Align Technology, Inc. (Ahanitha Ashok)

See attached file.

Docket No. FDA-2026-N-7874
For: “Considerations for the Regulation of Generative AI-Enabled Medical Devices” Discussion Paper
and Request for Feedback
Submission Method: Federal eRulemaking Portal: https://www.regulations.gov.
Submitted by: Align Technology Inc. (hereafter referred to as Align)

October 19, 2026

Dear CDRH,
We appreciate the opportunity to provide feedback on FDA's discussion paper, Considerations for the
Regulation of Generative AI-Enabled Medical Devices. We support FDA's proactive effort to engage
stakeholders and establish a risk-based regulatory framework that promotes innovation while ensuring the
safety and effectiveness of generative AI (GenAI)-enabled medical devices. FDA notes that the
discussion paper seeks stakeholder input on risk assessment, premarket evaluation, postmarket
monitoring, and other regulatory considerations for GenAI-enabled medical devices.
As a manufacturer of medical devices and digital health technologies, Align recognizes the potential of
GenAI to enhance clinical decision-making, improve workflow efficiency, and support personalized care.
At the same time, GenAI introduces unique challenges related to output variability, transparency,
reproducibility, model governance, and lifecycle management. Our comments focus on practical
considerations for manufacturers developing clinician-facing software functions and AI-enabled medical
devices.
Comments below are grouped by topic area as outlined in the corresponding Request for Public
Comment.

Section IV.A – Assessment of Risk (Q1–Q6)
Q1. Adequacy of the two-axis risk framework and additional risk dimensions
Align supports the two-axis framework as a heuristic. Recommend adding (a) reversibility of the resulting
action and (b) output traceability/grounding as explicit modifiers and assessing a function by the realistic
range of its outputs rather than a single nominal cell. Downstream safeguards should include controls
already built into a larger device, such as clinician review and approval of the device output, when the
GenAI function is a sub-component.
Because the discussion paper builds on FDA’s existing framework for regulating software as a medical
device and AI/ML-enabled devices, recommend that FDA state explicitly that the framework is anchored
to existing device classification, intended use and established software requirements (risk management,
design controls, change control), so that lower-consequence, HCP-supervised functions are not subject to
the same rigor as high-consequence functions.
Questions to FDA
1. Will FDA clarify how the two-axis framework interacts with existing device classification (Class
I/II/III) and product codes, so that it is not an independent classification layer?

Page 1 of 11
 2. How should a sponsor document placement on the framework when a single GenAI function can
produce outputs spanning more than one cell?

Q2. Spectrum from non-directive to action-directing information
Align supports treating directiveness as a continuum. Recommend FDA define a small number of
illustrative tiers (general information, contextualized information, recommendation, specific instruction)
with examples, and accept sponsor-controlled output constraints (e.g., restricted response templates,
prohibited instruction types) as risk modifiers, while agreeing that disclaimers alone are not sufficient
mitigation.
Directiveness should modify risk within device oversight, not determine device status. Consistent with
FDA’s existing clinical decision support framework, a non-directive output can still be a device function
where it is based on analysis of medical images, signals or patterns.
Questions to FDA
1. Would FDA accept verified output constraints (e.g., the device is validated not to produce specific
dosing instructions) as evidence that a function remains at a lower directiveness tier?
2. Will FDA provide worked examples of directiveness tiers for HCP-facing and patient-facing
functions in any future guidance?

Q3. Patient-facing versus HCP-facing functions
Align supports an intended use-driven approach rather than a presumption that all patient-facing functions
are higher risk. Recommend that risk increase for patient-facing functions only where the output is actiondirecting on the consequence axis, and that FDA recognize mitigations such as escalation to a clinician,
scope limitation, readability testing and source citation.
Questions to FDA
1. For patient-facing functions that operate within HCP-defined parameters (for example, remote
treatment-monitoring notifications which are generated from doctor-set assessment thresholds and
notification settings and confirmed by trained personnel before delivery), would FDA base the risk
assessment on the HCP-defined decision logic, rather than treating the use of GenAI to phrase or
personalize the patient message as increasing risk?
2. Would FDA consider HCP-preset parameters and human verification of outputs before delivery to
patients (human-in-the-loop) as downstream safeguards that lower the function’s position on the
activity or consequence axis?
3. Where patient-facing instructions are limited to low-consequence, reversible actions within a
prescribed treatment (e.g., continue wearing the current aligner, advance to the next aligner, contact
the doctor), would FDA consider such functions to sit low on the consequence axis, even though
they are action-directing?

