American College of Cardiology (Roxana Mehran)

American College of Cardiology comment letter.

10/19/2026

Rick Abramson, M.D.
Director for Center for Devices and Radiologic Health
Food and Drug Administration
10903 New Hampshire Avenue
Silver Spring, MD 20993

RE: Considerations for the Regulation of Generative AI-Enabled Medical Devices:
Discussion Paper and Request for Feedback

Dear Director Abramson:

The American College of Cardiology (the ACC) is the global leader in transforming cardiovascular
care and improving heart health for all. As the preeminent source of professional medical education
for the entire cardiovascular care team since 1949, ACC credentials cardiovascular professionals in
over 140 countries who meet stringent qualifications and leads in the formation of health policy,
standards and guidelines. Through its world-renowned family of JACC Journals, NCDR registries,
ACC Accreditation Services, global network of Member Sections, CardioSmart patient resources and
more, the College is committed to ensuring a world where science, knowledge and innovation
optimize patient care and outcomes.

Introduction
The ACC appreciates the opportunity to provide feedback to the Food and Drug Administration’s
(FDA) Center for Devices and Radiologic Health (CDRH) regarding potential approaches to the
regulation of generative artificial intelligence (GenAI) enabled medical devices. Clinicians, including
those delivering cardiovascular care, are increasingly encountering AI-enabled technologies and
given this increase ACC is supportive of a regulatory framework that allows patients and clinicians
to benefit from innovation while maintaining appropriate safeguards for patient safety, clinical
autonomy, and high-quality care.

ACC continues to be a champion of innovation and believes these technologies have strong
potential to be advantageous in a clinical setting. However, the benefit of these technologies is yet to
be realized and thus requires continued surveillance and review throughout the product lifecycle.
ACC supports CDRH’s consideration in leveraging a risk-based and total-product-lifecycle approach
to regulating GenAI-enabled medical devices. These technologies vary in their intended use, degree
of autonomy, clinical consequences, and role in the clinical decision-making process. Therefore,
ACC recommends that any regulatory actions should remain proportionate to the risks associated
with each specific function of the tool as opposed to simply the presence of generative AI.
In addition, ACC supports the use of GenAI-enabled technologies to augment clinical-decision
making and physician expertise and strongly believes these technologies should remain ancillary in a
clinical setting. AI technologies should be designed and evaluated to support safe and effective
clinical care, where appropriate, with meaningful clinician oversight based on the tools’ intended use,
risk level, and demonstrated performance.

Assessment of Risk for GenAI-Enabled Devices
CDRH is considering a risk-proportionate regulatory framework to address uncertainty regarding
the potential for GenAI-enabled medical devices to cause harm. The proposed two-axis framework
evaluates “Activity” on the horizontal axis and “Consequences” on the vertical axis (see Figure 1).
“Activity” refers to the function of the GenAI-enabled medical device, ranging from informational
to action-taking functions. These categories include informational/non-directive,
informational/action-directing, action-taking/supervised, and action-taking/fully autonomous
functions. “Consequences” refers to the potential harm that could result from relying on an
incorrect device output and is categorized as limited, moderate, or severe. Under this framework,
risk generally increases as the device’s level of autonomy increases. ACC agrees with CDRH that a
software function operating under healthcare professional (HCP) supervision presents a different
risk profile than one that operates autonomously.
Figure 1. FDA framework illustrating the relationship between increasing device autonomy and the potential consequences of device outputs. Source: U.S. Food and Drug
Administration, Considerations for the Regulation of Generative AI-Enabled Medical Devices: Discussion Paper and Request for Feedback
(2026)

ACC sees some merit in CDRH’s proposed risk framework considering both the degree of device
activity or autonomy and the consequences of relying on an incorrect output. However, these two
dimensions, Activity and Consequence, should not be considered in isolation. ACC recommends
that CDRH consider the clinical context in which a device is used, including the ability of a clinician
to independently evaluate an output, the time available for review, the reversibility of a resulting
action, the availability of confirmatory information, and the presence of meaningful humanoversight safeguards. Several of these dimensions are consistent with considerations identified in
FDA’s Clinical Decision Support Software: Guidance for Industry and Food and Drug Administration Staff.

