Implementation Alpha AI (Sharon Licqurish and Marc Slabbert)

Implementation Alpha AI (IAAI), an independent AI implementation and governance consultancy operating in the United Kingdom and Australia, welcomes the opportunity to comment on CDRH’s discussion paper. Our full response is attached.

In summary, IAAI supports the risk-proportionate, total product life cycle approach and the competency-based model of benchmarking followed by clinical confirmation. Our central recommendation is that the unit of evaluation should be the device as used in its clinical context. We recommend: adding deployment-context modifiers to the two-axis risk framework; evaluating human–AI team performance, including automation bias; comparing performance against care without the device; including implementation outcomes in clinical confirmation; conditioning reduced premarket evidence on verified monitoring capacity; defining ecosystem responsibilities explicitly; requiring foundation model change notification; and building international alignment in from the start.

Submitted by Dr Sharon Licqurish, PhD, and Dr Marc Slabbert, Co-Founders, Implementation Alpha AI.

IAAI Response to FDA Discussion Paper on Generative AI-Enabled Medical Devices (FDA-2026-N-7874)

MEMORANDUM
TO: U.S. Food and Drug Administration, Center for Devices and Radiological Health, Digital
Health Center of Excellence (Docket FDA-2026-N-7874, via Regulations.gov)

FROM: Dr Sharon Licqurish, PhD, and Dr Marc Slabbert, Co-Founders, Implementation
Alpha AI (United Kingdom and Australia)

DATE: 19 October 2026

RE: Comments on Considerations for the Regulation of Generative AI-Enabled Medical
Devices: Discussion Paper and Request for Feedback (CDRH, August 2026)

Submitter information and disclosures

Field Detail

Organisation Implementation Alpha AI (IAAI), an independent
consultancy specialising in AI implementation and
governance in healthcare, operating in the United
Kingdom and Australia

Authors Dr Sharon Licqurish, PhD, Co-Founder; Dr Marc
Slabbert, Co-Founder

Corresponding author Dr Sharon Licqurish ·
sharon@implementationalphaai.com · +61 493 115
Conflict of interest statement. IAAI provides consultancy services in AI implementation,
evaluation and governance to healthcare organisations. Several positions in this
submission, including support for independent third-party evaluation (Question 16) and
structured deployer-side monitoring (Questions 19 and 21), describe activities in which
IAAI or similar firms could offer services. Both authors are founders of IAAI and declare
this interest. Dr Licqurish is also Senior Strategic Scientist at Ontocore LLC, a US-based AI
governance firm whose work may be affected by the regulatory approaches discussed in
this paper. Dr Slabbert has no other interests to declare. This submission is made on
behalf of IAAI only and does not represent the views of any other organisation with which

Page 1 of 15
IAAI Response to FDA Discussion Paper on Generative AI-Enabled Medical Devices (FDA-2026-N-7874)

the authors are affiliated. Neither author has a financial relationship with any GenAIenabled device manufacturer or foundation model developer referenced in this
submission.

Summary of key recommendations
IAAI supports CDRH's direction: a risk-proportionate, total product life cycle (TPLC)
approach built on competency-based premarket evaluation and stronger postmarket
monitoring. Our central recommendation is that the unit of evaluation should be the
device as used in its clinical context, not the device alone. GenAI-enabled devices
succeed or fail through the people, workflows and organisations that use them, so
evidence requirements should capture that. Because many of these devices will be built
in the US and deployed worldwide, we also encourage CDRH to develop this approach
with international partners from the outset.

