Generation Patient (Luis Gil Abinader)

Please see the attached comment from Generation Patient on Docket No. FDA-2026-N-7874.

October 19, 2026

Submitted electronically via www.regulations.gov

Dockets Management Staff (HFA–305)
Food and Drug Administration
5630 Fishers Lane, Room 1061
Rockville, MD 20852

Re: Considerations for the Regulation of Generative AI-Enabled Medical Devices; Discussion
Paper and Request for Feedback, Docket No. FDA-2026-N-7874

Dear Dr. Tarver:

Generation Patient is an organization created by and for young adult patients living with chronic
and rare medical conditions such as lupus, inflammatory bowel disease, Lyme disease, tuberous
sclerosis, and rheumatoid arthritis. We seek to ensure a better future for our generation of
patients by providing direct support through peer support groups while driving systems-level
change through policy work, leadership programming, and advocacy initiatives. Through our
direct support work, we have led over 650 peer support meetings and continue to build the
evidence base for holistic support for young adults with chronic and rare conditions.

Thank you for the opportunity to comment on the Center for Devices and Radiological Health
(CDRH) discussion paper, Considerations for the Regulation of Generative AI-Enabled Medical
Devices. American young adults are increasingly using conversational tools enabled by generative
artificial intelligence (AI) for mental health support. The discussion paper fails to mention young
adults, mental health, suicide, or AI companion tools.1 Generation Patient urges CDRH to:

1. Issue guidance disqualifying AI companion tools from the wellness exception

2. Assess AI devices based on their most directive function and most severe consequences

3. Strengthen premarket standards and postmarket monitoring
Joint Comment Letter on Docket No. FDA-2026-N-7874 § 1 (Oct. 19, 2026) (signed by Deinfluence, Doctors for
America, Generation Patient, InnovateEDU, Innovation For Everyone, Interfaith Center on Corporate Responsibility,
National Center for Health Research, Our Bodies Ourselves, Patient Safety Action Network, USA Patient Network,
Washington Advocates for Patient Safety, and Young People’s Alliance) (noting that the terms “mental health,”
“suicide,” “crisis,” and “companion” never appear in the discussion paper) [hereinafter Joint Comment].
 4. Direct conversational generative AI devices to De Novo and restrict predicate eligibility

5. Disaggregate data on device performance and adverse events by age, including young adults

6. Treat foundation models as device components and require mandatory disclosures

1. Issue guidance disqualifying AI companion tools from the wellness exception

Young adults are increasingly using conversational tools enabled by generative AI for mental
health support. A nationally representative survey found that 19.2 percent of Americans aged 12
to 21 had used AI chatbots for mental health advice as of late 2025.2 Use among age groups ran
highest at 18 to 21, at 24.1 percent. 3 Respondents who had discussed their mental health with a
physician in the prior six months used AI chatbots for mental health advice at higher rates. 4
Among people aged 15 to 30, those with a chronic illness had more than four times the odds of
attempting suicide.5 Products that simulate a relationship, engage users in distress, and present
themselves as emotional support operate as mental health interventions even when
manufacturers describe them as wellness tools. FDA oversight should rest on design features and
foreseeable harm to users, including young adult patients, rather than on marketing claims alone.

Section 3060(a) of the 21st Century Cures Act permits that approach. Congress wrote the
wellness exception as a conjunctive test, removing a software function from the device definition
only where the function is "intended… for maintaining or encouraging a healthy lifestyle and is
unrelated to the diagnosis, cure, mitigation, prevention, or treatment of a disease or condition."
(emphasis added)6 AI companion tools sit outside the device definition only while both conditions
hold. Whether a particular tool meets those conditions is a determination for FDA to make on
the facts of each product. Labeling, advertising, and representations made by manufacturers are
evidence of intended use, but FDA may also consider objective design, user interface,
Ryan K. McBain et al., AI Chatbot Use and Disclosure for Mental Health Among US Adolescents and Young Adults,
180 JAMA Pediatrics 884, 886 (2026), https://doi.org/10.1001/jamapediatrics.2026.2015.
Id. at 886 (“Usage was highest among those aged 18 to 21 years (24.1%).”).
Id. at 884, 886. Use was more common among respondents who had spoken with a physician about their mental
health in the prior six months than among those who had not, adjusted odds ratio 1.89 (95% CI 1.18–3.03).
Mark A. Ferro et al., Suicidal Behaviour Among Adolescents and Young Adults with Self-Reported Chronic Illness,
62 Can. J. Psychiatry 845, 845 (2017), https://doi.org/10.1177/0706743717727242.
21 U.S.C. § 360j(o)(1)(B); 21st Century Cures Act, Pub. L. No. 114-255, § 3060(a), 130 Stat. 1033, 1130–32 (2016).
functionality, instructions for use, and deployment context.7 If the function otherwise meets the
definition of a device under section 201(h) of the FD&C Act, FDA may regulate it as a device.8

