Gary Hsuanyu Liu

This comment is submitted by Gary Hsuanyu Liu, J.S.D., Health and Human Information Policy Research Fellow at the Cordell Institute for Policy in Medicine and Law, Washington University in St. Louis, in an individual capacity; the affiliation is for identification only and does not indicate endorsement by Washington University in St. Louis or the Cordell Institute. The full comment, with footnotes, is attached as a PDF.

It responds to Questions 2, 7, 11, 18, and 25 of the discussion paper, with short answers to Questions 5 and 8. Each answer addresses whether an approach the paper considers falls within existing statutory authority and evidentiary standards, which instrument could carry it, and on what condition it would instead require rulemaking or legislation.

Summary of recommendations

Question 2: FDA could connect the action-directing spectrum to the Criterion 3 and 4 language through guidance; if a binding boundary for functions directed to a health care professional is sought, this step would require a section 520(o)(3) order where its finding is available, otherwise legislation.

Question 7: FDA could accept device benchmarking as part of the valid scientific evidence for a given device in its premarket review; if benchmarking is to replace clinical investigation as a class, this step would require rulemaking amending 21 C.F.R. § 860.7.

Question 11: FDA could state through guidance which confirmation methods are investigations under Part 812 and how 21 C.F.R. § 812.3(p) applies to software processing patient data; if any method is to be exempted from Parts 50, 56, or 812 as a class, this step would require rulemaking.

Question 18: FDA could accept greater premarket uncertainty for PMA devices through conditions of approval and section 522 orders; if a type-level surveillance special control is sought for class II devices, this step would require an order under section 513(e) or 513(f)(2); if a device-specific condition of 510(k) clearance is sought, legislation.

Question 25: FDA could establish a voluntary Foundation Model MAF through the Device Master File program and guidance, confining confidentiality to information within 21 C.F.R. § 20.61; if disclosure is sought from a foundation model developer that is not a device manufacturer, this step would require legislation.

Question 5: FDA could treat design-driven conversational trajectories as evidence of intended use under 21 C.F.R. § 801.4 in classification and premarket review, subject to section 513(i)(1)(E)(i) for 510(k) submissions; labeling for a foreseeable harmful use of a 510(k) device follows the same provision (short answer).

Question 8: FDA could use the two-axis framework as an input to the factors in section 513(a)(2) and 21 C.F.R. § 860.7(c)(2) in its classification and premarket review; if a freestanding evidentiary tier is sought, this step would require rulemaking amending § 860.7 (short answer).

Respectfully submitted,
Gary Hsuanyu Liu, J.S.D.

October 19, 2026

Dockets Management Staff (HFA-305)
Food and Drug Administration
5630 Fishers Lane, Rm. 1061
Rockville, MD 20852

Re: Docket No. FDA-2026-N-7874
Comment on Considerations for the Regulation of Generative AI-Enabled Medical Devices:
Discussion Paper and Request for Feedback