Q4. Generalist versus specialist HCP users
Align recommend that intended-user specification in labeling, combined with scope-maintenance controls
(benchmark element S.2), be the primary mitigation, and that the generalist/specialist distinction be
treated as a modifier rather than a separate risk category.

Page 2 of 11
Questions to FDA
1. Would FDA expect separate performance evidence for each intended-user category (e.g., general
dentist vs. orthodontist) when a device is labeled for both?

Q5. Multi-turn conversational trajectories
Align recommend that intended use be defined by the highest-directiveness behavior the device is
designed or validated to allow, with trajectory-based testing (multi-turn simulated encounters) and
conversation-level guardrails as the means to show the device stays within that bound.
Questions to FDA
1. Will FDA accept a defined set of representative multi-turn test scenarios, with prespecified drift and
scope-breach acceptance criteria, as sufficient evidence of conversational-trajectory risk control?

Q6. Under- and over-escalation in care escalation functions
Align supports considering both directions of error. Recommend that sponsors prespecify context-specific
acceptance criteria for under- and over-escalation separately (with under-escalation weighted more
heavily for time-critical conditions) and demonstrate consistency of escalation behavior across repeated
runs and paraphrases.
Questions to FDA
1. Will FDA provide examples of acceptable approaches for weighting under- versus over-escalation,
or will this be left entirely to sponsor justification?

Section V.E – Competency-Based Premarket Evaluation (Q7–Q17)
Q7. Competency-based approach (benchmarking followed by clinical confirmation)
Align supports the competency-based approach (benchmarking followed by clinical confirmation) and
evaluation of the final user-facing device as configured. Recommend that FDA confirm that
benchmarking and clinical confirmation scope scale with risk, and that existing verification and
validation, human factors and software documentation continue to apply.
Recommend that FDA consider the EU approach to clinical evidence for medical device software as a
reference point for scaling clinical evidence to risk. MDCG 2020-1 (Guidance on Clinical Evaluation
(MDR) / Performance Evaluation (IVDR) of Medical Device Software) addresses how to determine the
appropriate level of clinical evidence for software, structured around valid clinical association, technical
performance and clinical performance. The EU MDR also allows clinical evaluation based on non-clinical
data, with adequate justification, for lower-risk devices (Article 61(10)), and supplements premarket
evidence with post-market clinical follow-up.
Questions to FDA
1. How will competency-based evidence be integrated with existing premarket submission content
(e.g., software documentation, human factors, bench performance testing) to avoid duplicative
testing?
2. Is clinical confirmation expected for all risk levels, or can it be waived for lower-risk GenAIenabled devices? If not fully waived, can clinical evidence for lower-risk devices shift from
premarket clinical confirmation to greater reliance on postmarket monitoring?

Page 3 of 11
Q8. Using the two-axis framework to set the level of evidence
Align position
Recommend that FDA publish an illustrative mapping from two-axis position (and device class) to
expected benchmarking elements and clinical confirmation approaches, so sponsors can predict evidence
expectations at the pre-submission stage.
Questions to FDA
1. Will FDA provide an evidence-tiering table linking risk-framework position to expected
benchmarking elements and clinical confirmation methods?

Q9. Adequacy of the benchmarking structure
Align supports the element structure and the principle that elements are selected by intended use and risk.
Recommend that FDA add or clarify privacy/data leakage, groundedness/citation accuracy and
cybersecurity considerations, and explicitly cross-reference existing FDA premarket cybersecurity
expectations rather than creating parallel requirements.
Questions to FDA
1. Which externally developed standards or consensus test methods does FDA anticipate recognizing
for GenAI benchmarking elements?
2. How should prompt-injection testing under S.2 and A.1 relate to cybersecurity documentation
expected in premarket submissions?

