Forge Applied Science & Technology (John-Paul Bonansinga)

See attached file(s)

Comment on Docket No. FDA-2026-N-7874
To: Center for Devices and Radiological Health, U.S. Food and Drug Administration (via Regulations.gov)
Re: Considerations for the Regulation of Generative AI-Enabled Medical Devices: Discussion Paper and
Request for Feedback
From: John-Paul Bonansinga, MD, on behalf of Forge Applied Science & Technology
About the submitter: Forge Applied Science & Technology is an independent research and development
company. Its founder, John-Paul Bonansinga, MD, has a background in neuroscience and medicine and
now works in physical and information security. He tests frontier AI models daily and has watched their
behavior shift as their memory of him grew.

Summary
We support R.1, under which “variation in safety-critical behaviors such as escalation, refusal, or
diagnostic conclusions is treated as a failure” [1]. Three points follow, each with a recommendation and
questions for discussion.
1. Memory changes a device without changing its model. The paper’s examples of how a device
evolves do not include memory.
2. What is not logged cannot be tested. When a device remembers, “the same input” has no fixed
meaning.
3. An accepted error can outlive the session. Tracing it needs logs that link each output forward to
the records it informs.
We address Appendix B questions Q1, Q2, Q5, Q9, Q19, Q21, Q22 and Q23; the annex keys each to
these points.

1. Memory changes a device without changing its model
By memory we mean context a system accumulates across sessions, about one user or shared across
users, and applies to later queries without its being supplied in them. Section II gives examples of the
features through which a device can evolve over time: “the underlying model, prompts, retrieval
strategies, guardrails, orchestration logic, and/or user interface” [1]. The nearest categories are Section
VI.C’s “model-evolution changes,” which FDA describes as change that arises because a device learns or
adapts during use, and the 2024 DHAC Executive Summary’s adjustment based on “user interactions”
[2]. Neither names memory nor says whether a change that leaves the model untouched is included.
Memory changes behavior after release while the model and its released configuration stay the same.
In clinical use, the likelier failure is innocent, not malicious, though both are documented:
• Contamination without an attacker. In controlled tests, benign interactions persisting in
undefended shared state produced 57–71% cross-user contamination, one user’s interaction
changing another user’s output. Two of the three datasets were clinical EHR databases [3].
• Passing disclosures become permanent traits. Of 179,057 consumer-chatbot conversations audited,
21.31% contained personal health data. Memory synthesis selectively condensed passing symptom
disclosures into “permanent diagnostic traits” [4].
• Leakage and sycophancy. Across 18 LLMs, median failure rates were 53% for cross-domain memory
leakage and 97.8% for memory-induced sycophancy [5].

Docket FDA-2026-N-7874 · Forge Applied Science & Technology · Page 1 of 5
 • Attack, too. Elements S.2 and A.1 name prompt injection; memory is a further, persistent channel.
Through queries alone, an attacker planted malicious records with 98.2% average success; the attack
then succeeded 76.8% of the time on average, including against an EHR agent [6].
All four findings come from preprints [3–6]; we cite them as early signals, not settled rates.
Recommendation 1 (Q22, Q23; see Q2). Name memory among the features through which a device
evolves and make clear that VI.C’s model-evolution changes include memory that alters behavior while
model weights stay fixed. Review the memory mechanism (what may be stored, how it is corrected,
when it expires) as part of the design, and place changes to it under change control. Per-user memory
content, like the future modifications Q23 describes, “cannot be fully prespecified”; it should reach the
model only as explicit, logged input.

For discussion
• Can a PCCP prespecify a memory mechanism whose content cannot be prespecified?
• Once a stored error has been reused across sessions or users, what should a manufacturer be able to
show about how it is found, corrected and removed?

