Medical Device Manufacturers Association (Mark Leahey)

Attached please find comments on behalf of the Medical Device Manufacturers Association (MDMA).

1333 H Street, NW
Suite 400W
Washington, DC 20005
Phone (202) 354-7171
Fax (202) 354-7176
www.medicaldevices.org

October 19th, 2026

Via Electronic Submission

Dockets Management Staff (HFA-305)
Food and Drug Administration
5630 Fishers Lane, Rm. 1061
Rockville, MD 20852

RE: Docket No. FDA-2026-N-7874, Considerations for the Regulation of Generative AIEnabled Medical Devices; Discussion Paper and Request for Feedback

To Whom It May Concern:

On behalf of the Medical Device Manufacturers Association (MDMA), please find below
comments on the Discussion Paper, Considerations for the Regulation of Generative AI-Enabled
Medical Devices: Discussion Paper and Request for Feedback (the “Discussion Paper”).1

MDMA is a national trade association that provides educational and advocacy assistance to
hundreds of innovative companies in the field of medical technology. Our members, the majority
of which are small to mid-sized medical device companies, have a strong record of delivering
breakthrough therapies to treat chronic diseases and life-threatening conditions while lowering the
cost of care. MDMA’s mission is to ensure that patients have timely access to the latest
advancements of safe and effective medical technologies that improve health outcomes. We
appreciate the opportunity to provide these comments, and we look forward to ongoing
collaboration with the U.S. Food and Drug Administration (FDA) to address this important topic.

MDMA is grateful for the Center for Devices and Radiological Health’s (CDRH’s) and Digital
Health Center of Excellence’s willingness to engage stakeholders on this important topic. As the
Agency develops the framework for Generative AI (GenAI)-enabled device regulation, MDMA
wishes to remind the Agency of several foundational principles that should inform its approach.

As described further below, FDA’s existing authorities, and the foundational principles that
underlie the FDA regulatory framework, are appropriate tools and provide a roadmap for the
Agency’s regulation of GenAI-enabled devices and functions. MDMA believes that any approach
to GenAI regulation should align with these foundational principles.
FDA, Considerations for the Regulation of Generative AI-Enabled Medical Devices: Discussion Paper and
Request for Feedback (Aug. 18, 2026), https://www.fda.gov/media/194242/download [hereinafter the “Discussion
Paper”].
Foundational Principles of Device Regulation Should Drive FDA’s Approach to GenAIEnabled Device Regulation

FDA’s device authorities are rooted in a product’s intended use in the context of the product’s
technology.2 A product or function generally only becomes subject to the Agency’s device
authorities if it has a “device” intended use. Moreover, Congress amended FDCA Section 520 to
expressly exempt from the definition of a “device” certain software functions, including clinical
decision support software.3 For a multiple function product, FDA retains authority over the
product’s device functions but does not regulate the non-device software functions.4

For products or functions subject to FDA’s device authorities, FDA premarket review involves the
Agency’s assessment of whether the product or function is safe and effective for its intended use5
or, in the case of 510(k) premarket notifications, whether the product is substantially equivalent to
a legally marketed predicate device, which includes a determination that the product or function is
as safe and effective as its predicate.6