1. Add deployment context to the risk framework. Keep the two-axis heuristic, but add
explicit risk modifiers for reversibility, time pressure, available downstream
safeguards, output traceability and the vulnerability of the patient population (Q1).
2. Evaluate the human–AI team, and measure automation bias. Where a clinician uses
the device, clinical confirmation should test combined performance, including how
often users accept incorrect outputs. Recent evidence shows this can happen even
among domain experts (Q14).
3. Compare against care without the device. Acceptance criteria should consider the
realistic alternative (usual care, unaided judgement, delayed specialist review), not
only an idealised expert panel (Q15).
4. Include implementation outcomes in clinical confirmation. Use hybrid effectiveness–
implementation designs to assess acceptability, appropriateness, feasibility, fidelity
and adoption alongside safety and effectiveness (Q11).
5. Accept greater premarket uncertainty only with verified monitoring capacity.
Reliance on postmarket evidence is appropriate only where monitoring at deployment
sites is specified, resourced and auditable (Q18).
6. Allocate ecosystem responsibilities explicitly. Define manufacturer, deployer and
clinician duties so that shared responsibility does not become diffused accountability
(Q21).
7. Set minimum foundation model change-notification commitments. Voluntary Master
Files are useful but not sufficient; manufacturers should hold contractual rights to
advance notice of model changes (Q24, Q25).

Page 2 of 15
IAAI Response to FDA Discussion Paper on Generative AI-Enabled Medical Devices (FDA-2026-N-7874)

8. Build international alignment in from the start. Develop the risk framework,
benchmarking elements and change-control principles with international partners
through IMDRF and existing joint work with the MHRA and Health Canada. Set clear
conditions for using clinical evidence generated outside the US, and require
performance testing across the languages and health systems where devices will be
deployed (see International alignment).

About IAAI and our perspective
Implementation Alpha AI is an independent consultancy that helps healthcare
organisations implement and govern AI. Our approach draws on established
implementation science frameworks, including CFIR 2.0, Normalisation Process Theory
(NPT), RE-AIM, the MRC/NIHR framework for complex interventions, and NASSS. IAAI's
founders bring complementary clinical, research and health economics expertise. Dr
Sharon Licqurish is a midwife and implementation scientist who has worked in health
services research since 2013. Dr Marc Slabbert is a surgeon and health economist working
in value-based care and health AI strategy.

IAAI works across the UK and Australian health systems, and our submission reflects that
international perspective. GenAI-enabled devices authorised in the US are likely to be
deployed in health systems with different workflows, languages, funding models and
regulators. The choices CDRH makes now will shape global practice, so we comment both
on the US framework and on how it can align with approaches elsewhere.

We offer one perspective that is under-represented in device regulation: what happens
between authorisation and patient benefit. The discussion paper rightly recognises that
GenAI-enabled devices "interact with users, workflows, and patient populations in ways
that may not be captured by structured benchmarking" (Section V.C). Implementation
research has shown for decades that the same intervention can produce different results
in different settings, depending on workflow fit, user capability, organisational readiness
and how the intervention becomes part of routine practice. For GenAI-enabled devices,
whose outputs are open-ended and whose users must decide whether to rely on them,
these contextual factors are part of the device's safety profile, not an afterthought.

The current evidence base underlines the gap. The great majority of FDA-authorised AIenabled devices have not reported patient outcomes. Recent reader studies have also
shown that clinicians, including specialists, can accept incorrect AI recommendations. A

Page 3 of 15
IAAI Response to FDA Discussion Paper on Generative AI-Enabled Medical Devices (FDA-2026-N-7874)

regulatory approach for GenAI should therefore build in evaluation of real use from the
start, which the competency-based approach and the TPLC emphasis are well placed to
do.

Our comments address the questions where we have relevant expertise. We have not
responded in detail to questions that are mainly technical (for example, Question 17 on
model architectures).

Section IV: Assessment of risk (Questions 1 to 6)
Q1. Does the two-axis framework capture the most relevant dimensions?

The two axes are a sound and intuitive starting point. We recommend keeping them as the
primary heuristic and adding a defined set of risk modifiers that can move a function up
or down the consequences axis. All four dimensions FDA suggests are relevant, and we
propose one more:

Reversibility. Whether an action based on an incorrect output can be detected and
reversed before harm occurs.
Time pressure. Whether the setting allows the user to verify an output, such as an
emergency department versus a scheduled outpatient review.
Downstream safeguards. Whether independent checks exist after the output, such as
pharmacist review of a prescription. These should only count if they are shown to
operate in the intended setting.
Traceability. Whether the output links to primary sources the user can check.
Population vulnerability. Whether the intended population includes groups where
errors carry amplified or compounded harm: pregnant and postpartum people,
neonates and children, older adults with polypharmacy, and people with limited health
literacy. In pregnancy, a single error can affect two patients.

