Kaiser Permanente (Erin E. Richardson)

Kaiser Permanente appreciates the FDA’s consideration of the attached comments in response to its discussion paper on generative AI-enabled medical devices.

October 19, 2026

The Honorable Kyle Diamantas
Acting Commissioner
U.S. Food & Drug Administration
Center for Devices and Radiological Health
10903 New Hampshire Avenue
Silver Spring, MD 20993-002

Submitted electronically via www.regulations.gov

Re: Considerations for the Regulation of Generative AI-Enabled Medical Devices: Discussion
Paper and Request for Feedback (FDA-2026-N-7874)

Dear Acting Commissioner Diamantas:

Kaiser Permanente appreciates the opportunity to comment on the Food and Drug
Administration’s (FDA) discussion paper and request for information (RFI)1 soliciting public
comment to shape a regulatory framework for generative artificial intelligence (GenAI) enabled
medical devices (the “GenAI Medical Device RFI”). Kaiser Permanente2 is the largest private
integrated health care delivery system in the United States, with more than 12.9 million members
in nine states and the District of Columbia. Kaiser Permanente’s mission is to provide high-quality,
affordable health care services and to improve the health of our members and the communities we
serve.

Artificial intelligence (AI) has the potential to improve nearly every aspect of health care. Kaiser
Permanente uses AI to enhance care quality, reduce provider burden and improve patient
experiences. We are committed to using AI responsibly, and we adopt AI tools and solutions only
after we have thoroughly assessed them for excellence in quality, safety, reliability and equity.

GenAI-enabled medical devices, including those with agentic capabilities, may extend access to
clinical knowledge, improve care navigation and coordination, reduce avoidable administrative
burden and costs, and help address gaps in workforce capacity. However, these devices’ rapidly
evolving functions and capabilities present risks distinct from traditional software and other AIenabled medical devices. These risks include plausible but incorrect outputs (hallucinations),
overconfidence in situations where information is incomplete or uncertain, variability in outputs
across similar inputs, and error propagation when outputs are consumed by downstream systems
or workflows.

1 FDA, Considerations for the Regulation of Generative AI-Enabled Medical Devices: Discussion Paper and Request for Feedback

(FDA-2026-N-7874) (Aug. 18, 2026), available at https://www.regulations.gov/docket/FDA-2026-N-7874.
2 Kaiser Permanente’s longstanding integrated care and coverage model comprises Kaiser Foundation Health Plan, Inc., the nation’s

largest not-for-profit health plan, and its health plan subsidiaries outside California and Hawaii; the not-for-profit Kaiser Foundation
Hospitals, which operates 40 hospitals and over 600 other clinical facilities; and the Permanente Medical Groups, self-governed
physician group practices that exclusively contract with Kaiser Foundation Health Plan and its health plan subsidiaries to meet the
health needs of Kaiser Permanente’s members. In addition to the entities in our integrated care and coverage model, the Kaiser
Permanente enterprise includes: Risant Health and its subsidiaries, Geisinger Health and Cone Health; a new PACE Program
partnership, Habitat Health; and the Maui Health System.
Kaiser Permanente Comments
FDA GenAI Medical Device RFI

Realizing the benefits of GenAI-enabled medical devices will require carefully calibrated
regulatory approaches that provide assurances of safety and effectiveness while remaining
proportionate, practical and sufficiently flexible to support responsible innovation. We appreciate
FDA’s efforts to solicit meaningful feedback and provide thoughtful leadership to develop a
regulatory approach that aligns with advances in technology and digital health innovation.

