World Privacy Forum (Pam Dixon)

Attached please find the comments of the World Privacy Forum regarding Considerations for the Regulation of Generative AI-Enabled Medical Devices: Discussion Paper and Request for Feedback, (PDF). The World Privacy Forum is a 501 C 3 non-profit public interest research group based in the US.

Comments of the World Privacy Forum to the US Food and Drug Administration regarding
Considerations for the Regulation of Generative AI-Enabled Medical Devices: Discussion
Paper and Request for Feedback, Docket No. FDA-2026-N-7874

Via regulations.gov

Dockets Management Staff (HFA-305)
Food and Drug Administration
5630 Fishers Lane, Rm. 1061
Rockville, MD 20852

19 October 2026 DOI: 10.5281/zenodo.23328824

The World Privacy Forum appreciates this opportunity to submit comments regarding the Food
and Drug Administration’s discussion paper, Considerations for the Regulation of Generative AIEnabled Medical Devices: Discussion Paper and Request for Feedback (August 2026), Docket No.
FDA-2026-N-7874.1 The Center for Devices and Radiological Health (CDRH) asks twenty-six
questions in the Discussion Paper, hereinafter the Discussion Paper. These comments are
responsive to a set of the questions that fall within WPF’s scope of research.

1 U.S. Food & Drug Admin., Ctr. for Devices & Radiological Health, Considerations for the Regulation of
Generative AI-Enabled Medical Devices: Discussion Paper and Request for Feedback (Aug. 18, 2026),
https://www.fda.gov/media/194242/download [hereinafter Discussion Paper]; Docket No. FDA-2026-N7874, https://www.regulations.gov/docket/FDA-2026-N-7874.

WPF Comments - FDA Discussion Paper Page 1 of 23
The World Privacy Forum (WPF) is a non-profit public interest research group. We publish
original research and policy analysis focused on the governance and privacy of complex data
ecosystems, including those using advanced AI in the areas of health, identity, education,
finance, and other issue areas. We have testified before Congress multiple times, and before
many federal agencies. We have written hundreds of reports and comments over the years.
Regarding our AI expertise, WPF was appointed as a member of the inaugural drafting group for
the OECD AI principles, begun in 2017 and ratified in 2019, and was also part of the 2024
update of the same. WPF’s Executive Director is a strategic advisor to the WHO’s Health Data
Collaborative, where she works on data, digital ecosystems, and AI. She is the Civil20 WG4 cocoordinator for AI and emerging technologies for this year’s G20, and is on the steering
committee of the Global Partnership on AI at OECD.

Specific to the FDA, WPF has testified before the FDA at its workshops (iPledge), issued reports
regarding other FDA programs, and submitted comments relevant to our expertise for two
decades now, including comments in 2022 to HHS regarding the SACHRP AI Framework and in
2024 regarding FDA’s request for inputs regarding consent, and in 2025 regarding the use of
artificial intelligence in regulatory decision-making for drug and biological products.2 We have
appreciated FDA’s attention and responsiveness to privacy and governance issues. You can see
our publications and find more information at www.worldprivacyforum.org.

WPF supports CDRH’s decision to seek early input, before issuing formal guidance, on a class of
devices that behaves unlike devices the Center has routinely regulated. The Discussion Paper is
candid where candor is rare. It asks whether a “talk to your doctor” sentence makes an output
any less directive (p. 7). It plainly states that an expert adjudicator may itself be a language
model, and that the independence principle still applies when it is (p. 14). It also says that
benchmarks can be contaminated, saturated, and unrepresentative (p. 12), and that a device
may begin a conversation in an informing mode and end the conversation directing patients
toward particular decisions or actions (p. 8). These are the right observations to make. Our
comments build on them.

