Srikanth Mahankali

Re: FDA-2026-N-7874 - Considerations for the Regulation of Generative AI-Enabled Medical Devices

Submitted in my individual professional capacity. I appreciate CDRH’s request for input on its August 2026 discussion paper. It is a nonbinding discussion paper, not draft or final guidance. FDA regulates qualifying medical-device functions, not GenAI generally. My recommendations are proposed options rather than existing FDA requirements.

1. RISK AND CLINICAL RELIANCE (Q1-6). Retain FDA’s two-axis heuristic (activity and consequence of incorrect output), but assess when outputs become clinically relied upon. Map illustrative - not regulatory - workflow states: editable draft, recommendation, released/committed output, and executed action. Assess directiveness, detectability, time-to-harm, reversibility, source traceability, and actual delegated authority. Human oversight mitigates risk only if the reviewer has expertise, underlying evidence, time, and power to intervene. Assess multi-turn escalation and patient- versus professional-facing contexts; measure under- and over-escalation separately.

2. COMPETENCY AND CLINICAL EVIDENCE (Q7-17). Evaluate the versioned, integrated user-facing function, not a foundation model alone. Document prompts, retrieval, tools, user interface, guardrails, and clinician workflow - Benchmark prespecified clinically material errors, uncertainty, and relevant subgroups using appropriate expert standards and contamination-resistant cases. For medical imaging, distinguish summarization of a signed report, image-based interpretation with clinician review, and autonomous time-sensitive alert routing. Test omitted or invented findings, laterality, prior comparison, measurements, urgency recommendations, and handoffs. Select confirmation (retrospective, shadow-mode, adjudication, prospective) proportionately; include human-AI team performance when intended. Synthetic stress cases supplement but should not be pooled uncritically with real patient observations. For multimodal functions, separately verify grounding to pixels/signals versus records.

3. POSTMARKET EVIDENCE (Q18-21). Use a detection-latency test: can meaningful deterioration be detected, contained, and corrected before consequential harm? Monitoring is not an adequate substitute for stronger premarket evidence when the first reliable signal follows irreversible harm. Prespecify denominators, review cadence, thresholds, subgroup checks, drift triggers, response ownership, and rollback. Validate any supervisory agent independently; retain clear manufacturer accountability.

4. CHANGE CONTROL (Q22-24). Evaluate behavioral impact from model/API changes, prompts, retrieval content, UI, guardrails and tool access. Specify the scope of a validated change, regression tests, pass criteria, notifications and rollback. Apply existing final FDA PCCP guidance where appropriate; do not treat it as permission for unspecified changes.

5. FOUNDATION MODELS AND AGENTS (Q25-26). Consider voluntary Foundation Model Device Master Files (MAFs), while preserving device-manufacturer responsibility for intended-use evidence. For agentic device functions, test action scope, access permissions, approval checkpoints, cascading tool errors, logging, and safe stopping.

I encourage FDA to publish nonbinding, risk-proportionate worked examples for diagnostic imaging, clinical reports, and patient communications. The governing principle should be the clinical consequences and demonstrable performance of the deployed medical-device function, not its AI label.

Re: FDA-2026-N-7874 - Considerations for the Regulation of Generative AIEnabled Medical Devices

Please consider my attached public comment, "Regulating Generative AIEnabled Medical Devices at the Point of Clinical Reliance." It responds
selectively to FDA's August 2026 discussion paper (Questions 1-26), with
an emphasis on real clinical reliance, whole-device and clinician-device
validation, image-grounded evidence, postmarket detection limits,
modification controls, voluntary Foundation Model Master Files, and
agentic device functions.

The attachment contains my substantive recommendations. I submit in my
individual professional capacity, without claiming to represent any
company, institution, or agency. The FDA discussion paper is for feedback
and is not binding guidance.

FDA-2026-N-7874 | OCTOBER 19, 2026 | PUBLIC COMMENT

Regulating Generative AI-Enabled Medical Devices at the Point of
Clinical Reliance
Individual professional public comment in response to FDA’s August 2026 discussion
paper | Docket FDA-2026-N-7874
Submitted by Srikanth Mahankali, MD | Individual professional capacity; views are personal and not
presented as those of any employer, institution, manufacturer, or agency.

1 Scope and executive recommendation | FDA Questions 1, 2, 7, 18
I appreciate the Center for Devices and Radiological Health (CDRH) inviting early public input on its August 2026
discussion paper. The paper expressly is not draft or final guidance, does not propose or implement policy changes,
and does not set future evidence requirements. FDA regulates qualifying medical-device functions, rather than
generative AI technologies in the abstract. The recommendations below are policy options within the existing
intended-use and risk-based regulatory context, not assertions that the requested measures are already
compulsory. [1,2,5]

I support the paper’s proposed risk heuristic (device activity × consequence of relying on an incorrect output) and
proposed two-step competency approach (device benchmarking plus clinical confirmation). I recommend
complementing both with a “point of clinical reliance” analysis: determine when generated material is likely to
shape an actual clinical decision, released communication, patient action, or automated device activity—and test
the integrated, intended-use configuration at that consequential point. This is an illustrative synthesis, not an
independently validated device-risk classification, new regulatory category, or claim of conceptual priority. [1]