ACC recommends that CDRH’s risk framework clearly address accountability for the outputs and
resulting clinical consequences of GenAI-enabled medical devices. Responsibility should not
become unclear merely because a device incorporates or depends upon a third-party general-purpose
or foundation model. The medical device manufacturer should remain accountable for the safety,
effectiveness, validation, monitoring, and regulatory compliance of the complete device as deployed,
including components developed by third parties. Manufacturers should identify the boundaries of
the regulated device, disclose material dependencies on underlying foundation models and external
services, and establish controls addressing changes to those components that could affect device
behavior. Contractual arrangements among developers, foundation-model providers, deployers, and
healthcare organizations should not shift responsibility for latent technical failures to clinicians or
patients.

In addition, ACC believes that clinician supervision should be treated as a meaningful component of
risk mitigation only when that supervision is realistic and clinically meaningful. A manufacturer’s
labeling or interface should not characterize a clinician as providing oversight where the system’s
design, workflow integration, volume of outputs, or time pressures make meaningful review
impractical. Additionally, the mere presence of a clinician within the workflow should not
automatically be considered sufficient to reduce risk. Meaningful oversight requires that the clinician
have sufficient information, time, authority, and practical ability to independently evaluate the AI
output, understand relevant uncertainty and limitations, and intervene before a consequential clinical
action occurs.

ACC further recommends that the effectiveness of clinician oversight be evaluated during clinical
confirmation. Such evaluation should assess whether intended users can recognize, investigate, and
correct consequential device errors under realistic conditions, including time pressure, competing
clinical demands, the volume of outputs, and the way information is presented within the clinical
workflow. This would help demonstrate whether proposed human-oversight safeguards are effective
in practice rather than merely available in theory.

ACC highly encourages CDRH to recognize that the “informational”, and “action-directing”
function exist on a continuum. Risk assessment should consider the specificity, personalization,
confidence, urgency, and clinical context of the recommendation rather than relying primarily on
particular words such as “recommend” or “consider”. For example, language directing a clinician to
“consider” an action may still pose significant risk when the recommendation is patient-specific,
highly confident, time-sensitive, and likely to elicit immediate action. By contrast, stronger language
such as “recommend” may pose less risk in a routine, non-urgent clinical context where the clinician
has sufficient opportunity to conduct an independent review. Thus, potential harm should be
evaluated based on clinical context of the recommendation as opposed to the terminology used to
express it.

ACC recommends that CDRH apply heightened scrutiny to systems that move beyond clinical
decision support and perform or initiate clinical actions. Autonomous or agentic functions should
not operate without meaningful human involvement when an output could lead to a consequential
diagnosis, treatment, referral, or other clinical action. For higher-risk functions, the device should
require review and authorization by an appropriately qualified clinician before an action is
implemented. Any exception should be supported by robust evidence demonstrating that
autonomous operation is necessary, clinically beneficial, and accompanied by safeguards
proportionate to the potential consequences of failure.

ACC cautions against the use of only two dimensions that assess the risk level of a GenAI-enabled
software function. As CDRH notes in the discussion paper, there are multiple considerations that
must be made when assessing the potential risk a medical device may pose when used in a clinical
setting. ACC agrees that these dimensions provide a useful starting point for evaluation, however
additional factors need to be considered to reflect the complexity of clinical practice. In addition to
evaluating the function of the AI tool and how harmful an incorrect output would be, CDRH
should also evaluate a clinician’s ability to evaluate the output provided, the clinical environment in
which the tool is being deployed, and whether the tool can perform reliably in real-world practice.
ACC encourages CDRH to incorporate these considerations as possible risk modifiers when
leveraging the two-dimensional risk framework during the evaluation process of a GenAI-enabled
tool.

