Hippocratic AI (Munjal Shah)

Hippocratic AI respectfully submits the attached comments on CDRH’s discussion paper, Considerations for the Regulation of Generative AI-Enabled Medical Devices (Docket No. FDA-2026-N-7874). Hippocratic AI develops generative AI agents that conduct real-time voice conversations with patients for non-diagnostic care tasks. Drawing on more than 775,000 clinician-conducted test calls and more than 300 million real-world patient interactions, our comments propose ten auditable minimum expectations for patient-facing GenAI devices, addressing discussion questions 1–26 across risk assessment, premarket evaluation, and postmarket monitoring. Please see the attached letter, submitted on behalf of Munjal Shah, Co-Founder and CEO.

Hippocratic AI
Menlo Park, California · hippocraticai.com · October 19, 2026

Dockets Management Staff (HFA-305), Food and Drug Administration, 5630 Fishers Lane, Rm. 1061, Rockville, MD 20852
Re: Docket No. FDA-2026-N-7874 — Considerations for the Regulation of Generative AI-Enabled Medical Devices:
Discussion Paper and Request for Feedback

Dear Colleagues at the Digital Health Center of Excellence:
Hippocratic AI builds generative AI agents that hold real-time, multi-turn voice conversations with patients for
non-diagnostic tasks such as post-discharge follow-up, medication adherence, chronic-condition check-ins and
pre-procedure preparation. We write from operating experience rather than theory. Our published validation study
covered 6,234 U.S.-licensed clinicians and more than 307,000 unique clinician-conducted conversations, with every
flagged error adjudicated through a tiered nurse-then-physician review and graded by potential harm. Our network
has since grown to more than 7,700 license-verified clinicians, with more than 775,000 cumulative test calls. Under
that process, our current release delivers correct advice in 99.89% of evaluated interactions, with no-harm errors at
0.11% and minor-harm and severe-harm errors both at 0.00%. By contrast, when human nurses handled the same
scenarios in place of the agent and were scored under the same rubric, they delivered correct advice in 81.16% of
interactions, with 14.72% no-harm and 4.12% minor-harm errors. Our agents have completed more than 300 million
real-world patient interactions across more than 60 healthcare organizations, where production performance has
matched pre-deployment testing. Our comments describe the practices that produced those results and ask CDRH to
make them the floor for every GenAI-enabled device that talks to a patient.
We support the discussion paper’s direction: a risk-based, total-product-life-cycle approach that evaluates the final
device as configured and deployed, competency-based benchmarking followed by clinical confirmation, and the
recognition that confirmation need not always be a prospective trial. Our central message is that the paper’s
competency elements (S.1–S.3, E.1–E.4, R.1–R.2) are only as reliable as the architecture that enforces them and the
evidence that measures them. A patient cannot tell a fluent wrong answer from a fluent right one, so the burden must
sit with the manufacturer to prove, at scale and in the deployed modality, that the device behaves safely. Below are
ten minimum expectations, grouped by what the device must contain, how it must be proven before marketing, and
how it must be controlled afterward. Each is in use today and is therefore achievable. Each is stated so that it can be
audited.