2 Risk, directiveness, oversight, and escalation | Questions 1–6
To make the two-axis model operational, map where output moves along an illustrative workflow continuum: (A)
editable draft, (B) decision-informing recommendation, (C) released or clinically committed message/report/alert,
and (D) executed action. These states are not device classes; reliance can occur before any formal signature or
release. In each intended workflow, characterize directiveness, consequence severity, time to harm, realistic
opportunities for independent detection, the reversibility of downstream actions, source traceability, and the
authority actually delegated. Avoid translating these modifiers mechanically into additional mandatory axes. [1]

Count “human oversight” as an effective safeguard only when the intended user can actually review underlying
evidence, has the right clinical expertise, receives outputs in time to intervene, and retains authority to reject or
correct them. Where a generalist receives specialist-domain recommendations, validate the degree to which that
user can recognize errors. Where patients receive direct advice, account for comprehension, access, safeguards,
and patient agency, without presuming a patient is incapable of informed choice. Test multi-turn trajectories that
shift from explanation to action-direction. Separately measure clinically material under-escalation and overescalation, recognizing their consequences are not necessarily commensurable. [1]

3 Integrated competency and appropriate clinical confirmation | Questions 7–16
Benchmark the user-facing, versioned device configuration: underlying model and version; system instructions;
prompts; retrieval data and update policy; input modalities; guardrails; connected tools; user interface; and actual
clinician-review design. A foundation-model benchmark alone cannot establish safety or effectiveness of the
marketed function. Define the clinical construct under examination, representative input distributions,
adjudication method, prespecified failure taxonomy, quantitative acceptance criteria, uncertainty intervals, and
subgroup assessments appropriate to intended use. Address data contamination, repeated-output variability and
sponsor overfitting by incorporating independent or sequestered challenges when practicable. [1]

For radiology, distinguish at least: (i) faithful patient-friendly summarization of an existing signed report; (ii)
preliminary findings generated from image pixels for clinician review; and (iii) autonomous routing of timeFDA-2026-N-7874 • 1
 FDA-2026-N-7874 | OCTOBER 19, 2026 | PUBLIC COMMENT

sensitive findings. Appropriate reference standards differ: source-report fidelity for summarization versus expertadjudicated image and clinical findings for primary interpretation. Report the frequency and severity of invented
or omitted findings, laterality/anatomy mismatch, erroneous measurements, discordant comparison with priors,
misplaced certainty, inappropriate urgency/follow-up, and failed notifications. Test scanner and protocol variation,
missing sequences, discrepant clinical context, and meaningful patient or site subgroups when relevant to the
claims. [1,7,8]

Use clinically appropriate confirmation—not a blanket mandate for prospective trials. Retrospective source-data
evaluation, shadow-mode observation, simulated interactions, independent clinician adjudication, and prospective
studies each have roles that depend on intended use and clinical consequence. For an intended clinician-in-theloop product, measure both standalone device performance and the realized human–AI team; compare results
with the actual pathway likely without the device, where practicable. Prospective intervention evidence may be
necessary where high-consequence harm would not be readily detectable or reversible; a low-risk reportexplanation function should not automatically face equivalent burden. [1]

Synthetic cases are valuable for rare and adversarial failures, but should not be treated as automatically
exchangeable with representative patient cases. If synthetic and real cases are combined into a summary estimate,
require a defensible model of distributional differences, dependence, case weighting and measurement
uncertainty; otherwise report separate results. Favor independent adjudication for high-stakes endpoints while
avoiding a universal third-party testing barrier. As historical context, a JAMA systematic review of 519 studies
published through February 19, 2024 found 5% used real patient-care data; this was a description of past
literature, not a measured rate of current device safety or FDA submissions. [1,6]

4 Multimodal source grounding | Question 17
Where intended use includes interpretation of medical images, evaluate whether each material generated finding
is supported by original pixels/signals and appropriate clinical context. Distinguish image-grounded observations,
reproduced record statements, inferences, and practice recommendations. Plausible citations, attention maps and
generated explanations are not substitutes for expert-established correctness. For a report-only summarizer, test
faithful communication of the signed source rather than implying it independently interprets the images. Include
discordant prior reports, altered metadata, incomplete studies and contradictory retrieved context when
foreseeable in intended use. [1,7]

5 Postmarket monitoring and time to detect harm | Questions 18–21
Postmarket evidence can complement premarket evidence only where meaningful degradation can reasonably be
detected, contained, and corrected before disproportionate harm. I recommend a “detection-latency” inquiry:
when will the earliest reliable performance signal be available relative to the plausible time and reversibility of a
consequential failure? If surveillance would reveal problems only after irreversible harm, monitoring alone is a
weak justification for accepting substantially greater premarket uncertainty. [1]

