DNV AS (Serena Elizabeth Marshall)

Comments by:
Serena Elizabeth Marshall (DNV AS) and Vibeke Binz Vallevik (DNV AS and University of Oslo), also researchers in the EU project SYNTHIA IHI (https://www.ihi-synthia.eu/) with the aim to leverage synthetic data in precision medicine. Views and opinions expressed are those of the authors only and do not necessarily reflect those of the aforementioned parties. See attached file(s).

Comments to FDA docket FDA-2026-N-7874
Discussion paper: Considerations for the Regulation of Generative AI-Enabled
Medical Devices

Comments by:

Serena Elizabeth Marshall (DNV AS) and Vibeke Binz Vallevik (DNV AS and University of
Oslo), also researchers in the EU project SYNTHIA IHI (https://www.ihi-synthia.eu/) with
the aim to leverage synthetic data in precision medicine. Views and opinions expressed
are those of the authors only and do not necessarily reflect those of the aforementioned
parties.

Oslo, Norway 15.October 2026

Response to A1.

The two-axis risk framework provides a simple and fairly superficial initial
indication of risk, however much more evidence is required to fully support the
assessment of a GenAI Medical device. For example, human in the loop is not
infallible - our ability to be critical to content may be influenced by automation
bias. Governance functions included into the design should affect the profile and
risk categorization and (independent) oversight requirements.1

Response to E10.

It is perceivable that benchmarking data could include synthetic data in the future
and/or recursively generated data. Information supporting fit-for-purpose,
representativity and utility should also be included, including risk of hallucinatory
Dratsch et. al, Automation Bias in Mammography: The Impact of Artificial Intelligence BI-RADS
Suggestions on Reader Performance. Radiology. 2023 May;307(4):e222176. doi:
10.1148/radiol.222176. Epub 2023 May 2. PMID: 37129490.
inclusions where relevant. Sponsor-developed benchmarks should have
independent assessment by experts in the relevant (clinical) domain.

Response to E12:

We comment on the second and third parts of the question, from our work on
synthetic tabular health data. Our evidence concerns structured data, not
conversational inputs, but we believe the points below apply to synthetic inputs
generally.

Accounting for differences between synthetic and real distributions

We suggest that justification should not rest on statistical similarity alone, but
include analytical validations comparing the predictive signal of the synthetic
dataset. In our review of 94 studies, most quality metrics measured similarity
between synthetic and real data, and few addressed relationships between
variables2. In a study of recursive generation, synthetic data lost its predictive
signal while common similarity metrics did not reliably detect it3. Synthetic inputs
can look similar to real data and still give misleading performance estimates.
Average similarity scores can disguise collapses. Statistical similarity metrics
should focus on the predictive variables and the patterns and relationships
between variables, and distributional diversity and fairness metrics should be
included.

Section V.C.1 also requires synthetic data to be “representative of the environment
in which the device is intended to be deployed”. This depends first on the real data
used to generate it: synthetic data cannot represent patients or patterns that were
missing from the source data. In addition to statistical similarity metrics, DNV
suggests quality to be measured for confidentiality (when necessary), downstream
utility, fairness and computational complexity and carbon footprint, see conceptual
framework for quality evaluations of synthetic data in the position paper “How
Vallevik VB, et al. Can I trust my fake data – A comprehensive quality assessment framework for
synthetic tabular data in healthcare. Int J Med Inform. 2024;185:105413.
doi:10.1016/j.ijmedinf.2024.105413
Vallevik VB, Babic A, Edwin B, Befring AK, Nygård JF. Collapse or creativity: hallucinations in
recursive synthetic data generation. Preprint, under review. doi:10.21203/rs.3.rs-10883391/v1
can I trust my fake data?” 4. The UK Medicines and Healthcare products Regulatory
Agency (MHRA) and PHG Foundation make the same point and treat source data
representativeness as a separate assessment step5. We suggest sponsors
document:

• which inputs, subgroups and share of the test set are synthetic, and why;

• how the source data represents the intended use population, including any
privacy measures that may have removed rare cases and augmented bias;

• how the synthetic data was evaluated, including multivariate structure,
bias/fairness and subgroup coverage, not only overall similarity or average
distance scores.

When to combine evidence into a single estimate

We suggest combining only when:

• performance is first reported separately for real and synthetic inputs;

• performance on synthetic and real inputs agrees for cases where both exist;

• a sensitivity analysis shows the estimate with and without the synthetic
portion.

This is consistent with the UK MHRA and PHG Foundation view that reliance on
synthetic data should decrease as device risk increases, and that evidence should
rarely rest on synthetic data alone6. In the terms of the consequence axis in the
two-axis framework in Section IV, the bar for combining should rise with the
consequences of an incorrect output.

Response to E13:
How can I trust my fake data? Position paper by DNV; 2026.
Reich V, et al. Synthetic data for development of AI as a medical device (AIaMDs): Regulatory
considerations. MHRA & PHG Foundation; 2025. doi:10.61599/vhac1
Reich V, et al. Synthetic data for development of AI as a medical device (AIaMDs): Regulatory
considerations. MHRA & PHG Foundation; 2025. doi:10.61599/vhac1
We comment from the perspective of our work on synthetic tabular health data
which concerns structured data, not conversational inputs. Our response is limited
to where synthetic data is suited or inadequate.

