GE HealthCare (Amir Khan)

See attachments.

Division of Dockets Management (HFA-305)
Food and Drug Administration
5630 Fishers Lane, Rm. 1061
Rockville, MD 20852

Submitted electronically to http://www.regulations.gov

Re: GE HealthCareʼs comments on “Considerations for the Regulation of Generative AI-Enabled Medical
Devices: Discussion Paper and Request for Feedback”

Docket No. FDA-2026-N-7874

To Whom It May Concern:

GE HealthCare appreciates the opportunity to submit comments in response to Considerations for the
Regulation of Generative AI-Enabled Medical Devices: Discussion Paper and Request for Feedback.

GE HealthCare is a leading global medical technology, pharmaceutical diagnostics, and digital
solutions innovator, dedicated to providing integrated solutions, services, and data analytics to make
hospitals more efficient, clinicians more effective, therapies more precise, and patients healthier and
happier. Serving patients and providers for more than 125 years, GE HealthCare is advancing
personalized, connected, and compassionate care, while simplifying the patientʼs journey across the
care pathway. Together, our Imaging, Ultrasound, Patient Care Solutions, and Pharmaceutical
Diagnostics businesses help improve patient care from diagnosis to therapy, to monitoring. We are on
a mission to create a world where healthcare has no limits.

We commend CDRH for its thoughtful and early engagement on Generative AI-enabled devices. Our
detailed responses to the questions are provided in the attached document.

Across those responses, several overarching principles guide our recommendations:

• Build on established medical device frameworks rather than create parallel GenAIspecific regulatory systems: GenAI-specific characteristics may affect risk or evidence needs,
but should generally be addressed within established medical device risk management,
software lifecycle, usability, cybersecurity, quality-system, and change-control frameworks
rather than through parallel regulatory systems. Our comments similarly encourage
consideration of relevant international efforts, including IMDRF N81.
• Keep intended use, clinical consequence, foreseeable reliance, and exposed device
capabilities at the center of regulatory assessment: The use of Generative AI itself should
not determine evidence expectations. Assessment should consider the intended use, the
overall interaction, and the risk of individual capabilities and their combined effect.
• Apply competency-based evaluation flexibly and proportionately: The competency-based
approach can be a useful organizing framework where applicable but should complement
rather than replace established analytical and clinical validation. Benchmarking, acceptance
 criteria, and clinical confirmation should be fit-for-purpose and tailored to intended use,
capabilities, and risk, without fixed methodologies or routine expectations for prospective
studies. Evaluation should emphasize representative and challenging cases rather than testset volume alone.
• Use postmarket monitoring for residual uncertainty, not as a broad substitute for
adequate premarket evidence: Premarket evidence should establish that the device is
sufficiently validated for its intended use and risk profile. Postmarket monitoring can then
address continued performance, emerging signals, and residual uncertainties that cannot
reasonably be resolved premarket. FDA should provide a clear and predictable framework for
monitoring expectations while preserving risk-based, device-specific implementation.
• Evolve PCCPs for GenAI change management: The significance of a modification should
depend on its impact on the device rather than simply which technical component changed.
PCCPs should remain the primary mechanism for foreseeable GenAI-related changes, while
evolving to accommodate foreseeable categories of change that may not be fully defined in
advance, including foundation-model updates. For third-party models, regulatory
expectations should focus on what manufacturers can reasonably detect, evaluate, and
control at the final configured device level.
• Address emerging capabilities such as agentic AI proportionately to the autonomy and
actions exposed by the device: Where devices plan, make decisions, use external tools, or
execute multi-step actions, evaluation should address the safety and reliability of the overall
action sequence as well as individual steps, with appropriate human intervention, traceability,
and system-level testing.

Across these areas, we encourage CDRH to provide clear definitions, internationally aligned principles,
and illustrative examples across representative device types, while preserving technology-neutral,
risk-based, and least burdensome approaches. Greater regulatory clarity will help promote
consistency and predictability while allowing evaluation approaches to evolve with rapidly advancing
technology and clinical practice.

GE HealthCare welcomes the opportunity to continue engaging with CDRH as its approach to
Generative AI-enabled medical devices evolves and would be pleased to discuss these comments
further.

Respectfully submitted,

Amir Khan, Ph.D.
Director Regulatory Affairs-Digital
GE HealthCare
amir.khan@gehealthcare.com
(571)-365-6964

Considerations for the Regulation of Generative AI-Enabled Medical Devices: Discussion
Paper and Request for Feedback

Q1: Does the two-axis risk framework, organized around device activity and the consequence of
relying on an incorrect output, appropriately capture the dimensions most relevant to the risk of a
GenAI-enabled software function? If there are additional dimensions—such as the reversibility of a
resulting action, the availability of downstream safeguards, the time pressure of the deployment
setting, or the traceability of the output (i.e., to primary source materials)—that
should be represented in a risk framework, please describe and provide examples of how they
should be represented.
Q1 response:

We believe the existing medical device risk management framework, including ISO 14971, provides the
appropriate foundation for evaluating risks associated with GenAI-enabled device functions. FDAʼs
proposed two-axis framework is a high-level heuristic for conceptualizing how characteristics of a
GenAI-enabled device function may influence risk, but these considerations should be incorporated
into existing risk estimation and evidence expectations rather than established as a separate risk
framework.

In particular, the activity performed by the GenAI function, degree of autonomy, availability of
downstream safeguards, traceability, reversibility, and time pressure may affect the sequence of
events leading to harm and therefore the probability of harm. In considering how these characteristics
should be incorporated into the assessment of GenAI-enabled device functions, FDA should consider
relevant existing international efforts, including IMDRF document Characterization Considerations for
Medical Device Software and Software-Specific Risk (IMDRF/SaMD WG/N81 FINAL:2025). The
consequences of incorrect output are already addressed through estimation of the severity of harm.
We, therefore, do not recommend adding additional independent axes but instead recommend
treating these characteristics as context-specific factors within the established medical device risk
management process. The approach to estimating probability of harm should remain consistent with
existing medical device risk management principles; GenAI-specific characteristics may affect the
sequence of events and associated probabilities but do not require separate probability calculation
methodology.

Q2: CDRH seeks input on how to account for the spectrum of GenAI-enabled informational
functions that vary in the degree to which they direct a user to a particular action (i.e., between
“non-directive” and “action-directing”). What characteristics of an output—such as its wording,
specificity, personalization, or context—could be considered as modifiers of the risk associated with
an informational function, after accounting for the deviceʼs overall functionality and intended use?
What additional information would provide manufacturers with sufficient clarity and predictability

GE HealthCare - Considerations for the Regulation of Generative AI-Enabled Medical Devices Page 1 of 22
 around risk assessment for informational functions while recognizing that directiveness may exist
along a continuum rather than as a binary distinction?
Q2 response:
We agree with CDRH that the distinction between "non-directive" and "action-directing" informational
functions is not binary, but rather exists along a continuum, and that directiveness depends on the
substance and context of the output, not solely on whether it uses words such as "recommend,"
"should," or "consider." The intended user and their ability to independently evaluate and
appropriately respond to the output are also relevant when assessing foreseeable reliance.
Statements such as "talk to your doctor" or "I am not a medical professional" should not, by
themselves, be assumed to reduce directiveness or foreseeable reliance. Directiveness should
therefore not be assessed based solely on the grammatical form of an individual response.

