Wolters Kluwer

Attached please find feedback from Wolters Kluwer on FDA’s Discussion Paper entitled Considerations for the Regulation of Generative AI-Enabled Medical Devices. We appreciate the opportunity to provider our views.

October 19, 2026
Response from Wolters Kluwer to FDA’s Discussion Paper on
Considerations for Regulation of Generative AI-enabled Medical Devices

Below is Wolters Kluwer’s response to the Food and Drug Administration (FDA)’s
recently released discussion paper entitled Considerations for Regulation of Generative AIenabled Medical Devices (FDA-2026-N-7874). We appreciate the opportunity to provide
feedback on the discussion paper.

As way of background, Wolters Kluwer is a leading global provider of clinical
technology and evidence-based solutions that assist effective decision-making and outcomes
across the healthcare continuum. Key solutions include UpToDate®, UpToDate® Lexidrug™,
UpToDate® Patient Engagement, Medi-Span®, Sentri7®, Lippincott® Solutions, Ovid®, and
Health Language®. Wolters Kluwer had annual revenue in 2025 of $6.6 billion.

We commend FDA for developing the discussion paper and soliciting stakeholder
feedback to help inform the Agency’s development of a regulatory framework for generative AI
(GenAI)-enabled medical devices.

In its discussion paper, FDA defines its goal as supporting “innovation while promoting
and protecting public health, and to establish regulatory approaches that will permit beneficial
devices to reach clinicians, patients, consumers, and health systems when there are reasonable
assurances of safety and effectiveness.” We strongly agree with these overarching goals,
particularly in creating a regulatory framework that, in FDA’s words, “employs least
burdensome principles and allows patients timely access to safe and effective medical devices.”

Our response below outlines our recommendation for how FDA should structure the
regulatory framework for such devices, which we believe strikes this balance. We also provide
responses to specific questions posed in the discussion paper.

Wolters Kluwer’s Proposed Regulatory Framework for GenAI-enabled Medical Devices

At the point of care, early-stage GenAI is already delivering faster clinical referential
information, summarized clinical content, and more efficient workflows. GenAI-enabled clinical
decision support (CDS) software has the potential to significantly improve medical decisionmaking and care outcomes. By synthesizing the latest clinical evidence, such systems can help
identify overlooked treatment options, prevent medical errors, reduce care variability and
enhance care quality. Empowering CDS with GenAI also enables more flexible inquiries from
clinicians, more tailored responses and faster access to relevant clinical information. GenAIenabled CDS also has the potential to provide specialist-level decision support to practitioners in
rural or underserved areas of the country, a key priority of the Trump Administration.

Despite the great promise of generative AI-enabled devices, these solutions will, at times,
not perform as designed, putting patients at potential risk. Any regulatory framework FDA
deploys needs to control for and minimize such risk while also promoting continued innovation.
 To strike the appropriate balance between rewarding innovation for AI solutions while
also ensuring such solutions are effective and safe for patients, we recommend FDA focus its
active regulatory oversight on GenAI-enabled device software functions that pose the highest
risk to patient safety. In our view, these are clinical functions that are fully “agentic,” meaning
they can act autonomously, making care decisions and/or taking actions that directly influence
patient care without human intervention (as opposed to administrative or operational functions).
Though the deployment of agentic functions can add significant value and efficiency to the
clinical workflow, freeing up trained human professionals to address more complex patients, they
also pose significant threats to patient safety if the software does not perform as designed.

Remaining GenAI-enabled device software functions that are non-agentic, and thus
incapable of acting independently of human intervention, would still remain under FDA’s
regulatory authority, but be subject to enforcement discretion. FDA could provide guidance that
defines the terms of such discretion, which, in our view, should be premised on the software’s
demonstration of strong clinical governance, validation and meaningful clinician oversight. For
example, clinical experts should be involved in developing the software’s standards and clinical
logic. Subsequent evaluation would then measure the performance of the software against those
standards. Enforcement discretion would also be tied to the software’s design requiring a trained
human intermediary to make a clinical decision based on their experience and judgment, with the
software itself having no agentic capability.