As an integrated care and coverage organization, Kaiser Permanente encourages FDA to consider
how GenAI-enabled devices affect the longitudinal care journey, rather than evaluating
performance only within a single encounter or discrete task. Depending on the intended use,
clinically meaningful evaluation may include whether a device supports appropriate follow-up,
improves quality and equity, reduces unwarranted variation, affects care-team capacity, and
creates intended or unintended changes in utilization across settings

Our overarching comments are summarized below, followed by a detailed discussion in response
to the questions and topics addressed in the RFI:
 Overall, we support using a risk assessment framework to guide premarket review and
competency evaluation when a device is deployed within a health system or under clinician
oversight. We do not believe the same framework is appropriate for direct-to-consumer
tools, which present additional risks and considerations, may require more premarket
evidence, and are more difficult to oversee and monitor after deployment.
 We recommend that FDA clearly define manufacturer postmarket monitoring
responsibilities and accountability distinct from health care system and provider
implementation controls and governance.
 We agree that agentic AI functions warrant heighted scrutiny in health care and recommend
continued exploration of appropriate review and approval metrics.

TWO-AXIS RISK FRAMEWORK

The discussion paper proposes leveraging a two-axis risk framework to establish appropriate
review and oversight for GenAI-enabled devices. One axis scores how independently a device
function acts, ranging from providing non-directive information, to action-directing information,
to supervised action, to fully autonomous action. The other axis scores the severity of
consequences if the device produces an incorrect output, ranging from limited to severe harm. We
find the proposed two-axis framework to be a useful starting point but recommend that it be
supplemented with established risk assessment methods.

Deployment Context

We believe that the proposed two-axis risk framework is workable for devices deployed within a
health care system and/or overseen by a provider or care team but is not sufficient for devices
provided directly to patients. While the framework illustrates how the same AI tool can quickly
move across a spectrum of risk, it does not adequately account for the broader environment in
which the tool is deployed.

We recommend that FDA clearly distinguish between devices that are intended or marketed as
direct-to-consumer use versus those intended to be deployed within a health system. Health system
Kaiser Permanente Comments
FDA GenAI Medical Device RFI

or clinician oversight, including implementation of appropriate guardrails, controls and monitoring
can substantially reduce risk, which is not captured in the risk assessment framework. Further,
within a health system, clinicians work within layers of review, quality controls and operational
support that help mitigate risks and lessen the severity of adverse consequences, should they occur.
Patients using a tool independently may lack those checks and balances, producing a materially
different risk profile even before other factors are considered. For these reasons, direct-toconsumer deployment requires a different contextualization of potential risks along with additional
safeguards to protect against patient harm.

Include Additional Components When Assessing Severity of Consequences

We recommend that probability or frequency be included as a factor when assessing severity of
consequences to better capture population-level impacts. For example, antibiotic overprescribing
may appear relatively low risk in an individual case yet cause substantial harm at scale by
accelerating antimicrobial resistance or increasing the incidence of side effects. Similarly, a nondirective GenAI device that provides incorrect information could create significant aggregate harm
when widely deployed, such as under or overutilization of services or medications and increased
patient anxiety or confusion. We concur with treating the additional dimensions identified in the
discussion paper (reversibility of a resulting action, the availability of downstream safeguards, the
time pressure of the deployment setting, or the traceability of the output) as components of
consequence rather than as independent axes. Additionally, we encourage FDA to use risk analysis
methods that take into account uncertainty and incomplete information, particularly in more
autonomous settings, throughout the device lifecycle.

FDA should clearly define terms used to describe consequence such as “limited” and “severe” to
account for both individual and population level impacts. Further, we recommend that the
framework and any associated guidance or definitions align with the established functional criteria
used to determine non-AI medical device risk and classification to ensure consistency when
evaluating devices with both non-AI and AI-enabled functions.

Account For Application and Scope When Assessing Autonomy

We recommend that FDA explicitly account for the device function’s application and scope when
assessing autonomy, either in the framework or accompanying guidance. For example, a highly
autonomous function may still present limited risk if it is very narrowly constrained or limited to
a very specific function or purpose. Conversely, a less autonomous device may pose substantial
risk if its permissible inputs or actions are broad, because greater uncertainty about a device’s
possible inputs, outputs or actions should increase the assessed level of risk. General purpose tools,
for example, may be harder to assess because they could occupy and move rapidly among different
points on the risk assessment depending on use context, which may not be fully understood during
premarket review.