These modifiers describe the deployment context. Because the same function can be low
risk in one setting and high risk in another, we recommend that manufacturers describe
the intended deployment context in the intended use statement and that the risk
assessment be tied to it.

Q2. How should the continuum from non-directive to action-directing be handled?

We agree that directiveness should be judged by the substance and context of an output,
not by keywords. We also agree that disclaimers such as "talk to your doctor" do not
reduce directiveness. Implementation and behavioural research supports this: how

Page 4 of 15
IAAI Response to FDA Discussion Paper on Generative AI-Enabled Medical Devices (FDA-2026-N-7874)

people act on advice depends on its perceived authority, specificity and fit to their
situation, not on hedging language.

We suggest manufacturers characterise directiveness using observable output features:
personalisation to the user's data, specificity of the recommended action (including
doses and timeframes), and whether alternatives are presented. Directiveness should be
assessed empirically, by testing how representative users interpret outputs, not only by
expert review of the text. This links directly to benchmarking element E.4.

Q3. Do patient-facing functions present different or higher risks?

Yes, in many cases, but the risk depends on the user's ability to act safely on the output,
not on whether they are a patient. We recommend that patient-facing functions be
shifted up the consequences axis by default, with the shift reduced where the
manufacturer shows, through testing with representative users, that users understand
the output's limits and escalate appropriately.

Useful safeguards include plain-language explanations of uncertainty, explicit and
specific escalation triggers (for example, named symptoms that require urgent review),
and testing across health literacy levels, languages and dialects (element R.2). Patient and
consumer representatives should be involved in defining what "safe use" looks like. This
supports patient empowerment while managing the real risk that a fluent, confident
output is trusted more than it should be.

Q4. Does the generalist versus specialist distinction matter?

Yes. Recent evidence shows the effect can run in both directions. Generalists may gain
the most from specialist-level support, but users at every level can accept incorrect
outputs. In one 2026 reader study of AI decision support for advanced lung cancer,
specialists accepted incorrect AI suggestions more often than non-specialists. We
therefore recommend that risk assessment consider both the knowledge gap a function
bridges and the evidence on how each intended user group relies on it. Clinical
confirmation should test performance separately for each intended user group.

Q5. How should risk be assessed for multi-turn conversations?

We support assessing risk across realistic conversational trajectories. We suggest
manufacturers define the intended use by its outer boundary: the most directive and
highest-consequence behaviour the device is permitted to reach in any conversation. Risk
would then be assessed at that boundary. Benchmarking should include multi-turn

Page 5 of 15
IAAI Response to FDA Discussion Paper on Generative AI-Enabled Medical Devices (FDA-2026-N-7874)

scenarios built from real interaction patterns, including users who push for more directive
advice. Postmarket monitoring should check whether real conversations exceed the
boundary (see Q19).

Q6. How should under-escalation and over-escalation be weighed?

Both directions of error should be assessed. Their relative weight should be set per
clinical context, before testing, with clinicians and patients involved. A useful example
comes from maternity care. Under-escalating reduced fetal movements can contribute to
stillbirth, a catastrophic and irreversible harm. Over-escalating can overload maternity
assessment units and erode trust in the service. A pre-specified harm matrix for each
intended use, giving explicit weights to each error type, would make the trade-off
transparent and reviewable. Over-escalation rates should also be monitored after
deployment, because their system-level effects, such as service demand and loss of trust,
only show up at scale.

Section V: Competency-based premarket evaluation (Questions 7
to 17)
Q7. Is benchmarking followed by clinical confirmation a useful framework?

Yes. The clinician analogy is apt, and the two-step structure mirrors how clinical
competence is established: knowledge testing, then supervised practice. We would
strengthen the analogy in one respect. Clinicians are credentialed for a specific setting:
hospitals grant privileges based on local scope, supervision and resources. GenAIenabled devices would benefit from a comparable step, in which deployers confirm the
device fits their workflow, users and population before full use. FDA need not regulate
this step, but labelling and premarket evidence should support it, for example by
specifying the conditions under which clinical confirmation was performed.

Q8. How should the risk framework scale the evidence required?