Specific transparency requirements could also be tied to enforcement discretion, both for
purposes of monitoring the software’s overall performance as well as assisting the clinician at the
bedside to evaluate the output in the context of the patient’s condition and the medical evidence.
For example, the developer could disclose their software’s AI-related source attribute
information. Developer disclosures related to their risk identification and mitigation practices
could also be made, with the National Institute for Standards and Technology’s AI Risk
Management Framework serving as a possible model for such practices. Transparency and
disclosures will also help promote adoption and use of such solutions in the clinical workflow.
Clinicians and other medical professionals will be the principal actors in driving adoption of
GenAI tools at the point of care, but it has been our experience that they will not use solutions
that lack transparency.

Focusing FDA’s active regulatory oversight on agentic AI-enabled device software
functions also recognizes the practical constraints on FDA’s oversight capacity, allowing the
Agency to concentrate its limited staff and resources on the AI-enabled device functions that
present the greatest potential risk to patients. In several public statements and an article
published in late 2024,1 FDA leadership expressed concerns about the Agency’s ability to field
sufficient staff and resources to properly review the expected wave of new AI-enabled device
Haider J. Warraich, MD; Troy Tazbaz, BS; Robert M. Califf, MD FDA Perspective on the Regulation of Artificial
Intelligence in Health Care and Biomedicine Journal of the American Medical Association
doi.10.1001/jama.2024.21451 Published online October 15, 2024
submissions, while also noting that hospitals and health systems may need to take more
responsibility for ensuring the accuracy and safety of AI-enabled tools used in patient care.

We appreciate that the FDA must act judiciously in granting enforcement discretion to
any subset of medical devices subject to the Agency’s regulatory oversight. We believe the
requirements outlined above related to non-agentic GenAI-enabled device software functions
create sufficient safeguards to allow for safe, effective use of such solutions without the need for
active FDA oversight. As an important aside, low-risk decision support solutions were subject to
FDA’s enforcement discretion until 2016, when Congress formally excised them from the
Agency’s regulatory scope in the 21st Century Cures Act.

Responses to Questions
1.Does the two-axis risk framework, organized around device activity and the consequence of
relying on an incorrect output, appropriately capture the dimensions most relevant to the risk
of a GenAI-enabled software function? If there are additional dimensions—such as the
reversibility of a resulting action, the availability of downstream safeguards, the time pressure
of the deployment setting, or the traceability of the output (i.e., to primary source materials)
that should be represented in a risk framework, please describe and provide examples of how
they should be represented.

Our Response: In our view, focusing on the agentic capabilities or level of automation is the
most relevant factor in assessing the risk of GenAI-enabled devices. If the device is designed to
function without the intervention of a trained human intermediary, if it can automatically
prescribe a medication or authorize a refill, develop and implement a care plan, order tests or
make a diagnosis that is not reviewed or confirmed by a trained medical professional, it should
be subject to rigorous pre-market review and strong post-market controls and monitoring.

By contrast, devices that by design cannot influence care without a trained human
intermediary present significantly less risk. Such software either falls outside the definition of a
‘device’ altogether, per the 21st Century Cures Act, or merits enforcement discretion from the
Agency, provided it adheres to rigorous clinical standards, testing, transparency and monitoring
that appropriately reflect its clinical context and potential for harm

The other additional dimensions suggested in this question would, in our opinion, unduly
complicate the risk framework and render it unworkable. The reversibility of the resulting action
is too context- and patient-dependent to serve as a consistently objective factor in any risk
framework. Similarly, determining the time pressure of the deployment setting is not as clear as
it might seem due to numerous factors, including the patient, their presentation, and the setting in
which treatment is being delivered. For example, the management of a patient with
gastrointestinal bleeding may be emergent if the patient is severely bleeding and is in shock,
whereas it may be less urgent if the patient had a single episode of bleeding an hour earlier and is
hemodynamically stable.