This is particularly relevant for multi-turn conversational GenAI-enabled software functions, where the
overall interaction, not an individual response, may progressively influence the user's next clinical
action. For example, a user asks, "Can you summarize the key findings from this radiology report?"
The software responds, "The report describes a pulmonary embolism involving a segmental
pulmonary artery in the lower right lobe," which is informational. The user then asks, "What would
typically happen next?" and the software responds, "Patients with pulmonary embolism are typically
evaluated urgently and anticoagulation is commonly considered, depending on the overall clinical
presentation." Although the software never explicitly states, "You should initiate anticoagulation," the
overall interaction may reasonably influence the user's next clinical action, even though no explicit
recommendation has been provided. FDA should therefore evaluate the reasonably foreseeable
reliance created by the overall interaction, rather than the grammatical form of an individual response.

Foreseeable reliance is influenced not only by the content of the output, but also by the intended user
and intended use. The same output may present different levels of risk depending on the intended
user's ability to independently evaluate, verify, and appropriately respond to an incorrect output.
Likewise, a human-in-the-loop should only be considered an effective safeguard where the intended
user can realistically identify and override clinically meaningful errors.

To improve clarity and predictability, FDA should supplement assessment of directiveness by
considering characteristics that influence reasonably foreseeable reliance, including the output's
specificity, personalization, transparency regarding limitations and uncertainty, intended-user
verification capacity, and the availability of effective safeguards. The nature and level of information
provided to support understanding or verification should also be appropriate to the intended user and
use context. These characteristics are better viewed as context-specific modifiers of risk and the
evidence expected for the device, rather than as additional risk dimensions.

FDA may also consider describing informational functions along a continuum from descriptive, to
interpretive, to prioritizing, to recommending, to executing while recognizing that the appropriate
level of evidence should remain proportionate to the device's intended use, risk profile, foreseeable
reliance, and clinical consequence.

GE HealthCare - Considerations for the Regulation of Generative AI-Enabled Medical Devices Page 2 of 22
 Q3: CDRH seeks input on whether and when a GenAI-enabled function that results in delivery of
clinical information to patients, as opposed to HCPs, could present different or higher risks, while
also recognizing the potential benefits associated with improved patient empowerment,
engagement, and access to clinical information. What device characteristics, output features, or
safeguards might mitigate risks that could arise when a user lacks the domain knowledge to
independently evaluate an output, without unnecessarily underestimating patient capability?
Q3 response:
We agree that patient-facing GenAI-enabled functions may present different risk considerations than
HCP-facing functions, particularly where the intended user may have limited ability to independently
evaluate the clinical accuracy or appropriateness of an output. However, patient-facing use should not
be treated as an automatic risk escalator. Risk should remain anchored to the functionʼs intended use,
the clinical consequence of relying on an incorrect output, the degree of foreseeable reliance on the
output, and the availability of appropriate safeguards.

The nature and context of the patient-facing function are important. For example, a function
responding to a patient asking, “I have chest pain, should I go to the emergency room?” may present
greater concerns regarding foreseeable reliance because the output could directly influence a timesensitive clinical action. In contrast, a function that explains an existing test result in plain language
and provides context to help the patient prepare for a subsequent discussion with their HCP may
present different considerations because the output is primarily supporting patient understanding
and engagement rather than directing an immediate clinical action.

Patient-facing status should, therefore, be considered a context-specific risk modifier of foreseeable
reliance and error detectability, including the potential for over-reliance on automated outputs,
particularly where outputs are urgent, specific, personalized, or action-steering, and where users may
not have sufficient domain knowledge, source information, or clinical context to independently
identify and appropriately respond to an incorrect output. Mitigations may include clear intended-use
boundaries, plain-language outputs, appropriate communication of uncertainty and limitations,
source traceability where feasible, avoidance of inappropriately directive language, and appropriate
escalation or redirection to an HCP.

Q4: CDRH seeks input on whether and how the distinction between generalist and specialist
physicians might inform the assessment of risk for HCP-facing GenAI-enabled functions. Under what
circumstances, if any, might risk be affected when an HCP who lacks the relevant clinical specialist
knowledge receives information that falls within a specialist area of practice? What device
characteristics or safeguards might mitigate such risks?
Q4 response:
The distinction between generalist and specialist HCPs should primarily be addressed through the
device's intended use, intended user population, labeling, and supporting evidence, rather than as a

GE HealthCare - Considerations for the Regulation of Generative AI-Enabled Medical Devices Page 3 of 22
separate risk dimension. Risk may be affected where the intended users do not possess the specialtyspecific knowledge, supporting clinical information, or clinical context assumed by the device's
intended use, or where the device is used outside the intended user population for which it was
designed and validated. Conversely, where a device is specifically intended to support generalist
users, the supporting evidence and evaluation should reflect that intended use rather than assume
specialist expertise.

We believe the current risk management and usability engineering requirements for medical devices
are generally well suited to address these considerations. Foreseeable use by different intended user
populations, including reasonably foreseeable misuse, should be identified, evaluated, and
appropriately mitigated within the device's risk management process and reflected in the supporting
evidence submitted to FDA.

Where a device is specifically intended for specialist practitioners, appropriate mitigations may
include clear definition of the intended users, labeling, and user training. Where appropriate,
additional mitigations may include warnings, contextual information, or other messaging
incorporated within the device output.

Q5: For multi-turn conversational GenAI-enabled devices that may migrate from providing “nondirective” information to “action-directing” information over the course of an exchange, how should
risk be assessed across realistic conversational trajectories? How could the intended use of such a
device be characterized when its behavior is emergent across a conversation?
Q5 response:
We believe that, as with other medical devices, the intended use of a multi-turn conversational GenAIenabled device should be clearly defined by the manufacturer, including the intended users, intended
clinical or operational purpose, and conditions of use. The fact that a GenAI-enabled device may be
conversational or capable of variable outputs should not, by itself, expand the deviceʼs intended use
beyond defined functionality and implemented controls.

Manufacturers should identify reasonably foreseeable conversational trajectories that may create risk,
including missing or ambiguous context, repeated follow-up prompts, adversarial prompting,
attempts to move the system beyond its intended purpose, or requests that could lead to actiondirecting outputs beyond the scope of the intended workflow. These risks should be assessed and
mitigated through appropriate design controls including guardrails such as scope containment
appropriate to the intended use and intended user, recognizing that the appropriate boundaries and
safeguards may differ based on the user's ability to independently evaluate and appropriately respond
to the output. Other controls may include clarification or refusal behavior, source grounding,
escalation pathways, and human review where appropriate.