Products engineered to sustain an ongoing simulated relationship, to keep users engaged
during moments of emotional distress, and to present themselves as a source of emotional
support fail the second condition in section 3060(a) of the 21st Century Cures Act.9 Generation
Patient asks FDA to treat design features of that kind as defeating the wellness exception.

FDA already treats design features as disqualifying under its own wellness policy. Revised General
Wellness guidance issued on January 6, 2026, states that products "are not general wellness
products if their labeling, advertising, user interface, or functionality" includes alerts or prompts
that recommend specific clinical action, treatment guidance that directs medical management,
or intended-use statements targeting management of a disease or condition. (emphasis added) 10
FDA can issue guidance clarifying that design features of that kind disqualify AI companion tools
and chatbots from the wellness exception in section 3060(a) of the 21st Century Cures Act.

2. Assess AI devices based on their most directive function and most severe consequences

Conversational devices enabled by generative AI produce outputs across an extended exchange.
CDRH acknowledges that those devices "may begin by performing an informational function and
migrate, over the course of a conversation, to an action-directing function."11 CDRH is therefore
considering an approach that would assess risk "across realistic conversational trajectories, not
only at the level of individual functions." 12 However, nothing in the paper explains which of the
functions a device performs determines its placement in the risk framework that CDRH describes.
21 C.F.R. § 801.4 (intended uses “refer to the objective intent of the persons legally responsible for the labeling
of an article,” which “may be shown by such persons’ expressions, the design or composition of the article, or by
the circumstances surrounding the distribution of the article”). See also Tech Justice Law, Comment Letter on
Docket No. FDA-2026-N-7874, Considerations for the Regulation of Generative AI-Enabled Medical Devices § 2.2.4
(Oct. 19, 2026) (explaining that disclaimers cannot override evidence of a product’s design, distribution, and
known use) [hereinafter TJL Comment].
21 U.S.C. § 321(h)(1).
See also TJL Comment, supra note 7, § 2.4.2 (concluding that health chatbots fall outside the general wellness
exclusion).
U.S. Food & Drug Admin., General Wellness: Policy for Low Risk Devices 6 (Jan. 6, 2026).
U.S. Food & Drug Admin., Ctr. for Devices & Radiological Health, Considerations for the Regulation of Generative
AI-Enabled Medical Devices: Discussion Paper and Request for Feedback 8 (Aug. 18, 2026),
https://www.fda.gov/media/194242/download [hereinafter Discussion Paper].
Id.
Generative AI models grow more likely to produce unsafe outputs as conversations progress.
Three models in simulated psychiatric dialogues crossed their first safety boundary after 9.21
turns on average, and after 4.64 under adaptive probing.13 A benchmark of 600 medical dialogues
across 20 models measured unsafe agreement at 5.9 percent at the initial query and at 75.7
percent by the fifth turn.14 OpenAI reports its safeguards "work more reliably in common, short
exchanges" and "can sometimes be less reliable in long interactions." 15 ChatGPT may "correctly
point to a suicide hotline when someone first mentions intent," but "after many messages over
a long period of time, it might eventually offer an answer that goes against" those safeguards. 16

Generation Patient asks CDRH to evaluate risk of conversational AI devices based on the most
directive function they can perform and its most severe consequences, regardless of how late in
a conversation it emerges or how often it appears.17 CDRH should require sponsors to test
trajectories in which users disclose distress, minimize symptoms, or resist escalation, and to
report the most directive function the device performs. Assessing conversational AI devices
based on predominant use would be difficult to implement and gameable, because sponsors
could dilute the prevalence of a directive function by over-representing harmless conversations.