2. What is not logged cannot be tested
R.1 asks whether safety and clinical proficiency properties “hold consistently across foreseeable
variation in inputs, runtime conditions, and conversational contexts” [1]. Memory is such a condition:
foreseeable, but invisible. Two clinicians posing an identical query are not giving the device the same
input.
Identical design does not guarantee identical behavior. Models trained identically except for the random
seed can perform equally well on held-out test data yet behave differently in deployment; the domains
studied include clinical risk prediction from electronic health records [7]. FDA’s definition of a locked
model, one that “provides the same output each time the same input is applied to it and does not
change with use” [2], presumes a defined input.
Principle. A clinical generative AI device should act only on explicit, auditable context supplied with each
query, not on implicit context accumulated across sessions. We have not found it stated for clinical
generative AI devices by a regulator or standards body. It is stricter than the nearest published proposal
we found, a default of “minimal, reviewable, and revocable persistence” for AI memory [8].
Under it, every input supplied to the model with a query, retrieved records and stored user context
included, is logged with the model version and decoding settings. Logging does not make outputs
deterministic; it makes their variation attributable. Longitudinal care is unaffected: the patient’s record
is retrieved and supplied explicitly, with its provenance logged. The principle also covers re-ingestion of
the device’s own earlier outputs, which can carry state through a nominally stateless design [9].
Recommendation 2 (Q5, Q9). Add to R.1 either (a) a declaration and demonstration that no crosssession state influences outputs, or (b) testing of identical queries across a risk-selected set of
constructed memory states, with each response’s context logged. The synthetic approaches of Section
V.B.2 apply. In R.2 subgroup testing, vary the memory state as well as the query: in a comparison run on
one model, names supplied through a chatbot’s memory yielded higher harmful-stereotype rates than
the same names supplied as custom instructions [10].

Docket FDA-2026-N-7874 · Forge Applied Science & Technology · Page 2 of 5
 For discussion
• Constructed memory states are synthetic; real ones exist only after deployment. Should option (b) be
paired with postmarket sampling of real memory states, and should that sampling be repeated for
each deployed configuration?
• Should R.2’s “clinically relevant populations” explicitly account for regional differences in disease
prevalence, which shift pretest probability, and for local documentation practice such as institutionspecific abbreviations? US adult obesity prevalence, for example, ranged from 29.6% in the Northeast
to 35.5% in the Midwest in 2025 [11].

3. An accepted error can outlive the session
Element E.4 names automation bias, “in which a user accepts an output without appropriate scrutiny
because of the device’s fluency or perceived authority” [1]. Its effects outlast the interaction:
• Radiologists at every experience level lost accuracy when a purported AI suggested an incorrect BIRADS category [12].
• In two of three experiments, non-clinician participants who had worked with a biased AI in a
simulated diagnostic task reproduced its errors after the assistance was withdrawn [13].
We saw this in miniature while preparing this comment. AI study aids built from our own source
documents and web search stated that regulators already mandate logging of prompts and model
versions. We found no such requirement in the HIPAA Security Rule, ONC’s health IT certification rules
or 21 CFR Part 11. The claim reached this author’s notes before a check against primary sources caught
it.
An error accepted once can enter the record, and colleagues’ decisions, as human-authored content
with no link back to the device. No in-session benchmark observes that path. Later review has its own
bias: 112 practicing anesthesiologists rated identical care as appropriate 31 percentage points less often
when its outcome was changed from temporary to permanent [14]. A fair review needs a record of what
the device and the clinician saw at the specific point in time when the decision was made.
A partial precedent exists. In health IT certified to ONC’s audit-log criterion (certification is voluntary),
recorded actions “must not be capable of being changed, overwritten, or deleted by the technology”;
alteration must be detectable; and clocks must be synchronized [15].
Recommendation 3 (Q1, Q19, Q21; see E.4).
• (a) Treat persistence of an accepted error beyond the session as a hazard in the risk analysis,
alongside E.4.
• (b) Keep each response’s logged context, output and model version retrievable under the
manufacturer’s quality system, with privacy safeguards, and give each output an identifier that
institutions can link to the records it informs. Q1’s “traceability of the output (i.e., to primary source
materials)” then runs both ways, and an error found later can be attributed to a corrupted input, a
device-introduced distortion, or a clinician’s decision.
• (c) In sample-based clinician review (Q19), include whether device errors propagate into
documentation.