Risk should be assessed across representative end-to-end conversational scenarios rather than
isolated prompts, recognizing that foreseeable reliance and directiveness may evolve over the course

GE HealthCare - Considerations for the Regulation of Generative AI-Enabled Medical Devices Page 4 of 22
of an interaction. Where the device retains or reuses context across sessions or care encounters,
evaluation should also consider the integrity and appropriate use of that context over time, such as
handling stale or superseded information, propagation of corrections, or changes in user or clinical
context. FDA should assess whether a multi-turn conversational GenAI-enabled device reliably remains
within its defined intended use across realistic interaction trajectories. Behavior outside the intended
use should not, by itself, control the characterization of intended use where the manufacturer has
identified reasonably foreseeable misuse, implemented appropriate guardrails, and evaluated their
effectiveness.

Q6: For GenAI-enabled care escalation functions, CDRH is considering how the evaluation may
account for both under-escalation and over-escalation. How could manufacturers characterize and
weigh these two directions of error, given that they may not be commensurable and that acceptable
trade-offs may vary by clinical context?
Q6 response:
We believe that accounting for under-escalation and over-escalation is not unique to GenAI-enabled
devices. These error directions are already addressed through established medical device risk
management principles and are familiar considerations for AI-enabled detection, diagnostic support,
triage, and decision-support devices.

Because the relative significance of under- and over-escalation depends on the device's intended use,
clinical context, workflow, time sensitivity, and foreseeable consequences, manufacturers should
characterize each error direction separately and justify the associated mitigations and performance
objectives based on the device-specific risk assessment.

FDA's framework should allow flexibility for context-specific benefit-risk considerations rather than
prescribing a single approach to weighing under- and over-escalation.

Q7: Is the competency-based approach described above, i.e., device benchmarking followed by
clinical confirmation, a useful and appropriate framework for evaluating GenAI-enabled devices?
Q7 response:

We believe the proposed competency-based approach provides a useful high-level organizing
framework for evaluating certain GenAI-enabled devices. However, many elements of the proposed
approach, including analytical validation, clinical validation, risk-based evidence generation, and
evaluation of the final configured device, already reflect established principles used for software and
AI-enabled medical devices. The competency-based framework should therefore complement, rather
than replace, existing validation approaches by addressing the additional evaluation considerations
introduced by GenAI-enabled devices, such as open-ended outputs, conversational interactions, or
autonomous behaviors that may not be adequately characterized through traditional task-specific
validation alone.

GE HealthCare - Considerations for the Regulation of Generative AI-Enabled Medical Devices Page 5 of 22
The framework should remain risk-based and proportionate to the device's intended use, intended
users, outputs, and risk profile. We support a modular approach in which the manufacturer identifies
the competencies relevant to the device and defines the appropriate benchmarking and clinical
confirmation strategy. Evaluation may occur at the individual competency level and at the level of the
final configured device, as appropriate to the intended use, capabilities, and risk assessment. Not
every competency element will apply to every GenAI-enabled device; the applicable benchmarking
elements, test datasets, acceptance criteria, and clinical confirmation activities should be selected
according to the capabilities exposed by the device and their associated risks.

To promote consistent and predictable regulatory expectations across similarly situated devices, FDA
should provide clearer definitions of key concepts, including competency, benchmarking, and clinical
confirmation, together with principles and illustrative examples describing the expected rigor of
evaluation. Sponsors should retain flexibility to use fit-for-purpose tests and datasets, including
sponsor-developed approaches, where justified. FDA review should assess whether the overall
benchmarking strategy is appropriate and sufficiently rigorous for the device's intended use and risk
profile, including whether the selected benchmarks and datasets are representative and capable of
evaluating clinically meaningful capabilities and failure modes, while avoiding fixed test methods or
datasets that could become outdated or unnecessarily constrain innovation.

Q8: How might the two-axis risk framework described in Section IV be considered within the
competency-based approach described above to help determine the level of evidence needed for a
premarket submission?
Q8 response:
The proposed two-axis conceptual model may provide a useful input for informing the nature, rigor,
and extent of evidence appropriate for a GenAI-enabled device. However, evidence expectations
should continue to be driven primarily by the device's intended use, clinical consequence, and overall
risk assessment within the existing medical device risk management framework. The competencybased assessment should remain tailored to the device's intended use and proportionate to risk, with
the applicable benchmarking elements, range and difficulty of test conditions, and extent of clinical
confirmation determined by the device's intended use, capabilities, and risk profile.

What GenAI changes is not the underlying risk framework, but the evidence needed to characterize
failure modes that are unique to generative technologies. Existing resources, such as the NIST AI Risk
Management Framework: Generative Artificial Intelligence Profile (NIST AI 600-1), may provide useful
reference points for identifying potential GenAI-specific failure modes and considerations relevant to a
particular device. As risk and foreseeable reliance increase, FDA may expect progressively stronger
evidence addressing GenAI-specific failure modes and the characteristics needed to evaluate them,
such as source grounding (faithfulness to source information), reliability, robustness, transparency,
fairness, privacy, and the effectiveness of safeguards. The relevance and extent of evaluation of these
characteristics should be determined based on the device's intended use, capabilities, and risk profile.

GE HealthCare - Considerations for the Regulation of Generative AI-Enabled Medical Devices Page 6 of 22
Traditional medical device evidence should remain the foundation for demonstrating safety and
effectiveness. The objective is not to replace established medical device evidence, but to supplement
it where GenAI introduces novel failure modes that are not adequately characterized through
traditional validation alone. GenAI-specific evidence should therefore supplement, rather than
replace, established analytical validation, clinical validation, human factors, subgroup performance
evaluation, and other established evidence generation approaches by addressing failure modes
unique to generative technologies. Evaluation should also consider reasonably foreseeable misuse,
including ways in which users may interact with GenAI-enabled functions beyond the expected
workflow, where relevant to the device's intended use and capabilities. Depending on the device's
intended use and risk profile, this may include evaluation of source grounding, hallucination or
confabulation, open-ended outputs, prompt sensitivity, adversarial or boundary-condition testing,
transparency, explainability where relevant, uncertainty communication, subgroup performance for
generative outputs, and unintended disclosure of protected information.

Two principles should guide how evidence scales. First, clinical consequence: GenAI-specific
evaluation should supplement, not replace, traditional medical device evidence. Second, evidence
should scale with clinical consequence and foreseeable reliance, rather than the use of generative AI
itself. Where a device performs multiple distinguishable tasks or capabilities with different risk
profiles, the nature and extent of evidence should similarly be proportionate to the risk associated
with each task or capability, while considering their interactions and the overall device risk.

FDA should also allow sponsors to demonstrate performance within a defined and validated operating
domain appropriate to the deviceʼs intended use rather than expecting evidence of universal
correctness across all conceivable inputs. This is consistent with CDRH's recognition that, for devices
with broad intended uses or open-ended inputs, it may be unreasonable to evaluate every conceivable
input that the device could encounter during deployment.

