Frontier Governance Group (Jessica R. Smith)

Frontier Governance Group respectfully submits the attached comments in response to FDA’s August 2026 discussion paper, Considerations for the Regulation of Generative AI-Enabled Medical Devices: Discussion Paper and Request for Feedback.

These comments principally address the relationship between premarket uncertainty, competency-based premarket assessment, and postmarket monitoring, including considerations relevant to agentic AI-enabled medical devices.

Respectfully submitted,
Jessica R. Smith, JD, AIGP, CIPP/US
Founder, Frontier Governance Group

COMMENTS OF FRONTIER GOVERNANCE GROUP

Premarket Evidentiary Standards and
Postmarket Monitoring
for GenAI-Enabled Medical Devices
In response to Considerations for the Regulation of Generative AI-Enabled Medical Devices:
Discussion Paper and Request for Feedback
U.S. Food and Drug Administration, Center for Devices and Radiological Health
August 2026

Jessica R. Smith, JD, AIGP, CIPP/US
Founder, Frontier Governance Group

Jessica R. Smith, JD, AIGP, CIPP/US, Founder of Frontier Governance Group (FGG),
respectfully submits these comments in response to the Center for Devices and Radiological
Health's discussion paper concerning the regulation of generative artificial intelligence
(GenAI)-enabled medical devices. FGG focuses on governance and assurance questions
raised by increasingly capable AI systems, including the evidentiary standards necessary to
support responsible deployment and continuing oversight.

Executive Summary
FGG supports CDRH's effort to develop a risk-proportionate, total product life cycle
approach for GenAI-enabled medical devices. The discussion paper correctly recognizes
that open-ended inputs and outputs, variable behavior, evolving system components, and
reliance on third-party foundation models can make exhaustive premarket testing
impracticable. FGG also supports CDRH's exploration of competency-based premarket
evaluation, including device benchmarking and clinical confirmation.

FGG's principal concern relates to CDRH's Question 18: whether greater premarket
uncertainty regarding a GenAI-enabled device's benefit-risk profile may be acceptable when
accompanied by greater reliance on postmarket monitoring. Before adopting such an
approach, CDRH should define what constitutes permissible 'premarket uncertainty.' Not
all uncertainty is equivalent. Postmarket monitoring may be appropriate for irreducible
residual uncertainty that remains after rigorous, risk-proportionate premarket assessment;
it should not operate as a substitute for evidence that reasonably could and should have
been generated before patient exposure, and it should not compensate for known
performance deficiencies.

FGG therefore recommends that CDRH establish a risk-proportionate premarket
evidentiary floor, develop a taxonomy of residual uncertainty, and specify which categories
of uncertainty may appropriately be managed through postmarket evidence. For
high-consequence or highly autonomous systems, the permissible degree of residual
uncertainty should be correspondingly lower. Continuous assurance should extend
premarket assurance, not defer it.

Frontier Governance Group 1
 I. CDRH's Proposed Premarket Framework Is an Important Starting Point
The discussion paper does not contemplate postmarket monitoring in isolation. CDRH
describes a competency-based approach to premarket evaluation consisting of non-clinical
device benchmarking followed by clinical confirmation. Under the contemplated approach,
the final user-facing device, as configured and intended for real-world deployment, would
be evaluated rather than the foundation model standing alone or another isolated
subcomponent.

CDRH further contemplates tailoring the nature, rigor, and amount of evidence to intended
use and risk. Proposed benchmarking elements include safety-critical recognition and
escalation; scope maintenance and boundary adherence; calibration, uncertainty
communication, and clinical deferral; clinical knowledge and task fidelity; information
gathering and clinical analysis; quantitative and measurement analysis; communication
quality; robustness, reliability, reproducibility; subgroup performance; and additional
competencies for agentic AI.

The proposed clinical-confirmation stage is also significant. CDRH recognizes that
structured benchmarking may not establish how a GenAI-enabled device will perform with
actual users, workflows, and patient populations. The paper therefore identifies a range of
possible confirmation methods, including retrospective evaluation on real patient inputs,
shadow deployment, standardized patient interactions, clinician adjudication of real cases,
and prospective clinical studies.

FGG agrees with the basic premise that GenAI may require evaluation methods different
from those developed for bounded software. The central policy question, however, becomes
what uncertainty may remain after this premarket process and still be consistent with
reasonable assurance of safety and effectiveness.

