Manatt, Phelps & Phillips, LLP (Ross Margulies)

Please see attached.

Ross Margulies
Partner
Manatt, Phelps & Phillips, LLP
Direct Dial: (202) 585-6626
rmargulies@manatt.com

October 19, 2026

Via Electronic Submission

Dockets Management Staff (HFA–305)
Food and Drug Administration
5630 Fishers Lane, Rm. 1061
Rockville, MD 20852

Re: Docket No. FDA-2026-N-7874, Considerations for the Regulation of Generative
AI-Enabled Medical Devices; Discussion Paper and Request for Feedback

To Whom it May Concern:

On behalf of a medical technology Company (the “Company”), below please find
comments responding to the Discussion Paper and Request for Feedback, Considerations for the
Regulation of Generative AI-Enabled Medical Devices (the “Discussion Paper”) published by the
Center for Devices and Radiological Health (“CDRH”) in August 2026.
The Discussion Paper provides a constructive starting point for the regulation of generative
AI-enabled (“GenAI”) devices on which the Company welcomes the opportunity to share its
views. The Company’s comments support a risk-proportionate approach that focuses on what a
function does and the consequences of error, rather than on the underlying technology used to
produce the output. The Company recognizes that directiveness falls on a continuum, that patientfacing delivery can be addressed through safeguards and that established tools, such as expert
adjudication, real-world data, and predetermined change control plans, remain relevant. The
Company’s comments identify areas where additional clarity would strengthen the framework, and
support responsible innovation and user access to beneficial technologies.

I. Statutory Authority and Definition of “Device”
The Company recognizes that this Discussion Paper is not intended to address whether the
approaches discussed throughout are within FDA’s existing statutory authority, or whether
implementing them would require the introduction of new authorities. That being said, the
Company would appreciate clarity on the exclusions from the definition of “device.” Specifically,
as FDA recognizes in the Discussion Paper, FDA regulates only products that meet the definition
of "device" under section 201(h) of the FD&C Act. That definition contains limitations that apply
to many of the products the Discussion Paper considers. Most notably, a device must be intended
for use in the diagnosis, cure, mitigation, treatment, or prevention of disease. Many AI products
are not intended for such use, as shown by their labeling, claims, and marketing, and fall outside
the statutory definition of “device.” Further, even where an AI product is intended for such a
purpose, section 520(o)(1)(E) of the FD&C Act, as interpreted in FDA's 2026 clinical decision

Manatt, Phelps & Phillips, LLP 1700 M Street NW, 4th Floor, Washington, D.C. 20036 Tel: (202) 585-6500 Fax: (202) 585-6600
October 19, 2026
support guidance, excludes from the device definition software functions that meet the clinical
decision support criteria. Specifically, the Company asks that FDA: (1) state expressly that GenAI
software functions meeting the section 520(o)(1)(E) criteria are not devices, and (2) confirm that
those functions are not subject to the risk-based regulatory approaches described in the Discussion
Paper.