Q9: Would a benchmarking structure such as the one described above be likely to provide adequate
evidence of clinical knowledge, analytic capabilities, safety behavior, communication, and
generalizability to support a reasonable assurance of safety and effectiveness? Are there elements
that are missing, redundant, or inappropriately categorized? Are there externally developed
standards that could be leveraged?
Q9 response:
The proposed benchmarking elements provide a reasonable and largely comprehensive starting point
for evaluating GenAI-enabled devices. However, benchmarking should characterize relevant
capabilities and failure modes to inform, rather than replace clinical confirmation. We support the
inclusion of robustness, reliability, and reproducibility (R.1), particularly the recognition that clinically
meaningful consistency, not identical outputs, should be the objective when evaluating nondeterministic GenAI systems.

GE HealthCare - Considerations for the Regulation of Generative AI-Enabled Medical Devices Page 7 of 22
Overall, the proposed structure provides appropriate coverage. The principal opportunity is not to
introduce additional benchmark categories, but to clarify how existing benchmark elements are
applied consistently across different device types and capabilities within a modular, risk-based
framework.

Our primary observation is that reliability and robustness (R.1) are better viewed as cross-cutting
evaluation characteristics than as sub-elements of Generalizability. These characteristics are relevant
to safety behavior, clinical proficiency, communication, and other benchmarking elements, rather
than being limited to evaluation across populations. FDA may therefore wish to evaluate reliability and
robustness across each applicable benchmarking element while reserving Generalizability primarily
for performance across intended populations, clinical settings, and operating conditions.

The proposed framework could also more explicitly recognize cybersecurity and security-related
considerations for GenAI-enabled devices, particularly with respect to prompt injection, adversarial
inputs, manipulation of retrieved information, unauthorized tool invocation, and other securityrelated failure modes. These considerations should build upon, rather than duplicate, existing FDA
medical device cybersecurity requirements, with additional evaluation focused on security
considerations introduced or amplified by GenAI-enabled functionality.

The applicability and interpretation of benchmarking elements should remain tied to the device's
intended use, capabilities, and risk profile.

Existing medical device standards—including ISO 14971, IEC 62304, IEC 62366-1, ISO 13485, and
emerging standards such as ISO/IEC 42001—provide a strong foundation for risk management,
software lifecycle, usability engineering, quality management, and AI governance. Other resources,
including the NIST AI Risk Management Framework and its Generative Artificial Intelligence Profile
(NIST AI 600-1), may provide useful considerations for GenAI-specific risks, robustness, security, and
ongoing assurance. These standards, however, generally describe governance principles and
development expectations rather than detailed benchmarking methodologies for GenAI-enabled
medical devices. FDA may therefore wish to leverage these existing standards while encouraging
development of future consensus standards that provide practical benchmarking methodologies for
GenAI-enabled devices, including evaluation of source grounding, hallucination or confabulation,
robustness, adversarial testing, and other GenAI-specific failure modes.

Q10: CDRH recognizes that publicly available benchmarking assets may be subject to data
contamination, saturation, and limited real-world representativeness. How should a sponsor
establish that performance on a given benchmark predicts safe and effective real-world behavior for
the deviceʼs intended use? What evidence should support the construct validity of a benchmark
used to gate device evaluation, and what role should sponsor-developed benchmarks play given
potential concerns around independence and optimization to the test?

GE HealthCare - Considerations for the Regulation of Generative AI-Enabled Medical Devices Page 8 of 22
Q10 response:
Benchmarks can provide useful evidence for characterizing relevant device capabilities, performance,
and failure modes under defined test conditions. However, benchmark performance should not be
assumed to predict real-world performance simply because a benchmark is publicly available, widely
used, or technically challenging. Sponsors should demonstrate that the benchmark is relevant to the
device's intended use and evaluates capabilities and failure modes that are meaningful to
performance in clinically representative conditions. Benchmarking should characterize relevant
capabilities and failure modes, while clinical confirmation establishes performance under clinically
representative conditions.

The validity of a benchmark should be supported by evidence demonstrating that its content, tasks,
outputs, and failure modes are representative of the device's intended use. Sponsors should also
demonstrate that benchmark performance is associated with clinically meaningful performance
during validation, rather than relying solely on benchmark scores.

Sponsor-developed benchmarks should play an important role where publicly available benchmarks
are not representative of the intended use or are susceptible to contamination, saturation, or limited
clinical relevance. Sponsors should justify that such benchmarks are representative of the intended
use, evaluate clinically meaningful capabilities and failure modes, and are supported by appropriate
documentation, governance, and validation.

For example, a benchmark evaluating general medical knowledge may provide limited evidence for a
radiology report generation device unless it evaluates representative radiology tasks, outputs, and
clinically meaningful failure modes relevant to the device's intended use.

Public benchmarks should also be periodically assessed for continued relevance as technology,
clinical practice, and evaluation needs evolve. They may provide useful reference points or baselines
but should not become fixed regulatory performance standards where the underlying data or tasks are
no longer representative of current clinical practice or have become saturated. Sponsors should retain
flexibility to use updated or alternative benchmarks where these provide a more appropriate
evaluation of the device's intended use.

Q11: CDRH is considering that clinical confirmation for a GenAI-enabled device might not require a
prospective clinical study in every case, and has described above a range of approaches of
increasing rigor and patient exposure. How might a sponsor select and justify a confirmation
approach tailored to a deviceʼs intended use and proportionate to the deviceʼs risk profile? Are there
device types or risk profiles for which one or more of these approaches would be insufficient or
inappropriate? How might the anticipated distribution of real-world inputs be taken into
consideration? Are there other methods of clinical confirmation that might help inform the
evaluation of GenAI-enabled devices?

GE HealthCare - Considerations for the Regulation of Generative AI-Enabled Medical Devices Page 9 of 22
Q11 response:
We believe that many considerations for selecting a clinical confirmation approach are not unique to
GenAI-enabled devices but reflect established principles for evaluating software and AI-enabled
medical devices. Evidence should be tailored to the deviceʼs intended use, risk profile, clinical
workflow, intended user and use environment, and foreseeable consequences of incorrect outputs.
For GenAI-enabled devices, these principles may need to be adapted to account for variable outputs,
open-ended inputs, and clinically representative interaction patterns, but they do not require a
fundamentally new evidentiary paradigm.

We agree that a prospective clinical study should not be required in every case. Consistent with least
burdensome principles, FDA's proposed range of clinical confirmation approaches provides a useful
starting point and should allow sponsors flexibility to select or combine fit-for-purpose methods.
Prospective clinical evidence should generally be reserved for situations where lower-burden
approaches such as retrospective real-world case evaluation, clinician adjudication, workflow
simulation, or shadow deployment cannot adequately confirm performance in the intended clinical
workflow. Examples may include devices that act autonomously, initiate or materially direct highconsequence clinical actions, produce outputs that users cannot reasonably independently verify, or
whose benefit-risk profile cannot be adequately assessed without observing real-world clinical
workflow, downstream user action, or patient impact.