Docket FDA-2026-N-7874 · Forge Applied Science & Technology · Page 3 of 5
 For discussion
• Should a manufacturer be able to reconstruct any past output, with its full input, model version and
settings, on request?
• Should GenAI device logs meet the tamper-resistance and clock-synchronization expectations already
set for certified health IT? Who should hold them, and for how long?
• How can these expectations scale to small and rural practices?

Closing
Naming memory, logging every input, and linking records back to outputs would make R.1 testable and
its failures attributable. We would welcome the opportunity to discuss these questions with CDRH staff.
Disclosure. Neither the author nor Forge Applied Science & Technology has a financial interest in any
product, company or study cited in this comment, and neither is currently funded directly by any AI
developer or medical device manufacturer. AI tools assisted with research, drafting and fact-checking;
an attached note describes how.
Respectfully submitted,
John-Paul Bonansinga, MD
Founder, Forge Applied Science & Technology

Annex. Responses keyed to the discussion questions (Appendix B)
Question Topic Our response Point
Q1 Additional risk dimensions, Traceability in both directions: output to sources, and downstream 3
including “the traceability of record back to output.
the output”
Q2 Output characteristics that Personalization can rest on memory. Where it does, treat memory 1, 2
may modify risk, including as a change vector and supply it as explicit, logged input.
“personalization”
Q5 Intended use when behavior Memory makes behavior emergent across conversations. Exclude 2
is emergent across a cross-session state, or declare, test and log it.
conversation
Q9 Missing or miscategorized R.1: add the declaration or the constructed-state test. R.2: vary 1–3
benchmarking elements; memory state as well as the query. E.4: extend beyond the session.
external standards S.2 and A.1: memory is a further injection channel. Standards and
frameworks: IMDRF N93 draft §5.6, which describes collecting
interaction logs and prompt-response histories [16]; ONC’s auditlog certification criterion, 45 CFR 170.315(d)(2), and the standards it
references at 170.210(e), (g) and (h) (log content from selected
sections of ASTM E2147-18; synchronized clocks) [15].
Q19 Postmarket evaluation, Include whether device errors propagate into documentation. This 3
including sample-based presupposes logged, linkable interactions.
clinician review
Q21 Stakeholder roles without Output identifiers and manufacturer-held logs let institutions report 3
diffusing manufacturer propagated errors and attribute them to input, device or clinician
accountability decision, without diffusing manufacturer accountability.

Docket FDA-2026-N-7874 · Forge Applied Science & Technology · Page 4 of 5
 Question Topic Our response Point
Q22 Scaling evidence to Cross-session persistence that can alter outputs is a category of 1
modifications; PCCP modification, including when model weights are fixed.
categories
Q23 Change control when Per-user memory content cannot be prespecified. Its mechanism 1, 2
modifications cannot be fully can: what may be stored, and that it enters each query as explicit,
prespecified logged input.

We do not comment on the other questions.

