Dun & Bradstreet

See attached file(s)

DUN & BRADSTREET GOVERNMENT

Public Comment for Docket No. FDA-2026-N-7874
The Role of Trusted Data, Source Traceability, and Third-Party Governance in Generative AIEnabled Medical Devices

Submitted by: Dun & Bradstreet
Re: Request f or Comment on Generative AI-Enabled Medical Devices

Scope of These Comments
Dun & Bradstreet (D&B) submits these comments as a commercial data, analytics, and riskintelligence provider with nearly two centuries of experience establishing the provenance, quality,
and governance of information sourced from tens of thousands of third parties worldwide. D&B
does not develop, manufacture, or market medical devices, and the company offers no opinion
on clinical validation, clinical performance thresholds, or the medical appropriateness of any
device output.

Dun & Bradstreet’s comments are therefore deliberately limited to the cross-cutting, non-clinical
matters on which the company has direct and demonstrable expertise: source traceability and
data provenance, transparency into third-party foundation models and data suppliers,
independent verification, and lifecycle monitoring of upstream dependencies. Accordingly, these
comments respond only to Questions 16, 19, 20, 24, and 25. D&B respectfully takes no position
on the remaining questions, which concern clinical and device-performance matters outside the
company’s domain.

Question 16 — The Role of Qualified Independent Third Parties
Independent third parties can strengthen confidence in generative AI systems, particularly where
benchmarking and verification are concerned. Drawing on Dun & Bradstreet’s experience
providing independent, auditable data verification, the company suggests the value of an
independent party depends less on its identity than on the rigor, provenance, and reproducibility
of the evidence it produces.

Where independent third parties support benchmarking or confirmation, the Food and Drug
Administration (FDA) may wish to expect that:
• Benchmark datasets carry documented provenance, version control, and independent
verification of data quality;
• Benchmarking methodologies are auditable and reproducible, with documentation of dataset
composition, intended use, coverage, and known limitations;
• Where synthetic data is used, its origin, generation methodology, and relationship to source
populations are transparently documented so an independent party can assess
representativeness.

These provenance and reproducibility standards help ensure independent evaluation results are
representative, defensible, and comparable across submissions.

Questions 19 and 20 — Postmarket Monitoring of Upstream Dependencies and
Supervisory Approaches
Postmarket monitoring for generative AI-enabled devices should, in Dun & Bradstreet’s view,
extend beyond statistical performance drift. Significant organizational, financial, or operational
changes affecting a foundation model provider, data supplier, or cloud provider can introduce new
risk even when measured device performance appears unchanged. Monitoring the health and

Commercial in Confidence
Commercial in Confidence
 DUN & BRADSTREET GOVERNMENT

stability of the supply chain behind a device is directly analogous to the entity- and supplier-risk
monitoring D&B performs at scale, including standardized signals such as changes in legal status,
financial distress, and “out of business” indicators.

FDA may wish to consider a postmarket framework that incorporates:
• Continuous monitoring of upstream providers for material changes in ownership, legal
status, financial condition, and cybersecurity posture;
• Reassessment triggers keyed to those change events, in addition to periodic rebenchmarking;
• Defined roles and responsibilities for manufacturers, providers, and other stakeholders in
surfacing and escalating such changes.

On the question of machine-based supervisory agents (Question 20), D&B suggests any such
agent be subject to the same provenance, traceability, and independent-verification standards
applied to the device it monitors, with auditable logs of its inputs, decisions, and escalations, so
the supervisory layer does not itself become an unverified dependency.

Question 24 — Managing Changes Introduced by Third-Party Foundation Model
and Data Providers
Many generative AI-enabled devices rely on third-party foundation models, cloud services, and
external data suppliers whose development practices and ongoing changes may not be fully
visible to the device manufacturer or to the FDA. In D&B’s experience, managing dependency on
inputs one does not originate is fundamentally a governance and monitoring problem, not solely
a point-in-time testing problem. D&B respectfully suggests FDA treat material changes at the
provider level as discrete, trackable events that may warrant reassessment even when measured
device performance appears stable.

FDA may wish to consider whether the following provider-level events should trigger review or rebenchmarking obligations:
• Material updates, retraining, or version changes to an underlying foundation model;
• Ownership changes, mergers, or changes in legal status affecting a foundation model
provider, cloud provider, or key data supplier;
• Cybersecurity incidents, service disruptions, or degradation in a provider’s operational or
financial condition;
• Changes to the sourcing, licensing, or permissible use of data feeding retrieval or training
pipelines.

Tying re-benchmarking triggers to documented upstream change events, rather than to elapsed
time alone, would allow manufacturers to identify and address emerging risks before they affect
clinical use, and would give FDA a clearer basis for allocating oversight responsibility across the
device manufacturer and its providers.

Question 25 — Voluntary Foundation Model Master Files and Transparency
Content
Dun & Bradstreet supports the concept of a voluntary Foundation Model Master File as a
mechanism to improve transparency into third-party models. D&B offers one central observation
drawn from the company’s own governance of third-party data: a transparency file is only useful
if it carries verifiable provenance and lineage, not merely a descriptive model card. To support
consistent risk assessment and clearer oversight, D&B suggests such a file capture, at minimum:

Commercial in Confidence
Commercial in Confidence
 DUN & BRADSTREET GOVERNMENT

• Model ownership, provider identity, and known third-party dependencies within the model
supply chain;
• Development and update practices, including a version and change history sufficient to
correlate model changes with device behavior;
• Training data sources and their provenance, with documentation of origin, coverage, and
known gaps or limitations;
• Safety controls, evaluation methodology, and documented limitations or known failure
modes;
• Sufficient lineage metadata to allow an independent party to trace a representative output
back toward its contributing sources.

Standardizing this content would help regulators evaluate how changes to an underlying model
may affect device performance over time and would reduce reliance on opaque, unverifiable
provider assertions.

Conclusion
Dun & Bradstreet appreciates the opportunity to comment within the narrow scope described
above. In the company’s experience, data provenance, source traceability, third-party model
transparency, and lifecycle monitoring of upstream dependencies are foundational to
accountability, adverse-event investigation, and durable oversight of systems that evolve over
time. D&B would welcome the opportunity to serve as a resource to FDA on these specific, nonclinical dimensions as the Agency develops its approach.

Commercial in Confidence
Commercial in Confidence