Technical Validation Considerations for Risk Assessment
In addition to clinical factors, ACC encourages CDRH to consider technical characteristics of these
tools when evaluating their safety and risk level that goes beyond autonomy level and device
function. Technical aspects of a GenAI-enabled tool include model drift, algorithmic bias, data
quality, reliability and reproducibility, confabulations (or hallucinations), and cybersecurity
vulnerabilities.

Risk assessment should also consider whether the manufacturer has sufficient access,
documentation, testing rights, change notifications, and technical controls to identify and manage
risks originating from a third-party foundation model, general-purpose model, external service, or
other component outside the manufacturer’s direct control.

The overall performance of a GenAI-enabled medical device may change over time as the input
data, clinical environment, patient population, and underlying model continually evolve. Therefore, a
device may perform during premarket evaluation but might not maintain that performance level post
deployment. ACC is supportive of CDRH’s approach of evaluating these technologies throughout
its lifecycle and thus highly encourages that model drift–the possible degradation of performance of
a model—be considered during the evaluation process. Any risk assessment of a GenAI-enabled
medical device should include the clinical consequences of model drift and degradation and whether
the device manufacturers have established appropriate mechanisms to detect and address changes in
performance.

Reliability and reproducibility, referring to the trustworthiness and verifiability of an AI output, are
also pertinent when assessing risk. A GenAI-enabled medical device can produce multiple outputs
when responding to similar inputs, therefore manufacturers should be required to demonstrate that
outputs remain consistent across clinically equivalent scenarios. In addition, model performance may
be influenced by the duration of the interaction leading to possible degradation over extended multiturn conversations as opposed to single-turn queries. Performance may also be impacted when
models process or generate multimodal inputs and outputs, such as combinations of text, images,
audio, or other clinical data. Therefore, evaluation criteria should assess performance across
interaction lengths and input and output modalities, the probability of confabulations, clinical
recommendations that are not medically supported, and inflated expressions of confidence that
make incorrect outputs difficult to identify.

In addition, cybersecurity vulnerabilities can compromise model performance or cause a function to
operate outside of its intended use. As more GenAI-enabled devices enter the market, security risks
will continue to increase. ACC encourages that these risks should be assessed in relation to their
potential consequences for patient safety and clinical decision-making.

ACC also believes that clinicians utilizing these technologies should not bear the burden of
independently detecting algorithmic bias, model drift, or other technical failures that may not be
apparent during routine clinical use. While ACC believes that clinician oversight is essential to the
safe use of GenAI-enabled technologies, oversight should not be treated as a substitute for these
critical technical validations. These technical validations can be difficult to discern and therefore
require regular and constant evaluation of the model’s performance. CDRH should incorporate
these technical validation considerations into its risk assessment framework which can help inform
the rigor of both premarket and postmarket benchmarking.

Generalist and Specialist Physician Use
CDRH seeks input on whether Gen-AI enabled tools that provide clinical information directly to
patients should be considered higher risk than those used by healthcare professionals, and what
safeguards can help patients safely understand and act on AI-generated information while preserving
patient empowerment and access to care. In addition, CDRH requests feedback on whether risk
should be assessed differently when GenAI tools are used by generalist clinicians rather than
specialists, particularly when the information falls within a specialty area, and what safeguards can
support safe use in those settings.

For GenAI-enabled medical devices that provide information directly to patients, ACC recommends
that evaluation includes whether intended users can understand the device’s output, recognizes its
limitations and uncertainty, and identifies when clinical evaluation is needed. Testing should reflect
the health literacy and other relevant characteristics of the intended patient population and should
assess whether potentially urgent findings are communicated in a manner that supports timely and
appropriate care. These safeguards are particularly important for tools addressing cardiovascular
symptoms or findings for which delayed evaluation could result in significant harm.
GenAI-enabled medical devices should clearly disclose the patient populations and data sources
used to train and validate the tools used. This information is critical to clinical performance and may
not translate across varying populations; for example, a model developed using adult patient data
should not be presumed to be safe or effective in pediatric patients without adequate validation.
These key details should not be buried in fine print in technical documentation and the limitations
of the tool should be made apparent.