3. Strengthen premarket standards and postmarket monitoring

CDRH is considering whether it would be appropriate to "accept greater premarket uncertainty"
about generative AI devices "through greater reliance on postmarket monitoring." 18 CDRH also
asks for which device types that approach would be inappropriate. 19 The paper describes periodic
re-testing against benchmarks, review of real-world outputs by independent clinicians, and
monitoring for performance degradation as possible approaches.20 Each of these rests with the
Youyou Cheng et al., The Slow Drift of Support: Boundary Failures in Multi-Turn Mental Health LLM Dialogues,
arXiv:2601.14269 (Jan. 2, 2026) (stress-testing three frontier models against 50 virtual patient profiles in psychiatric
dialogues of up to 20 turns; first boundary violation at 9.21 turns on average under static progression and at 4.64
turns under adaptive probing; concluding that “the robustness of LLM safety boundaries cannot be inferred solely
through single-turn tests”). Preprint, not peer reviewed.
Saman Sarker Joy & Niloy Farhan, MedPRESS: A Multi-turn Benchmark for Patient-Pressure-Induced Medical
Sycophancy in LLMs, arXiv:2608.02520 (Aug. 3, 2026) (600 five-turn medical dialogues evaluated across 20 model
configurations; a response is counted as unsafe agreement where it “includes safe caveats but still supports the
unsafe patient belief”). The benchmark evaluates general-purpose and medical-domain language models.
OpenAI, Helping people when they need it most (Aug. 26, 2025), https://openai.com/index/helping-peoplewhen-they-need-it-most/, archived at
https://web.archive.org/web/20250827id_/https://openai.com/index/helping-people-when-they-need-it-most/.
Id.
See also TJL Comment, supra note 7, § 2.3 (concluding that health chatbots sit at the high end of both axes of
the discussion paper’s risk framework).
Discussion Paper, supra note 11, at 19.
Id. at 21 (Question 18).
Id. at 19–20.
manufacturer, and the paper fails to say how FDA would enforce its own authority over devices
already on the market.21 Neither "adverse event" nor "recall" appears anywhere in the paper.

Replacing premarket evidence with postmarket monitoring, or weighing it heavier than
premarket evidence, would shift the burden of harm onto patients. For products where a
foreseeable failure is a missed suicidal crisis,22 a postmarket signal may come only after a patient
has been seriously harmed. Products that engage users in emotional distress must be required
to demonstrate safety, including crisis response performance, before they reach patients.
Generation Patient has for a long time asked for stronger postmarket surveillance, but as a
supplement to premarket evidence instead of a substitute. We ask FDA to strengthen postmarket
monitoring of devices enabled by AI but without reducing standards for premarket evidence.23

Strengthening postmarket monitoring of devices enabled by AI requires practical changes to how
failures are recorded, how patterns across users are detected, and what triggers review.
Conversational tools enabled by generative AI can fail through concept drift, covariate shift,
algorithmic instability, and disparate error rates, among other failure modes. “None of these
issues can be well-categorized using the typical constructs that FDA uses for reporting a device
'malfunction.'”24 Failures without a matching adverse event category are described in the report
narrative rather than captured in a code, which makes aggregate analysis far more difficult. 25 The
Manufacturer and User Facility Device Experience (MAUDE) database is built around individual
cases, while failure patterns in conversational AI devices often appear only across many users.26
Id. at 20 (“While manufacturers are responsible for the postmarket monitoring of their devices ...”).
Pichowicz et al., Performance of Mental Health Chatbot Agents in Detecting and Managing Suicidal Ideation, 15
Sci. Reps. 31652, at 1, 4 (2025); Brewster et al., Characteristics and Safety of Consumer Chatbots for Emergent
Adolescent Health Concerns, 8 JAMA Network Open e2539022, at 2 (2025); De Freitas et al., Chatbots and Mental
Health: Insights into the Safety of Generative AI, 34 J. Consumer Psych. 481, 486 (2024). See also Digital Health
Advisory Committee Meeting Transcript 10 (Nov. 6, 2025) (remarks of Dr. Michelle Tarver) (“to date, there are no
generative AI-enabled medical devices that have been authorized for use in mental health conditions”),
https://www.fda.gov/media/190451/download.
See 21 C.F.R. pt. 803 (medical device reporting); id. pt. 806 (reports of corrections and removals); 21 U.S.C. §
360h(e); 21 C.F.R. pt. 810 (mandatory device recall authority). See also Joint Comment, supra note 1, § 2.
Boris Babic et al., A General Framework for Governing Marketed AI/ML Medical Devices, 8 npj Digit. Med. 328
(2025) (examining concept drift, covariate shift and algorithmic instability, with disparate error rates across
demographic subgroups as a manifestation of instability).
See Babic et al., supra note 24, at 5.
Babic et al., supra note 24 (the adverse event reporting system “is designed at a patient/case level to identify
local/individual issues, but many problems associated with AI/ML devices will present only at an aggregate or global
level”).
Nothing in the current framework specifies what kinds of adverse events typical of conversational
AI devices would trigger a recall,27 and the CDRH discussion paper failed to address this issue.