This comment is submitted by Gary Hsuanyu Liu, J.S.D., Health and Human Information Policy
Research Fellow at the Cordell Institute for Policy in Medicine and Law, Washington University in St.
Louis, in an individual capacity; the affiliation is for identification only. It responds to Questions 2, 7,
11, 18, and 25 of the discussion paper, with short answers to Questions 5 and 8.1 Each answer turns on
whether an approach the paper considers falls within existing statutory authority and evidentiary
standards, which instrument could carry it, and on what condition it would instead require rulemaking
or legislation. The paper states that it “is not intended to address whether the approaches discussed
below are within FDA’s existing legal authorities”;2 this comment supplies that layer, question by
question. It does not address postmarket monitoring design, deployment settings, or technical methods,
because its contribution is legal analysis rather than empirical evidence.
Summary of recommendations
• Question 2: FDA could connect the action-directing spectrum to the Criterion 3 and 4 language
through guidance; if a binding boundary for functions directed to a health care professional is
sought, this step would require a section 520(o)(3) order where its finding is available,
otherwise legislation.
• Question 7: FDA could accept device benchmarking as part of the valid scientific evidence for
a given device in its premarket review; if benchmarking is to replace clinical investigation as a
class, this step would require rulemaking amending 21 C.F.R. § 860.7.
• Question 11: FDA could state through guidance which confirmation methods are investigations
under Part 812 and how 21 C.F.R. § 812.3(p) applies to software processing patient data; if any
method is to be exempted from Parts 50, 56, or 812 as a class, this step would require
rulemaking.
Digital Health Ctr. of Excellence, Ctr. for Devices & Radiological Health, FDA, Considerations for the Regulation of
Generative AI-Enabled Medical Devices: Discussion Paper and Request for Feedback (Aug. 18, 2026),
https://www.fda.gov/media/194242/download [hereinafter Discussion Paper]. Pinpoint citations are to the paper's printed
pagination. Note 25 of the paper cites "Example #1 on Page 11" of FDA, Policy for Device Software Functions and Mobile
Medical Applications: Guidance for Industry and Food and Drug Administration Staff (Sept. 28, 2022),
https://www.fda.gov/media/80958/download; that guidance uses no such label, and the referenced content appears in Section
V.A, item 1 (p. 11), with the control example on p. 12.
Discussion Paper, supra note 1, at 1.
 • Question 18: FDA could accept greater premarket uncertainty for PMA devices through
conditions of approval and section 522 orders; if a type-level surveillance special control is
sought for class II devices, this step would require an order under section 513(e) or 513(f)(2); if
a device-specific condition of 510(k) clearance is sought, legislation.
• Question 25: FDA could establish a voluntary Foundation Model MAF through the Device
Master File program and guidance, confining confidentiality to information within 21 C.F.R. §
20.61; if disclosure is sought from a foundation model developer that is not a device
manufacturer, this step would require legislation.
• Question 5: FDA could treat design-driven conversational trajectories as evidence of intended
use under 21 C.F.R. § 801.4 in classification and premarket review; labeling for a foreseeable
harmful use of a 510(k) device follows section 513(i)(1)(E) (short answer).
• Question 8: FDA could use the two-axis framework as an input to the factors in section
513(a)(2) and 21 C.F.R. § 860.7(c)(2) in its classification and premarket review; if a
freestanding evidentiary tier is sought, this step would require rulemaking amending § 860.7
(short answer).