Moreover, concerns about automaticity or automation bias, which FDA has raised in the
past, can best be addressed by designing systems to facilitate easy inspection of source materials,
and to ensure any recommendations and outputs adhere to the principles of evidence-based
medicine: a) reflect the body of evidence, not just a citation; b) reflect uncertainty, values and
preferences; c) offer a sense of the strength of the recommendations; d) not hallucinate fake
references; e) and ensure that the reference materials and the text recommendations are aligned

Finally, we note that the Activity axis on FDA’s proposed 2-axis risk framework (page 6
of the discussion paper) is broadly defined to capture GenAI-enabled solutions that are
“Informational: Non-directional” in nature. In our view, solutions that provide information only
and do not direct a medical decision were carved out of the definition of ‘device’ by Congress in
the 21st Century Cures Act and are therefore exempt from FDA regulation. As such, we
recommend constricting the Activity axis of the proposed framework to begin with
“Informational: Action-Directing” as the initial threshold for determining the level of risk for a
GenAI-enabled device, with “Action-Taking: Fully Autonomous” on the extreme end of the
Activity axis. Under our recommended regulatory framework, “Informational: Action-Directing”
software would be granted enforcement discretion by FDA since it is incapable of impacting
patient care without a trained human intermediary. GenAI-enabled devices that are “ActionTaking” would be subject to FDA oversight, with the Agency imposing more rigorous controls
over fully autonomous versions.

2. CDRH seeks input on how to account for the spectrum of GenAI-enabled informational
functions that vary in the degree to which they direct a user to a particular action (i.e.,
between “non-directive” and “action-directing”). What characteristics of an output—such as
its’ wording, specificity, personalization, or context—could be considered as modifiers of the
risk associated with an informational function, after accounting for the device’s overall
functionality and intended use? What additional information would provide manufacturers
with sufficient clarity and predictability around risk assessment for informational functions
while recognizing that directiveness may exist along a continuum rather than as a binary
distinction?

Our Response: As we pointed out above, in our view, a GenAI-enabled solution that provides
informational, non-directive output would not fall under the “device” definition and is thus
exempt from FDA regulation. With regard to the characteristics of an output for GenAI-enabled
solutions that do fall under the definition of ‘device,’ we believe parsing the wording, specificity,
personalization or context of such output is overly complex and would render the framework
unworkable. Per our response above, assessing the risk of a device based on its agentic
capabilities is far simpler and more easily understood by both FDA staff and industry, with
additional factors such as clinical context and patient harm helping inform an appropriate testing
and monitoring regime.

3. CDRH seeks input on whether and when a GenAI-enabled function that results in delivery
of clinical information to patients, as opposed to HCPs, could present different or higher risks,
while also recognizing the potential benefits associated with improved patient empowerment,
engagement, and access to clinical information. What device characteristics, output features,
or safeguards might mitigate risks that could arise when a user lacks the domain knowledge to
independently evaluate an output, without unnecessarily underestimating patient capability?
Our Response: FDA’s approach to regulating patient-facing applications should recognize that
patients already act on information from apps, internet searches and large language models
(LLM). We agree GenAI-enabled devices designed for patients hold great promise to improve
patient access to health information, health literacy and outcomes. We therefore caution the
Agency to be judicious in selecting those patient-facing devices worthy of regulatory oversight
and the subsequent controls applied to them.

7. Is the competency-based approach described above, i.e., device benchmarking followed by
clinical confirmation, a useful and appropriate framework for evaluating GenAI-enabled
devices?