References
1. U.S. Food and Drug Administration, Center for Devices and Radiological Health. Considerations for the Regulation of
Generative AI-Enabled Medical Devices: Discussion Paper and Request for Feedback. 2026. Docket FDA-2026-N-7874,
document FDA-2026-N-7874-0001. Available from: https://www.fda.gov/media/194242/download (docket copy:
https://downloads.regulations.gov/FDA-2026-N-7874-0001/attachment_1.pdf)
2. U.S. Food and Drug Administration. Executive Summary for the Digital Health Advisory Committee Meeting: Total Product
Lifecycle Considerations for Generative AI-Enabled Devices. Meeting of 20–21 November 2024. Available from:
https://www.fda.gov/media/182871/download
3. Yang T, Li J, Nian Y, Dong S, Xu R, Rossi R, et al. No attacker needed: unintentional cross-user contamination in sharedstate LLM agents. arXiv:2604.01350v1 [Preprint]. 2026 [cited 2026 Oct 18]. Available from:
https://arxiv.org/abs/2604.01350
4. Zaman SMM, Hoque MM. Vulnerabilities in personalization: assessing health privacy risks in ChatGPT logs and memory.
arXiv:2609.14697v1 [Preprint]. 2026 [cited 2026 Oct 18]. Available from: https://arxiv.org/abs/2609.14697
5. Pulipaka S, Chen O, Sharma M, Bajwa TS, Raina V, Sheth I. PersistBench: when should long-term memories be forgotten by
LLMs? arXiv:2602.01146v2 [Preprint]. 2026 [cited 2026 Oct 18]. Available from: https://arxiv.org/abs/2602.01146. Poster
presented at: International Conference on Machine Learning (ICML 2026); 2026 Jul 9.
6. Dong S, Xu S, He P, Li Y, Tang J, Liu T, et al. Memory injection attacks on LLM agents via query-only interaction.
arXiv:2503.03704v5 [Preprint]. 2026 [cited 2026 Oct 18]. Available from: https://arxiv.org/abs/2503.03704
7. D’Amour A, Heller K, Moldovan D, Adlam B, Alipanahi B, Beutel A, et al. Underspecification presents challenges for
credibility in modern machine learning. J Mach Learn Res. 2022;23(226):1-61.
8. Kasneci G, Kasneci E. The safety failures we are not instrumenting: a perspective on hidden safety-critical challenges in
modern AI systems. arXiv:2607.19292v1 [Preprint]. 2026 [cited 2026 Oct 18]. Available from:
https://arxiv.org/abs/2607.19292. Published as: AI Ethics. 2026;6(3):295. doi:10.1007/s43681-026-01132-0
9. Salem A, Paverd A, Abdelnabi S. Position: stateless yet not forgetful: implicit memory as a hidden channel in LLMs.
arXiv:2602.08563v1 [Preprint]. 2026 [cited 2026 Oct 18]. Available from: https://arxiv.org/abs/2602.08563
10. Eloundou T, Beutel A, Robinson DG, Gu-Lemberg K, Brakman AL, Mishkin P, et al. First-person fairness in chatbots. In:
Proceedings of the International Conference on Learning Representations (ICLR). 2025. p. 58234-68. arXiv:2410.19803.
11. Centers for Disease Control and Prevention. Adult obesity prevalence maps [Internet]. U.S. Department of Health and
Human Services; 2026 [updated 2026 Sep 24; cited 2026 Oct 18]. Available from: https://www.cdc.gov/obesity/data-andstatistics/adult-obesity-prevalence-maps.html
12. Dratsch T, Chen X, Rezazade Mehrizi M, Kloeckner R, Mähringer-Kunz A, Püsken M, et al. Automation bias in
mammography: the impact of artificial intelligence BI-RADS suggestions on reader performance. Radiology.
2023;307(4):e222176. doi:10.1148/radiol.222176
13. Vicente L, Matute H. Humans inherit artificial intelligence biases. Sci Rep. 2023;13:15737. doi:10.1038/s41598-023-423848
14. Caplan RA, Posner KL, Cheney FW. Effect of outcome on physician judgments of appropriateness of care. JAMA.
1991;265(15):1957-60. doi:10.1001/jama.1991.03460150061024
15. 45 CFR 170.315(d)(2), Auditable events and tamper-resistance; 45 CFR 170.210(e), (g), (h). Electronic Code of Federal
Regulations [Internet]. Current as of 2026 Oct 15 [cited 2026 Oct 18]. Available from:
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-D/part-170
16. International Medical Device Regulators Forum, Artificial Intelligence/Machine Learning Working Group. Technical
framework for artificial intelligence life cycle management. IMDRF/AIML WG/N93 DRAFT. 7 April 2026. Available from:
https://www.imdrf.org/consultations/technical-framework-artificial-intelligence-life-cycle-management

Docket FDA-2026-N-7874 · Forge Applied Science & Technology · Page 5 of 5

Our comment in plain language
A companion to the comment that John-Paul Bonansinga, MD, submitted for Forge Applied Science &
Technology on FDA docket FDA-2026-N-7874. It is for readers who are curious about medical AI but
don’t work with it.

