guardrails,
and interface design can materially affect performance, even when products share an underlying
foundation model. Relevant testing should capture these interactions and the conditions under
which users receive and act upon outputs. Foundation-model scores may inform assessment, but
cannot independently establish the safety or effectiveness of the deployed product. Evidence
should address the capabilities and limitations of the system patients and clinicians will actually
encounter.

The competencies assessed should follow the device’s intended use and clinical responsibilities.
Relevant elements may include clinical knowledge, reasoning, quantitative accuracy, recognition
of uncertainty, communication, and appropriate escalation. A documentation function and an
autonomous clinical agent will require different combinations and levels of proficiency.
Evaluation should examine consequential failure modes alongside average performance,
including incorrect dosing, missed warning signs, and misleading confidence. Strong results
across routine tasks should not obscure weaknesses in less frequent situations where errors could
cause serious patient harm.

Benchmarks should demonstrate relevance to the capabilities they purport to measure and the
settings in which the device will operate. Data contamination, repeated optimization against
known tests, and narrow case selection can produce results that overstate clinical readiness.
Appropriately independent assessment and protected test sets can strengthen confidence without
requiring one exclusive testing arrangement. Sponsors should also be able to propose specialized
benchmarks tailored to their devices, provided they justify case selection, scoring methods,
acceptance criteria, and the relationship between measured performance and intended clinical
use.

Performance comparators should reflect the device’s purpose and patients’ realistic alternatives.
Depending on intended use, appropriate comparisons may involve existing care, unaided
clinicians, specialist assessment, or a clinician working with AI support. Delayed specialist
review or the absence of timely intervention may also be relevant when supported by deployment
circumstances. Such comparisons should illuminate actual benefits and risks without selecting an
artificially weak alternative to excuse preventable harm. FDA should explain how comparator
selection affects evidentiary expectations and how clinically important differences should be
evaluated.

Clinical confirmation should establish whether demonstrated competencies translate into
appropriate performance under real or clinically representative conditions. Retrospective testing,
shadow deployment, standardized encounters, and qualified clinician adjudication may provide
adequate evidence for some uses. Prospective studies should be expected where clinical
consequences, workflow dependencies, or unresolved uncertainty warrant stronger confirmation.
FDA should provide predictable criteria for selecting and combining these approaches.
Requirements should address material evidentiary gaps while avoiding studies that add
substantial cost or delay without meaningfully improving confidence in patient protection.

Synthetic data can supplement evaluation when sponsors establish its relevance,
representativeness, and limitations for the intended purpose. Particular care is necessary when
generating and evaluated models share assumptions or blind spots that could conceal clinically
important failures. Sponsors should examine coverage of relevant subgroups, statistical validity,
and differences between synthetic cases and real clinical inputs. Evidence should distinguish
generated examples from independent observations and avoid overstating effective sample size.
Remaining uncertainty should be explicit, with additional confirmation proportionate to its
significance for safe and effective use.

VII. Pair Premarket Flexibility With Effective Postmarket Monitoring

Greater reliance on postmarket monitoring may support appropriate premarket flexibility when
remaining uncertainty can be managed without exposing patients to unacceptable risk. Relevant
considerations include the severity and reversibility of potential harm, the speed with which
deterioration can be detected, and the manufacturer’s ability to intervene effectively. Stronger
premarket evidence remains necessary when errors could cause serious injury before monitoring
identifies them or corrective action becomes possible. FDA should explain the conditions
supporting flexibility and the evidence needed to demonstrate that proposed monitoring can
address specific uncertainties.

Monitoring should combine methods suited to the device’s intended use, including periodic
reassessment, sampled clinician review, detection of performance drift, and incident reporting.
The frequency and scope of review should reflect clinical risk, deployment conditions, and
triggering events such as material model changes or emerging failure patterns. Review of every
interaction should not become a default expectation where representative sampling and targeted
surveillance provide adequate protection. Monitoring plans should identify meaningful
indicators, responsible participants, and procedures for distinguishing isolated errors from
broader performance deterioration.

Corrective action plans should establish thresholds for investigation, restricted use, rollback, user
notification, or suspension, with responses proportionate to the identified problem.
Manufacturers and deploying institutions should be able to act promptly when serious risks
emerge. Decisions should also consider the consequences of withdrawing a useful system,
including interrupted workflows, lost follow-up, and reduced access to care. Appropriate
contingency arrangements should preserve necessary services during correction. These
considerations should guide the manner of intervention while maintaining timely protection
against unacceptable patient harm.