II. Directiveness as a Continuum (Discussion Questions 1, 2 & 3)
The Company supports CDRH’s recognition that the distinction between non-directive
information and action-directing outputs is a continuum of risk. This approach appropriately
reflects how users interpret information in practice. The Company also writes in support of the
value of disclaimers such as “talk to your doctor” or “I am not a medical professional,” which are
one safeguard in a layered set (including scope limits, contraindication screening, and escalation
to a clinician), as research has shown that people are more likely to say they would contact a
physician or health professional before acting on the advice when they have heard a disclaimer
message. 1 Elsewhere in the Discussion Paper, the FDA correctly identifies the value of “avoiding
medical parentalism that may underestimate patient capability,” and the Company believes this
principle applies equally to mitigating risk in action-directing functions. Additionally, as such
statements are a common design mitigation strategy, sponsors would benefit from FDA’s
confirmation that they carry significant weight in CDRH’s assessment of risk and the associated
determination of the appropriate regulatory pathway. The framework would also benefit from
guidance on where specific output types fall on the continuum. The Company expects FDA to not
regulate responses that merely recite public information in response to a query, for example when
asked about a drug or device name or labeling information. The Company urges FDA to clarify
that it will exercise enforcement discretion for GenAI-enabled functions of this type that provide
informational, non-directive outputs.
This proposal aligns with FDA’s classification of similar low-risk digital health functions,
where the FDA identified certain types of software functions that would not be subject to
regulatory requirements because they pose a lower risk to the public. For example, FDA states that
it will exercise enforcement discretion for “software functions that . . . provide a list of possible
medical conditions and advice on when to consult a health care professional,” 2 and even functions
allowing someone to send an alert or emergency notification to first responders. 3 Assuming that
the outcome (or consequence to the user) remains the same and this can be effectively
demonstrated, the fact that GenAI produces the output instead of a decision tree does not increase
risk to a user, and therefore, FDA’s classification should remain the same. Risk is not about the
computational method used to generate an output, but rather whether the medical device poses a
risk to the patient’s safety when not functioning as intended. FDA’s existing framework for device
Bickmore TW, Ólafsson S, O'Leary TK. Mitigating patient and consumer safety risks when using conversational
assistants for medical information: exploratory mixed methods experiment. J Med Internet Res.
2021;23(11):e30704. doi:10.2196/30704.
See FDA, Policy for Device Software Functions and Mobile Medical Applications: Guidance for Industry and
Food and Drug Administration Staff (Sept. 28, 2022) at 24, available at
https://www.fda.gov/media/80958/download.
See FDA, Policy for Device Software Functions and Mobile Medical Applications: Guidance for Industry and
Food and Drug Administration Staff (Sept. 28, 2022) at 25, available at
https://www.fda.gov/media/80958/download.
October 19, 2026
software functions and mobile medical apps focuses on what a function does — the clinical action
it informs or directs — not on how it arrives at that output. For instance, a symptom checker that
returns “consider consulting a physician about sleep apnea” carries the same risk to the user
whether the result was produced by a rules-based decision tree or a GenAI model. The user cannot
tell the difference, and the consequence of an incorrect result is identical in both cases: the user
receives a non-directive informational suggestion, and no treatment is directed either way.
Therefore, non-directive informational guidance that does not diagnose should not be subject to
the same degree of oversight as guidance that diagnoses and could result in a harmful consequence
to the user if wrong (e.g., not going to the hospital for a life-threatening illness). The burden should
be on demonstrating the low risk consequence to the public.
Separately, because the continuum focuses on directiveness, it should account for human
factors validation of how users actually interpret the directiveness of a given output, as users’ realworld interpretation may diverge from CDRH’s ex ante assessment. One such factor to consider
is the user's expectations and understanding of whether the output's advice is that of a licensed
healthcare professional — which could be determined by the inclusion of clear and transparent inproduct disclaimers informing users about what the GenAI can and cannot do.
The Company further recommends that CDRH recognize downstream safeguards,
reversibility, and output traceability as risk-mitigating factors. Common measures, such as limiting
what downstream actions an output can trigger, designing outputs that are readily reversible, and
preserving traceability so a reviewer can see what sources or tools informed an output, should
carry mitigating weight. This is especially important for agentic products where the clinical
consequence results from a sequence of linked outputs rather than a single output alone. As one
example of such a safeguard, the Company recommends that FDA recognize that review by a
qualified professional of the basis for an AI-generated output before it becomes consequential
reduces risk under FDA’s two-axis framework.

III. Patient-Facing Delivery and Available Safeguards (Discussion Question 3)
The Company supports recognizing the benefits of patient access to clinical information, and
in that vein believes patient-facing delivery should not by default shift a device upward on the
consequences axis. Instead, risk should be considered mitigated where safeguards are built into a
particular device, including contraindication screening and limits on the scope of output for
patient-facing devices. A categorical upward shift on the consequences axis for patient-facing
delivery would not distinguish between products designed with substantial safeguards for
untrained users and products designed without them. Such an approach would effectively penalize
sponsors that invest in safety-by-design measures and would discourage patient-facing innovation
in contexts where patients stand to benefit most. In other words, the Company believes the
appropriate inquiry in assessing risk is whether the safeguards present in a particular device
adequately address the risks of patient-facing use — not whether the device is patient-facing at all.
This approach accords with FDA’s authorization of certain non-professional device categories
with mandated controls and labeling, such as OTC hearing aids. 4 It is also consistent with FDA’s
21 CFR 800.30.
October 19, 2026
current treatment of OTC medical devices, with the agency noting that OTC devices range from
class I to class III. 5
User education about AI limitations represents an important safeguard category that merits
explicit recognition. A device that clearly communicates the imperfections inherent in AIgenerated outputs, such as hallucination potential, educates users about the need to exercise
independent judgment, and directs users to seek professional medical advice for consequential
decisions appropriately sets user expectations and reduces the likelihood that users will place
unwarranted reliance on device outputs. This category of mitigation—expectation-setting through
transparent communication about system limitations—is both effective and scalable.