We suggest the two-axis position, adjusted by the modifiers in Q1, should set three things:
the breadth of benchmarking elements required, the rigor of clinical confirmation, and the
intensity of postmarket monitoring. As a rough guide, informational, limited-consequence
functions might rely on benchmarking plus retrospective evaluation; action-directing or
moderate-consequence functions would add shadow deployment or clinician
adjudication; and action-taking or severe-consequence functions would require
prospective study.

Q9. Is the benchmarking structure adequate?

Page 6 of 15
IAAI Response to FDA Discussion Paper on Generative AI-Enabled Medical Devices (FDA-2026-N-7874)

The elements are well chosen. We recommend two additions:

Workflow and handoff behaviour. How outputs are delivered into real workflows:
timing, where they appear, how they are documented and how they hand over to the
next person in the care pathway. Many real-world failures occur at handoffs rather
than in the output itself.
Reliance and automation bias. Element E.4 mentions automation bias, but it should be
measured directly with representative users, not inferred from output text. It may
warrant its own element, given its importance.

Relevant existing standards include ISO 14971 (risk management), IEC 62366-1 (usability
engineering), ISO/IEC 42001 (AI management systems) and reporting guidelines such as
TRIPOD+AI, DECIDE-AI and CONSORT-AI.

Q10. How should a sponsor show that benchmark performance predicts real-world
behaviour?

Benchmark validity should be shown, not assumed. We recommend that sponsors show
the benchmark represents the cases, users and settings of the intended use, and present
evidence that benchmark performance tracks real-world performance (for example, from
shadow deployment). Sponsor-developed benchmarks are acceptable if their
construction is documented in advance and paired with an independent held-out test set
(see Q16).

Q11. How should the clinical confirmation approach be selected and justified?

We support the graded approaches described, and that a prospective study should not be
required in every case. We recommend two additions.

First, hybrid effectiveness–implementation designs (Curran et al., 2012) can assess
device performance and implementation outcomes together, at modest extra cost.
Implementation outcomes (Proctor et al., 2011) such as acceptability, appropriateness,
feasibility, fidelity and adoption show whether a device will be used as intended. A device
that performs well in testing but is used in unintended ways, or abandoned, will not
deliver its expected safety or benefit. Validated measures, such as the NoMAD
instrument for NPT (Finch et al., 2018), are already available.

Second, shadow deployment is especially valuable for GenAI because it captures the real
distribution of inputs, including the messy, incomplete and colloquial inputs that
benchmarks underrepresent. But it cannot test how users respond to outputs. For any
function where a clinician or patient acts on the output, shadow deployment should be
followed by at least one approach that does test this.

Page 7 of 15
IAAI Response to FDA Discussion Paper on Generative AI-Enabled Medical Devices (FDA-2026-N-7874)

Approaches using standardised patients or synthetic inputs alone are likely to be
insufficient for patient-facing, action-directing functions in severe-consequence domains
such as emergency triage or maternity care.

Q12 and Q13. Statistical performance and synthetic data.

Benchmark and clinical confirmation evidence should be reported separately, not pooled
into a single estimate, because they measure different things. Synthetic data is well
suited to stress-testing rare but critical scenarios and edge cases. It is poorly suited to
establishing performance for underrepresented subgroups, because generators trained
on the same data inherit the same gaps. Synthetic data should not substitute for real data
in subgroup analyses unless the sponsor shows the generator was validated against real
data from that subgroup, and the data was produced independently of the device's model
family. The communities concerned should be involved in validating synthetic scenarios
intended to represent them.

Q14. How should comparators and acceptance criteria be selected?

Where a clinician uses the device, the primary comparison should be human–AI team
performance against the clinician working alone. Device-alone performance is informative
but does not predict team performance: a 2026 international reader study in lung cancer
immunotherapy found that AI support raised clinicians' accuracy from 57% to 65%, but
that clinicians also accepted incorrect AI suggestions. Acceptance criteria should
therefore include an explicit limit on harmful reliance, such as the rate at which users
accept incorrect outputs on safety-critical cases. Device-alone performance against an
expert panel is the appropriate comparator only for autonomous functions.

Q15. Should performance be compared with care in the absence of the device?