Monitoring plans should prespecify denominators, safety events, sampling methods and cadence, qualified review,
threshold responses, relevant subgroup trends, complaint capture, investigation ownership,
suspension/revalidation triggers, and rollback pathways. Trigger reassessment for model updates and for changes
in patient mix, acquisition protocols, clinical workflow, retrieval content and alert routing. Machine-based
supervisory agents may help, but their false negatives, correlated errors, resilience to misleading inputs and
escalation reliability require independent evaluation; they should not be treated as infallible safety gates.
Clinicians and institutions can contribute contextual safety signals without displacing manufacturer
accountability. [1]

6 Third-party supply chains, updates, and PCCPs | Questions 22–24
Potentially meaningful changes include not only model weights but also third-party API/model versions, prompt
templates, retrieval indices, tool permissions, user interfaces and guardrails. Base regression and clinicalequivalence assessments on plausible behavioral impact and intended-use boundaries, with change provenance,

FDA-2026-N-7874 • 2
 FDA-2026-N-7874 | OCTOBER 19, 2026 | PUBLIC COMMENT

acceptance criteria, notification, version-pinning options and rollback. FDA’s August 2025 final PCCP guidance
already describes marketing-submission recommendations for specified AI-device modifications, but it is not a
blanket authorization for unknown future modifications. Clarify what may be controlled through an appropriate
quality system, what can be sufficiently prespecified in a reviewed PCCP, and what requires further FDA
interaction under applicable law. [1,3,4]

7 Foundation Model MAFs and agentic medical-device functions | Questions 25–26
Explore the voluntary Foundation Model Device Master File (MAF) approach identified in the discussion paper:
structured and maintainable evidence on provenance, known limitations, model and safety-behavior changes,
healthcare-relevant evaluation, and communication to downstream device sponsors. MAF submission would not
authorize the foundation model for any device intended use and would not shift device-specific
safety/effectiveness responsibility away from manufacturers. Assess workable incentives and alternatives if
developers decline to participate. [1]

For agentic device functions, specify allowed tools and records; action and authorization boundaries; logging and
auditability; independent checkpoints before high-consequence or irreversible action; safe handling of faulty tool
outputs, prompt injection or unavailable services; and stop, rollback and escalation routes. The evidence and
degree of human intervention should correspond to the authority and consequences of the particular intended
function, rather than a single undifferentiated “agentic AI” label. [1]

8 Requested FDA deliverables
I encourage FDA to develop nonbinding, stakeholder-tested worked examples that align risk modifiers,
competency elements, clinical confirmation, monitoring latency, and change-control choices for the three imaging
functions above. Each example should identify what is a device function, the intended user, realistic alternative
care, key failure modes, meaningful independent review, and feasible evidence. This would translate the
discussion paper’s useful questions into reproducible regulatory-science methods without prematurely converting
proposals into regulatory obligations. [1,2]

Appendix | Illustrative points of clinical reliance

State (not a device class) Illustrative imaging workflow Example evidence emphasis

Clinical omissions and usability under
A. Editable draft Unreleased candidate report
realistic review

Directiveness, source fidelity, specialist
B. Recommendation AI-drafted follow-up or triage suggestion
error detectability

Signed report, delivered alert or patient Severity, comprehensibility,
C. Committed output
message delivery/handoff completeness

Automated device/tool action in Permissions, interruption, escalation,
D. Executed action
authorized workflow reversibility

References and authoritative source status
[1] FDA. Considerations for the Regulation of Generative AI-Enabled Medical Devices: Discussion Paper and Request for
Feedback. August 2026. 31-page PDF supplied by commenter.

https://www.fda.gov/media/194242/download

[2] FDA. Discussion paper landing page and notice of the October 19, 2026 feedback deadline.

https://www.fda.gov/medical-devices/digital-health-center-excellence/considerations-regulation-generative-ai-enabled-medical-devicesdiscussion-paper-and-request

FDA-2026-N-7874 • 3
 FDA-2026-N-7874 | OCTOBER 19, 2026 | PUBLIC COMMENT

[3] FDA. Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled
Device Software Functions. Final guidance, August 2025.

https://www.fda.gov/regulatory-information/search-fda-guidance-documents/marketing-submission-recommendations-predeterminedchange-control-plan-artificial-intelligence

[4] FDA. Artificial Intelligence-Enabled Device Software Functions: Lifecycle Management and Marketing Submission
Recommendations. Draft guidance, January 2025.

https://www.fda.gov/regulatory-information/search-fda-guidance-documents/artificial-intelligence-enabled-device-software-functionslifecycle-management-and-marketing

[5] FDA. Clinical Decision Support Software. Final guidance, revised January 2026.

https://www.fda.gov/media/109618/download

[6] Bedi S, Liu Y, Orr-Ewing L, et al. Testing and Evaluation of Health Care Applications of Large Language Models: A Systematic
Review. JAMA. 2025;333(4):319–328.

https://doi.org/10.1001/jama.2024.21700

[7] Tanno R, Barrett DGT, Sellergren A, et al. Collaboration between clinicians and vision–language models in radiology report
generation. Nature Medicine. 2025;31:599–608.

https://doi.org/10.1038/s41591-024-03302-1

[8] Generative Large Language Models Trained for Detecting Errors in Radiology Reports. Radiology. doi:10.1148/radiol.242575.

https://doi.org/10.1148/radiol.242575

FDA-2026-N-7874 • 4