Generation Patient asks FDA to develop more granular taxonomies reflecting typical performance
failures in AI devices and the harms they can contribute to. 28 For conversational tools, that would
require new device problem terms for sycophantic responses, fabricated statements, and
clinically wrong recommendations. FDA should also add patient problem terms for a suicide
attempt, self-inflicted injury, and dependence on a device. Adding new terms would change how
problems are described, not what is reportable under 21 CFR 803.50. 29 We also ask FDA to require
periodic performance reporting for generative AI devices to surface patterns that appear only
across users.30 We further ask FDA to specify what a reported failure requires of a sponsor and
of the agency, and to use the postmarket surveillance authority in section 522 for AI devices. 31

Additionally, CDRH should establish permanent mechanisms to collect safety signals from AI tools
that operate outside the device definition. FDA collects evidence about excluded software
functions through docket FDA-2018-N-1910, which typically opens for roughly thirty days every
two years.32 That docket implements section 3060(b) of the 21st Century Cures Act, which
directed the Secretary to examine information about "any risks and benefits to health associated
with software functions described in section 520(o)(1)" and to include input from outside experts
such as representatives of patients and consumers.33 Generation Patient asks FDA to keep docket
See 21 C.F.R. pt. 806 (reports of corrections and removals); 21 U.S.C. § 360h(e) (authorizing a mandatory recall
where there is “a reasonable probability that a device intended for human use would cause serious, adverse health
consequences or death”).
Cf. Shaheen E. Lakhan, Postmarket Safety Surveillance of FDA-Cleared Prescription Digital Therapeutics Using the
Manufacturer and User Facility Device Experience (MAUDE) Database: A Pharmacovigilance Study, 17 Cureus e85343
(2025), doi:10.7759/cureus.85343 (“A more granular, indication-specific taxonomy for digital products would
improve signal detection and public transparency.”).
21 C.F.R. § 803.50(a) (manufacturer must report where information reasonably suggests a device “may have
caused or contributed to a death or serious injury,” or has malfunctioned in a way that would be likely to do so were
the malfunction to recur).
Babic et al., supra note 24 (proposing that “manufacturers must flag both when training data is significantly
updated and when deployment conditions are substantially amended,” together with a quarterly performance
update to identify instabilities).
21 U.S.C. § 360l(a)(1) (authorizing postmarket surveillance orders for class II or class III devices whose failure would
be reasonably likely to have serious adverse health consequences).
Docket No. FDA-2018-N-1910 (opened for comment five times since 2018, most recently for thirty days closing
Aug. 13, 2026); see Generation Patient, Comment Letter on Docket No. FDA-2018-N-1910 (Aug. 13, 2026),
https://www.regulations.gov/comment/FDA-2018-N-1910-0385 (asking FDA to keep the docket continuously open).
21st Century Cures Act, Pub. L. No. 114-255, § 3060(b), 130 Stat. 1033, 1132–33 (2016) (covering all software
functions under section 520(o)(1), including those excluded as wellness software).
FDA-2018-N-1910 continuously open for public comment. Nothing in section 3060(b) prescribes
a comment period or a closing date, and FDA already maintains standing dockets on this model. 34

4. Direct conversational generative AI devices to De Novo and restrict predicate eligibility

Clearances made through the 510(k) pathway rest on chains of earlier decisions. Applicants can
secure FDA clearance by showing "substantial equivalence" to a "predicate" device. 35 The
integrity of the 510(k) pathway thus depends on which devices serve as predicates, the evidence
FDA used to assess them, and the rigor of postmarket surveillance to ensure they remain safe.
However, the 510(k) pathway “cannot be transformed into a premarket evaluation of safety and
effectiveness as long as the standard for clearance is substantial equivalence to any previously
cleared device.”36 For instance, researchers examining 156 devices subject to Class I recalls found
that, among the 127 with identifiable predicates, 44.1 percent cited predicates that had
undergone Class I recalls, and that 119 of the 156 underwent no premarket clinical testing. 37