A. What a patient-facing GenAI device should be required to contain
​1. Independent supervisory models on every safety-critical computation. No safety-critical behavior should depend
on the generative model alone. Dose and frequency checks, over-the-counter maximum-dose checks, laboratory and
vital-sign range interpretation, and symptom detection for escalation should each be performed by a separately
trained, separately qualified model of a different lineage that runs on every conversational turn and can block, correct
or escalate the primary agent’s output. CDRH should give no risk-control credit to instructions written only in a
prompt, because the model they constrain can override them. Credit should be reserved for controls enforced outside
the generative component, with verified detection sensitivity reported with confidence bounds. (Q1, Q9, Q20)
​2. Deterministic grounding of quantitative and factual outputs. Any output involving a dose, a reference range, a
contraindication, an institutional policy or a patient’s own record must be drawn from a clinician-approved reference
table, the EHR, or a controlled retrieval source with an explicit no-answer fallback, never from the model’s parametric
memory. Patient-reported values should be checked against plausibility ranges and clarified before interpretation (“a
systolic pressure of 500 is not plausible; did you misspeak?”). A medication or value that cannot be matched to an
approved source should trigger deferral to the care team, not a general answer. (Q9 (E.1, E.3))
​3. A clinician-authored protocol as the intended-use boundary, with state tracking. For conversational devices,
intended use should be expressed as a clinician-authored protocol listing the required tasks, the permitted output
classes and the maximum level of directiveness. The device should maintain conversation state against that protocol
so that tangents do not cause omissions, and sponsors should report protocol-completion rate and
out-of-scope-output rate per conversation across adversarial and drifting trajectories. A “talk to your doctor”
disclaimer should receive no credit toward reducing directiveness. Directives that relay a clinician’s signed order or
protocol should be evaluated for fidelity of capture and application. Directives the model originates should be treated
as higher risk. (Q2, Q5, Q9 (S.2))
​4. Real-time human escalation against a validated nursing protocol, with measured latency. Every patient-facing
device should contain a dedicated escalation function that detects potentially serious symptoms on every turn and
evaluates their severity against a validated nurse-triage standard. Our own escalation engine applies the
Schmitt-Thompson framework across more than 120 symptoms. The escalation function should route each case to a
defined, time-bound disposition: immediate live transfer to a licensed clinician for high severity, care-team call-back
within a stated interval for medium and low severity, and a documented note otherwise. Critical values and apparent
overdoses should escalate automatically. Sponsors should report under-escalation, over-escalation, failed hand-offs
and time-to-human separately, with under-escalation held to an absolute floor before over-escalation is optimized.
(Q6, Q9 (S.1))
​5. Identity verification and PHI isolation by architecture. No protected health information should enter the
generative model’s context until the caller’s identity has been confirmed by a non-generative check against the record,
with the call terminated after a bounded number of failures. This should be verified with adversarial attempts to
extract PHI before verification, and the pass rate should be 100%. (Q3)