IV. Measurement and Signal Processing Functions (Discussion Question 1)
The Company agrees that a user's inability to independently evaluate the basis for an output is
a legitimate risk consideration, and that measurement and signal processing functions warrant
specific attention on this ground. However, the inability to independently evaluate the basis for an
output does not, by itself, establish that the output is higher risk. Risk should be assessed against
the mitigations available to address the specific limitation of unverifiability—not applied as a fixed
upward shift— consistent with with the role controls play providing reasonable assurance of safety
and effectiveness for certain devices. A measurement function that cites clinical sources,
incorporates calibration against an established reference method, suppresses output when
operating conditions fall outside the validated range, or directs confirmation of unexpected results
by an independent method or by a clinician directly, presents a materially different risk profile
than one that carries none of these mitigations.

V. Reference Standards and Adjudication Quality (Discussion Questions 14 & 16)
The Company supports CDRH's proposal to utilize reference standards and the recognition that
expert clinical adjudication may be established through multi-clinician consensus with
documented adjudicator independence and adjudicator qualification criteria. However, a reference
standard that is derived from expert judgment carries a well-known difficulty: the quality of the
reference itself must be established before device performance can be measured against it.
In the Company’s experience, defining what a correct output looks like requires structured
labeling protocols, agreement thresholds, and a documented disagreement-resolution rule fixed in
advance. Questions about the independence and consistency of an adjudication panel are
considerably more expensive to answer after the fact than before. Pre-specification of these
parameters is essential to ensure that evaluation results are credible and reproducible.
The Company supports a tiered approach to reference standards: objective ground truth (for
example, a laboratory or pathology result) where it exists, then reference standards informed by
published clinical practice guidelines, then prespecified expert panel consensus. Historical controls
See, FDA Over-the-Counter (OTC) Medical Devices: Considerations for Device Manufacturers, available at
https://www.fda.gov/medical-devices/products-and-medical-procedures/over-counter-otc-medical-devicesconsiderations-device-manufacturers.
October 19, 2026
may serve as useful comparators where the intended use, patient population, and reference standard
are comparable and the comparison is prespecified.

VI. Use of Real-World and Synthetic Data (Discussion Questions 12 & 13)
The Discussion Paper recognizes that evaluation approaches may incorporate real-world data
and data collected outside the United States, and seeks input on considerations for the use of such
data.
Benchmarking and model evaluation should permit de-identified real patient data. Synthetic
data helps where real data is scarce, as with rare diseases, but it does not reflect the ambiguity and
edge cases of real clinical care, so strong synthetic scores may not hold up with real patients. Deidentified data prepared to HIPAA standards, such as Expert Determination under 45 C.F.R. §
164.514(b), keeps that clinical complexity while protecting privacy, and the use of privacyenhancing technologies (PETs) can reduce identifiability further. Where synthetic data is used,
transportability frameworks can adjust for how it differs from the real patient population. The data
type that should be utilized depends on the context and the sponsor is best positioned to make this
determination.
Because these systems are deployed and used worldwide, the Company strongly encourages
the agency to recognize the value of real-world data (RWD) collected outside the United States.
Data from global sources does more than supplement domestic datasets. In many cases it is
necessary to reach adequate sample sizes for rare conditions, and to capture the genetic,
demographic, environmental, and clinical diversity needed to make sure these technologies are
safe and effective for everyone who relies on them.
Limiting evidence to U.S.-sourced data would also understate the diversity of the U.S.
population itself. Many patients in the United States were born or raised elsewhere, and their
ancestry, prior exposures, disease presentation, and care needs may be better reflected in
international data than in domestic data alone. Including high-quality ex-U.S. RWD would
therefore strengthen the evidence base for U.S. patients while advancing health outcomes globally.
The Company urges FDA to make clear that such data is acceptable when it meets appropriate
standards for relevance and reliability.
A risk-based approach to data use—one that evaluates the quality, relevance, and protections
associated with the data rather than categorically excluding data by geography—would best serve
the goals of safety and innovation.

VII. Competency-Based Evaluation (Discussion Questions 9 & 10)
The Company supports a competency-based approach to evaluation and agrees that the
ability to perform a defined task reliably across varied conditions is the right question to ask of a
generative system.
Competency is not currently defined at the metric level in the Discussion Paper. Left entirely
to individual sponsors, the resulting evidence would not be comparable across submissions—
which limits its usefulness to CDRH as much as to industry. The Company encourages the FDA
to work with industry to develop benchmarks. Standardized benchmark development, in which
industry develops candidate benchmarks that are then evaluated and adopted by CDRH, offers a
October 19, 2026
path toward consistent and comparable evaluation. Industry is actively developing healthfocused benchmarks, and such efforts could be leveraged to establish industry-wide evaluation
standards.
The Discussion Paper's analogy to professional licensing also highlights a genuine regulatory
gap. State medical boards license individuals; they do not license software. No existing state
licensing framework contemplates the evaluation of AI systems performing clinical tasks, which
means there is no established regulatory home for competency-based evaluation of AI-enabled
devices outside the federal framework. CDRH is well positioned to fill this gap and should do so
in a manner that promotes consistency and avoids fragmented state-by-state approaches.