Rather than prescribing specific clinical confirmation approaches, FDA should allow sponsors
flexibility to justify the selected clinical confirmation approach based on the deviceʼs intended use and
risk profile. The key question should be whether the final configured device performs as intended in a
clinically representative use environment and provides sufficient evidence to support the applicable
regulatory determination, including substantial equivalence or reasonable assurance of safety and
effectiveness, as applicable.

The anticipated distribution of real-world inputs should be addressed through representative
sampling of case mix, input quality, care setting, user type, workflow, and relevant subgroups.
Evaluation should also include appropriate diversity and challenging cases to characterize device
limitations and identify potential failure modes, rather than relying primarily on test-set volume. FDA
should provide flexibility for sponsors to use synthetic data, OUS data, and real-world evidence as
supplemental evidence where appropriately justified and relevant to the intended use, use
environment, and anticipated real-world input distribution.

Q12: How should sponsors achieve statistically meaningful performance measurement for GenAIenabled devices? Where synthetically generated inputs supplement real patient data, how should
sponsors account for differences between the synthetic and real-world distributions when
estimating performance, and under what conditions, if any, is it appropriate to combine
benchmarking evidence and clinical confirmation evidence to support a single performance
estimate?

GE HealthCare - Considerations for the Regulation of Generative AI-Enabled Medical Devices Page 10 of 22
Q12 response:
Statistically meaningful performance measurement should remain driven by the device's intended
use, intended population, risk profile, and performance claims rather than by a single prescribed
methodology. Existing statistical approaches used for software and AI-enabled medical devices remain
appropriate, with additional considerations where GenAI introduces open-ended outputs or novel
failure modes.

Real-world clinical data should continue to provide the primary clinical anchor for evaluating safety
and effectiveness. Synthetic data may appropriately supplement real-world evidence where it
addresses gaps in coverage, rare conditions, edge cases, subgroup representation, or other aspects of
the intended use that are difficult to capture through clinical data alone. Synthetic evidence does not
need to rely solely on GenAI methods; physics-based simulation, computational modeling, digital
phantoms, controlled perturbation, rule-based generation, and targeted augmentation may also
provide valuable supplemental evidence where appropriate. Sponsors should justify how synthetic
data are representative of the intended use, document how they were generated, characterize relevant
differences from real-world data, and demonstrate that their use is appropriate for the performance
claim or competency being supported.

Whether benchmarking and clinical confirmation evidence can support a single performance estimate
should depend on the intended use, performance claim, clinically meaningful endpoint, and the
representativeness of the underlying data. FDA should allow sponsors flexibility to justify when
evidence from different sources may appropriately be considered together, considering the purpose,
strengths, and limitations of each source of evidence.

Q13: For which clinical domains, device functions, or subpopulations is synthetic data particularly
well-suited, or particularly inadequate, as a supplement to real-world evidence? What safeguards
would mitigate the risk that synthetic data generated by models of the same class as the device
under evaluation reproduces the very performance gaps the evaluation is intended to detect,
particularly for underrepresented subgroups?
Q13 response:
Many of the considerations for the use of synthetic data are not unique to GenAI-enabled devices but
apply more broadly to AI-enabled medical devices. Where synthetic data are appropriate as a
supplement to real-world evidence for GenAI-enabled devices, similar principles should be considered
for other AI-enabled devices, since the underlying rationale, addressing gaps such as rare conditions,
edge cases, acquisition variability, subgroup representation, or anticipated failure modes, is generally
independent of whether the underlying AI technology is generative or predictive.

Synthetic data may be particularly valuable as a supplement to real-world evidence where it
intentionally addresses such gaps. Synthetic data does not need to rely solely on GenAI methods;
physics-based simulation, computational modeling, digital phantoms, controlled perturbations, ruleGE HealthCare - Considerations for the Regulation of Generative AI-Enabled Medical Devices Page 11 of 22
based generation, and targeted augmentation may also provide valuable supplemental evidence
where appropriate.

Synthetic data is less appropriate as primary evidence where performance depends heavily on realworld clinical workflows, clinician behavior, longitudinal disease progression, treatment response,
complex comorbidities, or other factors that cannot be adequately represented synthetically. Realworld clinical data should therefore remain the primary clinical anchor for demonstrating safety and
effectiveness.

Appropriate safeguards should ensure that synthetic data are representative of the device's intended
use and supported by clear documentation describing how they were generated, what aspects of the
intended use they are intended to represent, and how they differ from real-world data. Sponsors
should also evaluate subgroup performance, use representative real-world data to confirm that
synthetic evidence remains clinically relevant, and, where synthetic data are generated using models
similar to those incorporated into the evaluated device, consider additional independence, sensitivity
analyses, or real-world validation to reduce the risk of reproducing the same performance gaps the
evaluation is intended to detect.

Q14: For open-ended device outputs, how should performance comparators and acceptance
criteria be selected? When a panel of qualified clinicians serves as the comparator, how should the
applicable standard (for example, the standard of care versus the performance of a median clinician
in practice) be defined and justified? Should generalist or specialist physicians be used as a
performance standard? When should human-AI team performance, rather than the device operating
alone, serve as the basis for evaluation?
Q14 response:
We believe that performance comparators and acceptance criteria should be selected based on the
device's intended use, intended users, outputs, clinical context, and risk profile. There is unlikely to be
a single comparator or acceptance criterion that is appropriate across all GenAI-enabled devices,
particularly where outputs are open-ended and multiple clinically acceptable responses may exist.
FDA should therefore avoid prescribing a uniform comparator hierarchy or evaluation methodology
across all GenAI-enabled devices.

The selected comparator should be fit-for-purpose and reflect the device's intended role in clinical
practice. Depending on the intended use, appropriate comparators may include an established
reference standard, expert consensus, standard of care, or human-AI team performance where that
reflects the intended clinical workflow. Standalone device performance may become increasingly
important as device autonomy increases and there is less opportunity for independent user review
before a clinically consequential action is taken.

For open-ended outputs, acceptance criteria should focus on whether the device safely and effectively
performs its intended clinical task rather than whether it matches a single expected response.

GE HealthCare - Considerations for the Regulation of Generative AI-Enabled Medical Devices Page 12 of 22
Appropriate evaluation dimensions may include clinical correctness, clinical appropriateness,
completeness, safety, consistency, communication quality, and adherence to the device's intended
use and scope, with the relative importance of each dimension determined by the device's intended
use and risk profile.

Consistent with least burdensome principles, FDA should allow sponsors flexibility to justify fit-forpurpose comparators and acceptance criteria rather than prescribing uniform comparator hierarchies
or performance standards across all GenAI-enabled devices. Illustrative examples demonstrating
appropriate comparator selection and acceptance criteria for representative categories of GenAIenabled devices would improve consistency and predictability while preserving a risk-based
approach.