These foundational principles determine whether products or functions are subject to FDA
oversight. Functions, including those that employ GenAI, that do not meet the statutory definition
of a device, such as because they are not intended to diagnose, treat, cure, mitigate, or prevent
disease or other conditions, remain outside FDA’s device jurisdiction, consistent with FDCA
Section 520(o)(2).
The scope of FDA’s device authorities hinges on a product’s intended use. The FDCA defines a “device,”
in relevant part, as “an instrument, apparatus, implement, machine, contrivance, implant, in vitro reagent, or other
similar or related article, including any component, part, or accessory which is . . . intended for use in the diagnosis
of disease or other conditions, or in the cure, mitigation, treatment or prevention of disease, in man or other animals,
or . . . intended to affect the structure or any function of the body of man or other animals.” 21 U.S.C. § 321(h).
See id. § 321(h) (“The term ‘device’ does not include software functions excluded pursuant to [21 U.S.C.]
section 360j(o)”). In turn, FDCA Section 520(o) generally excludes from the definition of a “device” any “software
function that is intended” (A) “for administrative support of a health care facility . . .”; (B) “for maintaining or
encouraging a healthy lifestyle and is unrelated to the diagnosis, cure, mitigation, prevention, or treatment of a disease
or condition”; (C) “to serve as electronic patient records” under qualifying conditions; (D) “for transferring, storing,
converting formats, or displaying clinical laboratory test or other device data and results, findings by a health care
professional with respect to such data and results, general information about such findings, and general background
information about such laboratory test or other device, unless such function is intended to interpret or analyze clinical
laboratory test or other device data, results, and findings.” 21 U.S.C. § 360j(o)(1)(A)-(D). FDCA Section 502(o) also
excludes from the device definition software functions intended for “displaying, analyzing, or printing medical
information about a patient or other medical information,” “supporting or providing recommendations to a health care
professional about prevention, diagnosis, or treatment of a disease or condition,” or “enabling such health care
professional to independently review the basis for such recommendations that such software presents so that it is not
the intent that such health care professional rely primarily on any of such recommendations to make a clinical
diagnosis or treatment decision regarding an individual patient” except, in each case, if the function is intended to
acquire, process, or analyze a medical image or a signal from an in vitro diagnostic device or a pattern or signal from
a signal acquisition system.” Id. § 360j(o)(1)(E).
See id. § 360j(o)(2).
See id. §§ 360c(f)(2)(A), 360e(d)(2); 21 C.F.R. §§ 860.7(b)-(e), 860.260.
See 21 U.S.C. § 360c(i)(1)(A); 21 C.F.R. § 807.100(b).
FDA also acknowledges that “[s]ome software functions may meet the definition of a medical
device, but because they pose a lower risk to the public, FDA intends to exercise enforcement
discretion over these devices.”7 FDA also does not intend to exercise regulatory authority over
general-purpose computing or mobile platforms unless such functions are an extension of a
medical device by connecting the device for purposes of controlling it or analyzing medical device
data; use attachments, display screens, or sensors or by including functionalities similar to those
of currently regulated medical devices; or that perform patient-specific analysis and provide
patient-specific outputs or directives to healthcare professionals (HCPs) or patient-specific
diagnosis or treatment recommendations to patients or other non-HCPs.8

This framework provides the foundation for FDA’s regulation of device functions, including those
that employ GenAI. As the Agency acknowledges in the Discussion Paper, FDA “does not
regulate GenAI as such; it regulates medical devices.”9 General-purpose foundation models or
large language models that lack a device intended use do not meet the statutory definition of
medical devices and therefore should not be subject to device regulation. For those products or
functions that have a device intended use, FDA’s focus should remain on the device function and
the claims made for the finished product, rather than on a general-purpose model that may support
many non-device uses. This approach aligns with FDCA Section 520(o)(2), which preserves the
distinction between the device and non-device functions of a multiple function product by
excluding the latter from device regulation.10

FDA has also long distinguished between general and specific intended uses, and that distinction
remains applicable to GenAI-enabled devices. Many GenAI-enabled functions will have a general
‘tool’ intended use, while others will make claims regarding specific diseases, conditions, or
clinical tasks. For example, a diagnostic ultrasound system may be authorized to generate images
generally, whereas a claim that the system automatically measures left ventricular ejection fraction
requires evidence supporting that specific function. Consistent with FDA guidance concerning
general and specific intended uses,11 MDMA recommends that FDA distinguish general-purpose
tool claims from specific clinical use claims for GenAI-enabled devices and tailor evidentiary
expectations and risk controls to the specificity of the intended use. FDA should also not treat an
intended use as more specific solely because a product incorporates GenAI.

In short, FDA’s existing statutory authorities are well suited to GenAI-enabled devices. Targeted
administrative updates, such as revisions to existing guidance, may be appropriate to address
technology-specific considerations without upending the existing framework. Likewise, FDA’s
existing enforcement discretion policies for low-risk device functions should apply regardless of
whether a function incorporates GenAI.
FDA, Guidance for Industry and Food and Drug Administration Staff: Policy for Device Software Functions
and Mobile Medical Applications (Sep. 28, 2022), at 2, https://www.fda.gov/media/80958/download.
See id. at 11-13.
Discussion Paper at 5.
21 U.S.C. § 360j(o)(2).
FDA, Guidance for Industry: General/Specific Intended Use (Nov. 4, 1998),
https://www.fda.gov/media/71966/download.
FDA’s Approach to GenAI-Enabled Device Regulation Must Be Risk-Based and Consistent
with Least Burdensome Principles