What this is about
The FDA is working out how to review medical devices built on generative AI. These are chat-style tools
that can answer questions, summarize a patient’s records, or suggest what might be wrong. In 2026 the
FDA published a discussion paper on the subject and asked the public for feedback. This page explains
what we told it, without the jargon.

Four terms
• AI model. The core program that writes the answers. It learned patterns from a huge amount of
text. Once released, it usually stays the same until its maker updates it.
• Memory. Notes an AI tool keeps about a person between conversations, such as what they asked
last week or what it assumes about their job. The tool can use those notes later without being asked
to.
• Log. A record of what went into the AI, what came out, and when.
• Change control. The rules a company must follow when a device changes after it reaches the
market.

1. Memory can change a device without changing its model
The FDA’s paper gives examples of the ways medical AI can change over time: its model, its instructions,
the sources it looks things up in, and so on. Memory isn’t one of them.
That gap matters because memory can change the answers even when nothing else changes. Two
doctors can ask the same tool the same question and get different answers, because it remembers
different things about each of them.
Early research shows that memory can go wrong even when no one is attacking it. In one set of tests,
ordinary conversations by one user changed the answers another user got. In another study, passing
mentions of symptoms were stored as if they were lasting diagnoses. These studies are new, and most
have not yet been through full peer review, so we treat them as early warnings rather than settled facts.
What we asked: name memory as one of the ways a device can change, and review how a device stores,
corrects and deletes what it remembers.

2. What isn’t written down can’t be tested
The FDA’s paper proposes that when these tools vary on the things that matter most, such as whether
to send a patient for urgent care, when to refuse, or which diagnosis to suggest, the variation counts as
a failure. To check for it, a tester must know exactly what the tool was given.
So we suggested a simple rule: everything the tool uses to answer should be handed to it along with the
question and recorded. That includes any stored notes and any records it pulls in. A patient’s own
medical record can still be used. It just comes in openly, with each question, and is logged.

Docket FDA-2026-N-7874 · Forge Applied Science & Technology · Page 1 of 2
This won’t make every answer identical, because these tools have some built-in randomness. But when
two answers differ, a tester can tell whether the inputs differed or the tool went wrong.
What we asked: test devices that keep memory across many different stored memories, or have the
maker show that nothing carried over between conversations affects the answers. Either way, log what
went into each answer.

3. A mistake can outlive the conversation
When an AI sounds sure of itself, people tend to believe it, experts included. In one study, radiologists
reading mammograms made more mistakes when an AI suggested a wrong answer. In another,
volunteers who had worked with a biased AI kept making its mistakes after it was taken away.
We saw a small version of this ourselves. While we were preparing the comment, AI study tools told us
that regulators already require AI prompts to be logged. We checked the main federal rules on health
data and electronic records and found no such requirement. By then the claim had already made it into
our notes.
A wrong answer accepted once can be copied into a medical record. From there it can shape a
colleague’s decisions, with nothing showing that it came from an AI. Reviewing a case later has its own
trap: in a classic study, anesthesiologists rated the same care as appropriate far less often when they
were told the harm to the patient was permanent rather than temporary. A fair review needs a record
of what the AI and the doctor saw at the moment the decision was made. Complete information is not
always available when a time-sensitive intervention is needed. Without a true snapshot of the situation,
it is difficult or impossible to make improvements to protocols and procedures.
What we asked: treat a mistake that outlives the conversation as a known risk. Keep a record of each
answer and what went into it. Give each answer an ID that a hospital can link to the records it
influenced. There is a model to follow: some health record software is already certified to keep activity
logs that can’t be quietly altered, with synchronized clocks.