Question 2 (Section IV): The non-directive to action-directing spectrum and section
520(o)(1)(E)
This comment addresses the spectrum’s legal effect, not the risk dimensions themselves.
• Statutory position: For functions directed to a health care professional (HCP), the spectrum’s
upper end lies outside section 520(o)(1)(E) under FDA’s current reading of clauses (E)(ii) and
(iii).
• Patient-directed functions: These lie outside clause (E) by its terms; for them the spectrum
bears on classification, not on device status.
• Single-option functions: A function recommending the only clinically appropriate option
remains a device under FDA’s stated enforcement discretion policy.
• Instrument: Guidance can map the spectrum onto the criteria; a binding boundary needs a
section 520(o)(3) order or legislation.
Statutory basis. Section 520(o)(1)(E) excludes from the device definition a software function intended,
among other conditions, for “supporting or providing recommendations to a health care professional”
and for “enabling such health care professional to independently review the basis for such
recommendations,” and an excluded function is not a device under section 201(h)(1).3 The paper’s
spectrum runs from non-directive information to outputs that direct action; disclaimers, it considers,
do not move a function toward the non-directive end. Its four-tier lisinopril example, from general drug
information to a specific dosing instruction, shows where the text takes over: under the Clinical
Decision Support Software guidance, a function providing “a specific preventive, diagnostic or
21 U.S.C. §§ 321(h)(1), 360j(o)(1)(E)(ii)–(iii). Section references in this comment are to the Federal Food, Drug, and Cosmetic
Act (FD&C Act); regulations are cited to title 21 of the Code of Federal Regulations as currently in force.
treatment output or directive” does not meet Criterion 3, and a function used for a “critical, timesensitive task or decision” does not meet Criterion 4, so the example’s top tier sits outside clause (E)
on FDA’s reading.4 The guidance states current thinking and binds neither sponsors nor the agency;5
whether its reading of “recommendations” would hold on independent judicial construction has not
been tested.
Patient-directed and single-option functions. A patient-directed recommendation function is outside
clause (E), which speaks to recommendations to a health care professional. Whether it is a device turns
on intended use under section 201(h)(1)(B), determined objectively under 21 C.F.R. § 801.4 from the
article’s design and the circumstances of its distribution; the guidance states FDA’s view that such
functions meet the device definition.6 For them the spectrum operates on classification, where the
statutory factors are the intended users, the conditions of use, and probable benefit weighed against
probable injury or illness, section 513(a)(2)(A)–(C);7 output specificity and personalization count as
evidence under those factors.
The single-option case marks the spectrum’s limit. The guidance states that FDA intends to exercise
enforcement discretion for a function that recommends the only clinically appropriate option when the
other criteria are met. That function remains a device; section 520(o)(4)(A) preserves FDA’s authority
to exercise enforcement discretion as to any device.8
FDA could, through guidance, connect the spectrum to the existing Criterion 3 and Criterion 4 language,
note that for patient-directed functions it informs classification under section 513(a)(2), and weigh
output characteristics in its classification and premarket review procedures; guidance supplies
predictability, not obligations. If CDRH sought a binding action-directing boundary for HCP-directed
functions, it would need an order under section 520(o)(3), available only for a function type that FDA
finds “reasonably likely to have serious adverse health consequences,” issued after notice with the
rationale and evidence, a comment period of at least thirty days, and consideration of the factors in
subsection (o)(3)(C).9 For any other HCP-directed function the boundary is the text of clauses (E)(ii)
and (iii), and moving it would require legislation.