GenAI-enabled device functions hold significant promise. To unlock this potential to improve
patient outcomes, expand access, and reduce the costs and burden of care delivery, FDA must
employ a predictable, risk-based approach to device classification and premarket review. To that
end, MDMA is grateful for FDA’s commitment to “a nimble regulatory approach that employs
least burdensome principles and allows patients timely access to safe and effective medical
devices.”12 A tailored, risk-based approach would not only promote our shared goal of patient
access to safe and effective GenAI-enabled devices but also allow the Agency to focus its limited
resources on those device functions that present the greatest potential risk.

FDA’s expectations for evidence generation in the context of premarket review are, and should
remain, a function of a device’s intended use and regulatory classification, determined on a devicespecific basis. For GenAI-enabled devices, FDA’s approach to regulatory classification and, if
applicable, premarket review should align with its longstanding approach to devices with general
‘tool’-based intended uses.

MDMA welcomes the Discussion Paper’s acknowledgment that clinical confirmation “might not
require a prospective clinical study in every case.”13 When clinical confirmation is appropriate, its
purpose should be to test whether benchmark performance predicts performance in actual use
under intended-use conditions. Clinical evidence should be treated as one potential source of
evidence within a single evaluation, rather than as a separate competency stage, and should be
required only when other available evidence is insufficient to support a reasonable assurance of
safety and effectiveness or a substantial equivalence determination meaning the device is as safe
and effective as the predicate device. From an assessment perspective, this is essentially criterionrelated validation.

FDA’s approach must also recognize the distinction among three related but separate concepts: (1)
risk-based device classification, (2) benefit-risk evaluation in the context of premarket review, and
(3) risk characterization. Risk-based device classification establishes a device classification
regulation based on FDA’s determination of the appropriate regulatory controls and, if the Agency
determines premarket review is needed to provide a reasonable assurance of the device’s safety
and effectiveness, the appropriate premarket review pathway.14 FDA’s benefit-risk evaluation
involves an assessment of whether the evidence in a particular premarket submission provides a
reasonable assurance of a device’s safety and effectiveness for its intended use or supports a
substantial equivalence determination.15 Risk characterization describes the potential risks
associated with a particular product that informs activities such as risk management. While each
Discussion Paper at 1.
Id. at 14.
See 21 U.S.C. § 360c(a).
See id. §§ 360c(a)(2), 360c(i)(1)(A), 360e(d)(2); 21 C.F.R. §§ 807.100(b), 860.7.
is relevant to the regulation of devices, they are distinct concepts that serve different regulatory
functions.

The Discussion Paper’s treatment of “action-directing” outputs illustrates why FDA’s approach to
risk assessment should focus on substance rather than form. The Discussion Paper contrasts an
output that endorses an action (“I recommend increasing the lisinopril dosage”) with one that gives
a “specific” instruction (“increase the lisinopril from 10 mg to 20 mg daily”).16 In both cases, the
relevant questions are whether the output is correct and whether the user can recognize when it is
not. An error in a “specific” instruction may in fact be easier to detect, because it states a value
that a clinician can check against the patient’s results or circumstances. MDMA therefore agrees
with the Discussion Paper that directiveness may depend on the substance and context of an output,
not solely on whether it uses words such as “recommend,” “should,” or “consider.”17 Grading risk
based on the form of language would reward hedging even where hedging is unwarranted. FDA’s
approach should instead reward accurate outputs and clear communication of uncertainty.

Similarly, the intended user’s clinical specialty may be a relevant contextual factor, but it should
not be a primary determinant of device risk or a proxy for user competence. The Discussion Paper
asks whether the distinction between generalist and specialist HCPs should inform the assessment
of risk.18 MDMA believes the more relevant factors are task complexity, the user’s ability to
appropriately interpret the output under intended-use conditions, the consequences of an erroneous
output, and the effectiveness of available safeguards.