Population-Specific Risk

The framework should account for how risk varies across populations, including pregnant patients,
children, people with disabilities, and people with chronic health and mental health conditions.
Kaiser Permanente Comments
FDA GenAI Medical Device RFI

The likelihood and severity of harm may differ for these groups compared with the general
population.

Multi-Turn Conversational GenAI-Enabled Devices

Unlike deterministic or predictive tools built for one objective, GenAI systems can shift rapidly
across the autonomy spectrum, making it difficult to ascertain risk. The risk associated with the
function also depends on the clinical application. For example, recommending antibiotics after a
confirmed positive strep test differs materially from initiating thrombolytic orders for an acute
stroke due to differences in the severity and urgency of the medical condition, risk profile of the
medication and need for follow-up care. We recommend that the risk of these functions be assessed
for the highest level of independent action they can take as opposed to the intended or most
common or highest probable action. A tool should not be identified as informational if it can
initiate additional actions or activities. For example, a patient-facing chatbot should be considered
fully autonomous if it has the capability to execute actions autonomously during a patient
interaction, such as an interaction that begins with providing information and escalates to initiating
a prescription drug order without clinician review.

COMPETENCY-BASED APPROACH TO PREMARKET EVALUATION

The discussion paper proposes evaluating GenAI-enabled devices in a manner similar to physician
assessment, using standardized benchmarks and clinical confirmation.

We support assessing these tools through mechanisms that draw from established processes used
to evaluate clinician competency and ensure quality of care. This approach combines existing
methods from both clinician training and deterministic AI evaluation instead of creating an entirely
new system. We recommend keeping the approach as straightforward as possible to avoid overly
complex frameworks that may be impractical or ineffective. However, as we noted earlier in our
comments, we think this approach is workable within established health care oversight
infrastructure and governance processes that provide guardrails and monitoring to ensure patient
safety and care quality.

Competency-Based Assessment Should Supplement Conventional Medical Device Evaluation
Criteria

While clinician competency is a useful analogy, key differences exist between individual clinicians
and GenAI-enabled device functions that warrant further consideration. For example, a clinician’s
licensure generally authorizes broad independent practice; clinicians are not tested and validated
on every task they are authorized to perform. We do not believe that GenAI tools should receive
broad authority to act autonomously based on general competency but instead should be authorized
for discrete, bounded tasks or subtasks for which they have demonstrated safe, reliable and
accurate performance. It should also not be assumed that performance generalizes across clinical
domains, workflows, populations or even adjacent decision types. GenAI-enabled devices can
operate at substantially greater scale, reproduce the same error across many patients, change
through centralized updates, and depend on components that neither the user nor device sponsor
fully controls. For these reasons, competency-based assessment should supplement, rather than
Kaiser Permanente Comments
FDA GenAI Medical Device RFI

replace, conventional medical device evaluation criteria such as engineering assurance, system
quality, cybersecurity and device-validation requirements.

Alternative Framing to Competency-Based Assessment

Team-based practice models may serve as an alternative analogy to guide GenAI medical device
premarket evaluation. Team-based practice models enable multiple health professionals to work
together with patients to provide coordinated, high-quality care. The models typically rely on
defined protocols and require participants to act within a specified scope with clearly defined
escalation pathways. The models enable carefully bounded authority within a governed clinical
system, as opposed to broad independent authority, and may provide a better frame for AI-enabled
tools than clinician credentialing or licensure. We recommend that FDA consider authorizing
GenAI functions only for discrete, protocolized tasks within a defined scope, subject to clear
monitoring, guardrails and escalation requirements at this time, with the opportunity for continued
refinement as the technology advances.

Standardized Device Benchmarking

We agree that the rigor of required premarket evidence should correspond to the risks associated
with the GenAI function’s intended use and capabilities. We support inclusion of the four core
benchmarking categories (safety, clinical proficiency, generalizability and agentic AI capabilities)
and recommend that greater emphasis be placed on safety guardrails. For example, benchmarking
should assess how a GenAI system responds to uncertainty or insufficient information, which is
critical to recognize abnormal findings and determine appropriate next steps. We also recommend
requiring explicit documentation about the intended deployment context in the applicable
benchmarking categories such as the intended user, the intended level and timing of review and
oversight processes, how the tool is intended to be integrated into clinical workflows, detectability
and reversibility of errors, and escalation and post-deployment monitoring workflows.

