JNPMEDI (Jae Hyun Lee, Keith Christopher)

Comment from JNPMEDI

OCTOBER 2026

PUBLIC COMMENT / FDA DOCKET NO. FDA-2026-N-7874

Postmarket Monitoring and Manufacturer Accountability
for Generative AI-Enabled Medical Devices

Response to Discussion Questions 19 and 21 | Section VI: Postmarket Monitoring
SUBMITTED TO AUTHORS
U.S. Food and Drug Administration Jae Hyun Lee, JD, DDS
Center for Devices and Radiological Health Keith Christopher, PhD
DISCUSSION PAPER
AFFILIATION (BOTH AUTHORS)
Considerations for the Regulation of Generative AIJNPMEDI Global Research Center
Enabled Medical Devices (August 2026)

1. Scope and evidentiary basis
We appreciate CDRH’s consideration of periodic re-benchmarking, sample-based clinician review, and
performance-degradation monitoring, together with the roles of clinical and institutional stakeholders. We
recommend a risk-proportionate, closed-loop postmarket process: detect potential safety signals, perform targeted
clinical reassessment, and take timely, documented action under clear decision authority. This proposal draws on
two published conceptual JMIR Viewpoints—Co-Lifecycle Governance and Refined Exclusion in Medical AI—
coauthored by one of the submitters [1,2]. We apply their governance principles to GenAI-enabled device functions
without claiming empirical validation of a particular monitoring protocol. We address Questions 19 and 21 only.
These views are submitted in the authors’ individual capacities.

2. Response to Question 19 — Postmarket performance evaluation
CDRH seeks feedback on re-benchmarking, clinician review, performance-degradation monitoring, additional methods,
and the cadence and triggers for reassessment.
Distinguish early detection from clinical confirmation. These approaches serve complementary purposes. Rebenchmarking tests continued performance against prespecified device competencies; sample-based clinician
review examines clinical appropriateness in context; and surveillance identifies anomalies in inputs, outputs,
workflows, incidents, and measurable performance proxies. A surveillance signal warrants investigation, but by
itself does not establish loss of effectiveness or patient harm [1].
Monitor the deployed GenAI system, not only the foundation model. Where relevant to the authorized device
function, monitoring should be version- and configuration-aware: changes to prompts, retrieval sources, guardrails,
orchestration logic, user interfaces, and third-party foundation models may alter safety even without retraining.
Additional signals may include clinically consequential confabulations, unsafe action-directed outputs, and failures
across multi-turn or multilingual interactions. Review must account for output variability, actual intended use, and
privacy-preserving access to appropriate evidence [3].
Prespecify risk-proportionate cadence and event triggers. A monitoring plan should justify routine
reassessment intervals by severity and reversibility of potential harm, intended use, level of clinical oversight,
deployment heterogeneity, change frequency, and the availability of reliable outcomes. Higher-consequence clinical
triage or treatment uses may warrant earlier and more intensive review than lower-consequence functions; no
universal numerical interval is justified by the current conceptual evidence. Material configuration changes, serious
incidents, recurrent concordant errors, and clinically important departures from prespecified criteria should prompt
event-driven reassessment. When ground-truth outcomes lag, short-horizon process monitoring can precede
intermediate chart review and longer-horizon outcome confirmation [1].
Preserve subgroup and workflow visibility. Aggregate metrics may obscure concentrated uncertainty or
deterioration by language, site, population, or workflow [2]. Clinically justified subgroup analyses should include
sample and event counts, missingness, and uncertainty; calibration should be evaluated only where meaningful for
the output. Sparse data or wide confidence intervals should trigger caution and proportionate safeguards rather
than be interpreted as evidence of safety [2].
Illustrative trigger-to-action structure (risk- and device-specific, not uniform thresholds):
Illustrative trigger Proportionate evaluation Potential response
 OCTOBER 2026

Re-benchmark against prespecified device
Document results and revise monitoring
Scheduled risk-based review competencies; sample real-world interactions for
intensity if warranted.
qualified clinician assessment.

Assess impact of model/version, prompts, retrieval,
Material change to model or deployment Apply appropriate change controls and
guardrails, or workflow changes; perform proportionate
configuration deployment safeguards.
targeted or broader reassessment.

Urgent clinical triage and device-level investigation; Use interim human oversight, restrictions,
Credible serious event or unsafe output focused case review without awaiting statistical or a local pause as appropriate; report
repetition. when required.