Supervisory technologies require evaluation of their own reliability, including whether they share
failure modes with the systems they monitor. An AI reviewer may overlook the same error, rely
on the same flawed information, or produce misleading reassurance. Monitoring arrangements
should therefore include appropriate independent checks and escalation pathways, with
safeguards for sensitive information collected during review. Manufacturers should retain
identifiable responsibility for their devices, even when monitoring involves clinicians,
institutions, or outside services. Delegating surveillance tasks should not obscure accountability
for investigating problems and implementing necessary corrections.

VIII. Create Predictable Pathways for Updates and Foundation-Model Changes

Predictable update pathways are essential to maintaining useful medical AI as clinical
knowledge, software dependencies, and deployment conditions evolve. FDA should distinguish
routine maintenance from modifications that materially affect clinical behavior, intended use, or
patient risk. The significance of a change depends on its consequences within the complete
device, rather than its technical label alone. Reassessment should therefore address the
capabilities and safeguards potentially affected, using evidence proportionate to the expected
impact. Clear examples would help manufacturers identify when internal validation or additional
regulatory review is appropriate.

Predetermined change control plans can support efficient improvement when anticipated
modifications and their evaluation methods can be described adequately. FDA should explain
how these mechanisms apply to generative systems and clarify pathways for changes that cannot
be fully specified in advance. Manufacturers need predictable criteria for determining whether a
modification falls within an authorized plan, can be managed through existing quality processes,
or requires further review. Minor adjustments should not automatically trigger renewed
authorization, while changes affecting safety or effectiveness should receive appropriate
assessment.

Devices built on outside foundation models require arrangements for identifying versions,
receiving meaningful change notifications, conducting regression testing, and restoring an
acceptable configuration when feasible. Expectations should reflect the manufacturer’s actual
technical and contractual control, while preserving its responsibility for the deployed device.
Where model-provider practices prevent adequate evaluation of consequential changes,
manufacturers should establish additional safeguards or select a more controllable deployment
arrangement. FDA should clarify acceptable approaches without assuming that every
manufacturer can inspect proprietary model internals or prevent all upstream modifications.

Voluntary foundation-model master files could provide useful information for device review
while reducing duplicative submissions across manufacturers using the same underlying model.
FDA should identify the information such files would contribute, how updates would be
maintained, and how authorized references would operate. Legitimate confidential information
should receive appropriate protection, with alternative evidence pathways available when a
model developer does not participate. Participation should remain voluntary in practice, and any
reliance on these files should have an explained evidentiary purpose rather than become an
unexplained prerequisite for market entry.

IX. Make Human Oversight Meaningful and Accountability Proportionate

Meaningful human oversight requires conditions that enable a supervising clinician to recognize
problems and intervene. Relevant information, appropriate training, sufficient time, and authority
to question, override, or stop a system are essential to that function. Evaluation should consider
whether these conditions exist in the intended workflow, including when multiple demands
compete for clinician attention. A signature or acknowledgment alone cannot establish effective
supervision. Oversight arrangements should demonstrate how review addresses foreseeable
errors and how concerns reach someone capable of taking corrective action.

Independent clinical judgment should remain practical as AI becomes integrated into care.
Automation bias, repeated low-value alerts, and fear of liability may encourage uncritical
acceptance or defensive adherence to recommendations. Systems should support appropriate
overrides and allow clinicians to record relevant reasoning without imposing excessive
documentation burdens. Acceptance or rejection of an AI recommendation should not
independently establish whether care was reasonable. Assessment should consider the
information available, the patient’s circumstances, the tool’s intended role, and the clinician’s
response to identifiable limitations or warning signs.

Responsibility should reflect each participant’s knowledge, control, and ability to prevent harm.
Developers should address defects, validation, disclosed limitations, and modifications within
their control. Deploying institutions should address product selection, integration, training,
staffing, and workflow conditions. Clinicians should remain responsible for reasonable use and
patient-specific judgment within their professional role. Shared involvement may require
investigation of several contributing causes. This approach should preserve accountability
throughout the system without assuming that the treating clinician can discover every technical
defect or compensate for every deployment failure.

Patients need workable mechanisms for investigating errors, obtaining corrections, and pursuing
appropriate remedies. Relevant records should identify system versions, material outputs, and
consequential actions while protecting confidentiality and avoiding unnecessary data retention.
Contractual arrangements should not obscure responsibility or suppress information needed to
identify and address safety problems. Insurance and appropriate indemnification can allocate
financial risk, but should remain aligned with participants’ actual responsibilities. Agreements
should support timely cooperation in investigations rather than leave patients or clinicians
confronting gaps between developer and institutional obligations.