Generative AI strains the 510(k) pathway further. Clearance through the 510(k) pathway requires
either the same technological characteristics as the predicate or different characteristics that
raise no different questions of safety and effectiveness. Section 513(i)(1)(B) of the FD&C Act
defines different technological characteristics as "a significant change in the materials, design,
energy source, or other features of the device from those of the predicate device." 38 A foundation
model is such a feature. 39 AI devices can be built on any of hundreds of foundation models and
versions currently available on the market.40 Safety behavior varies substantially across model
Stakeholders may submit comments on human drug compounding at any time. 80 Fed. Reg. 12504 (Mar. 9, 2015)
(Docket No. FDA-2015-N-0030); see also 80 Fed. Reg. 65765 (Oct. 27, 2015) (Docket No. FDA-2015-N-3534). Public
comments on a guidance document may likewise be submitted at any time. 21 C.F.R. § 10.115(g)(5).
21 U.S.C. § 360c(i) (FD&C Act § 513(i)) (permitting clearance where a device has the same intended use as a
legally marketed predicate and either the same technological characteristics as the predicate or different
characteristics that do not raise different questions of safety and effectiveness).
Inst. of Med., Medical Devices and the Public’s Health: The FDA 510(k) Clearance Process at 35 Years 193, 196
(2011) (recommending that FDA obtain the information needed to design a framework to replace the 510(k)
process, and that Congress then enact it).
Kushal T. Kadakia et al., Use of Recalled Devices in New Device Authorizations Under the US Food and Drug
Administration’s 510(k) Pathway and Risk of Subsequent Recalls, 329 JAMA 136 (2023),
https://doi.org/10.1001/jama.2022.23279. Predicates were identified for 127 of the 156 index devices, of which 56
(44.1 percent) cited a predicate that had itself undergone a Class I recall.
21 U.S.C. § 360c(i)(1)(B). Clearance on the basis of different technological characteristics additionally requires
information demonstrating that the device is as safe and effective as a legally marketed device. Id. §
360c(i)(1)(A)(ii)(I).
Discussion Paper, supra note 11, at 22 (models supplied by third parties may control “refusal behavior, content
policies, output formatting, version control, and safety-critical behaviors integral to device safety and
effectiveness”).
Model documentation published by OpenAI, Anthropic, Google (Gemini API and Vertex AI), Amazon Web Services
(Bedrock), Microsoft (Azure OpenAI), Meta, Mistral, xAI and DeepSeek (reviewed Sept. 10–11, 2026).
families and scale.41 Even models from the same developer have shown different performance
across successive versions.42 Two devices built on different foundation models therefore raise
different questions of safety and effectiveness, even if the same manufacturer makes both.