Review relevant cases and performance with subgroup Target validation and consider narrowed
Recurring subgroup or workflow signal
event counts, uncertainty, and context. use or corrective action.
Close the loop. Each monitoring plan should identify a signal owner, severity-based triage timeline, criteria for
targeted clinical validation, escalation contacts, and available actions—additional clinical oversight, restricted use,
correction, rollback, or temporary suspension. Credible serious risks may justify interim safeguards before
causation is fully confirmed. Existing reporting obligations apply as required and should not be deferred merely
because validation is ongoing [1,2].

3. Response to Question 21 — Stakeholder roles without diluted accountability
CDRH asks how clinicians, institutions, professional and standards bodies, and others may support postmarket monitoring
without diffusing manufacturer accountability.
Operational tasks should follow each actor’s access to evidence and ability to act, while the manufacturer remains
responsible for the marketed device function and its applicable FDA regulatory obligations. Co-Lifecycle
Governance supplies a life-cycle responsibility matrix [1]; Refined Exclusion emphasizes that subgroup or workflow
signals are not actionable unless an identifiable actor can evaluate and respond to them [2]. We suggest the
following roles:
• Manufacturer: maintain device-level surveillance and change-control processes; investigate suspected devicerelated failure; assess version-specific impacts; implement, communicate, and document corrective measures;
and fulfill applicable FDA reporting obligations.
• Healthcare institution: manage local deployment and workflow safety; identify a clinical/AI governance
authority able to require enhanced review, restrict use, or pause a local deployment; and promptly
communicate relevant events to the manufacturer.
• Clinicians and clinical teams: interpret consequential outputs in patient context, flag discrepancies and
incidents, and contribute to defined case reviews—without bearing sole responsibility for technical surveillance
or root-cause analysis.
• Professional societies and standards-setting bodies: develop useful clinical review criteria, incident
taxonomies, subgroup considerations, and reporting formats that reduce duplicative monitoring burden across
sites.
• Foundation-model suppliers, patients, and caregivers: suppliers should support traceability and timely
change notices through appropriate arrangements with device manufacturers; patients and caregivers should
have accessible safety-feedback channels [2].
Make information exchange operational. Manufacturers and deploying institutions should document what is
shared, with whom, and when: device and component version identifiers; relevant incident context and minimally
necessary input/output evidence; assessment findings; severity and notification thresholds; and disposition of
corrective actions. These protocols should protect patient privacy and respect data-use limits. A hospital’s authority
to restrict local clinical use and the manufacturer’s obligation to investigate and remediate device-level issues are
complementary rather than competing functions. A concise written matrix should identify who detects, adjudicates,
pauses, investigates, corrects, notifies, and reports [1,2].

4. Illustrative application (hypothetical)
Consider an authorized GenAI-enabled clinical triage device used in a multilingual outpatient workflow. Clinicians
notice a recurring pattern of inappropriately low-urgency recommendations in one language group. The institution
promptly reviews the cases and may require human verification or pause local use; it also informs the manufacturer.
The manufacturer examines versioned outputs and relevant model, prompt, and retrieval configurations, performs
targeted clinical reassessment, and determines device-level mitigations and applicable reporting. This example
illustrates how Q19’s detection–validation–action sequence depends on Q21’s explicit authority and informationsharing pathways; it is not evidence of an observed failure or of a validated intervention.
 OCTOBER 2026

5. Requested CDRH considerations
For future policy development, we respectfully suggest that CDRH consider: (i) distinguishing low-burden, signaloriented surveillance from targeted clinical validation and competency re-benchmarking; (ii) encouraging riskjustified scheduled reviews and prespecified event triggers that capture changes in GenAI deployment
configurations, serious incidents, and clinically meaningful subgroup uncertainty; and (iii) encouraging a written
responsibility and information-sharing matrix that enables local action without transferring the manufacturer’s
applicable obligations [1–3].

References
1. Lee JH, Choi B, Jeong K, Suh SW, Kim JH, Son DS. Co-Lifecycle Governance for Learning Medical AI: A Hybrid Convergence
Framework for Adaptive Regulatory Oversight. J Med Internet Res. 2026;28:e90654. https://doi.org/10.2196/90654
2. Lee JH, Choi B, Jeong K, Suh SW, Kim JH, Son DS. Refined Exclusion in Medical AI: Data Justice and Patient Safety Governance. J
Med Internet Res. 2026;28:e102359. https://doi.org/10.2196/102359
3. U.S. Food and Drug Administration, Center for Devices and Radiological Health. Considerations for the Regulation of Generative AIEnabled Medical Devices: Discussion Paper and Request for Feedback. August 2026. https://www.fda.gov/media/194242/download