Implementing this approach will require greater standardization and a more formal process for
determining each tool’s risk level, as public benchmarks are often poorly representative of realworld use. Thus, appropriate benchmarking should utilize sequestered test sets, prespecified
acceptance criteria, representative workflow and populations, repeated testing runs, confidence
intervals and estimated failure rates, and adversarial and out-of-distribution testing.

Clinical Confirmation

The discussion paper describes a range of methods for generating real-world performance evidence
and expressly recognizes that clinical confirmation may not require a prospective clinical study in
every case. The five approaches—retrospective evaluation on real patient inputs, shadow
deployment, standardized patient interactions, clinician adjudication of real cases and prospective
clinical study—increase in rigor, with the appropriate level determined by the device’s position on
the risk grid.

In the health system context, the clinician-inspired, competency-based approach is practical
because delivery systems already evaluate clinicians through established quality and credentialing
Kaiser Permanente Comments
FDA GenAI Medical Device RFI

functions. If similar functions were available to evaluate AI-enabled tools today, they would give
health systems greater confidence that a tool is fit for its intended use.

Vendors should retain flexibility to design testing methods appropriate for their device
functionality; however, health care providers and systems should be able to rely on a credible,
transparent and well-documented process. We recommend that FDA specify the controls that
vendors must implement and document when testing and demonstrating system performance,
distinct from controls applied by the health system or provider (if applicable). These methods
should demonstrate the tool’s suitability in the context of the clinical question. For example,
shadow deployment may characterize technical outputs and errors but cannot fully measure the
potential for automation bias, user comprehension, patient behavior, workflow disruption or the
real-world performance of the AI tool.

Tools intended to perform tasks traditionally done by a delivery system or care provider should
demonstrate competency equivalent to that of a high-quality delivery system as opposed to being
compared to a specific tool or component of care. This is critical because while digital tools can
help patients manage health conditions, fragmented programs can dilute accountability and data
across entities, which could lead to poorer outcomes overall.

EXPANDED POSTMARKET MONITORING EXPECTATIONS

The discussion paper indicates that greater reliance on postmarket monitoring may be appropriate
to ensure the ongoing safety of GenAI-enabled devices, in part because the variable nature of these
outputs limits the degree to which premarket evaluation alone can provide a comprehensive
assessment. The premarket competency-based assessment would become the baseline, and a
modified device would be re-benchmarked against the same capabilities.

We agree that postmarket monitoring is critical to ensure ongoing safety of GenAI functions.
Postmarket monitoring should address not only model drift, but also rare edge cases that were not
encountered during premarket testing and could produce adverse outcomes. For GenAI-enabled
devices, apparent performance degradation may reflect exposure to novel circumstances rather
than a change in the model itself.

Shared Ecosystem

FDA should define appropriate postmarket monitoring roles for clinicians, health care institutions,
professional societies, standards-setting bodies and other stakeholders without diffusing
manufacturer accountability. Manufacturers should be responsible for defining, documenting and
implementing their own postmarket monitoring processes with appropriate agreements and
controls in place to govern information sharing with health care providers and systems. We
recommend that FDA distinguish these responsibilities from health system implementation
controls and governance processes, which may be subject to other controls or standards distinct
from FDA medical device approval conditions. Manufacturer responsibilities should include:

 Product-wide safety and effectiveness  Foundation model dependency
 Device telemetry and performance- management
monitoring design  Workflow configuration
Kaiser Permanente Comments
FDA GenAI Medical Device RFI