Q10. Benchmark validity, contamination and sponsor-developed benchmarks
Align recommend that sponsors show their benchmark tests the capability the device is intended to
have—not just whether it can guess the expected answer from clues in the question, answer choices or
accompanying text.
If a device is intended to use a patient’s image or scan, compare its performance on the full case with its
performance when that image or scan is removed, obscured or, where appropriate, replaced with an
unrelated one. Report the results and investigate if performance changes little or not at all. This
comparison can help show whether the device is using the patient input as intended. It should be one part
of evaluating the benchmark, not a stand-alone pass-or-fail test.
Continue to allow sponsor-developed benchmarks when their clinical relevance and safeguards against
test-set exposure are justified. This is important for specialty areas such as orthodontics, where public
clinical benchmarks may be limited.
Questions to FDA
1. What minimum evidence of construct validity and sequestration would FDA expect for a sponsordeveloped benchmark used to support a submission?
2. Would FDA consider asking sponsors to compare device performance using the complete patient
input with performance when the relevant input is removed, obscured or, where appropriate,
replaced with an unrelated input? For which types of devices would FDA expect this comparison,
and how should sponsors interpret little or no change in performance?
Q11. Selecting a clinical confirmation approach
Align supports the menu of confirmation approaches and the statement that a prospective study is not
needed in every case. Recommend that retrospective evaluation plus clinician adjudication be accepted
Page 4 of 11
for lower-consequence or HCP-supervised functions, with prospective studies reserved for action-taking
or high-consequence functions.
For lower-risk devices, recommend that FDA consider allowing premarket clinical confirmation to be
waived, with justification, in favor of benchmarking plus a prespecified postmarket surveillance and
performance monitoring plan. This is comparable to the EU MDR approach, which allows justified use of
non-clinical data for lower-risk devices (Article 61(10)) and relies on post-market clinical follow-up, with
MDCG 2020-1 guidance on scaling clinical evidence for medical device software.
Questions to FDA
1. Would data collected outside the United States (e.g., from markets where the device is already
deployed) be acceptable for shadow deployment or retrospective confirmation, and under what
conditions?

Q12. Statistically meaningful performance measurement
Align recommend that FDA provide statistical principles (not fixed sample sizes) covering repeated-run
sampling, inter-rater agreement for rubric scoring, and conditions under which synthetic data may
contribute to performance estimates, including demonstration that synthetic data reproduce the real-data
distribution.
Questions to FDA
1. Will FDA provide statistical expectations for repeated-run testing (number of runs per input) and
acceptable variability for safety-critical versus non-safety-critical outputs?

Q13. Suitability of synthetic data
Align supports synthetic data as a supplement (not a replacement) for real-world data where the
underlying data distribution is well characterized, for example to add input variation (image quality,
phrasing, health literacy) around common presentations. Recommend safeguards such as generation by an
independent method, clinician review of synthetic cases, and comparison against held-out real data.
Recommend against using model-generated synthetic data to establish performance for rare conditions or
small subgroups. The generator cannot reliably reproduce a feature distribution that is not well
characterized, and representativeness cannot be verified against sparse real data. For these populations,
real clinical cases (including multi-site or non-US data) and clinician-curated test cases should be used.
Clinician-authored scenarios may still be used to stress-test safety behaviors, but not to support
performance claims.
Questions to FDA
1. What validation would FDA expect to show that synthetic test data are representative of the
intended deployment population?
2. Does FDA agree that model-generated synthetic data should not be used to support performance
claims for rare conditions or subgroups whose real-world feature distribution is not well
characterized?
Q14. Comparators and acceptance criteria for open-ended outputs
Align recommend that the comparator follow the intended use: human-AI team performance where the
device is used under clinician oversight, and standalone performance against standard of care for

Page 5 of 11
autonomous or high-consequence functions. Request that FDA give guidance on acceptable variability of
open-ended outputs and on defining acceptance thresholds.
Questions to FDA
1. For devices used under continuous clinician oversight, will FDA accept human-AI team
performance as the primary endpoint?
2. Will FDA specify whether there are required KPIs and what accuracy thresholds are acceptable, or
provide examples of acceptance criteria and KPIs for open-ended outputs?