Question 7 (Section V): The competency-based package as valid scientific evidence
This comment addresses the legal status of the benchmarking and confirmation package; benchmark
design is outside its scope.
Discussion Paper, supra note 1, at 6–7, 8 n.13 (the paper's one reference to section 520(o)(1)(E) within its risk framework);
FDA, Clinical Decision Support Software: Guidance for Industry and Food and Drug Administration Staff 10–11, 13–14 (Jan.
29, 2026), https://www.fda.gov/media/109618/download (superseding the Jan. 6, 2026 version; Criterion 3 at 13, Criterion 4 at
14) [hereinafter CDS Guidance].
21 U.S.C. § 371(h)(1)(A); 21 C.F.R. § 10.115(d)(1).
CDS Guidance, supra note 4, at 13–14.
21 U.S.C. § 360c(a)(2)(A)–(C).
CDS Guidance, supra note 4, at 10–11, 21; 21 U.S.C. § 360j(o)(4)(A).
21 U.S.C. §§ 360j(o)(3)(A)(i), (B)(i)–(iii), (C)(i)–(iv), 371(h)(1)(C)(i); 21 C.F.R. § 10.115(d)(1).
 • Governing standard: Effectiveness for a PMA or De Novo device is shown by valid scientific
evidence under section 513(a)(3) and 21 C.F.R. § 860.7, where the package is assessed.
• Benchmarking: Non-clinical benchmarking is not a well-controlled investigation under §
860.7(f); it enters only as other valid scientific evidence under § 860.7(e)(2), device by device.
• Confirmation methods: Each method the paper lists corresponds to a category in §
860.7(c)(2); sufficiency turns on the device and its conditions of use.
• Instrument: Guidance can describe presentation and review; replacing clinical investigation
with benchmarking as a class requires rulemaking amending § 860.7, not new authority.
Statutory and regulatory basis. Section 513(a)(3)(A) provides that effectiveness is determined “in
accordance with regulations promulgated by the Secretary, on the basis of well-controlled
investigations, including 1 or more clinical investigations where appropriate,” and subsection (B)
permits a determination on other valid scientific evidence.10 Section 860.7(c)(1) confines FDA to valid
scientific evidence, and paragraph (c)(2) lists its five forms, adding that the evidence required “may
vary according to the characteristics of the device, its conditions of use” and other factors. Paragraph
(e)(2) sets the default: evidence of effectiveness “shall consist principally of well-controlled
investigations, as defined in paragraph (f),” unless the Commissioner finds other valid scientific
evidence sufficient and well-controlled investigations “not reasonably applicable to the device.” A
510(k) is reviewed instead for substantial equivalence under section 513(i)(1)(A), which § 860.7 does
not govern directly.11
Where the package fits. The paper describes assessment of the device in its end-user configuration
“and not the foundation model standing alone or other isolated subcomponent.” 12 Benchmarking
cannot be a well-controlled investigation: paragraph (f) describes “the essentials of a well-controlled
clinical investigation,” including selection of subjects in (f)(1)(ii) and comparison with a control in
(f)(1)(iv), which a non-clinical test lacks. It can form part of the other valid scientific evidence that
paragraph (e)(2) permits; whether it suffices depends on a device-specific determination that wellcontrolled investigations are not reasonably applicable. The confirmation methods map onto paragraph
(c)(2): retrospective evaluation and clinician adjudication correspond to well-documented case
histories by qualified experts, shadow deployment to studies without matched controls, and a
prospective study to a well-controlled investigation.13 A GenAI-enabled device that claims equivalence
to a non-GenAI predicate but raises different questions of safety and effectiveness leaves the 510(k)
for De Novo, where § 860.7 returns.14 The paper also cites commentary proposing competency-based
or licensure-style evaluation;15 the governing text remains section 513(a)(3) and § 860.7.
21 U.S.C. § 360c(a)(3)(A)–(B).
21 U.S.C. § 360c(i)(1)(A)(ii)(I) (requiring "appropriate clinical or scientific data if deemed necessary" where technological
characteristics differ).
Discussion Paper, supra note 1, at 11; see also id. at 14 (clinical confirmation "may be a necessary step").
Discussion Paper, supra note 1, at 15; 21 C.F.R. § 860.7(c)(2).
21 U.S.C. § 360c(f)(1), (f)(2)(A)(ii), (iv), (i)(1)(A)(ii)(II).
Discussion Paper, supra note 1, at 10 & nn.14–16.
FDA could accept a benchmarking and confirmation package for a given device through its premarket
review procedures: a determination under § 860.7(e)(2) that other valid scientific evidence suffices
and, for a PMA, a written specification under section 513(a)(3)(D), which binds the agency unless
contrary to the public health and leaves the approval standard unchanged.16 Guidance could describe
presentation and review, including the adjudicator independence the paper describes. 17 If CDRH
sought to substitute benchmarking for clinical investigation across a class of GenAI-enabled devices,
it would need to amend § 860.7 by notice-and-comment rulemaking; section 513(a)(3)(A) already
authorizes that regulation, so the step is one of instrument, not authority.