Direct-to-consumer and other patient-facing tools warrant particularly rigorous premarket evaluation
because patients may act on outputs without immediate clinician interpretation. Before such tools
are deployed at scale, manufacturers should provide evidence from representative users and realistic
use conditions demonstrating that patients can understand the output, recognize uncertainty and
limitations, respond appropriately to urgent findings, and avoid harmful delay, false reassurance, or
unnecessary care. Postmarket monitoring should supplement, rather than substitute for, this
premarket evidence.

GenAI-enabled medical devices have the potential to assist general physicians’ understanding of
specialized medical information. ACC agrees that GenAI-enabled medical devices may offer
opportunities that support clinicians in providing access to specialty-specific clinical information and
assisting with the interpretation of complex patient information. As such, ACC believes that systems
intended for use within specialty care, such as cardiovascular care, should be evaluated using
clinically appropriate standards and expertise relevant to the function being performed. For example,
a primary care physician might use an AI tool to help interpret cardiovascular information, recognize
potential heart problems, or determine whether a patient should see a cardiologist. However, a GenAI-enabled medical device that provides specialized information should be tested by experts in the
medical field for which they are designed. For example, cardiologists should be directly involved in
the evaluation and assessment of an AI tool designed to interpret cardiovascular information tool to
ensure it provides accurate, safe, and clinically appropriate information, while human factors and
usability testing should include its intended users, such as general physicians.

ACC recommends that for GenAI-enabled medical devices that are intended to support specialty
care, physicians with relevant specialty training should contribute to the development of clinical
performance standards. Clinicians with specialty expertise should be involved in establishing clinical
performance standards and evaluating device outputs throughout the total product lifecycle.
In tandem with these recommendations, ACC encourages that any GenAI-enabled tool used in the
clinical setting be designed and evaluated to recognize and appropriately respond to its limitations.
Evaluation should assess not only whether the system produces a correct output, but also whether it
appropriately communicates uncertainty, identifies when a case falls outside its intended scope,
abstains from providing a definitive output when appropriate, and escalates the case for clinician
review when necessary. For example, if a tool assisting a primary care physician encounters a
cardiovascular condition requiring specialist expertise, it should clearly signal the need for further
evaluation rather than independently provide a confident recommendation that requires specialized
clinical judgment. ACC also recognizes that patients in rural and other remote areas may have
limited access to specialists. In these settings, appropriate guardrails and safety measures are
important to support the delivery of high-quality care while ensuring that AI tools are not used
beyond their demonstrated capabilities.

An important component of safe AI behavior is the ability to recognize when a confident answer
should not be provided. ACC strongly believes that these tools should remain ancillary in the clinical
setting and that transparency regarding limitations and uncertainty is essential to their safe and
effective use.

Competency-Based Premarket Evaluation
CDRH is considering a competency-based approach to evaluating GenAI-enabled medical devices
that combine nonclinical device benchmarking with clinical confirmation. This approach resembles
the evaluation and credentialing of physicians with medical examinations to assess clinical
knowledge and reasoning, clinical training and supervised practice to assess performance with
patients, and ongoing professional evaluation to assess competence during practice. The
competency-based GenAI-enabled medical device would undergo similar evaluation with premarket
benchmarking to assess clinical knowledge, safety behavior, reliability, etc., clinical confirmation that
evaluated performance using real or clinically representative situations, and postmarket monitoring
to reassess performance over time.

In addition, CDRH is considering whether benchmarking should evaluate competencies across four
broad categories including safety, clinical proficiency, generalizability, and additional capabilities
specific to agentic AI systems. These categories measure whether the device demonstrates
appropriate clinical knowledge and reasoning, communicate uncertainty, maintain performance
across patient populations, and operate reliably within their intended scope. CDRH recognizes that
while these measurements are valuable, benchmark performance alone cannot determine the
performance of a device in real clinical practice and proposes complementary clinical confirmation
methods. These methods include retrospective evaluations, shadow deployment, standardized
patient interactions, independent clinician adjudication, and prospective clinical studies when
appropriate.