Q15. Comparing against care without the device
Align supports allowing absence-of-device comparators (e.g., unaided clinical judgment, delayed
specialist review) where justified by the intended use and clinical workflow, as part of benefit-risk
assessment.
Questions to FDA
1. How should a sponsor justify an absence-of-device comparator, and would FDA accept published
data on current-practice performance for that purpose?

Q16. Role of independent third parties
Align supports voluntary third-party roles (sequestered datasets, independent adjudication, MDDTqualified tools, standards development), provided sponsor-developed evidence remains acceptable and
participation does not become a de facto requirement or bottleneck.
Recommend that any third-party role be supported by verifiable independence criteria: disclosure of
financial, funding and equity relationships with the sponsor and with foundation-model developers;
accreditation; and periodic audit. Recommend safeguards against dataset leakage: evaluation without
releasing test data to developers, access controls and logging, periodic refresh and retirement of test items,
and contamination checks. Without these safeguards, a third-party determination should not carry more
weight than well-controlled sponsor-generated evidence.
Questions to FDA
1. Would third-party participation be voluntary, and how would FDA weigh a third-party
determination against sponsor-generated evidence?
2. How would FDA define and verify the independence of third parties, including from foundationmodel developers, and what controls would FDA expect to prevent sequestered datasets from
leaking into model training data over time?

Q17. Applying the approach to other model architectures
Align recommend that FDA confirm that for vision-language and 3D/imaging-based generative models,
established imaging performance testing can be combined with the relevant subset of competency
elements, rather than applying conversational elements that are not relevant to the device. For devices that
rely on image or 3D inputs, consider the with/without-input comparison described under Q10 where
relevant. For devices that generate design outputs, such as 3D geometry, evaluate the output against

Page 6 of 11
prespecified engineering and clinical requirements rather than relying only on conversation- or text-based
benchmarks.
Questions to FDA
1. How would the competency-based approach apply to generative models whose outputs are images
or 3D models (e.g., predicted treatment outcomes) rather than text, including generative
components that produce design geometry within a larger device whose outputs are verified against
engineering specifications?
2. Would FDA accept a live check, in production by a non-ML automated QC component checking
against engineering and clinical requirements as acceptable performance testing?

Section VI.D – Postmarket Monitoring and Change Control (Q18–Q24)
Q18. Accepting premarket uncertainty in exchange for postmarket monitoring
Align supports greater reliance on postmarket monitoring for lower-consequence and HCP-supervised
functions, conditional on a prespecified monitoring plan with defined metrics, thresholds and escalation
actions. Oppose reduced premarket evidence for autonomous action-taking or high-consequence
functions.
Questions to FDA
1. What minimum elements of a postmarket monitoring program would FDA consider sufficient to
justify reduced premarket evidence?

Q19. Postmarket performance evaluation approaches
Align supports a risk-proportionate combination of periodic re-benchmarking, sample-based clinician
review and drift monitoring, integrated with existing complaint handling, trending, adverse event
reporting and CAPA processes rather than a separate system. Recommend that cadence be risk-based with
event-driven triggers (component or configuration changes, threshold breaches).
Questions to FDA
1. Manufacturers have established postmarket processes for AI/ML-enabled devices covering
performance monitoring, complaint handling, Medical Device Reporting and corrections and
removals. Does FDA intend these existing AI/ML approaches to apply to GenAI-enabled devices?
If not, which GenAI-specific characteristics would FDA expect to be handled differently?
2. What are FDA’s minimum expectations for post-market surveillance of GenAI-enabled medical
devices, including categorization of GenAI-specific failures and application of MDR requirements,
particularly the interpretation of “malfunction” for GenAI-generated outputs?

Q20. Machine-based supervisory agents
Align supports automated monitoring only in a narrow, supporting role: detecting predefined failure types
(e.g., missed escalation, scope violations, inconsistency across repeated outputs, departure from source
material) to prioritize cases for clinician review. Do not support general-purpose supervisory agents as a
substitute for clinician review or as primary evidence of device performance. A monitor able to judge any
clinical output reliably would need to be at least as capable as the device, which limits its practicality.