Yes, and we consider this one of the most important questions in the paper. The relevant
question for patients and health systems is whether care is safer and better with the
device than without it. In many settings, the realistic alternative is not a specialist panel
but a busy generalist, a long wait for specialist review, or no access to advice at all.
Requiring devices to match ideal performance may block devices that improve on real
care. Comparing only against ideal care may also hide harms. We recommend that
sponsors describe the realistic alternative in the intended setting and justify their
comparator against it.

Q16. Should independent third parties be involved?

Page 8 of 15
IAAI Response to FDA Discussion Paper on Generative AI-Enabled Medical Devices (FDA-2026-N-7874)

Yes, in specific roles. We see the most value in maintaining sequestered test datasets,
providing independent expert adjudication, and assessing benchmark validity. These
roles reduce the risk of sponsors optimising for their own tests. Independence criteria
should cover financial ties to both the sponsor and the foundation model developer, as
the paper notes. Accreditation through existing programs such as ASCA would help
ensure consistent quality. To avoid barriers to market entry for smaller manufacturers,
test assets should be accessible at reasonable cost and on non-exclusive terms. (See our
conflict of interest statement.)

Section VI: Postmarket monitoring (Questions 18 to 24)
Q18. When is greater premarket uncertainty acceptable?

It can be appropriate, but only when the monitoring that offsets the uncertainty will
actually happen. Postmarket plans often assume capacity that deployment sites do not
have: staff time for case review, data infrastructure, and clear routes for reporting
concerns. We recommend that reduced premarket evidence be conditional on:

a monitoring plan with pre-specified metrics, thresholds and responses, including
when the device will be paused or withdrawn;
evidence that monitoring can be carried out in the intended settings, including who will
do it and how it is resourced;
staged rollout, starting in sites with verified monitoring capacity before wider release;
and
public reporting of monitoring results at defined intervals.

This approach would not be appropriate for autonomous action-taking functions with
severe or irreversible consequences, or for functions used mainly by populations that
cannot readily recognise or report harm. Regulatory sandboxes, such as the UK MHRA's AI
Airlock, offer one model for generating real-world evidence under supervision before
wider release.

Q19. What postmarket approaches should be used?

All three approaches are valuable. We recommend adding:

Fidelity monitoring. Checking whether the device is used as intended: by the intended
users, for the intended tasks, within the intended scope. Off-label drift in use is a
common way for safe devices to cause harm.

Page 9 of 15
IAAI Response to FDA Discussion Paper on Generative AI-Enabled Medical Devices (FDA-2026-N-7874)

Reliance monitoring. Tracking how often users accept, modify or override outputs, and
whether acceptance rates change over time. Rising acceptance with no change in
accuracy can signal growing automation bias.
User and patient reported concerns. Simple, low-burden routes for clinicians and
patients to flag concerning outputs, linked to the manufacturer's complaint handling.

Reassessment triggers should include any change to the foundation model, prompts,
retrieval sources or guardrails; expansion to new settings or user groups; and safety
signals from any of the monitoring streams above.

Q20. Can machine-based supervisory agents help?

They could efficiently screen high volumes of interactions for review. However, they share
many failure modes with the systems they monitor, and may miss the same errors. We
recommend they be used to prioritise cases for human review, not to replace it; that they
be validated on their own; and that they come from a different model family or developer
where possible. A fixed proportion of interactions should still be sampled at random for
human review, so the supervisory agent's own performance can be checked.

Q21. What roles should the wider ecosystem play?

The paper is right that deployment depends on many parties. To avoid diffused
accountability, we recommend each role be defined, and its interface with the
manufacturer specified:

Page 10 of 15
IAAI Response to FDA Discussion Paper on Generative AI-Enabled Medical Devices (FDA-2026-N-7874)

Party Suggested role

Manufacturer Overall responsibility for safety and
effectiveness; monitoring plan; signal analysis;
corrective action

Deploying organisation Local readiness assessment; fidelity and
reliance monitoring; incident reporting; local
governance

Clinicians Appropriate use within scope; reporting
concerning outputs

Patients and consumers Reporting concerns; involvement in defining
acceptable use and harm

Professional societies and standards Use guidance, training and competency
bodies standards for users

Manufacturers could be required to supply deployers with what they need to fulfil their
role, such as monitoring dashboards, audit logs and guidance on local validation.
Precedent exists in the UK, where the government has accepted a National Commission
recommendation on clearer allocation of responsibility across the AI supply chain.

