Curai Health (Jemal Young)

See attached file(s)

2443 Fillmore St. #380-15799 | San Francisco, CA 94114 | (805) 635-8281

Curai Health comments on Docket FDA-2026-N-7874
Our comments follow the section numbers and question numbers in Considerations for the
Regulation of Generative AI-Enabled Medical Devices: Discussion Paper and Request for
Feedback.

IV. Considerations for the Assessment of Risk for GenAI-Enabled Devices

Question 1: The two-axis risk framework
The two axes are a reasonable starting point. We recommend adding 3 dimensions:

●​ Reversibility of the action that follows from the output.
●​ Time to error, meaning how quickly an incorrect output can lead to harm.
●​ The risk profile of the patient population, the treatment decision, and the disease.

The framework should also account for controls that eliminate or reduce risk. These include the
device recognizing when a case is outside its bounds and handing it off, limits on what the
device can output for a given condition, a clinician reviewing outputs before they reach the
patient, and similar mitigations. A function with these controls should sit lower on the
consequence axis than the same function without them.

Question 3: Patient-facing functions
Patient-facing functions can be made safe, and they expand access to care. The evaluation
should ask 2 things: whether patients understand the instructions they receive, and whether the
device delivers safe care without relying on the patient to catch a medical error.

Safeguards that address the gap in domain knowledge include access to a clinician when the
case needs one, language that conveys uncertainty when the device is uncertain, and output
that works across reading and education levels.

Question 4: Generalist and specialist HCPs
The test should consider whether the HCP already has the specialist expertise and also whether
the information is a reasonable extension of knowledge the HCP can apply. A primary care
physician can act on endocrinology guidance much more readily than on oncology guidance.
Risk should be assessed accordingly.

Question 5: Multi-turn conversations
Any generative AI device can drift over a long conversation. FDA should evaluate how well a
device’s guardrails keep it on track across full exchanges.
Testing should cover complete encounters and repeat visits, including changing symptoms,
contradictory information, and multiple conditions. Intended use can be characterized by
defining the clinical actions the device is permitted to take and showing that those boundaries
hold throughout the conversation.

Question 6: Under- and over-escalation
Under-escalation is the primary risk and should be the focus of evaluation. Over-escalation has
limited clinical downside, because any resulting intervention is directed by an HCP who applies
their own judgment. Its main costs are financial, and those are outside FDA’s review of safety
and effectiveness.

V. A Competency-Based Approach for Premarket Evaluation of
GenAI-Enabled Devices

Question 7: Benchmarking followed by clinical confirmation
Yes. This is a useful framework.

Primary care devices handle many conditions using shared competencies: diagnosis,
prescribing, and management. Sponsors should be able to validate those shared competencies
once and use that evidence to support multiple conditions where applicable, without repeating
validation condition by condition.

Question 11: Selecting a clinical confirmation approach
We oppose a universal requirement for randomized controlled trials.

The approaches in the paper answer different questions. Clinician adjudication of real cases
gives the strongest evidence of clinical appropriateness. Retrospective evaluation uses real
patient inputs and is easy to repeat, but it can’t recreate a multi-turn intake conversation; it
works best for testing triage logic and clinical reasoning. Standardized patient interactions are
the most repeatable, though less conclusive about real-world performance. Sponsors should
select the combination that addresses the uncertainties specific to their device.

FDA should also accept prospective case review, independent adjudication, and staged
supervised deployment, where patient exposure expands as performance is confirmed.

Question 13: Synthetic data
Synthetic patients are well suited to testing multi-turn intake, because the patient’s responses
depend on the questions asked and historical data can’t be replayed. They are also well suited
to rare hazards, adversarial behavior, and difficult combinations of conditions.
Synthetic data is inadequate as a high-volume stand-in for real-world edge cases. It can miss
real human behavior, and a simulator can share the blind spots of the device it is testing.

Synthetic cases should be validated against real cases and independent clinical judgment. They
should supplement real-world evidence, particularly for underserved populations where real
data is scarce.