Page 7 of 11
Where automated monitors are used, recommend that they be validated for detection sensitivity on the
defined failure types, that independence from the device be shown by testing that their misses are not
correlated with the device’s errors (rather than assumed from a different model family), and that clinician
review of flagged and randomly sampled cases be maintained.
Questions to FDA
1. Would FDA regard a supervisory agent used only for monitoring as a quality-system tool subject to
software validation, rather than as a device component?
2. What evidence would FDA expect to show that an automated monitor is sufficiently independent of
the device it monitors, given that many GenAI models share architectures and training data?

Q21. Ecosystem roles in postmarket monitoring
Align supports FDA’s defined ecosystem roles (e.g., site-level performance feedback, professionalsociety input on rubrics and standards) while keeping regulatory accountability clearly with the
manufacturer. Recommend that FDA clarify expectations for foundation-model developers, who are
otherwise outside the manufacturer’s quality system.
Align recommend that FDA consider the role definitions in the EU AI Act (Regulation (EU) 2024/1689)
to promote global harmonization. The Act separately defines the ‘provider’ (develops an AI system or
general-purpose AI model and places it on the market under its own name), the ‘deployer’ (uses an AI
system under its authority), the ‘downstream provider’ (integrates an AI model, whether its own or
supplied by another entity under contract, into an AI system), and importers and distributors. It also
places transparency obligations on providers of general-purpose AI models, including technical
documentation and information for downstream providers. These concepts correspond closely to the
foundation-model developer, device manufacturer and deploying institution roles discussed in the paper.
Questions to FDA
1. What obligations, if any, do FDA envision for foundation-model developers or deploying
institutions in postmarket monitoring of GenAI-enabled devices?
2. Will FDA consider harmonizing role definitions and information-sharing expectations for
foundation-model developers with the EU AI Act, to limit divergent requirements for
manufacturers marketing globally?

Q22. Scaling re-benchmarking and change control to the nature of a modification
Align proposes three tiers:
(1) interface wording or formatting with no model or logic change, managed in the QMS with targeted rebenchmarking; (2) prompt, retrieval or guardrail changes within prespecified bounds, managed through a
PCCP with re-benchmarking of the safety (S.1–S.3) and robustness (R.1) elements; and (3) foundationmodel replacement, a new indication, a new population, or increased directiveness or autonomy, requiring
a new submission when the change could affect safety & effectiveness. The same tiered logic should
apply when a GenAI component is first introduced into an existing cleared device, assessed under FDA’s
existing software-change guidance.

Page 8 of 11
Questions to FDA
1. Would FDA accept re-benchmarking limited to the elements affected by a change, rather than the
full premarket suite, for limited-scope modifications?

Q23. Adapting PCCPs when future changes cannot be fully specified
Align recommend an ‘acceptance-envelope’ PCCP in which modifications that pass the prespecified rebenchmarking suite and acceptance criteria remain within the authorized PCCP, limited to changes that
do not alter intended use, user population, directiveness or autonomy.
Questions to FDA
1. Would FDA consider a PCCP whose modification protocol is defined by performance acceptance
criteria rather than an enumerated list of specific modifications?

Q24. Third-party foundation-model changes
Align recommend that FDA recognize, as adequate assurance, a combination of contractual controls
(version pinning, advance change notice, deprecation timelines, access to evaluation data), technical
controls (pinned versions, automatic re-benchmarking on version change, shadow testing, rollback) and
PCCP coverage of model-version updates. Treat an unplanned foundation-model change as a
reassessment trigger.
Questions to FDA
1. Would FDA accept a PCCP that prespecifies the protocol for moving to a successor foundationmodel version (re-benchmarking, shadow testing and acceptance criteria), so that a version change
or retirement initiated by the model developer can be implemented without a new marketing
submission when the prespecified criteria are met?