VIII. Change Control and Predetermined Change Control Plans (Discussion
Questions 22 & 23)
The Company supports the use of a Predetermined Change Control Plan ("PCCP") as a
mechanism for managing modifications to FDA-regulated AI-enabled devices that can be
verified and validated and agrees that a modified device should be evaluated against the
capabilities established at premarket review. The PCCP framework is an important tool for
enabling responsible iteration of AI-enabled devices, and its effective implementation is critical
to both regulatory certainty and continued innovation.
Because GenAI outputs can vary across runs for identical inputs, the Company recommends
that the performance evaluation methods in a PCCP modification protocol for a GenAI-enabled
device specify expected behavior as statistical acceptance criteria on a fixed evaluation set across
repeated runs, rather than as exact expected outputs, and that re-benchmarking be scaled to the
capabilities a change affects, plus a fixed regression set, consistent with the least burdensome
provisions. The Company also recommends that FDA include that changes to prompts, retrieval
strategies, guardrails, and orchestration logic may be included in a PCCP, and that the premarket
benchmark baseline may be refreshed under a PCCP when benchmarks become contaminated or
saturated (Discussion Question 10), with comparability to the original baseline shown through a
bridging analysis. Finally, the Company recommends that FDA include that reverting a
modification implemented under a PCCP to the most recently authorized configuration, for
example after postmarket monitoring detects degradation, does not require a new marketing
submission or the reporting of a malfunction.

IX. Third-Party Foundation Models and Allocation of Responsibility
The Company appreciates CDRH's attention to devices built on third-party foundation models
and regards this as a significant question in the Discussion Paper. Where a foundation model is
updated by its developer rather than by the device sponsor, the change is initiated outside the
sponsor's quality system and may occur without notice. The Discussion Paper also raises
monitoring of the underlying foundation model rather than the sponsor's model alone. Both
questions implicate the fundamental issue of how regulatory responsibility is allocated across
model developers, device integrators, and deployers—and a single entity may occupy more than
one of those roles for the same product. The Company recommends that FDA treat foundation
models as off-the-shelf software under its guidance Off-The-Shelf Software Use in Medical
Devices.
October 19, 2026
X. Postmarket Monitoring and Place of Premarket Evidence
The Company supports accepting greater premarket uncertainty where postmarket monitoring
is robust, consistent with the least burdensome provisions of the FD&C Act.
The Company recommends that sponsors be able to select the postmarket monitoring approach,
such as periodic re-benchmarking, sample-based clinician review, or performance degradation
monitoring, that is proportionate to the device’s risk and justified in its monitoring plan, rather
than a single required method.
The Company’s view is that an individual incorrect output that falls within the device’s
specified performance is not, by itself, a malfunction under 21 CFR 803.3, and that reportability
should be assessed against the device's performance specifications and the reporting criteria in 21
CFR 803.
The Company encourages CDRH to clarify, within its real-world evidence framework for
devices, when postmarket real-world evidence may reduce the premarket evidence needed for
GenAI-enabled devices.

XI. Agentic AI Considerations (Discussion Question 26)
As CDRH noted, agentic AI is increasingly deployed in healthcare contexts and devices. In
light of the elevated risk associated with autonomous multi-step actions and reduced opportunity
for human oversight, the Company offers the following suggestions. As a threshold matter, the
Company recommends that FDA define “agentic” by functional characteristics, such as
autonomously executing external actions without per-action human confirmation, rather than by
how a product is described or marketed.
First, premarket evaluation of these systems should account for the fact that device behavior
depends not only on model outputs but on the interaction between the model and external tools,
APIs, and clinical systems. Trajectory validation—assessing the sequence of actions the system
takes across multiple serial decision points—is more informative than static output accuracy for
systems that execute multi-step workflows.
Second, for high-risk clinical actions, safeguards requiring user or clinician confirmation
before execution can mitigate the risk of autonomous execution errors. For example, an agentic
system managing a medication refill could independently gather relevant lab results, check for
drug interactions, and prepare the updated prescription, but would pause for clinician sign-off
before transmitting it to the pharmacy. A layered confirmation approach, in which the level of
required confirmation scales with the clinical consequence of the action, would align with the riskbased framework described in the Discussion Paper.
***
The Company sincerely appreciates CDRH's thoughtful and proactive approach to the
regulation of GenAI-enabled medical devices. The decision to seek stakeholder input at the
discussion paper stage—before positions have hardened—reflects a regulatory process that is wellsuited to a rapidly evolving technology.
October 19, 2026
Yours sincerely,

Ross Margulies
Partner