CDRH has already authorized more than 1,600 devices enabled by AI. Over 96 percent of those
devices have been cleared through the 510(k) pathway.43 In a study of AI devices cleared from
2019 through 2021, about a third were cleared on the basis of predicates that researchers
classified as not using AI.44 Predicate chains can also reach back decades. FDA cleared UpDoc in
2025 via the 510(k) pathway to manage insulin for type 2 diabetes, with a "conversation
service."45 The manufacturer describes UpDoc as "AI that delivers clinician-level care."46 UpDoc
was cleared based on a predicate lineage that traces to a drug dose calculator authorized in
2001.47 Devices on FDA's list of AI-enabled devices have lineages dating back to 1999. 48 FDA has
also cleared AI devices against predicates that were under an open design-related recall.49
Joy & Farhan, supra note 14 (reporting “substantial variation across model families, model scale, and prompt
type”; unsafe agreement across the twenty model configurations tested ranged from 21.9 percent to 67.9 percent;
across scales within one release, GPT-OSS-20B at 52.4 percent and GPT-OSS-120B at 34.9 percent).
Id. (successive versions at the same scale, Llama-3.1-70B-Instruct at 41.9 percent and Llama-3.3-70B-Instruct at
34.7 percent).
U.S. Food & Drug Admin., List of Artificial Intelligence-Enabled Medical Devices (content current Sept. 4, 2026),
https://www.fda.gov/medical-devices/artificial-intelligence-enabled-medical-devices/list-artificial-intelligenceenabled-medical-devices. Of the 1,614 devices listed, 1,553 were cleared under section 510(k), 40 granted through
De Novo classification, and 21 approved through premarket approval. FDA states that the list “is not a
comprehensive resource of AI-enabled medical devices.”
Urs J. Muehlematter, Christian Bluethgen & Kerstin N. Vokinger, FDA-cleared artificial intelligence and machine
learning-based medical devices and their 510(k) predicate networks, 5 Lancet Digit. Health e618 (2023).
U.S. Food & Drug Admin., 510(k) Summary, UpDoc, K253281 (Dec. 23, 2025),
https://www.accessdata.fda.gov/cdrh_docs/pdf25/K253281.pdf. Indications for use: “medication management for
patients aged 18 years and older who have been diagnosed with type 2 diabetes.” Cleared under 21 C.F.R. §
868.1890, product code NDC.
UpDoc, https://updoc.ai (visited Sept. 26, 2026), describing the product as “AI that delivers clinician-level care”
and as “agentic AI that acts where only physicians could.” The site does not identify the model the device uses.
UpDoc names as its predicate the d-Nav System, K181916 (Feb. 4, 2019), an “Insulin Dose Calculator.” d-Nav
names My Insulin Doser/IDS, K082512 (Nov. 7, 2008), whose summary states that the device “is identical to the
predicate device in functionality except for a few features” and “[u]ses the same algorithm.” That device names
the TRxF Intelligent Dosing System, K011571 (Aug. 9, 2001). All four were cleared under 21 C.F.R. § 868.1890.
Kneevoice Cartilage Evaluation System, K252076 (Feb. 6, 2026), names as its primary predicate the Biomet 3Channel Knee Electronic Amplified Stethoscope, K991756 (Dec. 10, 1999); the summary’s table is headed
“Predicate Trade Name (Primary Predicate is listed first).” K991756 does not appear on FDA’s AI-enabled device
list, and its summary, available only as a scanned image, contains no reference to artificial intelligence.
Embrace, K181861 (Dec. 20, 2018), has been subject to recall Z-0159-2024 since July 13, 2023; FDA records the
cause as “Device Design” and the status as open. EpiMonitor, K232915 (Feb. 15, 2024), names Embrace as its primary
predicate, as does Nelli, K251506 (Nov. 21, 2025), a device from a different manufacturer. The recall is Class II.
Generation Patient asks FDA to direct conversational devices enabled by generative AI to the De
Novo pathway under section 513(f)(2) of the FD&C Act as the default. 50 Those devices should be
evaluated on their own clinical evidence, including crisis response performance. Clearance
through 510(k) should be available only where the predicate employs the same foundation model
and version as the device under review. FDA should also set predicate eligibility criteria for AI
devices, including that neither a device subject to an open design-related recall nor a device
whose foundation model has been updated since authorization may serve as a predicate.

5. Disaggregate data on device performance and adverse events by age, including young adults

CDRH is considering benchmarking elements that would evaluate whether safety and clinical
proficiency "hold consistently across clinically relevant populations, including populations that
may be underrepresented in training data or face structural barriers to healthcare access." 51
Testing medical devices across populations is appropriate and consistent with what Congress has
directed.52 However, CDRH never explains whether sponsors would have to make the results of
that testing public, or how those results would be disaggregated by age group. 53

Most devices enabled by AI and authorized by FDA reach the market without publicly available
age-disaggregated evidence. Researchers examining 903 devices enabled by AI and authorized
by FDA found age-related subgroup information in 117 of 505 clinical performance studies.54
They conclude that available information was often insufficient to assess clinical generalizability
of such devices. A separate review of 692 authorized devices found the age of intended subjects
reported in 19.4 percent of summaries. 55 That review suggests that "the evaluation and approval
process of medical AI devices by the FDA lacks comprehensive data on age diversity."56
21 U.S.C. § 360c(f)(2).
Discussion Paper, supra note 11, at 26 (Appendix A, element R.2).
21 U.S.C. § 360j(g)(9)(A) (requiring sponsors of clinical studies supporting device submissions to set
enrollment goals, beginning 180 days after FDA issues final guidance); Pub. L. No. 117-328, § 3602 (2022)
(directing FDA guidance on enrollment goals “disaggregated by age group”).
Element E.1 refers to “pregnant patients, pediatric and geriatric patients” as populations a device should have
knowledge about, not as categories for reporting performance. Discussion Paper, supra note 11, at 25.
Daniel Windecker et al., Generalizability of FDA-Approved AI-Enabled Medical Devices for Clinical Use, 8 JAMA
Network Open e258052 (2025), https://doi.org/10.1001/jamanetworkopen.2025.8052. Of 903 AI-enabled devices
listed by FDA as of August 31, 2024, clinical performance studies were reported for approximately half. Among 505
such studies, 117 (23.2 percent) provided information on age-related subgroups.
Vijaytha Muralidharan et al., A scoping review of reporting gaps in FDA-approved AI medical devices, 7 npj Digital
Medicine 273 (2024). Of 692 AI/ML-enabled devices authorized from 1995 through 2023, 134 summaries (19.4
percent) carried information on the age of intended subjects.
Id.
Generation Patient asks FDA to require submissions to report data disaggregated by age bracket
for devices enabled by generative AI, beginning with ages 18 through 29. Sponsors should apply
those brackets to the benchmarking elements submitted before market and to performance and
adverse event data afterward. FDA should require a sponsor without age data in specific
subgroups to justify the absence, and the agency should make that justification public. For
conversational AI devices, enrollment goals should name young adults as a distinct group.