For the same reasons, patient-facing functions should not be presumed to present higher risk solely
because the intended user is a patient. The Discussion Paper itself recognizes that “there may be
important benefits associated with the democratization of clinical information, with patient
empowerment and engagement, and with avoiding medical parentalism.”19 Patient-facing
functions may raise additional considerations, but those considerations should be evaluated in the
context of a function’s intended use, degree of personalization, opportunity for professional
review, communication characteristics, effectiveness of available safeguards, and the clinical
significance of decisions the output may influence. Rather than relying on categorical
assumptions, FDA should evaluate the intended use and available risk controls, such as clear
communication of limitations and uncertainty, traceable and evidence-based outputs, escalation
pathways to HCPs, and user-appropriate explanations tailored to patient literacy levels.

The two-axis framework20 may be useful as a descriptive tool for characterizing certain dimensions
of risk associated with GenAI-enabled functions. Risk characterization, including the factors
reflected in the two axes, can appropriately inform evidentiary expectations, risk management
activities, and lifecycle oversight. It should not, however, be used to determine device
classification, predicate eligibility, substantial-equivalence conclusions, or premarket pathways.
Discussion Paper at 7.
Id.
See id. at 8-9.
Id. at 8.
Id. at 5-6.
Risk characterization should be grounded in established medical device principles, including
relevant considerations reflected in the International Medical Device Regulators Forum’s
(IMDRF’s) Characterization Considerations for Medical Device Software and Software-Specific
Risk and the National Institute of Standards and Technology (NIST) Artificial Intelligence Risk
Management Framework, together with factors related to the device’s intended use and
deployment context.21

Although the proposed two-axis framework may provide a useful way to visualize certain riskrelated characteristics of a GenAI-enabled device, consequences of relying on an incorrect device
output and level of autonomy of device activity alone do not capture the full range of factors that
contribute to medical device risk. A meaningful assessment of risk also depends on other factors
including the probability of harm, the effectiveness of downstream safeguards, and the extent to
which users rely on the output, among other considerations. Without a clearer explanation of how
placement within the framework would be used in practice, it is not clear what conclusions should
be drawn from a device function falling in a particular area of the two-axis plot or what value the
framework provides beyond the holistic risk assessment manufacturers already perform as part of
established risk management processes.

Accordingly, MDMA recommends that FDA take the following steps. First, FDA should confirm
that device classification for GenAI-enabled devices will be determined using the same principles
that apply to other devices, including devices with ‘tool’ claims, and address how appropriate
predicates may be identified more broadly, consistent with longstanding practice. FDA guidance
recognizes that “not every change in indications for use that may affect safety or effectiveness will
result in a finding of a new intended use.”22 Consistent with that guidance, FDA should avoid
narrowly interpreting when a new indication for use constitutes a new intended use. Second, FDA
should confirm that benefit-risk determinations for GenAI-enabled devices will be made consistent
with the existing statutory framework and historical practice. Third, FDA should clearly identify
how risk characterization will inform lifecycle management activities, such as risk management.

A Risk-Based Performance Evaluation Framework Is More Appropriate Than a
Competency-Based Approach

The Discussion Paper describes a potential competency-based approach “inspired . . . by how
human clinicians are evaluated and credentialed.”23 This approach shares certain features with
physician credentialing, in that both seek to establish the ability to perform defined tasks within
specified boundaries. FDA's statutory authority, however, extends to medical device regulation,
while physician licensure, credentialing, and privileging are governed by separate legal and
See IMDRF, Characterization Considerations for Medical Device Software and Software-Specific Risk (Jan.
29, 2025), https://www.imdrf.org/documents/characterization-considerations-medical-device-software-and-softwarespecific-risk; NIST, AI Risk Management Framework (Jan. 2023), https://www.nist.gov/itl/ai-risk-managementframework.
FDA, Guidance for Industry and Food and Drug Administration Staff: The 510(k) Program: Evaluating
Substantial Equivalence in Premarket Notifications [510(k)] (Jul. 28, 2014), at 17,
https://www.fda.gov/media/82395/download.
Discussion Paper at 10.
professional oversight frameworks. Importing a credentialing model into device review risks
conflating these distinct concepts, exceeding FDA’s statutory authorities, and frustrating our
shared goal of facilitating the availability of safe and effective medical devices. Any evaluation
framework for GenAI-enabled devices should therefore remain focused on demonstrating device
performance, safety, and effectiveness for the device’s intended use, rather than replicating
approaches developed to assess HCPs.