Q22 to Q24. Change control and third-party foundation models.

We support using the premarket benchmark as a baseline for re-benchmarking after
changes. Re-benchmarking alone will not reveal changes in how users respond to outputs,
so changes that alter tone, confidence, presentation or directiveness should also trigger
review of user reliance, even if accuracy is unchanged.

Predetermined Change Control Plans can accommodate GenAI if they define change
envelopes (bounds on behaviour that must be maintained) rather than specific changes.
A change that keeps re-benchmarking results within those bounds could proceed under
the PCCP.

For third-party foundation models, manufacturers should not depend on detecting
changes after they happen. We recommend that, as a condition of using a foundation
model in a device, manufacturers hold contractual rights to: advance notice of model
updates; access to a fixed model version for a defined period; and enough time to rebenchmark before a change takes effect. Where these rights cannot be secured, the
device's monitoring should be correspondingly more intensive.

Page 11 of 15
IAAI Response to FDA Discussion Paper on Generative AI-Enabled Medical Devices (FDA-2026-N-7874)

Section VII: Foundation model Master Files and agentic AI
(Questions 25 and 26)
Q25. Are voluntary Foundation Model Master Files practical?

We support the proposal and the content listed in footnote 24. Voluntary files will be most
useful if they carry clear benefits for developers, such as faster review of devices built on
their models. Their usefulness depends on being kept current, so files should state an
update cadence and be versioned to the specific model versions used in devices. Because
participation is voluntary, sponsors using models without a Master File should be
expected to supply equivalent information through other means, such as contractual
disclosure from the developer.

Q26. What extra considerations apply to agentic GenAI-enabled devices?

Agentic systems remove the natural pause in which a person can check an output before
acting on it. Oversight should be designed to restore that pause where it matters. We
recommend:

Mandatory human checkpoints before irreversible or high-consequence actions,
with acceptance criteria requiring near-zero bypass of those checkpoints in testing.
Complete, reviewable audit logs of each step, tool call and data source, so that errors
can be traced and attributed.
Scoped permissions, limiting the tools and data the agent can access to what its
intended use requires.
Testing of whole action sequences, not individual steps, including how errors
compound when an early mistake feeds later actions.
Evaluation of the oversight itself. Human checkpoints only work if the people
approving actions have the time, information and authority to refuse. Clinical
confirmation should test whether checkpoint approvers actually catch errors, or
whether approval becomes routine. Experience from other safety-critical industries
shows that "human in the loop" can become a formality under workload pressure.

International alignment
Regulators are converging on lifecycle oversight of AI-enabled medical devices. FDA has
an opportunity to make its GenAI framework the basis for shared international practice,
rather than one of several incompatible approaches.

Page 12 of 15
IAAI Response to FDA Discussion Paper on Generative AI-Enabled Medical Devices (FDA-2026-N-7874)

Jurisdiction Relevant direction Implication for this framework

United In October 2026 the government Closely aligned with the TPLC and
Kingdom accepted all 44 recommendations of postmarket emphasis in this paper.
the National Commission into the Shared approaches to post-market
Regulation of AI in Healthcare, evidence would benefit both
including proportionate lifecycle regulators.
regulation and clearer responsibility
across the AI supply chain. The
MHRA's AI Airlock sandbox is now
focused on post-market
surveillance.

Australia The TGA regulates AI-enabled Common risk categories and
software as a medical device and evidence expectations would help
has been reviewing how its manufacturers serving both
framework applies to AI, including markets.
generative AI.

European The EU AI Act classifies many AI- Overlapping requirements make
Union enabled medical devices as high- consistent terminology and
risk, adding obligations alongside evidence reuse especially valuable.
the Medical Device Regulation.