Coordination across regulatory and professional institutions can improve clarity while respecting
their distinct responsibilities. FDA’s role in evaluating medical devices differs from the
determination of malpractice standards, professional licensure, and liability under applicable law.
Authorization provides relevant information about a device’s permitted use and supporting
evidence, but does not resolve every question concerning reasonable care in a particular
encounter. FDA should explain device limitations and oversight expectations clearly, while
working with appropriate stakeholders on related issues without assuming authority to
comprehensively redesign professional liability law.

X. Preserve Competition and Feasible Participation

The cumulative burden of testing, specialist review, monitoring, and documentation can
influence which developers enter the market and which practices can adopt useful technologies.
Requirements that appear manageable individually may become substantial when combined,
particularly for smaller developers and resource-constrained providers. FDA should examine
these interactions when designing future expectations and consider whether equivalent assurance
can be achieved through less burdensome methods. Patient protection requires adequate
evidence, while efficient evaluation helps preserve competition and access to technologies suited
to diverse clinical settings.

Competitive testing arrangements can strengthen evaluation while limiting unnecessary
dependence on a small number of certifying organizations. FDA should permit qualified
independent assessors and multiple scientifically valid methods, with transparent criteria for
competence, independence, and acceptance of results. Safeguards should address financial
conflicts, inappropriate influence over scoring, and relationships between developers and
evaluators. Exclusive certification arrangements should require demonstrated justification,
including consideration of their effects on cost, capacity, and market entry. Sponsors should
retain reasonable opportunities to establish that alternative methods provide equivalent
assurance.

Practical interoperability can improve clinical usefulness by supporting authorized access to
relevant records and usable exchange of information across care settings. Manufacturers and
deploying institutions should consider whether data formats, interfaces, and export capabilities
enable appropriate verification, correction, and transfer. Avoidable vendor dependence can
complicate continuity and increase the cost of changing systems when performance proves
inadequate. FDA should address interoperability where relevant to device safety and
effectiveness, while respecting privacy, security, contractual rights, and the limits of its statutory
authority.

Implementation guidance should provide clear examples, usable templates, and expectations
proportionate to device risk and deployment conditions. It should distinguish manufacturers’
evidentiary and product responsibilities from providers’ workflow obligations, avoiding
ambiguous demands that shift compliance tasks between participants. FDA should seek feedback
from smaller developers and resource-constrained practices about practical obstacles and
unnecessary duplication. Subsequent evaluation should examine whether requirements materially
impede beneficial entry or adoption and whether adjustments could preserve patient protection
while reducing costs, uncertainty, and avoidable barriers to participation.

XI. Apply Additional Safeguards to Agentic Clinical Systems

Agentic clinical systems require assessment of what they can execute as well as what they can
recommend. Generating advice differs from placing an order, modifying a clinical record,
transmitting instructions, or initiating a treatment-related action. Evaluation should identify the
permissions and dependencies connecting these steps and examine their cumulative
consequences. An individually limited action may become consequential when combined with
subsequent actions or repeated across patients. Testing should therefore address complete task
sequences, including whether errors propagate before a clinician or another safeguard can
intervene.

Safeguards should match the consequences of authorized actions through defined permissions,
scope limits, and appropriate human checkpoints. Evaluation should examine tool failures,
prompt injection, misleading external information, and interrupted or partially completed
workflows. Systems should recognize when available information or tool responses cannot
support safe execution and respond appropriately. Audit records should permit reconstruction of
consequential actions, while recovery mechanisms should address duplicate orders, incorrect
changes, and incomplete handoffs. The feasibility and limits of reversal should inform controls
before an action occurs.

Appropriate autonomy can preserve the capacity benefits of validated automation when tasks
have bounded consequences and effective safeguards. Universal approval checkpoints may
consume clinician attention without improving safety for routine, lower-risk operations. FDA
should instead identify when human authorization provides meaningful protection and scale
expectations accordingly. As potential consequences, uncertainty, or irreversibility increase,
stronger validation, supervision, and intervention capabilities become necessary. This approach
would support useful automation while ensuring that operational independence remains justified
by evidence about the task, deployment conditions, and available protections.