Question 11 (Section V): Clinical confirmation methods under 21 C.F.R. Parts 50, 56, and
This comment addresses the status of the five confirmation methods under Parts 50, 56, and 812, left
open in the paper’s footnote 20.18
• Threshold: Whether a method is an investigation under Part 812 turns on the definition of
subject in § 812.3(p).
• Shadow deployment: Whether software that processes patient data without showing an output
is used “on” the patient, as § 812.3(p) requires, is a question of reading, not of study design.
• Parts 50 and 56: Their scope does not depend on whether an IDE is required.
• Instrument: Guidance can state the mapping; a categorical exemption requires rulemaking,
and enforcement discretion is not an exemption.
Regulatory basis. Section 812.3(h) defines an investigation as research “involving one or more
subjects,” and § 812.3(p) defines a subject as “a human who participates in an investigation, either as
an individual on whom or on whose specimen an investigational device is used or as a control.” Section
812.2(b)(1) treats an investigation of a device other than a significant risk device (§ 812.3(m)) as
having an approved IDE, subject to IRB approval and Part 50 consent. The diagnostic-device
exemption in § 812.2(c)(3) is keyed to § 809.10(c), a labeling provision for in vitro diagnostic products,
so its reach to a non-IVD GenAI function depends on FDA’s reading of that cross-reference. Parts 50
and 56 apply to “clinical investigations that support applications for research or marketing permits,” §
50.1(a), § 56.101(a), without requiring an IDE.19
Shadow deployment through the definitions. The paper describes shadow deployment as a device
that “operates in a live clinical workflow on real patients, but its outputs are not shown to clinicians or
patients.”20 The question is whether such a device is used “on” the patient within § 812.3(p). If the
21 U.S.C. § 360c(a)(3)(D)(i)–(v).
Discussion Paper, supra note 1, at 14.
Discussion Paper, supra note 1, at 15 & n.20.
See also 21 C.F.R. §§ 50.3(c), (g), 56.102(c), (e) (defining covered investigations to include those whose results are intended
to be submitted to FDA in support of an application, and human subjects as recipients of test articles or controls).
Discussion Paper, supra note 1, at 15.
phrase reaches software that processes a patient’s data, the deployment involves subjects and is an
investigation, and a device whose output reaches no one is a candidate for the § 812.2(b) route on the
sponsor’s and IRB’s risk determination. If the phrase requires some effect on the person or specimen,
the deployment is not an investigation under Part 812, yet Parts 50 and 56 still apply once its results
support a marketing submission. Standardized patient interactions raise the same question as to the
actor, and retrospective evaluation as to previously collected data; a prospective clinical study is an
investigation on any reading. The five methods thus differ in legal status, not only in rigor; one phrase
decides three of them; and a categorical answer either way would require amending § 812.3(p). Realworld data from a marketed device fall under § 860.7(c)(2); for a premarket device their status depends
on whether they arise from an investigation.21
FDA could state through guidance which methods are investigations under § 812.3(h), how § 812.3(p)
applies to software that processes patient data without displaying an output, and the default risk
determination for each; a presubmission or, for a PMA, a written specification under section
513(a)(3)(D) can settle the point for one device. If CDRH sought to exempt shadow deployment or
retrospective evaluation from Parts 50, 56, or 812 as a class, it would need to amend those parts by
notice-and-comment rulemaking; enforcement discretion is a policy, not an exemption, 21 C.F.R. §
10.115(d)(1), and section 520(g)(2)(A) already provides for exemption conditions to be set by
regulation.22