What the comment does not say
It doesn’t ask the FDA to ban AI memory, and it doesn’t say AI is unsafe. It asks for clear rules about
what gets tested and what gets written down, so that when something goes wrong, people can find out
why. It also asks how these rules could work for small and rural practices, not just large hospitals.

Where to read more
The FDA’s discussion paper and the public comments, ours included, are at regulations.gov under docket
FDA-2026-N-7874. Our full comment cites its sources.

Docket FDA-2026-N-7874 · Forge Applied Science & Technology · Page 2 of 2

How this comment was prepared
A note on the use of AI tools, attached to the comment that John-Paul Bonansinga, MD, submitted for
Forge Applied Science & Technology on FDA docket FDA-2026-N-7874.
Our comment argues that AI outputs should be traceable to what went into them. It seemed right to
hold the comment itself to the same standard. This note says who did what, how the claims were
checked, and when each idea entered the work.

Who did what
Me (John-Paul Bonansinga). The comment is built on observations and questions I raised in dictated
notes and in conversation. I chose which ones to pursue, directed each revision, and edited the final
text. Many of its phrases carry over from my dictation.
Claude, an AI assistant made by Anthropic. It searched the research literature and the regulations,
drafted most of the prose from my notes and instructions, formatted the references, and ran the checks
described below. Some things in the comment began with it rather than with me:
• the observation that the discussion paper’s examples of how a device can change do not name
memory, which I then confirmed;
• most of the research citations (I brought the anesthesia hindsight study; Claude located and verified
it);
• some of the framing, including the point that logging does not make answers identical but makes
their differences traceable, and the format of the annex.
Other tools. Speech-to-text software transcribed my dictation. Early on I also studied a briefing
document and an audio overview that another company’s AI tools generated from our sources. They got
the main argument right but presented some things as current law that are not. One of those claims
reached my notes before a check caught it; the comment uses that as an example (Point 3).
By our count. We traced 36 elements of the comment (its claims, recommendations, questions and
structural choices) back to where each one started. 16 began in my notes, 4 came out of our discussion,
and 16 began with Claude. I confirmed or extended 10 of those 16 in my own notes. The appendix lists
all 36.

How the claims were checked
• Each factual claim was checked against its primary source where one exists: the FDA paper, the
regulation text, or the study itself. Claims that could not be confirmed were cut or narrowed.
• The checks ran in separate AI sessions (also Claude) that saw only the draft and the sources, not the
conversation that produced the draft.
• The final round, on 18 October, had two parts: one for the regulatory statements and one for the
research citations. Together they recorded 99 findings and led to 18 corrections. The most
important one changed how we describe Section VI.C of the paper: an earlier draft said it presumes
a change to the model, and it does not.
• Earlier rounds, on 7 and 17 October, checked the first drafts’ citations, my own notes and the AI
study aids. They corrected several of my notes before those notes reached the draft.
• Where the comment relies on preprints, it says so.