2 Statement of the World Privacy Forum at the FDA/AHRQ Public Workshop, Implementation of Risk
Minimization Action Plans to Support Quality Use of Pharmaceuticals: Opportunities and Challenges, 28
June 2007
http://www.worldprivacyforum.org/wp-content/uploads/2007/06/WPF_RiskMAP_FDA28June2007fs.pdf,
and Written statement of Pam Dixon before the FDA Dermatologic and Ophthalmic Drugs Advisory
Committee and the Drug Safety and Risk Management Advisory Committee Regarding Privacy and the
iPledge Program, 1 August 2007,
http://www.worldprivacyforum.org/wp-content/uploads/2009/03/WPF_FDAiPledge_08012007fs.pdf.
See also Comments of WPF regarding Facilitating Understanding in Informed Consent, 30 April 2024
https://www.worldprivacyforum.org/wp-content/uploads/2024/04/WPF_Comments_FDA_InformedCons
ent_Guidance_30April2024-_fs.pdf; See also Comments of World Privacy Forum to the Food and Drug
Administration regarding Postmarket Management of Cybersecurity in Medical Devices. Docket No. FDA2015-D-5105, 4 April 2016
https://www.worldprivacyforum.org/wp-content/uploads/2016/04/WPFcomments_FDAcybersecurity_fs.
pdf. See related: Comments of the World Privacy Forum to the Secretary's Advisory Committee on Human
Subject Research Protections (HHS) regarding the SACHRP AI Framework, 20 July 2022,
https://worldprivacyforum.org/documents/33/WPF_Comments_SACGHS_AI_Frameowrk_July2022_fs.pdf
.

WPF Comments - FDA Discussion Paper Page 2 of 23
Our comments are focused on three main tranches: definitions of AI systems, components
missing from the Discussion Paper, and the way benchmarking has been defined and handled in
the overall approach.

I. Comments regarding AI Definitions

AI definitions require precision, and definitions move quickly right now in comparison to more
settled areas of law and technology. WPF has participated in the negotiation of several key AI
definitions in use today, including the OECD definition of AI from 2019 and then its most recent
update in 2024. Some of the normative AI definitions in use today took more than a year to
deliberatively discuss and arrive at a consensus.

In this section on AI definitions, we have sought to be as helpful as possible and our comments
are offered in that spirit.

A. Recommendation to update definition of “Generative AI” to reflect
the new Executive Order of 2025 and its updated definitions of AI
For purposes of background, the term "Generative AI" became popular in 2023. "Generative AI,"
reflective of that moment in time, was used in the definition section 3(p) of Executive Order
14110 (October 2023).3 NIST then carried the exact term and definition into SP 800-218A and
into its Generative Artificial Intelligence Profile, NIST AI 600-1.4 However, the Executive Order
(and the definition) were revoked in January 2025 by Executive Order 14148 § 2(ggg), which
was signed 20 January 2025.5

The replacement EO 14179 of 23 January 2025, Removing Barriers to American Leadership in
Artificial Intelligence, does not use the term "generative AI" anywhere, nor does it use "generative
artificial intelligence."6 This is appropriate and consistent with the direction of the updated
multilateral definitions discussed below. (We will return to the specific definition of generative
AI later in this section.)

The new EO defines the broad term "artificial intelligence" by reference to 15 U.S.C. § 9401(3),
with § 5(a) noting "the revoked Executive Order 14110."7 The OECD's updated definition,

3 Exec. Order No. 14,110, § 3(p), 88 Fed. Reg. 75,191, 75,194 (Nov. 1, 2023).
4 Nat'l Inst. of Standards & Tech., Secure Software Development Practices for Generative AI and Dual-Use
Foundation Models: An SSDF Community Profile, NIST SP 800-218A (July 2024),
https://doi.org/10.6028/NIST.SP.800-218A (glossary entry "generative artificial intelligence"); Nat'l Inst.
of Standards & Tech., Artificial Intelligence Risk Management Framework: Generative Artificial
Intelligence Profile, NIST AI 600-1 (July 2024), https://doi.org/10.6028/NIST.AI.600-1.
5 Exec. Order No. 14,148, § 2(ggg), 90 Fed. Reg. 8237, 8240 (Jan. 28, 2025).
6 Exec. Order No. 14,179, 90 Fed. Reg. 8741 (Jan. 31, 2025).
7 Id. §§ 3, 5(a).