ACC appreciates FDA’s consideration of a competency-based evaluation framework that is derived
from the assessment and ongoing evaluation of clinicians and incorporates clinically meaningful
benchmarking and appropriate clinical confirmation. ACC recognizes that the evolving and openended nature of GenAI-enabled medical devices requires benchmarking methodologies that reach
beyond typical performance testing. However, strong performance on standardized or technical
benchmarks should not, by itself, be considered sufficient evidence that a GenAI-enabled medical
device is safe and effective for clinical use. Evaluation should extend beyond demonstrating
proficiency on standardized clinical questions or generalized medical knowledge assessments.
Benchmark criteria should include the specific clinical function the device is intended to perform,
the patient population in which it will be used, and the complexity of the clinical environment.
Clinical confirmation should also evaluate performance within representative real-world workflows
and environments, including cases involving incomplete or evolving clinical information, patient
comorbidities, concurrent treatments, competing clinical demands, and other conditions that may
affect how the device’s output is interpreted and acted upon. As these evaluation frameworks
evolve, ACC is well positioned to play an important role in shaping these efforts by bringing
relevant cardiovascular clinical knowledge and expertise to the development of benchmarks,
validation methods, and performance standards, where appropriate.

The type and strength of evidence required should reflect the device’s intended users, clinical
function, level of autonomy, and potential consequences of incorrect or misleading output.
Manufacturers should provide robust evidence that the device performs safely and effectively within
the clinician and patient workflows in which it will be used, rather than relying principally on
technical benchmarks or controlled validation environments. Evidence should demonstrate not only
output accuracy, but also whether use of the device supports appropriate clinical decisions,
escalation, communication, and follow-up without introducing new risks or unreasonable burdens
into the care process.

GenAI-enabled medical devices intended to support specialty care, including cardiovascular clinical
decision-making, should be evaluated within the specific workflows and environments in which they
are intended to operate. Testing should use representative patient populations and clinical scenarios,
including comorbidities, medication interactions, incomplete or evolving clinical information,
variations in disease presentation, and differences in available resources. Evaluation should assess
whether the device appropriately recognizes cases requiring escalation, communicates the basis and
urgency of that escalation, and supports referral or review by a qualified specialist. Specialty medical
societies, such as ACC, could play a role in developing and validating performance criteria, escalation
pathways, and mechanisms through which users can report unsafe, inaccurate, or unexpected
outputs.

Evaluation should also include appropriate external validation to determine whether performance is
maintained across relevant differences in patient populations, institutions, healthcare environments,
clinical workflows, technologies and data sources, and, where applicable, acquisition equipment and
protocols. Performance demonstrated in a development environment or a single validation setting
may not translate directly to other clinical settings. The rigor and breadth of external validation
should reflect the device’s intended use, deployment conditions, and the potential consequences of
an incorrect output.

ACC recommends that clinical confirmation evaluate not only the accuracy of a device’s outputs,
but also the interaction between the device and its intended users. Evaluations should assess
whether clinicians can recognize, investigate, and correct consequential errors under realistic
workflow conditions. Representative testing should account for time pressure, competing clinical
responsibilities, alert or output volume, and the availability of information needed to independently
evaluate the device’s output.

ACC also recommends that performance evaluations separately measure errors with the greatest
potential for clinical harm. Aggregate accuracy metrics may obscure a device’s failure to identify an
urgent finding, its generation of an unsafe treatment recommendation, or its failure to direct a
patient to timely evaluation. Testing should therefore report clinically consequential errors separately
and use cases representative of the device’s intended population, setting, and function. Evaluation
should also assess whether use of the device improves—or, at minimum, does not adversely affect—
the care workflow into which it will be introduced.

Postmarket Benchmarking, Monitoring, and Revalidation
CDRH is considering periodic re-benchmarking, independent clinician review of real-world outputs,
and monitoring for performance degradation or model drift. CDRH notes that initial premarket
assessments could serve as a baseline for reassessing devices following modifications and CDRH
requests feedback on whether stronger postmarket monitoring could justify accepting greater
premarket uncertainty.