Docket FDA-2026-N-7874 · Forge Applied Science & Technology · Page 1 of 5
From observation to comment
Date (2026) What I observed or asked What it led to Where it appears
By 3 Oct Two doctors from different In discussion with Claude, a working rule: The Principle; “two
backgrounds will ask the same a clinical AI should act only on context clinicians” (Point 2)
clinical question in different words, supplied with each query, not on memory
and in a model that predicts word by carried between sessions.
word, a single word can matter.
5–6 Oct Does FDA’s framework account for A literature and regulatory survey by Point 1; references 3–6
memory? Claude. It found that the paper’s examples and 8–10
do not name memory, and it found recent
research on memory failures. First draft.
6 Oct Dictated thesis: what a patient Draft points on tracing a record back to Recommendation 3(b)
reports can be corrupted on its way the AI output that shaped it.
through the system, and clinical data
needs a chain of custody.
7 Oct Which of FDA’s questions do these A map of the points to the paper’s Annex
points answer? questions; the first citation check.
By 17 Oct Dictated notes: the likelier failure is A check of my notes and of the AI study “Innocent, not malicious”
innocent, not malicious; an error can aids. It caught the false “mandate” claim (Point 1); reference 7
persist across a patient’s record and and corrected several of my points. A (Point 2); the second
spread to colleagues; a fluent, partly right note on tamper-proof logs led question in Point 2’s box;
confident output sways decisions; to the precedent in reference 15. My skier Point 3’s example,
disease prevalence and analogy led to reference 7 by way of a hindsight study,
documentation habits vary by misreading (appendix, item 9). precedent and questions
region; a later review judges with
hindsight; storing these records
costs money that small and rural
practices may not have. The AI
assistants I use daily behave
differently as their memory of me
grows.
18 Oct Make each point short, and turn A rewrite into three points with discussion The structure of the
claims into questions that invite questions; the two-part final check. comment
discussion.
18 Oct Readers who don’t work with AI A comparison of structure and tone with Header, closing,
should be able to follow the nine comments already posted to this attachments
comment, and every reader should docket (no text borrowed). Added the
know how AI was used. submitter line, the disclosure, the preprint
note and two companion documents.

This note leaves out Forge’s internal tools and unrelated research. We kept every draft and check
report, with dates.
John-Paul Bonansinga, MD
Founder, Forge Applied Science & Technology

Docket FDA-2026-N-7874 · Forge Applied Science & Technology · Page 2 of 5
Appendix. Provenance record
This is the record behind “By our count”: 36 elements of the comment, each traced to where it started
and to what changed on the way. Origin codes:
• Author: began in my notes or dictation.
• Joint: came out of discussion between me and Claude.
• Claude, then author: began with Claude; I later confirmed, restated or extended it in my own notes.
• Claude: began with Claude.
All dates are 2026. “Notes” means my dictated notes, all written by 17 October. Where an element sits
on a boundary, the call is a judgment.
# Element (where in the Origin First appeared What changed on the way
comment)
1 The paper’s examples of how a Claude, then Claude’s literature survey, 5 The description of Section VI.C
device changes do not name author Oct; I confirmed it reading draft was corrected in the final check,
memory (Point 1) 3, 17 Oct 18 Oct
2 Memory changes behavior while Joint My notes on draft 3, 17 Oct: Became “foreseeable, but
the model stays the same (Point memory does not touch the invisible” (Point 2)
1) model’s weights, but it sets the
starting point
3 Innocent failure before Author My notes Became the lead in draft 4; one
malicious (Point 1) attack study was cut for length
4 The four memory studies [3]–[6] Claude, then Claude’s survey, 5–6 Oct; I A figure in my notes was
(Point 1) author chose “contamination without corrected
an attacker” as the lead, 17 Oct
5 The preprint caution (Point 1) Claude Comparison with posted —
comments, 18 Oct
6 Recommendation 1: name Claude, then First draft, 6 Oct; I restated it —
memory; change control author and added the risk of tampering
with stored memory, 17 Oct
7 Question: finding, correcting Author My notes: an error that a cross- —
and removing a stored error check accepts spreads system-
(Point 1) wide
8 Two clinicians posing one query Author My observation, by 3 Oct: two Entered the first draft, 6 Oct
are not giving the same input doctors ask the same question
(Point 2) in different words, and one
word can matter
9 Identical design does not Author My skier analogy, 17 Oct: a The check read the analogy as a
guarantee identical behavior [7] model is supposed to reach the claim that identically trained
(Point 2) same conclusion (the lodge) models always agree. The study
from the same inputs, but the it found [7] supports the same
route matters: follow-up headline from another direction:
questions, the order in which models that differ only in their
information arrives, and the training seed
context at each turn
10 The locked-model definition Claude, then First draft, 6 Oct; I extended it My extension stays a proposal,
presumes a defined input [2] author to dialect and wording, 17 Oct not a reading of FDA’s definition
(Point 2)