Question 18 (Section VI): Accepting greater premarket uncertainty: authority by pathway
This comment addresses the first part of the question, whether and at what level FDA can accept
greater premarket uncertainty; plan design and unsuited device types are outside its scope.
• PMA: Express authority exists to reduce premarket effectiveness data through reliance on
postmarket controls, bounded by the unchanged standard of reasonable assurance.
• De Novo and class II: Postmarket surveillance can be a special control, set for a device type
by order, not for a single device.
• 510(k): The statute permits only expedited classification in reliance on postmarket controls;
outside section 522, nothing attaches a monitoring condition to a single clearance.
• Decision level: Device by device for PMAs; by order or rulemaking for categories.
Authority by pathway. For a PMA, section 513(a)(3)(C) provides that the data required to show
effectiveness “can be reduced through reliance on postmarket controls,” and section 515(c)(5)(C)
directs FDA to “consider the role of postmarket information” in selecting the least burdensome
appropriate means under section 515(c)(5)(A); neither alters the approval standard, sections
513(a)(3)(D)(iv) and 515(c)(5)(D). Section 513(a)(3)(D) makes a written evidence specification
The author has argued elsewhere that the lawfulness of the collection from which such data derive bears on whether FDA
should accept them. Gary Hsuanyu Liu, Fruit of the Poisonous Data: The Case for an Administrative Exclusionary Rule in FDA
AI Approvals, Am. J.L. & Med. (forthcoming 2026), https://ssrn.com/abstract=7097378.
21 U.S.C. §§ 360c(a)(3)(D)(i)–(v), 360j(g)(2)(A); 21 C.F.R. § 10.115(d)(1).
binding on the agency.23 For a De Novo request, special controls, which may include “postmarket
surveillance,” section 513(a)(1)(B), are set in the classification order, section 513(f)(2)(A)(v), (B)(i);
for an existing type they are changed by an order under section 513(e)(1)(A)(i) after a proposed order
and public comment.24 For a 510(k), section 513(i)(1)(C) speaks only to expedited classification in
reliance on postmarket controls, and section 513(i)(1)(D)(iii) leaves the substantial-equivalence
standard unchanged; a device that raises different questions of safety and effectiveness is not a 510(k)
device.25 The uncertainty guidance the paper cites covers PMAs, De Novo requests, and HDEs, and its
seventh factor includes “consideration of FDA’s authority to require postmarket data collection”;26 the
citation presupposes authority that differs by pathway.
Enforceable carriers. A PMA may carry conditions of approval, including continuing evaluation and
periodic reporting under 21 C.F.R. § 814.82(a)(2) and restrictions on sale and distribution under section
515(d)(1)(B)(ii) to the extent section 520(e)(1) permits.27 An order under section 522 may require
surveillance of a class II or III device that meets a condition in section 522(a)(1)(A), “at the time of
approval or clearance of a device or at any time thereafter,” for a prospective period of up to thirty-six
months.28 Subsection (a)(1)(B) expressly permits surveillance as a condition of approval or clearance
for devices with expected significant pediatric use; that text can be read as implying that orders for
other devices are independently enforceable rather than conditions, or as an express statement of one
case with no implication for others. Outside section 522, no carrier attaches a device-specific
monitoring condition to a 510(k) clearance.
FDA could accept greater premarket uncertainty for PMA devices through a written specification under
section 513(a)(3)(D), conditions of approval under § 814.82, and an order under section 522 where its
conditions are met; the decision belongs to the individual review, and a categorical policy would
require rulemaking under § 860.7. If CDRH sought a postmarket surveillance special control for a type
of class II GenAI-enabled device, it would need a classification order under section 513(f)(2) or, for
an existing type, an order under section 513(e). If CDRH sought a device-specific monitoring condition
on a 510(k) clearance, outside section 522 and outside a type-level special control, that step would
require legislation.
21 U.S.C. §§ 360c(a)(3)(C)–(D), 360e(c)(5)(A), (C)–(D); see also 21 U.S.C. § 360e-3(e)(2)(C) (timely postmarket data
collection for breakthrough-designated devices, limited to applications under section 515(c)); FDA, The Least Burdensome
Provisions: Concept and Principles: Guidance for Industry and Food and Drug Administration Staff 21 (Feb. 5, 2019),
https://www.fda.gov/media/73188/download.
21 U.S.C. § 360c(a)(1)(B), (e)(1)(A)(i), (f)(2)(A)(v), (B)(i).
21 U.S.C. § 360c(i)(1)(A)(ii)(II), (C), (D)(iii).
Ctr. for Devices & Radiological Health, FDA, Consideration of Uncertainty in Making Benefit-Risk Determinations in
Medical Device Premarket Approvals, De Novo Classifications, and Humanitarian Device Exemptions: Guidance for Industry
and Food and Drug Administration Staff 11, 13 (Aug. 30, 2019), https://www.fda.gov/media/115672/download (factors 6 and 7
at 11); Discussion Paper, supra note 1, at 19 & n.21.