ACC strongly supports ongoing postmarket monitoring of GenAI-enabled medical devices to
ensure they maintain their safety and effectiveness throughout their lifecycle. ACC recommends that
postmarket monitoring responsibilities reflect each party’s access to relevant data. Manufacturers
should assess model drift, algorithmic bias, and performance degradation using representative test
sets and available performance data, while deploying health care organizations should monitor realworld performance within their local patient populations and clinical workflow. While ACC agrees
that the frequency and rigor of re-benchmarking should be proportionate to risk, all GenAI-enabled
tools should be reassessed and revalidated throughout the product life cycle to reduce the chance of
output failures.

As with premarket benchmarking, ACC believes that qualified specialty physicians should also
contribute to evaluating clinically significant performance changes during the postmarket evaluation
process. At the same time, manufacturers should retain responsibility for monitoring revalidation,
and corrective action of GenAI-enabled tools. In addition, ACC believes that postmarket
monitoring should complement rather than replace adequate premarket evidence. ACC agrees that
ongoing monitoring is essential for identifying performance degradation and possible risks.
However, it is imperative that manufacturers first demonstrate that a device can safely and
effectively perform its intended function prior to deployment.

Postmarket monitoring plans should include prespecified thresholds or triggers for investigation,
corrective action, and revalidation. Relevant triggers may include clinically meaningful changes in
performance, the emergence of new consequential error patterns, and material modifications to the
AI system, including major model updates, replacement or modification of an underlying foundation
model, fine-tuning, changes to system configuration or prompts, changes to training or input data,
and modifications to the user interface, intended use, clinical environment, or workflow. When such
changes could materially alter system behavior, manufacturers should conduct risk-proportionate
reassessment and revalidation before or promptly following deployment, as appropriate, rather than
presume that evidence supporting an earlier version remains applicable. Manufacturers should
monitor clinically consequential errors in actual use and remain accountable for investigating and
addressing identified safety and performance concerns. CDRH should also require clearly
communicated mechanisms through which clinicians and health systems can report suspected
device-related problems and receive appropriate follow-up.
CDRH should clarify how adverse events and other clinically significant performance concerns
involving GenAI-enabled medical devices should be identified, documented, evaluated, and reported
throughout the product lifecycle. Reportable events should not be limited to cases in which patient
harm has already occurred; they should also include near misses, repeated clinically consequential
errors, unexpected autonomous actions, failures to escalate or abstain, and patterns suggesting that
the device is operating outside its intended use or validated performance. Manufacturers should
maintain processes to aggregate reports across users and deployment sites, investigate potential
common causes, and communicate relevant findings and corrective actions to FDA, healthcare
organizations, and affected users.

Conclusion
ACC appreciates the opportunity to respond to FDA CDRH’s efforts to develop a regulatory
framework that addresses the unique and ongoing challenges of GenAI-enabled medical devices
while simultaneously supporting responsible innovation. ACC encourages CDRH to establish a riskbased, total product life cycle approach when considering regulatory approaches. Benchmarking and
evaluation should incorporate:
• Clinically consequential performance measures
• Clinical confirmation in representative real-world settings
• Appropriate external validation
• Clear manufacturer accountability for the complete device and its third-party model
dependencies
• Assessment of uncertainty and abstention behavior
• Realistic evaluation of clinician and patient interactions
• Meaningful physician oversight
• Appropriate limits on autonomous action
• Robust evidence for patient-facing tools
• Actionable adverse-event reporting
• Postmarket monitoring
• Revalidation requirements throughout the product lifecycle, following material system
changes.
ACC strongly believes that GenAI-enabled medical devices should augment, not replace physician
expertise and clinical judgment. If you have any questions or follow up, please contact Faizah
Pirzada, Associate Director of Health IT and Digital Health Policy at fpirzada@acc.org or (202)
375-6164.
Sincerely,

Roxana Mehran, MD, FACC
President, American College of Cardiology