6. Treat foundation models as device components and require mandatory disclosures

Devices enabled by generative AI are often built on foundation models developed by third
parties. Those foundation models can control "refusal behavior, content policies, output
formatting, version control, and safety-critical behaviors integral to device safety and
effectiveness."57 However, third-party models "offer varying levels of transparency into their
training data, architecture, and evaluation methods, making it difficult to attribute specific
behaviors and errors to the device or its underlying model." 58 CDRH also notes that updates may
be initiated by model developers rather than device manufacturers.59 In response, CDRH is
considering a voluntary mechanism under which model developers would submit information to
FDA confidentially.60 Yet CDRH concedes that model developers "may have limited incentive to
disclose safety-relevant information."61 In that context, CDRH also asks whether there are
alternative mechanisms “for obtaining information about underlying foundation models.” 62

Third-party software incorporated into a medical device has long been subject to FDA oversight.63
Under FDA's quality management system regulation, manufacturers must also arrange for
software suppliers to tell them about changes. 64 FDA also asks sponsors to identify third-party
Discussion Paper, supra note 11, at 22.
Id. at 2.
Id. at 21, 22 (Question 24).
Id. at 22 (describing Foundation Model Device Master Files).
Id. at 23 (Question 25).
Id.
Software incorporated into a device is a component of that device. 21 C.F.R. § 820.3 (defining component to
include “software, firmware”); see 21 U.S.C. § 321(h)(1) (device definition includes “any component, part, or
accessory”). U.S. Food & Drug Admin., Cybersecurity in Medical Devices: Quality Management System Considerations
and Content of Premarket Submissions 15 n.35 (Feb. 3, 2026) (“The use of ‘component’ in this guidance is consistent
with the definition in 21 CFR 820.3.”).
21 C.F.R. § 820.10(a) (requiring a quality management system that complies with ISO 13485); ISO 13485:2016 cl.
7.4.2, incorporated by reference at 21 C.F.R. § 820.7(b); see Warning Letter from Ctr. for Devices & Radiological
Health, U.S. Food & Drug Admin., to Unilam Co., Ltd. (Sept. 22, 2026) (MARCS-CMS 738562),
https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/unilam-coltd-738562-09222026 (citing “[f]ailure to maintain written agreements requiring suppliers to notify the firm of
changes to purchased product prior to implementation, as required by ISO 13485:2016 Clause 7.4.2”). The
software by title, supplier, and version.65 Where a device employs off-the-shelf (OTS) software
and a failure could cause death or serious injury, sponsors are expected to provide assurance
that "the product development methodologies used by the OTS software developer are
appropriate and sufficient for the intended use of the OTS software within the specific medical
device."66 Sponsors should also demonstrate that mechanisms exist to assure continued software
performance, maintenance and support should its developer change it or terminate support. 67

Foundation models incorporated into a medical device should be subject to at least the same
requirements.68 Generation Patient asks CDRH to use its existing authority to require disclosures
concerning all components of AI devices, including underlying foundation models. FDA should
require device sponsors to identify each model and version their product incorporates, including
fallbacks or alternates.69 Sponsors should also be required to state what notice, if any, they will
receive before models change or are withdrawn.70 FDA should also treat a model substitution
made outside an approved change control plan as a modification requiring a new premarket
submission. This would be consistent with current FDA guidance, which treats complete
algorithm rewrites as potentially significant even when performance claims and risk profile stay
the same.71 We further ask FDA to report to Congress and publish, within twelve months, an
analysis of its authority to require disclosures from model developers even when they do not
market a medical device of their own, and of the statutory gaps Congress would need to close.72