21 U.S.C. §§ 360e(d)(1)(B)(ii), 360j(e)(1); 21 C.F.R. § 814.82(a)(2).
21 U.S.C. §§ 352(t)(3) (failure to comply with a section 522 requirement renders the device misbranded), 360l(a)(1)(A)–(B),
(b)(1) (the thirty-six-month limit yields to agreement or dispute resolution); 21 C.F.R. § 822.1.
Question 25 (Section VII): A Foundation Model Device Master File
This comment addresses the legal footing of the four features the paper describes; responsibility
allocation among third parties is out of scope.
• Legal basis: Incorporation by reference rests on 21 C.F.R. § 814.20(c) for PMAs and on
administrative practice, uncodified in Part 807, for 510(k)s and De Novo requests.
• Confidentiality: FDA can hold file content in confidence only within 21 C.F.R. § 20.61;
public model card content falls outside it.
• Burden: Incorporation by reference leaves the sponsor’s burden under § 860.7 where it was.
• Mandatory disclosure: Section 519(a) reaches manufacturers and importers of devices; a
developer that is neither cannot be compelled without legislation.
The four features against existing law. The paper considers a voluntary Foundation Model MAF
built on the existing master file program, held by FDA in confidence, incorporated by reference with
the holder’s authorization, and not constituting authorization of the model for any device intended
use.29 For a PMA, § 814.20(c) supplies the basis: information in a master file submitted by another
person is not part of the application unless that person authorizes the reference in a submission to FDA.
Part 807 contains no master file provision; incorporation in a 510(k) or De Novo request rests on
practice, described on FDA’s Device Master File page, which allows incorporation by reference in “a
client’s PMA, 510(k), or IDE, or other submissions” and applies the Freedom of Information Act
except to information within § 20.61.30 “Held in confidence” therefore holds only for trade secret and
confidential commercial information under § 20.61(a)–(c); public model card content lies outside it.
The fourth feature restates § 860.7(g)(1), which keeps the evidentiary burden on the manufacturer.
Content and alternatives. The closest analogy is FDA’s own: the November 2024 Digital Health
Advisory Committee executive summary describes handling foundation model information “similar to
the current approach taken for incorporating OTS software into a medical device.”31 The analogy holds
for third-party documentation and sponsor responsibility but fails on version control: off-the-shelf
software is version-locked, and a foundation model may be updated by its developer. The draft lifecycle
guidance (Jan. 7, 2025), still a draft, would have a sponsor specify any pre-trained model, its pretraining dataset, and how it was obtained; “foundation model” does not appear in its body text.32 The
Quality Management System Regulation incorporates ISO 13485 through § 820.10(a), with purchasing
Discussion Paper, supra note 1, at 22 & nn.23–24.
21 C.F.R. §§ 814.20(c), 860.220(b); FDA, Device Master Files (Dec. 6, 2023), https://www.fda.gov/medicaldevices/premarket-submissions-selecting-and-preparing-correct-submission/device-master-files (listing six file types, none for
software or models; information already in the public domain is subject to disclosure).
FDA, Executive Summary for the Digital Health Advisory Committee Meeting: Total Product Lifecycle Considerations for
Generative AI-Enabled Devices 17 (Nov. 20–21, 2024), https://www.fda.gov/media/182871/download; see also id. at 4
(foundation models are not generally intended for use as a device); Discussion Paper, supra note 1, at 21 (changes to the
underlying model may be initiated by the foundation model developer).
FDA, Artificial Intelligence-Enabled Device Software Functions: Lifecycle Management and Marketing Submission
Recommendations: Draft Guidance for Industry and Food and Drug Administration Staff 26 (Jan. 7, 2025),
https://www.fda.gov/media/184856/download; see 90 Fed. Reg. 1154 (Jan. 7, 2025) (requesting comment on documentation for
generative AI).
requirements located, per FDA’s preamble, in the supplier controls of clause 7.4; whether they reach a
model accessed through an interface depends on whether it is a purchased product or outsourced
process and a “component” under § 820.3. 33 Section 514(c)(1)(A) allows FDA to recognize a
consensus standard for model documentation and accept a declaration of conformity under section
514(c)(3)(A), if a standards development organization produces one.34
FDA could establish a voluntary Foundation Model MAF through an update to the Device Master File
program and guidance, without rulemaking; CDRH should consider stating the basis for incorporation
by reference for each pathway, confining confidentiality to information within § 20.61, aligning the
content with the lifecycle guidance’s pre-trained model item and the OTS software approach, and
stating that the sponsor’s burden under § 860.7(g)(1) is unchanged. If CDRH sought disclosure from a
foundation model developer that is not itself a manufacturer or importer of a device, section 519(a)
would not reach it; that step would require legislation.35