B. How safety should be demonstrated before marketing and before every release
​6. Output testing at scale, by licensed clinicians, in the deployed modality, repeated for every release. Public
benchmarks and sponsor-run AI-to-AI simulation are useful for coverage but are vulnerable to contamination, shared
blind spots and training to the test, and should be supplementary only. The decisive evidence for a patient-facing
conversational device should be end-to-end interactions with the final configuration conducted by license-verified U.S.
clinicians acting as patients, reviewed in the modality patients experience (audio for voice devices), enriched for
red-flag and rare presentations and covering the subgroups, dialects and literacy levels of the intended population. For
initial authorization of moderate-risk conversational functions we recommend a baseline of at least 100,000 unique
clinician-conducted conversations. Higher-risk functions should add shadow or supervised deployment. The initial
evaluation should also include a human-clinician control arm on the same scenarios, with at least one call in fifty
routed to a licensed nurse and reviewed under the same rubric, so the comparator is measured on identical cases
rather than inferred from literature. We established our own human benchmark this way. Once the benchmark is set,
subsequent releases should be measured against it rather than re-run with a control arm. Every subsequent release,
whether a model update, a new feature, a new language or a new use case, should repeat a prespecified clinician
evaluation of fixed size before deployment (we run 10,000 clinician-conducted calls per model release, and release is
blocked until adjudication is complete, every floor is met, and the clinical safety team has signed off). The clinician
panel should be sponsor-administered where structural safeguards exist, so that scale is not limited by third-party
capacity. (Q7, Q9–Q11, Q13, Q14, Q16, Q22)
​7. A severity-graded harm taxonomy, tiered independent adjudication and hard safety floors. Every error flagged by
a testing clinician should be reviewed by a trained nurse and, for any potential harm, adjudicated to consensus by
independent physicians, then graded on a harm scale mapped to an established patient-safety taxonomy such as the
AHRQ Common Formats (no harm, minor harm, risk of severe harm, risk of death). Acceptance criteria should be
prespecified per severity and identical across every use case and site: zero observed severe-harm or death errors with
a one-sided 95% upper bound below a stated limit, a harm-free rate of at least 99%, and tight ceilings on lesser
deviations, with the unique clinical scenario as the unit of analysis. For safety-critical behavior the comparator should
be the guideline-based standard of care, not median practice. For overall quality, non-inferiority to licensed nurses
running the same protocol with the same patient actors. (Q12, Q14, Q15)
​8. Closed-loop resolution with controlled re-test. Every confirmed failure should have a documented root cause, a fix
validated against the prior version under controlled A/B conditions, and a permanent place in the regression suite so
the benchmark grows harder over time. Daily human-evaluated regression runs against production agents in
simulation make this continuous rather than episodic. Sponsors should report severity-graded error rates for each
release, allowing CDRH to see the trajectory of a device rather than a single snapshot. (Q19, Q22)
C. How the device should be controlled after authorization
​9. Configuration control: the manufacturer must control the model it ships. A sponsor that cannot hold its model
constant cannot meet TPLC obligations. Production systems should pin every model, prompt, retrieval index and logic
version under a configuration fingerprint and should never call auto-updating third-party endpoints. Any change to
any component, including a foundation-model update initiated by a third party, should trigger the release-level
clinician evaluation in item 6 and a full re-run of the benchmark suite, including a sequestered set, with every safety
floor met before deployment. Modular components should be re-benchmarked individually and at the system level.
Voluntary foundation-model master files are a useful reference, but device-level evidence should remain decisive, and
a sponsor that trains and controls its own models should not be disadvantaged for lacking one. For agentic functions,
tool permissions should be least-privilege and irreversible actions should require explicit human approval, verified
deterministically. (Q22–Q26)
​10. Intensive then sampled human review for every deployment, with full traceability to the care team. For every
new deployment, meaning each new use case and each new site, licensed clinicians should review 100% of
encounters for a prespecified initial period (we review the first 1,000 calls of every deployment) until the upper bound
on each severe-error rate falls below its floor. Thereafter, 100% of high-risk escalations should be human-reviewed
alongside a permanent random sample of routine encounters sized by detection power (we review 0.5–1%; about 600
encounters per period detects a 0.5% failure with 95% probability), including audio review for voice devices and
encounters that automated layers cleared. Automated evaluators may score every encounter and trigger additional
human review, but should be qualified against blinded human ratings and never serve as the sole safeguard. Every
encounter should produce a structured summary of medications, vitals, protocol outcomes and follow-ups delivered
to the care team, with the full transcript available, so that every output is traceable and a human can act on it. Drift
monitoring should define triggers for reassessment: model, prompt or logic change; new site, population or language;
guideline update; or any signal-threshold breach, with weekly multidisciplinary quality review and monthly
per-use-case safety reporting. (Q1, Q18–Q21)

Recommended next steps
Hippocratic AI encourages CDRH to (1) issue draft guidance that maps residual-risk tiers to the ten expectations above;
(2) establish a Competency Assessment Plan, fixing benchmark suite, adjudication, floors, release-evaluation size and
confirmation stage before testing, as a Q-Submission topic; (3) recognize licensed-clinician standardized-patient
testing as clinical confirmation for low- and moderate-risk patient-facing functions; and (4) pilot
performance-bounded change control for GenAI devices. These expectations are demanding, and they should be.
They are also demonstrably achievable at the scale the paper contemplates, and we would welcome the opportunity
to share our methods and data with the Agency.

Respectfully submitted,

Munjal Shah
Co-Founder and Chief Executive Officer, Hippocratic AI