We recommend that CDRH:

1. Extend existing joint principles to GenAI. FDA, Health Canada and the MHRA have
jointly published guiding principles on good machine learning practice, predetermined
change control plans and transparency. A comparable set of joint principles for GenAIenabled devices, developed with other IMDRF members including the TGA, would
reduce fragmentation.
2. Set clear conditions for evidence generated outside the US (Q11). Clinical
confirmation evidence from other health systems can be valuable, especially for
subgroups that are small in US data. Its acceptance should depend on showing
comparability of the deployment context, not just the patient population: similar
workflows, user groups, care pathways and language. Implementation research shows
that the same device can perform differently when these differ.
3. Test across languages and health systems. Element R.2 should explicitly cover the
languages, dialects and care models of the markets where a device will be deployed. A
device benchmarked only in US English and US care pathways should not be assumed

Page 13 of 15
IAAI Response to FDA Discussion Paper on Generative AI-Enabled Medical Devices (FDA-2026-N-7874)

to perform equivalently elsewhere.
4. Explore shared test assets and information exchange. Sequestered benchmark
datasets, and information from Foundation Model Master Files, could be shared with
trusted regulatory partners under confidentiality arrangements. This would reduce
duplicated effort for manufacturers and regulators alike.
5. Consider global equity. Devices trained and evaluated mainly in high-income settings
may be deployed in lower-resource settings with different disease patterns and fewer
downstream safeguards. Labelling should state the settings in which the device has,
and has not, been evaluated.

Closing statement
IAAI commends CDRH for an open and well-structured discussion paper. The
competency-based approach, the two-axis risk heuristic and the TPLC emphasis together
offer a credible path to timely access to safe and effective GenAI-enabled devices. Our
main message is that these devices will only deliver patient benefit if evaluation follows
them into real use: the clinicians and patients who rely on them, the workflows they enter,
and the organisations that must monitor them. Building implementation evidence into
premarket and postmarket expectations would also align FDA's approach with the
lifecycle direction being taken by regulators in the UK, Australia and Europe, supporting
international consistency for manufacturers and safety for patients wherever these
devices are used.

We would welcome the opportunity to contribute further, including to any public
workshop on clinical confirmation methods or postmarket monitoring.

Correspondence: sharon@implementationalphaai.com

References
1. Curran GM, Bauer M, Mittman B, Pyne JM, Stetler C. Effectiveness-implementation
hybrid designs: combining elements of clinical effectiveness and implementation
research to enhance public health impact. Med Care. 2012;50(3):217–226.
2. Proctor E, Silmere H, Raghavan R, et al. Outcomes for implementation research:
conceptual distinctions, measurement challenges, and research agenda. Adm Policy
Ment Health. 2011;38(2):65–76.

Page 14 of 15
IAAI Response to FDA Discussion Paper on Generative AI-Enabled Medical Devices (FDA-2026-N-7874)

3. Finch TL, Girling M, May CR, et al. Improving the normalization of complex
interventions: part 2 – validation of the NoMAD instrument. BMC Med Res Methodol.
2018;18:135.
4. Damschroder LJ, Reardon CM, Widerquist MAO, Lowery J. The updated Consolidated
Framework for Implementation Research based on user feedback. Implement Sci.
2022;17:75.
5. May C, Finch T. Implementing, embedding, and integrating practices: an outline of
normalization process theory. Sociology. 2009;43(3):535–554.
6. Glasgow RE, Vogt TM, Boles SM. Evaluating the public health impact of health
promotion interventions: the RE-AIM framework. Am J Public Health. 1999;89(9):1322–
1327.
7. Skivington K, Matthews L, Simpson SA, et al. A new framework for developing and
evaluating complex interventions: update of Medical Research Council guidance. BMJ.
2021;374:n2061.
8. Greenhalgh T, Wherton J, Papoutsi C, et al. Beyond adoption: a new framework for
theorizing and evaluating nonadoption, abandonment, and challenges to the scale-up,
spread, and sustainability of health and care technologies (NASSS). J Med Internet
Res. 2017;19(11):e367.
9. I3LUNG Consortium. Clinical usability of an explainable AI decision support tool and
evaluation of multimodal models in NSCLC. Nature Medicine. 2026. Link
10. UK Government. Government backs recommendations of NHS doctors-led AI
Commission. 6 October 2026. Link

Page 15 of 15