II. CDRH Should Define 'Premarket Uncertainty' Before Relying on Postmarket
Monitoring to Address It
Question 18 asks whether CDRH might accept greater premarket uncertainty regarding a
GenAI-enabled device's benefit-risk profile through greater reliance on postmarket
monitoring. The question is important, but the term 'premarket uncertainty' is potentially
too broad to serve as an operational regulatory standard without further differentiation.

GenAI systems may necessarily retain uncertainty after reasonable premarket evaluation.
Open-ended conversational trajectories may be effectively unbounded; rare combinations of
inputs may not appear in validation datasets; deployment environments may change; and
third-party foundation models may introduce dependencies that cannot be completely
characterized through a finite test program. These circumstances create genuine residual
uncertainty.

But uncertainty can also arise because evidence is incomplete, testing is insufficiently
representative, clinically relevant subgroups have not been adequately evaluated,
foreseeable failure modes have not been tested, or an identified performance limitation has
not been remediated. Those circumstances present a materially different regulatory
problem. A robust postmarket program should not transform inadequate premarket
evidence or a known material performance deficiency into an acceptable basis for market
entry.

Frontier Governance Group 2
 III. CDRH Should Adopt a Taxonomy of Premarket Uncertainty
FGG recommends that CDRH distinguish at least the following categories when
determining whether uncertainty may appropriately be managed after authorization:

Category Illustrative Example Role of Postmarket Monitoring

Irreducible residual Long-tail or rare behavior that cannot Potentially appropriate, subject to risk,
uncertainty reasonably be exhausted through detectability, monitoring capability, and
premarket testing despite a rigorous and timely mitigation.
representative evaluation.

Evidence uncertainty Insufficient clinical confirmation, Should not ordinarily be cured by
inadequate subgroup representation, or surveillance when the evidence could
insufficient testing of reasonably reasonably be generated premarket.
foreseeable conditions.

Known performance Premarket testing identifies a material Should not be offset by a promise to
deficiency safety weakness, unacceptable failure monitor the deficiency after deployment.
mode, or failure to satisfy a prespecified
acceptance criterion.

This taxonomy would help ensure that the phrase 'greater premarket uncertainty' does not
inadvertently collapse fundamentally different evidentiary conditions into a single category.
It would also give sponsors greater predictability regarding the circumstances in which
postmarket evidence can legitimately carry greater weight.

IV. Establish a Risk-Proportionate Premarket Evidentiary Floor
FGG recommends that CDRH establish an evidentiary floor that must be satisfied
independently of the strength of a proposed postmarket monitoring program. The floor need
not be identical across devices. Consistent with CDRH's proposed risk framework, it should
scale with the activity performed by the device and the consequences of relying on an
incorrect output.

Only after that floor has been satisfied should CDRH determine whether remaining
uncertainty is the type that can appropriately be managed through postmarket evidence.
The permissible amount of residual uncertainty should decrease as the severity of potential
harm, degree of autonomous action, irreversibility of an action, time pressure, difficulty of
detecting failure, and absence of meaningful human intervention increase.

This distinction is important because premarket assessment and postmarket monitoring
perform different safety functions. Premarket assessment can prevent exposure to
inadequately characterized risks. Postmarket monitoring generally detects emerging or
previously unobserved problems after exposure has begun. Although postmarket evidence
is indispensable for adaptive and open-ended systems, these controls are therefore
complementary rather than interchangeable.

Frontier Governance Group 3
 V. The Time-to-Detection Problem Should Inform the Amount of Permissible
Residual Uncertainty
CDRH should also consider how many patients may be exposed before a postmarket
monitoring program can reliably detect a failure signal. This is particularly important for
low-frequency, high-severity failure modes. Aggregate performance can remain strong even
while a rare failure mode creates substantial harm.

Accordingly, the appropriateness of relying on postmarket evidence should depend not only
on the expected frequency of error but also on severity, reversibility, detectability,
time-to-harm, expected time-to-signal, exposure volume before detection, and the
manufacturer's ability to intervene promptly once a signal is detected. Where harm may be
catastrophic, immediate, difficult to detect, or irreversible, postmarket surveillance is a
substantially weaker substitute for premarket characterization.

VI. Agentic Systems Require Particular Caution
CDRH defines agentic AI systems as GenAI-enabled systems that autonomously plan and
execute multi-step tasks, use external tools, or take actions across a sequence of steps. The
discussion paper appropriately asks how autonomous multi-step action, tool use, and
reduced opportunity for human review should affect acceptance criteria and oversight.