 Appropriate clinical and operational use  Training and access controls
 Data definitions  Monitoring locally relevant outcomes
 Secure information exchange  Escalation of suspected safety signals
 Privacy-preserving data sharing  Suspending local use when necessary
 Change notification  Shared responsibilities requiring
 Aggregate signal detection across agreement
customers  Investigation processes
 Corrective action, patch, rollback and  Timelines for notification
recall capability  Audit access
 Communicating known limitations and  Funding required regulatory
safety signals surveillance
 Deploying health system  Regulatory reporting
responsibilities  Incident attribution
 Local implementation governance

Health systems and clinicians participate in postmarket surveillance today, often through research
studies funded by government agencies or manufacturers. A similar model could be used in which
manufacturers retain responsibility for monitoring. Manufacturers would establish and fund
agreements with deploying health care providers and systems to support data collection and
evaluation while preserving patient safety and privacy. We recommend that FDA expressly
preserve existing mechanisms for manufacturer-funded surveillance to ensure that health systems
are not required to absorb manufacturers’ regulatory responsibilities, resource burdens or liability
as part of health system implementation, governance or quality monitoring.

Risk-Based Reassessment and Mitigation

After licensure, clinicians undergo continued medical education to ensure that they are keeping
their skills and knowledge up to date. Reassessment of clinician competency is generally triggered
by indications that quality or safety of patient care may be at risk, such as declining quality metrics
or unwarranted clinical variation from current evidence-based guidelines. A comparable risk-based
model for reassessment may be appropriate for GenAI-enabled devices along with assessments at
specified intervals to ensure that the function is consistent with current clinical guidelines and
practices. If a health system or provider identifies a credible safety or quality concern, it should
retain authority to pause or constrain local use while notifying the manufacturer and, when
appropriate, the FDA. The manufacturer should work with the health system or provider to
evaluate whether the issue is specific to a local configuration or workflow or reflects a broader
device defect or configuration issue. The FDA should be notified if the defect or issue warrants
corrective action across deployments.

AGENTIC AI COMPETENCY

The discussion paper describes the distinct capabilities of agentic AI and recognizes that some
agentic functions may qualify as medical devices, including when an agent’s sequence of actions
controls another medical device.
Kaiser Permanente Comments
FDA GenAI Medical Device RFI

We agree that evaluation of agentic AI functions warrants heightened scrutiny to ensure patient
safety. It may be difficult to clearly define and limit permissible actions of agentic functions
because even seemingly narrow functions, such as medication refills, could easily expand into
higher-risk medication changes or substitutions with significant clinical consequences. Assessing
the risk of agentic functions should include an explicit evaluation of whether the agent remains
within its authorized scope and is effectively prevented from taking actions outside defined
boundaries. Clearly defined boundaries will be essential to ensuring that agentic systems meet
applicable standards and operate with appropriate safeguards.

We recommend that FDA continue to consider the parameters of agentic AI device function
approvals including how agentic AI may interact with other agentic and non-agentic systems. For
example, FDA should consider whether agentic AI device functions should rely on outputs from
other AI systems and under what circumstances direct communication between agentic systems is
appropriate. We also recommend that FDA consider whether approval should be conditioned on:
 The nature and extent of approved activities, or all capabilities;
 Permissible interactions with other agents and non-agentic AI functions;
 Instructions or directions the agent may or could issue; and
 Whether it may function as a coordinating or “master” agent.

A framework that permits manufacturers to obtain narrow indications while leaving deployers
broad discretion for expanded or off label uses could create substantial product liability and
litigation risk. FDA approvals should therefore be sufficiently comprehensive to reflect reasonably
foreseeable uses and interactions without becoming so narrow that they shift material risk to users
and deploying health systems.

* * *

Kaiser Permanente appreciates FDA’s consideration of our comments, and we welcome the
opportunity for continued collaboration. Please feel free to contact me at erin.e.richardson@kp.org
or Megan Lane at megan.a.lane@kp.org with questions or if we can provide additional
information.

Sincerely,

Erin E. Richardson Stephen Parodi, MD
Senior Vice President Executive Vice President
Policy and Regulatory Affairs External Affairs, Communications and Brand
The Permanente Federation