Question 14: Performance comparators
The comparator should be the median clinician in practice, which represents what an average
physician would do. Where access is limited, the care patients actually receive may be worse
than that. Our response to Question 15 addresses this.

Question 15: Comparing against care without the device
The comparator should include the care patients would realistically receive without the device,
including delays and interrupted treatment.

Access benefits should be measured alongside clinical performance, while maintaining a
defensible minimum standard of care. Sponsors can draw on comparisons to care actually
delivered and on published data about appointment wait times and specialist availability across
the US.

Question 16: Independent third parties
Third-party review can be part of the approach only if the pool of qualified parties is broad. If
only a few organizations can perform benchmarking or confirmation, they will control market
access. If FDA can’t ensure that breadth, it shouldn’t require third-party participation.

VI. Postmarket Monitoring for GenAI-Enabled Devices

Question 18: Accepting premarket uncertainty through postmarket monitoring
We support this approach. Model drift, continuous improvement, new capabilities, and the
difficulty of testing a generative device fully before release all make postmarket monitoring
valuable. It will also get safe devices to patients faster.

Conditions should include bounded deployment with oversight, explicit evidence commitments,
and stopping rules. The monitoring program must be able to resolve the specific uncertainty that
was deferred at authorization.

Question 19: Postmarket performance evaluation approaches
We support all 3 approaches. A workable program would include:
 1.​ Automated evaluation of production outputs, initially covering all traffic, with sampling
reduced over time based on volume, risk, and demonstrated stability.
2.​ Clinician review of a smaller sample, combining random selection with targeted review of
potential safety or quality issues.
3.​ Regression testing on historical data and simulation testing before any change to device
behavior is deployed.

Reassessment should be triggered by model changes and by significant shifts in behavior
detected through automated monitoring.

Question 21: Roles of other stakeholders
Clinicians and health systems should have a receive-and-report role: they report problems they
encounter with the device. Accountability stays with the manufacturer.

We are skeptical of formal roles that would give a small group of institutions or organizations
control over postmarket oversight. That concentrates influence and diffuses the manufacturer
accountability the paper aims to preserve.

Question 22: Scaling re-benchmarking to the change
Most routine iteration within the authorized intended use shouldn’t require new premarket
review. Non-clinical engineering changes can be managed in the sponsor’s QMS. Changes that
affect device behavior are good candidates for a PCCP that defines the permitted modifications
and required validations. These include prompt and conversation flow updates, improvements to
clinical reasoning and triage logic, updates to the clinical criteria the device applies when the
issuing body revises a guideline, and model updates or replacements.

How much a PCCP can cover should depend on the kind of evidence behind the authorization.
If authorization depends on repeatable benchmarks and continued monitoring, the sponsor can
rerun those benchmarks after each change and compare the results against the premarket
baseline. Most changes that affect device behavior could then go through a PCCP. If premarket
evidence leans heavily on a one-time prospective trial, the sponsor has no practical way to
repeat that trial after each change. The PCCP would then be limited to minor changes, such as
small prompt edits.

Question 23: Change control when modifications can’t be fully prespecified
Model changes, including full model replacement, should be eligible for a PCCP. With
generative AI devices, nearly all premarket evaluations can be rerun on the modified device, so
the evidence gap between the original and modified device should be small.
A 2-stage PCCP would fit. The sponsor deploys the change after it passes the prespecified
offline evaluations and reports the results to FDA. The sponsor then submits real-world
performance data once it reaches a prespecified sample size.

Question 24: Developer-initiated foundation model changes
Manufacturers should pin each device to a specific model snapshot so it can’t be updated
automatically. At a minimum, the manufacturer should have a reliable way to learn of model
changes in advance, through its supplier agreement or the developer’s published versioning and
deprecation policy.

A pinned model can still change behavior. Automated monitoring of production outputs should
alert the manufacturer to significant shifts. Planned model upgrades should go through
regression and simulation testing before deployment, under a PCCP as described in our
response to Question 23.

Contact: Jemal Young, Regulatory Affairs Manager, Curai Health, jemal@curai.com