Docket FDA-2026-N-7874 · Forge Applied Science & Technology · Page 3 of 5
# Element (where in the Origin First appeared What changed on the way
comment)
11 The Principle: explicit, auditable, Joint Discussion, by 3 Oct; my —
per-query context only (Point 2) refinement: stateless is the
starting point, not the
destination
12 Not found stated elsewhere; Joint My claim, 17 Oct; Claude found Worded as “we have not found”
stricter than the nearest the nearest published proposal
proposal [8] (Point 2)
13 Log every input, with model Author My notes My note stated it as current law,
version and settings (Point 2) a claim that came from an AI
study aid; it is now a
recommendation
14 Logging makes variation Claude Draft 3, 17 Oct —
attributable (Point 2)
15 Longitudinal care is unaffected Claude First draft, 6 Oct —
(Point 2)
16 Re-ingestion of a device’s own Claude, then First draft, 6 Oct; I cited it, 17 My reading of the study was
outputs [9] (Point 2) author Oct corrected
17 Recommendation 2, options (a) Claude, then First draft, 6 Oct; I restated it, —
and (b) author 17 Oct
18 Vary memory state in subgroup Claude, then First draft, 6 Oct; I flagged it, 17 Scoped to one model in the final
testing [10] (Point 2) author Oct check
19 Question: synthetic versus real Claude Draft 3.1, 17 Oct —
memory states (Point 2)
20 Question: regional prevalence Author My notes My examples were replaced with
and local documentation (Point CDC regional data [11]
2)
21 Automation bias outlasts the Author My notes: a fluent, confident Claude found the evidence [12],
session (Point 3) output sways decisions [13]
22 The example from preparing this Joint It happened to me; caught 17 Claude proposed using it; I
comment (Point 3) Oct adopted it, 18 Oct
23 An error enters the record and Author My notes —
colleagues’ decisions (Point 3)
24 Hindsight in later review [14] Author My notes; I had cited the Claude identified and verified the
(Point 3) anesthesia study earlier paper, 18 Oct
25 “At the specific point in time Author My edit, 18 Oct Kept as written
when the decision was made”
(Point 3)
26 Partial precedent: tamper- Author My notes: audit logs must not Found partly accurate; became
resistant logs, synchronized be editable, and clocks must the precedent
clocks [15] (Point 3) agree
27 Recommendation 3(a): an Claude, then Draft 3, 17 Oct, from my notes —
accepted error that persists is a author on permanent errors; I restated
hazard it
28 Recommendation 3(b): Author My dictated thesis, 6 Oct (a —
traceability both ways; output chain of custody for clinical
identifiers data); my notes

Docket FDA-2026-N-7874 · Forge Applied Science & Technology · Page 4 of 5
 # Element (where in the Origin First appeared What changed on the way
comment)
29 Recommendation 3(c): check Claude, then Draft 3, 17 Oct; I restated it —
whether errors propagate into author
documentation
30 Question: reconstruct any past Author My notes: establish what the —
output (Point 3) system knew at any given time
31 Question: tamper resistance; Author My notes Narrowed to a question after the
who holds logs, and for how check
long (Point 3)
32 Question: small and rural Author My notes Kept to one question; the rest is
practices (Point 3) outside device scope
33 The questions-for-discussion Author My instruction, 18 Oct —
format
34 The annex format Claude Draft 2, 7 Oct —
35 The closing sentence Claude, then First draft, 6 Oct; I summarized Its last clause was added in draft
author it in my own words, 17 Oct 3
36 Submitter line, disclosure, Claude Comparison with posted The facts in them are mine
signature and question scope comments, 18 Oct

Totals: Author 16, Joint 4, Claude then author 10, Claude 6.

Docket FDA-2026-N-7874 · Forge Applied Science & Technology · Page 5 of 5