Our Response: We appreciate FDA’s interest in seeking to utilize a competency-based approach,
one in which the Agency could assess the intended use and risk of a GenAI-enabled device by
applying an objective set of universal benchmarking metrics to evaluate GenAI-enabled devices
in both the pre-marketing submission phase and in post-market monitoring and surveillance.
Unfortunately, we do not believe the development of universal benchmarks is currently possible.
Each GenAI-enabled health software solution is designed differently, with different functions
and outputs and poses different risks to patients. Thus, responsible developers are creating
customized performance metrics and processes tailored to the design, output and risks posed by
their solutions.

Wolters Kluwer has experience in developing such custom metrics and processes for its
recently released solution, UpToDate Expert AI, the next evolution of UpToDate, an evidencebased, physician-authored clinical knowledge system that helps clinicians answer medical
questions at the point of care. More than 7,600 physician authors, editors and peer reviewers use
a rigorous editorial process to synthesize the most recent medical information into evidencebased recommendations. UpToDate is used by more than 3 million clinicians annually in 190
countries.

UpToDate Expert AI leverages artificial intelligence (AI) algorithms to make UpToDate’s
“search” capabilities faster and more precise, and to improve the user experience. Like a virtual
assistant, UpToDate Expert AI provides “enhanced search,” including faster access to generative
AI-powered answers to clinical questions, based on UpToDate’s expert-authored and peerreviewed content. Users receive context-rich responses for each question with single-click access
to the assumptions driving the answers, the source of the answer in UpToDate, and the step-bystep rationale used to generate it, allowing clinicians to quickly review recommendations, and
then decide their next steps in patient care.
In our view, the performance of any GenAI-enabled software tool used at the point of
care must focus on strict clinical standards. To optimize the performance of UpToDate Expert AI,
Wolters Kluwer recently launched a clinical AI validation framework that evaluates clinical
intent, knowledge integrity and clinical impact, an approach that moves beyond traditional
benchmarks and ratings. The approach emphasizes real-world reliability by testing AI outputs for
context and evidence grounding, and safety under uncertainty, supported by physician review,
red teaming and continuous monitoring. Using this framework, UpToDate Expert AI achieved
99.9% clinical alignment across 15,000+ criteria and significantly fewer omissions than general
purpose LLMs. For more information, see the report entitled A Measured Approach to
Evaluating Clinical AI at the Point of Care at https://www.wolterskluwer.com/en/expertinsights/clinical-ai-evaluation-must-go-beyond-benchmark-wins.
We trust other GenAI developers have gone or are going through a similar exercise in
creating customized metrics and processes that help optimize their solutions. Though necessary
given the current state of the technology, parsing customized metrics and processes will be a
laborious task for FDA staff. This is yet another reason why simplifying the risk framework and
focusing FDA’s limited resources on agentic GenAI-enabled devices is a recommendation worth
adopting.
10. What role should sponsor-developed benchmarks play given potential concerns around
independence and optimization to the test?

Our Response: As we note above, the inability to develop objective universal benchmarks that
can be used with all, or most GenAI devices leaves FDA reliant on sponsor-developed
benchmarks to assess each product submission. Given the potential for abuse of home-grown
benchmarks by developers, we anticipate that FDA’s risk framework for GenAI-enabled devices
will require an independent third-party assessment as part of any new device submission.2

11. How might a sponsor select and justify a confirmation approach tailored to a device’s
intended use and proportionate to the device’s risk profile? Are there other methods of clinical
confirmation that might help inform the evaluation of GenAI-enabled devices?

Our Response: As we noted in our response to Question #7, measuring the performance of any
GenAI-enabled software tool used in patient care should be premised on stringent clinical
standards Using our own experience as an example, testing for what we refer to as ‘clinical
knowledge integrity’ is a unique method we use to validate UpToDate Expert AI. Our solution is
designed to produce answers grounded in UpToDate content. The system prompt specifies that
only UpToDate content can be used, employs a multi-step retrieval process, and is designed to
avoid responding if relevant UpToDate content cannot be located.