Q15: Are there ways in which performance might be assessed relative to the care, technology, or
course of action likely to occur in the absence of the device, rather than to the comparators
described in this section? What approaches might be used to identify and justify a comparator such
as unaided clinical judgment, delayed specialist review, or no intervention?
Q15 response:
We recognize that alternative comparators, such as unaided clinical judgment, delayed specialist
review, or no intervention, may be appropriate for certain GenAI-enabled devices when they more
accurately reflect the clinical practice or care pathway that would exist without the device. Comparator
selection should be justified based on the device's intended use, intended users, claimed clinical
benefit, expected clinical workflow, deployment environment, and the availability of an accepted
clinical reference standard.

The selected comparator should be the one that most appropriately demonstrates the clinical benefit
associated with the device's intended use and provides evidence sufficient to support the applicable
regulatory determination and overall benefit-risk assessment. For devices, whose primary claim
relates to diagnostic, analytical, or quantitative performance, established reference standards or
expert consensus will generally remain the most appropriate comparators. Alternative comparators
may be appropriate where they more directly evaluate the intended clinical benefit or care pathway
associated with the device, and where the realistic alternative in the intended deployment setting
differs meaningfully from an idealized reference comparator.

Sponsors should justify why the selected comparator is the most clinically meaningful for the intended
use, deployment context, and performance claim. Given the diversity of GenAI-enabled device
functions, comparator selection should remain fit-for-purpose and risk-based rather than follow a
single prescribed hierarchy.

GE HealthCare - Considerations for the Regulation of Generative AI-Enabled Medical Devices Page 13 of 22
 Q16: Should independent third parties be involved in some or all aspects of a competency-based
approach, including device benchmarking and clinical confirmation? If so, in what ways might
qualified, independent third-party participation contribute to this approach, and what
qualifications and independence criteria should apply? Are there aspects of the assessment for
which third-party involvement would be impractical or inadvisable? What safeguards or program
design features would be critical to prevent third-party participation from limiting competition or
preventing innovation?

Q16 response:
Independent third-party participation should not become a required additional step in the
competency-based evaluation of GenAI-enabled devices. Sponsors should remain responsible for
demonstrating that the final configured device performs as intended and supports the applicable
regulatory determination. Requiring third-party review, certification, or testing as a general
expectation could add cost, delay, and uncertainty without necessarily improving the quality of the
evidence.

Qualified third parties may have a limited, opt-in role where independence adds value, such as
maintaining public benchmark datasets, supporting specialized benchmarking or red-team-style
testing, serving as independent expert adjudicators, or developing voluntary tools or standards that
FDA may consider as supporting rather than sole evidence. However, third-party involvement would
require specific FDA mechanisms that are clearly established in advance, including safeguards
addressing potential disclosure of proprietary algorithms, model configurations, datasets,
cybersecurity-sensitive information, and other confidential commercial information.

If FDA explores a more formal third-party mechanism, further discussion would be needed on program
design, qualifications, independence criteria, confidentiality protections, handling of proprietary
information, and safeguards to prevent third-party participation from becoming a gatekeeping
requirement, adding unnecessary burden, limiting competition, or slowing innovation.

Q17: CDRH is exploring whether a competency-based approach could be applied to devices that
incorporate a variety of underlying model architectures, such as multimodal vision-language
models and generative or predictive world models. Are there aspects of the described approach
that might be ineffective or inapplicable to these devices? What additional or distinct
considerations might need to be addressed?
Q17 response:
We believe the competency-based approach can be applied across a range of underlying model
architectures, provided it remains technology agnostic and is driven by the device's intended use,
outputs, capabilities, and risk profile rather than the underlying AI architecture itself. Different model
architectures may require different evaluation methods, but they do not require different regulatory
frameworks.

GE HealthCare - Considerations for the Regulation of Generative AI-Enabled Medical Devices Page 14 of 22
Not all competency elements or evaluation methods described in the discussion paper are likely to
apply equally across all GenAI-enabled devices. The concept of competency should therefore be
defined relative to the intended device function and the capabilities exposed by the device, rather
than the underlying model architecture. Accordingly, different benchmarking elements, performance
metrics, acceptance criteria, and clinical confirmation approaches may be appropriate depending on
the capabilities being evaluated such as multimodal reasoning, conversational interaction, integration
with external clinical data or software tools, or autonomous multi-step actions as well as the
associated level of risk and human oversight.

The need for additional evaluation should be driven primarily by the capabilities exposed through the
medical device rather than by the underlying model architecture itself. FDA should therefore consider
a modular, risk-based evaluation approach that allows the applicable competency elements,
benchmarks, metrics, acceptance criteria, and clinical confirmation activities to be tailored to the
device's intended use, capabilities, and risk profile, rather than applying a uniform competency
framework across all GenAI-enabled devices. Illustrative examples, demonstrating how competency
expectations and evaluation approaches would vary across representative GenAI-enabled device
categories, would improve consistency and predictability while preserving a risk-based and least
burdensome approach.

Q18: CDRH is considering whether it may be appropriate to accept greater premarket uncertainty
regarding a GenAI-enabled deviceʼs benefit-risk profile through greater reliance on postmarket
monitoring. Under what conditions might such an approach be appropriate, and what
characteristics of a monitoring program would need to be in place to justify reduced premarket
evidence? Are there device types or risk profiles for which this approach would not be appropriate?
Q18 response:
We believe that postmarket monitoring is an important component of lifecycle management for
GenAI-enabled devices, but it should not be used as a broad substitute for adequate premarket
evidence. Premarket evidence should continue to establish that the device is sufficiently validated for
its intended use and risk profile before deployment, consistent with FDAʼs existing risk-based
framework.

Greater reliance on postmarket monitoring may be appropriate only for residual uncertainties that
cannot reasonably be resolved premarket. The extent of any reliance on postmarket evidence should
remain proportionate to the device's intended use, risk profile, and the nature of the remaining
uncertainty.

Before reduced premarket evidence can be broadly considered, FDA should establish a clear,
predictable, and risk-based postmarket monitoring framework, including appropriate regulatory
expectations and oversight mechanisms. Such a framework should provide sufficient clarity regarding
implementation, responsibilities, and performance expectations to support consistent application
across different device types and risk profiles.

GE HealthCare - Considerations for the Regulation of Generative AI-Enabled Medical Devices Page 15 of 22
 Q19: Please comment on the potential approaches to postmarket performance evaluation,
including periodic re-benchmarking, sample-based clinician review, and performance degradation
monitoring. What additional approaches should CDRH consider, and how should the cadence and
triggering events for reassessment be determined?

Q19 response:
We agree that periodic re-benchmarking, sample-based clinician review, and performance
degradation monitoring are appropriate approaches that may contribute to postmarket performance
evaluation of GenAI-enabled devices. These approaches should complement, rather than replace,
appropriate premarket evidence and should be applied in a manner proportionate to the device's
intended use, risk profile, deployment environment, and lifecycle characteristics.