MDMA does not believe that there is a scientific basis for applying a credentialing model to
GenAI-enabled device regulation. We are not aware of scientific evidence demonstrating that
performance on a test or benchmark can be validly extrapolated to broad medical competence or
to a showing of safety and effectiveness for a specific intended use. While FDA could consider
appropriate assessment methods drawn from competency-based evaluation, it should not adopt the
underlying measurement model, which infers latent, generalizable human capabilities from
sampled behaviors. That inference model does not hold for GenAI-enabled devices, whose
performance is highly dependent on inputs, prompts, system configuration, external tools, model
version, and stochastic variation.

FDA therefore does not need to establish that a GenAI-enabled device ‘possesses’ a competency.
The relevant question for FDA’s evaluation is whether the GenAI-enabled device or function is
safe and effective for its intended use. To that end, FDA should characterize performance,
uncertainty, clinically relevant sources of variation, and clinically significant unacceptable outputs
or actions under intended-use conditions as part of its evaluation. For GenAI-enabled devices with
agentic functions, FDA should apply a technology-neutral, risk-based approach. Evaluation may
appropriately address tool-use governance, external dependencies, prompt-injection resilience,
traceability and auditability, monitoring of autonomous behavior, and the ability to constrain or
override unsafe actions, with human oversight and intervention controls proportionate to the
consequences of the function. Benchmark, laboratory, simulated, synthetic, clinical, and
postmarket evidence may each contribute to that evaluation, as appropriate, but should not operate
as sequential competency gates.

MDMA recognizes that the competency-based approach is intended to bring structure to GenAIenabled device evaluation and agrees that these devices “may introduce unique risks” and that a
total product lifecycle (TPLC) approach is likely to be important to their regulation.24 However,
those objectives can best be accomplished by applying FDA’s established standards through riskbased performance evaluation, which can consider the potential for GenAI to pose new risks, rather
than via a new inference model that is ill-suited to these devices.

Benchmarks present a related challenge. As the Discussion Paper recognizes, publicly available
benchmarking assets may be subject to data contamination, saturation, and limited real-world
representativeness.25 MDMA shares that concern. Reported scores for current models
increasingly cluster near the top of many widely used medical benchmarks. A threshold that most
models clear cannot distinguish a device that performs acceptably for its intended use from one
Id. at 1.
See id. at 18.
that does not. For these reasons, device evaluation should rest on performance measured under
the conditions of the device's intended use.

GenAI-Enabled Device Regulation Does Not Require Third-Party Evaluation

MDMA does not support a regulatory model that relies on third-party evaluators to conduct
independent evaluation of GenAI-enabled medical devices. FDA’s regulatory framework is robust
and already promotes the safe and effective use of a range of technologies, including AI-enabled
devices, across the product lifecycle from premarket review to postmarket surveillance and
inspections. AI-enabled devices that have received marketing authorization have done so based on
valid scientific evidence reviewed by FDA under the applicable statutory standard, which is
intended to ensure the safety and effectiveness of medical devices. Once authorized, medical
device manufacturers remain subject to ongoing postmarket requirements, including quality
management system requirements, adverse event reporting, and, potentially, postmarket
surveillance study requirements. Manufacturers also routinely monitor user feedback and refine
their models as new clinical data and real-world evidence become available.

Mandatory third-party evaluation would risk fragmenting oversight of medical devices. Layering
additional or parallel evaluation requirements onto FDA review would be duplicative and
inefficient, would increase compliance burdens for manufacturers and resource demands on FDA,
and would introduce the risk of inconsistent standards and delayed patient access, without any
corresponding improvement in safety. Any third-party evaluation should be voluntary and operate
within FDA's existing mechanisms, such as the Accreditation Scheme for Conformity Assessment
(ASCA) Program, the development of consensus standards, and the voluntary use of testing
laboratories, each of which preserves FDA's central oversight role. Voluntary third-party
participation should not become an express or implied condition of submission acceptance, review
or marketing authorization, and should not introduce an additional prescribed layer of validation
of a manufacturer’s underlying data, models or evaluation methods beyond what is needed to
demonstrate the finished device’s safety and effectiveness for its intended use.