Despite this design, the same generative technology that enables more natural queries,
interpretation of abbreviations, state-of-the-art search capability, and answer synthesis can
introduce information from outside of UpToDate into answers, which we refer to as model
knowledge. Since model knowledge can sound plausible and is sometimes even correct (e.g., the
translation of a non-standard abbreviation), detecting model knowledge can be difficult. Our
approach to testing knowledge integrity is based on a custom test that assesses whether the words
in an answer were derived directly from UpToDate’s trusted clinical content.3
Gu, Y., Fu, J., Liu, X. et al. Evaluating the robustness and readiness of large frontier models in health AI
applications. Nat Med 32, 3023–3031 (2026). https://doi.org/10.1038/s41591-026-04501-8
For more information, see the report entitled A Measured Approach to Evaluating Clinical AI at the Point of Care
at https://www.wolterskluwer.com/en/expert-insights/clinical-ai-evaluation-must-go-beyond-benchmark-wins.
14. For open-ended device outputs, how should performance comparators and acceptance
criteria be selected? When a panel of qualified clinicians serves as the comparator, how
should the applicable standard (for example, the standard of care versus the performance of a
median clinician in practice) be defined and justified?

Our Response: Physician-authored rubrics can play a key role in any clinical standards-based
evaluation of GenAI-enabled health software and we were pleased to see FDA cite them in the
discussion paper as one of the general principles in assessing benchmarks. At Wolters Kluwer,
we test the performance of UpToDate Expert AI with clinical rubrics composed of 1,600 queries
with more than 15,000 criteria from across 25 medical specialties. Each rubric is composed of a
clinical query and the criteria that define what should be included in a good answer. Rubrics
allow us to break the open-ended answers from UpToDate Expert AI into specific, independently
scored elements that assess whether the answer includes: 1) expected clinical information; 2) has
relevant clinical context; 3) contains incorrect information or; 4) omits details important for
point-of-care use. This approach provides detailed information on what is present, what is
missing, and where an answer may be incomplete or unsupported. In addition to supporting
iterative development, rubric testing can also be used to monitor regression or drift during
iterative improvements to the system.
One area in which rubric testing is particularly valuable is in detecting omissions:
clinically meaningful information expected under the rubric that did not appear in the answer. As
a point of comparison mentioned in our response to Question #7 above, UpToDate Expert AI had
a significantly lower rate of omissions when compared with two general-purpose LLM
comparators; both comparators had a rate of omission that was 15% higher than UpToDate
Expert AI. This difference translates to users seeing one additional error for every seven queries
when using a general-purpose LLM model when compared with the use of UpToDate Expert AI.
As an important aside, we have found the proposed benchmarks for LLM performance to
be brittle. For example, a slight perturbation of a prompt (such as on a board-type question) can
lead to deterioration of accuracy. Similarly, some benchmarks developed by frontier labs reward
model-family resemblance.4 These observations suggest that no current benchmark adequately
captures all the dimensions of LLM performance relevant to their use in varied healthcare
settings and applications. It will therefore be imperative for FDA to define high standards for
LLM quality control and testing. Real-world performance benchmarks may take several forms,
including error reporting, third-party assessments, audits and rigorous data analysis.
18. CDRH is considering whether it may be appropriate to accept greater premarket
uncertainty regarding a GenAI-enabled device’s benefit-risk profile through greater reliance
on post-market monitoring. Under what conditions might such an approach be appropriate,
and what characteristics of a monitoring program would need to be in place to justify reduced
premarket evidence? Are there device types or risk profiles for which this approach would not
be appropriate?
Gu, Y., Fu, J., Liu, X. et al. Evaluating the robustness and readiness of large frontier models in health AI
applications. Nat Med 32, 3023–3031 (2026). https://doi.org/10.1038/s41591-026-04501-8
Our Response: We agree strong post-market surveillance can support a proportionate approach to
premarket uncertainty. Any surveillance regime should connect detection of an error in output to
investigation, correction, and verified improvement. For example, Wolters Kluwer solutions that
provide decision support on drug-dosing combine systematic testing before release with ongoing
monitoring. Post-market automated screening helps experts identify high-risk scenarios for
review; those and any negative feedback are reviewed as they are detected. Findings go to
accountable teams to correct the clinical logic, retrieval, or drug content, followed by testing to
confirm improvement. This ability to find and fix errors quickly, post-market, can support greater
flexibility before release, depending on the intended use and potential harm. We also audit a
statistically significant number of incoming question-answer pairs for accuracy, faithfulness to
our underlying content, and any potential for harm.