XII. Develop the Framework Through Transparent, Iterative Implementation

FDA’s discussion paper establishes no new requirements and should remain a vehicle for
gathering information and testing ideas. As the Agency develops future policy, it should explain
significant choices, identify their legal foundations, and describe how proposed expectations
relate to existing obligations. Further opportunities for public comment should allow
stakeholders to examine concrete approaches and suggest workable alternatives. Submission
reviews and informal communications should preserve this distinction, ensuring that exploratory
concepts do not become practical conditions of market access before the appropriate public
process.
Targeted pilots can generate evidence about evaluation methods, monitoring arrangements, and
deployment conditions while protecting patients. FDA should identify the uncertainties each
pilot addresses, establish suitable safeguards, and create accessible channels for reporting
experience. Generalizable findings should be shared publicly, consistent with confidentiality and
legitimate protections for proprietary information. Patients, frontline clinicians, smaller
developers, and resource-constrained providers should participate meaningfully. Their
involvement can reveal practical limitations and access barriers that may be less apparent in
well-resourced institutions or controlled testing environments.

Periodic review should examine whether implementation improves patient outcomes and access
while providing predictable review pathways and proportionate compliance burdens. FDA
should also consider effects on competition, including whether smaller participants can use
available evidence pathways and assessment services. Requirements that prove ineffective,
duplicative, or disproportionate should be reconsidered through a transparent process.
Reasonable transition periods should accompany future changes, with more immediate responses
reserved for circumstances warranting urgent protection. This approach can preserve continuity
while allowing regulatory expectations to improve as evidence and clinical experience develop.

Conclusion

Responsible development of medical AI can help expand the capacity to deliver effective,
affordable, and accessible care. The Center for Regulatory Analysis and Engagement welcomes
FDA’s willingness to explore evaluation methods suited to these technologies and their clinical
uses. Medical abundance should remain a guiding objective: more timely assessment,
appropriate treatment, clinician attention, and dependable follow-up. Realizing these benefits
requires evidence of useful performance and safeguards proportionate to risk, together with
recognition that unnecessary barriers can postpone improvements patients need.

Clear functional and statutory boundaries should anchor the framework. Documentation,
information management, clinical recommendations, and autonomous execution require distinct
assessments based on intended use and actual capabilities. Oversight should reflect clinical
consequences, independence of action, reversibility, deployment context, and effective
safeguards. Predictable examples would help manufacturers and providers understand these
distinctions before committing resources. FDA should preserve applicable exclusions and
explain how conversational behavior, personalization, and interactions among product functions
affect its assessment without making generative AI itself the basis for regulatory treatment.

Clinical continuity and patient agency should remain central as technology supports care across
settings. AI can strengthen established relationships while helping unfamiliar clinicians obtain
reliable context during episodic encounters. Source information, correction processes,
confidentiality protections, and explicit follow-up responsibility are essential to that contribution.
Ethical evaluation should examine harmful recommendations alongside omitted care,
inappropriate reassurance, excessive refusal, and delay. Patients’ limited alternatives should
inform realistic assessment while preserving meaningful protections and opportunities to
understand, question, and participate in decisions about their care.
Evaluation should connect relevant competencies to realistic clinical performance. FDA should
assess deployed systems, select justified comparators, and tailor clinical confirmation to intended
use and risk. Benchmarks and synthetic data can contribute evidence when their validity and
limitations are established. Appropriate premarket flexibility should be paired with monitoring
capable of detecting significant problems and supporting timely correction. Predictable pathways
for updates, including changes involving third-party models, would allow continued
improvement while maintaining confidence that material modifications receive assessment
proportionate to their consequences.

Accountability should follow each participant’s knowledge, control, and ability to prevent harm.
Clinicians need sufficient information, training, time, and authority for oversight to be
meaningful, while developers and institutions should retain responsibility for matters within their
control. Patients should have workable avenues for reporting problems, obtaining corrections,
and pursuing appropriate remedies. Competitive assessment arrangements, practical
interoperability, and feasible compliance pathways can preserve participation by smaller
developers and resource-constrained practices. Independent clinical judgment and responsible
innovation both depend on avoiding indiscriminate transfers of risk.

Ultimately, CRAE urges FDA to develop a transparent, lawful, and adaptable framework
informed by public participation and implementation evidence. Future expectations should have
clear legal foundations, understandable evidence pathways, and reasonable transitions, with
timely intervention when significant risks emerge. Patient protection and beneficial deployment
should advance together through relevant testing, accountable use, and continued improvement.
By measuring clinical value and avoiding disproportionate burdens, FDA can support
technologies that increase useful medical capacity and expand patients’ practical access to
competent care.

Sincerely,

Andrew M. Langer
President
Main Street Foundation