FDA should avoid prescribing a uniform postmarket monitoring approach across all GenAI-enabled
devices, while establishing consistent expectations for monitoring rigor across similarly situated
devices. These expectations should focus on whether the monitoring approach is sufficient to detect
clinically meaningful performance degradation and emerging safety signals, consistent with the
intended use and risk profile of the device. The appropriate monitoring activities, cadence, and
reassessment triggers should be determined based on the device's intended use, risk profile, expected
rate of change, deployment model, and changes implemented through established change-control
processes such as PCCPs. Postmarket monitoring approaches should also account for applicable
privacy, security, and data-governance constraints, particularly where monitoring involves collection
or retention of user interactions or device outputs.

As FDA further develops a postmarket monitoring framework for GenAI-enabled devices, it would be
helpful to establish a common set of elements that a postmarket monitoring plan should address,
while allowing implementation to remain risk-based and device-specific. These may include the
performance characteristics or signals to be monitored, data sources and collection methods,
monitoring cadence and reassessment triggers, roles and responsibilities, processes for evaluating
identified signals, and appropriate escalation or corrective-action pathways. FDA should continue to
build upon existing postmarket surveillance and quality system processes while adapting them, where
appropriate, to address GenAI-specific considerations in a risk-based and least burdensome manner.

Q20: Please comment on whether the proposed approaches to postmarket monitoring can be
facilitated by machine-based supervisory agents. What considerations, including the evaluation and
reliability of the supervisory agent itself, should CDRH take into account for such an approach?
Q20 response:
Machine-based supervisory agents have the potential to facilitate postmarket monitoring, particularly
by automating detection of performance drift, unexpected performance patterns, changes in realGE HealthCare - Considerations for the Regulation of Generative AI-Enabled Medical Devices Page 16 of 22
world input distributions, and other predefined quality signals. However, these approaches remain an
evolving area and should complement, rather than replace, appropriate human oversight.

Where supervisory agents are used, their suitability for the intended monitoring function should be
appropriately evaluated, with periodic comparison with qualified human reviewers where
appropriate. A practical implementation could combine automated analytics or AI-based evaluators
with periodic human review, allowing routine monitoring to be automated while using qualified
human reviewers to periodically assess clinically meaningful findings and evaluate continued
alignment of the supervisory agent with human judgment.

The implementation of machine-based supervisory agents should remain risk-based and flexible,
recognizing that the appropriate balance between automated monitoring and human oversight will
depend on the device's intended use, risk profile, deployment environment, the maturity of the
monitoring technology, and the role of the supervisory agent within the overall postmarket
monitoring process.

Q21: What roles might clinicians, healthcare institutions, professional societies, standards-setting
bodies, and other stakeholders appropriately play in postmarket monitoring, and how can these
roles be structured without diffusing manufacturer accountability?
Q21 response:
Clinicians, healthcare institutions, professional societies, standards-setting bodies, patients, and other
stakeholders can provide valuable real-world information and feedback to support postmarket
monitoring. Clinicians are well positioned to identify and report outputs that are clinically inaccurate,
inappropriate, or inconsistent with the patientʼs presentation, as well as near-misses and workflowrelated safety concerns. Healthcare institutions can contribute real-world performance information
based on their clinical experience, patient populations, and local implementation. Professional
societies and standards-setting bodies can support the development of consistent clinical
performance measures, reporting approaches, and can help define postmarket monitoring techniques
and methods.

Where effective postmarket monitoring depends on information available only within the healthcare
institution's environment, healthcare institutions are a critical source of information for effective
monitoring of device performance and for communicating relevant safety or performance signals to
the manufacturer. FDA should recognize practical limitations where such information is not reasonably
accessible to the manufacturer and provide clear expectations regarding stakeholder roles,
responsibilities, and communication pathways to help support effective and consistent postmarket
monitoring. However, stakeholder participation should complement, rather than reduce,
manufacturer accountability. Specifically, manufacturers should remain responsible for reviewing
safety signals (including information provided by stakeholders), assessing their potential clinical
significance, meeting applicable regulatory reporting requirements, and evaluating and implementing

GE HealthCare - Considerations for the Regulation of Generative AI-Enabled Medical Devices Page 17 of 22
any necessary corrective and preventive actions. Healthcare institutions remain responsible for safe
implementation and use within their clinical environments, while manufacturers remain accountable
for the continued safety and effectiveness of their devices.

Q22: CDRH envisions that a manufacturerʼs premarket competency-based assessment might serve
as a baseline against which post-deployment modifications could be re-evaluated. How might the
extent of re-benchmarking or other evidence be scaled to the nature and expected impact of a given
modification? For example, are there categories of change that might not significantly affect safety
or effectiveness of a GenAI-enabled device, or might be appropriately managed within a sponsorʼs
quality management system versus requiring FDA premarket review and authorization before
implementation? Are there categories of changes that might be appropriate for inclusion in a PCCP?
Q22 response:
We agree with CDRH's framing that re-evaluation should be scaled to the nature and expected impact
of a modification, and that the premarket competency-based assessment can serve as the baseline.
However, modifications should be evaluated relative to the intended use, claims, risk controls, and
performance characteristics established during the original assessment. The purpose of postdeployment evaluation should be to determine whether a modification meaningfully affects safety,
effectiveness, or clinically relevant performance rather than simply determining whether a system
component has changed. Consistent with the risk-based principles underlying FDA's Deciding When to
Submit a 510(k) for a Software Change to an Existing Device guidance, the significance of a GenAIenabled device modification should be evaluated based on its impact on the device rather than the
technical nature of the change alone.

The extent of re-benchmarking should be driven by the expected impact of a modification rather than
the specific component that changed. Not all modifications present the same risk. Some changes may
have little or no effect on clinically meaningful performance, while others may significantly alter
device behavior. Sponsors should perform a documented impact assessment evaluating whether a
modification could affect intended use, clinically meaningful outputs, risk controls, foreseeable
reliance, or overall device performance. Evaluation activities should then be scaled proportionately to
the expected impact of the change.

We believe changes that do not reasonably affect intended use, safety, effectiveness, clinically
meaningful outputs, or established risk controls may generally be managed within a manufacturer's
quality management system. Examples may include infrastructure updates, cloud-hosting changes,
logging and monitoring enhancements, cybersecurity patches, and administrative functionality
updates, provided appropriate verification activities demonstrate no meaningful impact on clinical
performance.

We believe PCCPs are the appropriate mechanism for managing many foreseeable GenAI-related
modifications and should continue to evolve to accommodate changes associated with foundation
models and other rapidly evolving AI technologies. PCCPs should be limited to foreseeable categories

GE HealthCare - Considerations for the Regulation of Generative AI-Enabled Medical Devices Page 18 of 22
of modifications with a sufficiently well-defined scope to support predefined validation approaches,
acceptance criteria, and associated risk controls. Examples may include prompt modifications,
guardrail updates, localization and language updates, retrieval-corpus updates, source-reference
updates, model configuration changes, and foundation-model version updates. These changes are
expected to occur throughout the product lifecycle and can often be evaluated using predefined
testing and acceptance criteria. Changes that fundamentally alter the device's intended use, materially
increase the level of autonomy, or otherwise materially alter the device's benefit-risk profile should
generally fall outside the scope of an authorized PCCP and be managed through the appropriate FDA
regulatory pathway.