Devices Authorized by FDA Do Not Require a Novel Postmarket Monitoring Framework

The Discussion Paper states that FDA is “considering whether it is appropriate to accept greater
premarket uncertainty regarding a GenAI-enabled device’s benefit-risk profile through greater
reliance on postmarket monitoring.”26 Importantly, medical devices are only authorized if the
applicable standard has been met: a reasonable assurance of safety or effectiveness or, in the case
of 510(k) premarket notifications, they are found to be substantially equivalent, meaning as safe
and effective as a legally marketed predicate device.27 Therefore, an FDA-authorized GenAIenabled device or function has been shown to satisfy this standard for its intended use. The fact
that a device or function incorporates GenAI should not call into question FDA’s determination
and does not warrant an additional, novel layer of postmarket oversight.
Id. at 19.
See 21 U.S.C. §§ 360c(f)(2), 360c(i)(1)(A), 360e(d)(2).
MDMA recognizes that, as with other medical devices, there may be circumstances in which
specific residual uncertainties can be appropriately addressed through targeted, risk-proportionate
postmarket controls. In such cases, FDA and the manufacturer may determine during premarket
review that the balance of premarket evidence and postmarket oversight can be appropriately
tailored based on the device’s intended use, risk profile, and remaining uncertainties. FDA’s
existing postmarket tools, including general postmarket controls, special controls, postmarket
study requirements, and reporting requirements, remain appropriate and adequate for GenAIenabled devices. Further, the Predetermined Change Control Plan (PCCP) framework already
provides a well-suited means for managing and monitoring planned modifications.28

Within that framework, we recommend that FDA allow manufacturers of GenAI-enabled devices
to prospectively define anticipated categories of change, associated validation activities,
performance thresholds, monitoring strategies and rollback procedures, recognizing that not
every future modification can be specified at authorization. Evidence for modifications outside a
PCCP should be scaled to the nature and expected impact of the change, with lower-risk changes
managed through established quality-system processes.

FDA should employ these established tools and mechanisms rather than developing a novel
postmarket framework that hinges solely on whether a device employs GenAI.

Manufacturers already monitor the performance of their devices under their quality management
systems, and these obligations apply equally to devices that incorporate GenAI. These activities
are determined by the manufacturer based on the specific device or function, its intended use, and
its risk profile. The Discussion Paper also notes that devices may be built on third-party foundation
models.29 MDMA notes that manufacturers also maintain supplier controls under their quality
management systems, engage in finished device verification and validation, and, if appropriate,
may operate under a PCCP. For devices built on third-party foundation models, supplier controls
may include version control, advance notice of material changes, change documentation,
regression-testing support, incident communication, and rollback or containment capabilities.
FDA expectations should reflect the information manufacturers can reasonably obtain from model
suppliers, while the manufacturer remains responsible for the safety and effectiveness of the
finished device.

The Discussion Paper also refers to a “shared ecosystem responsibility” and the potential for
clinicians, patients, healthcare institutions, payers, professional societies, public-private consortia,
standards-setting bodies, and other federal and state authorities to “play” “roles” in “monitoring,
reporting, and ongoing evaluation of GenAI-enabled devices.”30 While MDMA agrees that many
stakeholders contribute to the safe and effective use of medical devices, including GenAI-enabled
devices, this does not support unstructured data-sharing requirements. Any requests for
information from manufacturers should be grounded in FDA’s statutory authorities, limited to
information necessary to assess a device’s safety and effectiveness, and subject to statutory and
21 U.S.C. § 360e-4. See also Discussion Paper at 20 (PCCP is a “mechanism to facilitate certain device
changes without requiring a new premarket submission”).
See id. at 24.
Id. at 20.
regulatory protections, including protections for patient confidentiality, trade secrets and
confidential commercial information. Reporting should be incident based, and periodic general
reporting is unnecessary unless required by a special control.

MDMA shares the Agency’s goal of a regulatory approach to GenAI-enabled devices that supports
innovation and ensures access to safe and effective medical devices. These devices hold
significant promise for patients, clinicians, and the broader healthcare system. FDA possesses the
appropriate tools to regulate these devices under its existing authorities and guided by its
foundational principles.

* * * * *

We appreciate the opportunity to comment on this important topic. If we can provide additional
information, please contact me at mleahey@medicaldevices.org or (202) 354-7171.

Sincerely,

Mark Leahey
President & CEO
Medical Device Manufacturers Association