For these systems, FGG recommends that CDRH evaluate not only final outputs but also
consequential decision-and-action trajectories. An agent may reach an apparently
acceptable final result while employing unsafe intermediate reasoning, inappropriate tool
calls, unauthorized actions, or unreliable escalation behavior. Premarket competency
assessment should therefore test representative multi-step trajectories, including error
recovery, tool failure, conflicting information, boundary conditions, escalation, and attempts
to act outside authorized scope.

Similarly, postmarket monitoring should assess behavioral or trajectory drift, not merely
output drift. A system may maintain stable aggregate output metrics while materially
changing how it plans, selects tools, escalates, or executes actions.

VII. Human Oversight Should Be Evaluated for Meaningfulness, Not Merely
Presence
FGG also recommends that CDRH avoid treating 'human-in-the-loop' as a binary risk
mitigator. Human involvement reduces risk only when the human has adequate information,
authority, competence, and time to intervene before an unsafe action becomes irreversible.

A workflow in which an autonomous system executes an action and a clinician receives
notice afterward is materially different from one in which the system proposes an action,
presents the relevant basis and uncertainty, and requires clinician authorization before
execution. The regulatory framework should account for the practical effectiveness and
timing of oversight rather than the nominal presence of a human somewhere in the
workflow.

Frontier Governance Group 4
 VIII. Third-Party Foundation Models Reinforce the Need for Evidentiary Continuity
The discussion paper correctly identifies a difficult change-control problem for devices built
on third-party foundation models: the underlying model may be modified by an entity other
than the device manufacturer. CDRH asks whether contractual, technical, or Predetermined
Change Control Plan mechanisms could help manufacturers detect, evaluate, and respond
to such changes.

FGG supports treating the deployed device configuration and its material dependencies as
the relevant assurance object. Premarket evidence should establish a baseline against
which changes to foundation models, prompts, retrieval strategies, guardrails,
orchestration logic, tools, and other material dependencies can be evaluated. A material
change should trigger proportionate re-evaluation when it could affect the competencies or
risk controls on which authorization relied.

IX. Recommended Principles for Question 18
1. Define premarket uncertainty. CDRH should distinguish irreducible residual uncertainty
from uncertainty caused by incomplete evidence and from known performance deficiencies.

2. Establish a premarket evidentiary floor. A device should satisfy minimum
risk-proportionate evidence requirements independently of any proposed postmarket
monitoring program.

3. Limit postmarket reliance to appropriate residual uncertainty. Postmarket evidence
should principally address uncertainty that cannot reasonably be resolved before
deployment, emerging risks, real-world generalizability, drift, and material changes.

4. Reduce permissible uncertainty as risk increases. High-consequence, highly autonomous,
difficult-to-reverse, or difficult-to-monitor functions should carry a lower tolerance for
unresolved uncertainty at authorization.

5. Consider time-to-detection and exposure-before-signal. CDRH should evaluate whether
monitoring can identify a safety problem quickly enough to prevent unacceptable patient
exposure.

6. Preserve clear acceptance criteria. A failure to satisfy a material premarket acceptance
criterion should not ordinarily be cured through a postmarket monitoring commitment.

7. Require evidentiary continuity across the total product life cycle. Postmarket monitoring
should test continued conformity with the competencies and safety assumptions established
premarket.

X. Conclusion
FGG supports CDRH's effort to develop a flexible and scientifically sound framework for
GenAI-enabled medical devices. The characteristics that make GenAI difficult to evaluate
exhaustively also make postmarket evidence particularly important. The existence of
unavoidable uncertainty, however, should not obscure the distinction between residual
uncertainty and insufficient evidence.

CDRH can preserve the benefits of a total product life cycle approach by establishing a
clear premarket evidentiary floor and specifying the categories and degree of uncertainty

Frontier Governance Group 5
 that may appropriately remain at authorization. Postmarket monitoring should extend a
demonstrated foundation of safety and effectiveness; it should not serve as a mechanism for
deferring evidence that reasonably should be available before patients are exposed.

Continuous assurance should extend premarket assurance, not become deferred assurance.

Source Note
This comment responds to the August 2026 FDA/CDRH discussion paper, Considerations for the Regulation
of Generative AI-Enabled Medical Devices: Discussion Paper and Request for Feedback. The discussion
paper expressly states that it is for discussion purposes only and does not represent draft or final guidance
or proposed/final regulatory expectations.

Respectfully submitted,
Jessica R. Smith, JD, AIGP, CIPP/US
Founder, Frontier Governance Group
October 2026

Frontier Governance Group 6