20. Please comment on whether the proposed approaches to post market monitoring can be
facilitated by machine-based supervisory agents. What considerations, including the
evaluation and reliability of the supervisory agent itself, should CDRH take into account for
such an approach?

Our Response: At this time, we do not believe machine-based supervisory agents are currently
capable of independently facilitating post-market monitoring of GenAI-enabled devices. Any
surveillance technology used in post-market monitoring should be combined with expert clinical
judgment from a trained professional. Industry, academia and government should jointly define
consensus standards and assessment methods. As AI-enabled approaches demonstrate reliability
through ongoing evaluation and experience, the balance between human review and machineassisted monitoring can evolve accordingly, with less intensive human involvement needed
where confidence and demonstrated performance of the AI agent justify it.

21. What role might clinicians, healthcare institutions, professional societies, standardssetting bodies, and other stakeholders appropriately play in post market monitoring, and how
can these roles be structured without diffusing manufacturer accountability?

Our Response: The post-market monitoring framework should be one of shared accountability
among all stakeholders. Clinicians, healthcare institutions and other stakeholders have a vital role
to play in such a framework, with clinicians, particularly, offering real-time feedback and
reporting on device performance, especially if that performance deviates from its intended
design. Developers should be capable of receiving feedback from end users and will remain
accountable for investigating problems, implementing corrections, and verifying improvement.

26. Are there additional considerations that inform the premarket and postmarket evaluation
of agentic GenAI-enabled devices, beyond those applicable to non-agentic GenAI-enabled
devices? How should the elevated risk associated with autonomous multi-step action, tool use,
and reduced opportunity for human review be reflected in acceptance criteria and oversight?

Our Response: One topic that should not escape FDA’s notice is the use and validation of patient
data and patient health information (PHI) used in training and testing a GenAI-enabled device
and that help inform its output once it is deployed at the bedside. Systems that use PHI as input
should have methods to validate the clinical inferences being made from that data. For example,
does the system correctly infer that a patient has diabetes or that their blood pressure is
controlled? Given that patient records may contain incomplete or contradictory information, it
may also be important to communicate the model's confidence in the underlying patient data and
the resulting inferences. Also advisable is transparency into which patient information was used
to generate a recommendation so the clinician can verify that it is correct and adjust if needed.

A related policy issue that may interest the Trump Administration but is technically
outside the scope of FDA’s discussion paper is the promotion of AI literacy in medical
education. If clinician oversight is a central safeguard for GenAI-enabled devices, clinician
fluency in how AI operates should not be assumed. The Trump Administration and CMS are
engaged with medical schools about adding nutrition science to the curricula. AI literacy should
also be added to medical training and tested as part of medical licensing as a required
competency for new practitioners.

To close, we reiterate our recommendation that FDA’s regulatory framework for GenAIenabled devices be premised on whether the device is agentic, capable of acting autonomously to
impact patient care without the intervention of a trained human intermediary. GenAI-enabled
devices incapable of impacting patient care without the involvement of a trained medical
professional should be granted enforcement discretion if the developer can demonstrate strong
clinical governance, validation and meaningful clinician oversight. This approach strikes the
right balance by focusing limited FDA resources on the highest risk devices, while also
promoting innovation.

We appreciate the opportunity to comment. If FDA staff have questions or would like to
discuss our responses in more detail, please contact Bob Hussey at bob@bobhussey.com who
can arrange a discussion with the appropriate Wolters Kluwer staff.