predecessor provision, 21 C.F.R. § 820.50(b) (2025), required such an agreement only “where possible” and was
removed when the Quality Management System Regulation took effect on Feb. 2, 2026.
U.S. Food & Drug Admin., Off-The-Shelf Software Use in Medical Devices 7 (Aug. 11, 2023) (specifying, for each
OTS software component, “Title and Manufacturer of the OTS software” and “Version Level, Release Date, Patch
Number, and Upgrade Designation, as appropriate”); see IEC 62304 cl. 8.1.2 (identification of each software-ofunknown-provenance item by name, manufacturer and version), recognized by FDA, Recognition No. 13-79.
Off-The-Shelf Software Use in Medical Devices, supra note 65, at 10. Enhanced Documentation applies where “a
failure or flaw of any device software function(s) could present a hazardous situation with a probable risk of death
or serious injury,” assessed prior to implementation of risk control measures. Id. at 6 n.9.
Id. at 10 (“Demonstrate the existence of appropriate mechanisms for assuring the continued performance,
maintenance and support of the OTS software should the original OTS software developer either make changes to
the OTS software and/or terminate their support of the OTS software.”).
U.S. Food & Drug Admin., Executive Summary for the Digital Health Advisory Committee Meeting: Total Product
Lifecycle Considerations for Generative AI-Enabled Devices 14 (Nov. 20–21, 2024) (observing that “an analogous lack
of software lifecycle control over an incorporated foundation model may raise certain challenges”).
21 C.F.R. § 807.87 (content of a premarket notification submission); see 21 U.S.C. § 360i(a) (FD&C Act § 519(a))
(authorizing FDA to require reports and records).
See supra note 64 (existing requirement that manufacturers arrange for suppliers to tell them about changes).
21 C.F.R. § 807.81(a)(3); id. § 807.81(b)(1)(ii); 21 U.S.C. § 360e-4 (FD&C Act § 515C); U.S. Food & Drug Admin.,
Deciding When to Submit a 510(k) for a Software Change to an Existing Device 16 (Oct. 25, 2017) (“a complete rewrite
of the algorithm, even with the same performance claims and risk profile, may be significant enough to require
submission of a new 510(k)”).
See also Joint Comment, supra note 1, § 3 (making the same requests).
FDA should also cooperate with other federal agencies that have authority to collect information
about foundation models under compulsory processes, including the Federal Trade Commission
(FTC). FTC has general investigative powers under section 6(b) of the FTC Act, which authorizes
the Commission to require corporations whose business affects commerce to file answers in
writing to specific questions. 73 In September 2025, FTC issued orders to seven companies
requiring them to identify the model behind every generative AI companion product, the dates
of each model, and whether the company or a third party developed it.74 Each order also requires
production of the licensing agreements with every third party named. 75 Generation Patient asks
FDA to request from FTC any material related to companion tools and to establish a standing
information-sharing framework for foundation models incorporated into devices. 76

Sincerely,

Luis Gil Abinader
Policy Director
Generation Patient
luis@generationpatient.org
15 U.S.C. § 46(b) (FTC Act § 6(b)) (authorizing the Commission to require covered entities to file “annual or special,
or both annual and special, reports or answers in writing to specific questions”). The Commission describes section
6(b) as authorizing “wide-ranging studies that do not have a specific law enforcement purpose.” Federal Trade
Commission, Press Release, FTC Launches Inquiry into AI Chatbots Acting as Companions (Sept. 11, 2025).
Federal Trade Commission, Order to File a Special Report, Matter No. P254500, Specification 11(a) (Sept. 2025),
https://www.ftc.gov/system/files/ftc_gov/pdf/AICompanionChatbot6(b)Order.pdf (requiring each company to
show “the relevant AI Model for each AI Companion Product or Service, indicating the dates of each model, whether
the model was developed by You or a third party and, if applicable, Identifying the third party”). Orders issued Sept.
11, 2025 to Alphabet, Character Technologies, Instagram, Meta Platforms, OpenAI OpCo, Snap, and X.AI.
Id., Specification 11 (“If applicable, produce the relevant licensing or other agreements with each third party
referenced in Your response.”).
15 U.S.C. § 57b-2(d)(1)(B) (FTC Act § 21(d)(1)(B)) (permitting the Commission to disclose “the results of any
investigation or study carried out or prepared by the Commission” where no trade secret and no privileged or
confidential commercial or financial information is identified). The Commission commits to reporting confidential
commercial information on an aggregate or anonymous basis. Order to File a Special Report, supra note 74, at 2.