Section VII.C – Foundation Model MAFs and Agentic AI (Q25–Q26)

Q25. Voluntary Foundation Model Device Master Files (MAFs)
Align supports voluntary Foundation Model MAFs, with a standard content template, version-specific
updates and change-notice commitments. Ask FDA to clarify what premarket evidence a referenced MAF
can replace, and to confirm that sponsors without a MAF can demonstrate adequate control through
contractual and technical means plus their own testing.
Questions to FDA
1. How will FDA treat a foundation model referenced through a MAF relative to other third-party or
off-the-shelf software in a submission?
2. What evidence would a sponsor still need to provide on the foundation model if a MAF is
referenced, and if no MAF is available?

Q26. Additional considerations for agentic GenAI-enabled devices
Align supports additional oversight for agentic device functions, scaled to the reversibility and
consequence of actions: mandatory human confirmation before irreversible or high-consequence actions,

Page 9 of 11
action limits, audit logs, rollback, and injection-resistance testing across all input channels. Treat the
addition of new tools or permissions as a significant change.
Recommend that agentic device functions operate with least-privilege access to tools, data and connected
systems, with network segmentation consistent with FDA’s premarket cybersecurity expectations, and
that users be able to halt agentic actions and revert to manual operation at any time.
Recommend that FDA confirm that agentic GenAI used for administrative or operational functions (e.g.,
scheduling, billing, documentation or outreach that does not meet the device definition) is outside device
oversight, and that device-specific agentic controls apply only to device functions.
Questions to FDA
1. How will FDA determine when an agentic workflow containing both device and non-device steps
becomes a device function? Will FDA also confirm that agentic systems performing only
administrative or operational functions outside device oversight?
2. Will FDA specify minimum human-oversight controls (e.g., confirmation checkpoints, halt
capability, least privilege access) for agentic devices that can take irreversible actions?

General and Crosscutting Comments

Align position
Prioritize comments on the risk classification framework, agentic AI oversight, and PCCPs/change
management. Request that FDA anchor any GenAI framework to existing device classification, intended
use and quality system requirements rather than creating a parallel regime.
Request that FDA address cybersecurity and privacy explicitly for GenAI-enabled devices (e.g., prompt
injection, data leakage, access controls for agentic systems) and cross-reference existing premarket
cybersecurity expectations.
Request that FDA clarify how the framework applies when a GenAI-enabled function is a sub-component
within a larger device whose existing controls remain in place. An example is a generative model used
internally to propose design features (e.g., device geometry) that remain subject to the device’s existing
design verification, rule-based checks and clinician review and approval before manufacture.
For such components, recommend that:
(a) risk be assessed for the component in the context of the downstream safeguards already built into the
device, consistent with the ‘availability of downstream safeguards’ dimension raised in Q1;
(b) evidence focus on the component’s outputs against the device’s existing performance specifications,
with benchmarking elements selected only where relevant (conversational elements would generally not
apply); and
(c) introducing a GenAI component into a cleared device be assessed under FDA’s existing policy on
software changes to existing devices, rather than presumptively triggering new GenAI-specific
requirements.

Page 10 of 11
Questions to FDA
1. What is the anticipated timeline and format (e.g., draft guidance, pilot program) for next steps
following this discussion paper?
2. Section III states that the paper addresses the GenAI-enabled component of a broader device rather
than the entire device, while Section V.A states that the final user-facing device, not an isolated
subcomponent, would be evaluated. How does FDA intend to apply the risk framework and
competency-based evaluation to a GenAI component embedded within a larger device?
3. When a GenAI component replaces or augments an existing algorithm within a cleared device,
without changing intended use and with existing design controls and clinician review in place, will
FDA apply its existing software-change guidance to determine whether a new submission is
needed? What GenAI-specific factors, if any, would FDA expect that assessment to consider?

We appreciate the opportunity to provide feedback and support FDA’s efforts to engage stakeholders and
establish a risk-based regulatory framework that promotes innovation while ensuring the safety and
effectiveness of generative AI (GenAI)-enabled medical devices.
If you have any questions regarding these comments, please reach out to Lifei Liu (l_liu@aligntech.com)
or Ahanitha Ashok (aashok@aligntech.com).

Sincerely,

Ahanitha Ashok
Principal Regulatory Affairs Specialist
Align Technology, Inc.
2820 Orchard Parkway, San Jose, CA, 95134
Company Phone: +1 408-470-1000
Email: aashok@aligntech.com

Page 11 of 11