Question 5 (Section IV): Intended use and multi-turn conversations (short answer)
Intended use is objective: under 21 C.F.R. § 801.4 it may be shown by the circumstances surrounding
the distribution of the article, including “the design or composition of the article,” not by labeling alone.
The conversational trajectories a design necessarily produces are therefore evidence of intended use,
and a disclaimer such as “talk to your doctor” does not subtract from that evidence, as the paper itself
observes.36 For a 510(k) device, section 513(i)(1)(E)(i) permits the Director of CDRH to require a
labeling statement on a written determination that the device is reasonably likely to be used for an
intended use not identified in the proposed labeling and that such use could cause harm.37 FDA could
apply § 801.4 in that way in classification and premarket review without any further instrument.

Question 8 (Section V): The two-axis framework and the degree of evidence (short answer)
The degree of evidence is fixed by law at three points: classification under section 513(a)(1), governed
by the factors in section 513(a)(2)(A)–(C); the provision of 21 C.F.R. § 860.7(c)(2) that the evidence
required “may vary according to the characteristics of the device, its conditions of use” and other
factors; and, for a 510(k), substantial equivalence with “appropriate clinical or scientific data if deemed
necessary” under section 513(i)(1)(A)(ii)(I). 38 The two-axis framework, which the paper calls “a
possible organizing heuristic,” can serve as an input when FDA applies those provisions; it is not an
21 C.F.R. §§ 820.3, 820.10(a); Medical Devices; Quality System Regulation Amendments, 89 Fed. Reg. 7496, 7510 (Feb. 2,
2024) (response to comment 40).
21 U.S.C. § 360d(c)(1)(A), (c)(3)(A).
21 U.S.C. § 360i(a); Discussion Paper, supra note 1, at 5. Whether a foundation model incorporated into a device is a
"component" under section 201(h)(1), so that its developer is a manufacturer of a device for purposes of section 519(a), is not
resolved here; the text assumes a developer that is not.
Discussion Paper, supra note 1, at 7.
21 U.S.C. § 360c(i)(1)(E)(i) (intended use based on proposed labeling; Director's labeling statement under subclauses (I)–(II)).
21 U.S.C. § 360c(a)(1), (a)(2)(A)–(C), (i)(1)(A)(ii)(I); Discussion Paper, supra note 1, at 5 ("a possible organizing heuristic").
evidentiary tier of its own. FDA could use it in that way through its classification and premarket review
procedures; a freestanding tier would require rulemaking amending § 860.7.

Closing
This comment has connected the paper’s options to the provisions and instruments that would carry
them. The author would welcome the opportunity to provide further analysis on any question addressed
here, or to take part in the public process that follows, including any meeting of the Digital Health
Advisory Committee on these topics.

Respectfully submitted,

Gary Hsuanyu Liu, J.S.D.
Health and Human Information Policy Research Fellow
Cordell Institute for Policy in Medicine and Law
Washington University in St. Louis

This comment is submitted in my individual capacity. My institutional affiliation is provided for
identification purposes only and does not indicate endorsement by Washington University in St.
Louis or the Cordell Institute for Policy in Medicine and Law.