Q23: How might PCCP concepts or other change-control approaches be adapted for GenAI-enabled
devices when the nature or scope of future modifications cannot be fully prespecified?
Q23 response:
We believe that PCCPs remain the appropriate primary mechanism for managing postmarket changes
to GenAI-enabled devices. More broadly, even for today's AI-enabled devices, PCCPs would benefit
from greater flexibility and standardization, including clearer definitions of allowable modifications,
validation expectations, and change-control approaches to support efficient, risk-based innovation.

For GenAI-enabled devices, FDA should build upon this existing framework rather than establish a
separate change-control paradigm. While it may not be practical to prespecify every future model
update, prompt refinement, retrieval improvement, or workflow optimization, manufacturers can
define foreseeable categories of modifications together with applicable risk controls, evaluation
methodology, performance expectations, and criteria for determining whether a modification remains
within the authorized PCCP or requires additional FDA review.

FDA should continue to evolve the PCCP framework through clearer guidance and illustrative
examples for GenAI-enabled devices, preserving a risk-based and least burdensome approach while
maintaining appropriate regulatory oversight.

Q24: For devices built on third-party foundation models, changes to the underlying model may be
initiated by the third-party model developer rather than the device manufacturer. How can a
manufacturer detect, evaluate, and respond to such changes in a timely manner? What
mechanisms—for example, contractual, technical, or through a PCCP—could provide reasonable
assurance that third-party developer-initiated changes do not compromise the safety or
effectiveness of the device?
Q24 response:
Timely detection, evaluation, and response to third-party foundation model changes remain key
challenges for manufacturers, particularly where changes are initiated outside the manufacturer's
control. Effective management may require a combination of contractual, technical, and quality

GE HealthCare - Considerations for the Regulation of Generative AI-Enabled Medical Devices Page 19 of 22
management system controls. Existing supplier-control principles remain relevant, but their
application may need to account for the degree of transparency, control, and contractual leverage
reasonably available to the manufacturer in its relationship with third-party foundation model
developers. Enterprise deployment models that support stable model versions, advance notification
of model retirement or material changes, version traceability, backward compatibility, and sufficient
time for manufacturers to complete appropriate change evaluation before deployment would
substantially improve change management.

Where third-party foundation models are updated, manufacturers should evaluate both regression
and capability changes to determine whether the updated model continues to perform within the
performance expectations established for the device's intended use. This may include regression
testing using representative validation datasets together with targeted capability testing for new or
modified behaviors introduced by the updated model, with appropriate consideration of
interchangeability where multiple foundation models may be supported.

PCCPs provide an appropriate mechanism for managing many anticipated third-party model changes
and should continue to evolve to better accommodate foundation model updates. However,
manufacturers often have limited ability to influence or obtain detailed information from third-party
model developers, particularly where medical devices represent only a small portion of the
developer's commercial business. Accordingly, the regulatory framework should focus on what
manufacturers can reasonably control and evaluate at the final configured device level, rather than
assuming direct influence over third-party model development. Where changes cannot be fully
managed through contractual or technical mechanisms, manufacturers should have flexibility to
demonstrate continued safety and effectiveness through appropriate device-level evaluation,
including benchmarking, clinical confirmation where applicable, and established change-control
processes.

Q25: Would voluntary Foundation Model MAFs be practical for foundation model developers to
provide and to keep current, and what content might they include? Given that participation would
be voluntary and that model developers may have limited incentive to disclose safety-relevant
information, what would make such a program sufficiently useful for premarket review? Are there
alternative mechanisms CDRH should consider for obtaining information about underlying
foundation models?
Q25 response:
The usefulness of a voluntary Foundation Model MAF for premarket review will depend largely on the
extent and consistency of participation by foundation model developers.

CDRH's observation that model developers may have limited incentive to disclose safety-relevant
information is consistent with our experience. Manufacturers generally cannot compel disclosure of
training data provenance or healthcare-specific failure modes, prevent developer-initiated changes to
an underlying model, and they may have limited ability to negotiate disclosure terms with developers

GE HealthCare - Considerations for the Regulation of Generative AI-Enabled Medical Devices Page 20 of 22
for whom medical devices represent a small share of commercial activity. We therefore do not expect
broad voluntary participation, and we would caution against designing the program on the
assumption that it will materialize.

In our view, the more consequential question is what follows for sponsors who cannot obtain modellevel documentation. Section V of the discussion paper states that evaluation would address the final
user-facing device as configured for deployment, rather than the foundation model standing alone,
and we would encourage CDRH to hold to that position. Where model-level documentation is
unavailable, the primary evidentiary emphasis should remain on device-level evaluation, which
manufacturers can reasonably perform, rather than on information they may not be able to obtain
from third-party model developers.

Should CDRH proceed, though, we would suggest aligning the structure and content of a Foundation
Model MAF with documentation that general-purpose model developers already prepare under other
regimes, in particular Annexes XI and XII to the EU AI Act, which apply to providers of general-purpose
AI models placed on the European market. Several of the elements that CDRH describes overlap with
that existing documentation, and for models designated as presenting systemic risk, Annex XI
additionally requires evaluation strategies and results. Where a developer already maintains this
material for the European market, the incremental burden of a Master File would be confined largely
to healthcare-specific content, which no existing regime requires. Aligning to a schema developers
already populate appears to us the single change most likely to make voluntary participation viable.

Q26: Are there additional considerations that inform the premarket and postmarket evaluation of
agentic GenAI-enabled devices, beyond those applicable to non-agentic GenAI-enabled devices?
How should the elevated risk associated with autonomous multi-step action, tool use, and reduced
opportunity for human review be reflected in acceptance criteria and oversight?
Q26 response:
Agentic GenAI-enabled devices introduce additional considerations beyond those applicable to nonagentic GenAI-enabled devices because they can plan, make decisions, execute multi-step actions,
interact with external softwares or devices, and operate with reduced opportunity for human review.
Premarket and postmarket evaluation should therefore address not only the correctness of the final
output, but also the safety and reliability of the overall action sequence.

Evaluation should consider the device's ability to remain within its intended scope, appropriately
invoke external tools or software, safely handle failures or unexpected responses, recognize conditions
requiring human intervention, and maintain traceability of actions taken. Acceptance criteria should
be risk-based and proportionate to the level of autonomy, with greater emphasis placed on human
oversight, intervention points, and verification as autonomy increases.

A practical evaluation approach may combine testing of individual actions or decision steps (atomic
testing) with end-to-end scenario testing that verifies the complete workflow against the intended use.

GE HealthCare - Considerations for the Regulation of Generative AI-Enabled Medical Devices Page 21 of 22
This provides confidence that individual actions perform as intended while confirming that the overall
sequence remains safe, traceable, and within the authorized scope under realistic operating
conditions.

GE HealthCare - Considerations for the Regulation of Generative AI-Enabled Medical Devices Page 22 of 22