Section V.C.1 proposes synthetic data for “small or hard-to-sample subgroups
where real-world data is limited”. These are the cases where synthetic data is most
needed but can also be weakest. If not properly managed, generators tend to lose
rare patterns first. Recursive use increases this effect. In our study of recursive
generation, four types of generators lost predictive utility within a few generations,
mainly through loss of diversity7. For one generator, the minority outcome class
disappeared entirely, while the share of clinically implausible records fell to zero.
Standard quality checks with distributional distance metrics did not flag this. Meta
data on provenance can help avoid unintended reuse and concurrent erosion of
minority distributions.

Measures to improve privacy can worsen bias and fairness. In a national cancer
registry case, rare cases, minors and other outliers were removed from the source
data to reduce re-identification risk8. The MHRA and PHG Foundation recommend
prioritizing fidelity over such measures for medical device development, and
meeting privacy requirements through controlled access instead9. Fairness and
bias metrics should be included in quality evaluation.

We suggest:

• Subgroup checks against real data and/or expert evaluations: compare
device performance on synthetic and real inputs for each subgroup, even
where real cases are few, before relying on synthetic data for that subgroup.
This can be supplemented with expert evaluations.
Vallevik VB, Babic A, Edwin B, Befring AK, Nygård JF. Collapse or creativity: hallucinations in
recursive synthetic data generation. Preprint, under review. doi:10.21203/rs.3.rs-10883391/v1
Vallevik VB, et al. Can I trust my fake data – A comprehensive quality assessment framework for
synthetic tabular data in healthcare. Int J Med Inform. 2024;185:105413.
doi:10.1016/j.ijmedinf.2024.105413
Reich V, et al. Synthetic data for development of AI as a medical device (AIaMDs): Regulatory
considerations. MHRA & PHG Foundation; 2025. doi:10.61599/vhac1
 • Subgroup-level quality metrics: report coverage and fidelity for each
relevant subgroup, not only overall similarity.

• Source data documentation: state how each subgroup is represented in
the source data, and what was removed or changed before generation.

• Provenance: record whether the generator’s training data included
synthetic data, to avoid the degradation we observed under recursive
generation.

Comment to Q16

In response to Q16, and with relevance to Q10, we suggest that independence
criteria should apply not only to third-party roles but to the evidence base as a
whole.

The critique after the recent prospective feasibility study of Google’s
conversational diagnostic system AMIE10 illustrates the issue. The study was
funded by Alphabet, most of its authors are employed by the developer, and the
lead clinical investigator disclosed a visiting researcher position at Google during
part of the study period. The authors are transparent and disclose these ties.

The issue is structural: when the same organization develops the system, funds the
study, designs the evaluation and reports the results, there is no separation
between those who benefit from a favorable outcome and those who determine it.
Industry-sponsored studies more often reach conclusions favorable to the
sponsor11, and evaluations of generative AI involve many discretionary choices,
such as rubric design, comparator selection, how outputs are formatted before
rating, and which endpoints are reported, where this risk can enter without any
single decision being improper. The discussion paper already proposes that expert
Brodeur P, et al. Conversational diagnostic artificial intelligence in ambulatory primary care: a
prospective feasibility study. The Lancet. Published online 8 October 2026.
Lundh A, Lexchin J, Mintzes B, Schroll JB, Bero L. Industry sponsorship and research outcome.
Cochrane Database Syst Rev. 2017;2:MR000033.
adjudicators be structurally independent from the device sponsor and the
foundation model developer. We suggest extending this principle to the evidence
base as a whole: FDA should consider who funded, designed, conducted and
evaluated each study submitted in support of a device, give greater weight to
evidence generated or adjudicated independently of the developer, and require
sponsors to state these relationships explicitly for each study.

Reflections and response to Q7

If the competency-based approach draws on the analogy with human clinicians, as
Section V proposes, the analogy should extend to accountability as well as
assessment.

It is our opinion that the use of generative AI does not diminish accountability for
misleading or unsafe medical information. Even where such systems are designed
and marketed for general purposes, manufacturers should anticipate their
foreseeable use or misuse as medical devices. GenAI-enabled medical devices that
provide information or recommendations on which patients or healthcare
professionals may reasonably rely, should be subject to responsibilities and
liabilities commensurate with those applying to other providers of medical
information and advice. The fact that GenAI outputs may be variable, open-ended,
or susceptible to misleading inputs should not in itself reduce this responsibility;
healthcare professionals also operate under uncertainty, receive incomplete or
misleading information, and may provide variable responses. Manufacturers
should therefore demonstrate that the device is designed, validated, and
monitored to provide sufficiently reliable information for its intended use,
appropriately communicate uncertainty, and resist foreseeable attemptsintentional or otherwise - to elicit misleading or unsafe responses. The precise
allocation of legal liability may differ from that applicable to healthcare
professionals, but variability inherent to GenAI should not become a basis for
reduced accountability for the safety and validity of its outputs.