WPF Comments - FDA Discussion Paper Page 3 of 23
adopted by the OECD Council on 8 November 2023 and carried in the Recommendation as
amended on 3 May 2024, defines an AI system as one that:

"...infers, from the input it receives, how to generate outputs such as predictions, content,
recommendations, or decisions that can influence physical or virtual environments."8

NIST's AI Risk Management Framework (RMF), which adapts the earlier OECD text, defines an
AI system as one that:

"...can, for a given set of objectives, generate outputs such as predictions,
recommendations, or decisions influencing real or virtual environments."9

The FDA's own Digital Health and Artificial Intelligence Glossary (FDA Glossary), the source the
Discussion Paper names for its definitions, defines an "Artificial Intelligence System" as an:

"...[e]ngineered system that generates outputs such as content, forecasts,
recommendations, or decisions for a given set of human-defined objectives."10

Under each of these definitions, every AI system "generates outputs." Since all AI systems
generate outputs, classifying an AI system as generative of outputs does not actually describe a
particular class of AI, rather, it describes all of AI. Under FDA's own glossary, the outputs an AI
system generates expressly include "content."11 Any of these three definitions would function well
in the FDA context it is considering.

B. Recommend revising definition of "generative AI" in Discussion
Paper
The Discussion Paper currently defines "generative AI" as:

"...a class of AI models that emulate the structure and characteristics of input data in
order to generate derived synthetic content"12

The Discussion Paper sources the definition to the FDA Glossary, id. at 3 n.5, which quotes it
from FedRAMP's emerging-technology list;13 FedRAMP's framework was issued "in response to

8 OECD, Recommendation of the Council on Artificial Intelligence, OECD/LEGAL/0449, § I, at 6 (adopted
May 22, 2019, amended Nov. 8, 2023 & May 3, 2024),
https://legalinstruments.oecd.org/public/doc/648/648.en.pdf.
9 Nat'l Inst. of Standards & Tech., Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST
AI 100-1, at 1 (Jan. 2023), https://doi.org/10.6028/NIST.AI.100-1.
10 U.S. Food & Drug Admin., Digital Health and Artificial Intelligence Glossary – Educational Resource
(Sept. 26, 2024), https://www.fda.gov/science-research/artificial-intelligence-and-medical-products/fdadigital-health-and-artificial-intelligence-glossary-educational-resource.
11 FDA Glossary, supra note 10 (entry “Artificial Intelligence System,” citing ISO/IEC 22989:2022);
Discussion Paper, supra note 1, at 3 & n.5.
12 Discussion Paper, supra note 1, at 3.
13 FDA Glossary, supra note 10 (entry "Generative Artificial Intelligence").

WPF Comments - FDA Discussion Paper Page 4 of 23
Executive Order (EO) 14110."14 We have mentioned that EO 14110 has been revoked. Beyond
that issue, the current definition is effective as a description of a technique regarding derived
synthetic content. It is accurate in that context. However, the current definition is not likely the
reason the Center wrote the current Discussion Paper. The reasons are stated two pages earlier:
these devices "may accept open-ended inputs, perform multiple subtasks, and produce variable
outputs to similar inputs," they "can also evolve over time through changes to features such as
the underlying model, prompts, retrieval strategies, guardrails, orchestration logic, and/or user
interface," and "[m]any are built on general-purpose foundation models developed by third-party
entities".15 This is correctly analyzed, however, none of the five properties mentioned are content
generation.

Notably, each of the five properties the FDA mentioned defeat the evaluation methods the Center
has relied on: extensive testing across a representative sample of bounded inputs and fixed
outputs.16 A definition keyed to the technique of content generation will sweep in systems that
generate but do not vary, change, or depend on others, and it will miss systems that will vary,
change, and depend on others without generating anything a reader would call content.

A definition that is keyed to the properties versus technique can capture the regulatory object
precisely, and it will survive the next iteration of technique when it comes along. The
multilateral definitions of generative AI were updated after 2023, and these updates folded
generative AI into the general definition of an AI system rather than defining generative AI as a
separate class.

The OECD's own account of its 8 November 2023 revision states that the edits included
"...clarifying that the Recommendation applies to generative AI systems, which produce
'content,'" and "...reflecting the fact that some AI systems can continue to evolve after their
design and deployment." The Council of Europe Framework Convention on Artificial Intelligence
and Human Rights, Democracy and the Rule of Law, opened for signature on 5 September 2024
and signed by the United States on that date, adopts the same definition in Article 2.17

The updated governing definitions and norms notably shifted away from describing AI as
"generative" technique and toward utilizing properties as the governing object. The key
properties are captured in the verb "infers", and in the key nouns "predictions," "content,"
"recommendations," and "decisions." The noun "inference" does the same work in United States
law: 15 U.S.C. § 9401(3) which provides that artificial intelligence systems:

“... use model inference to formulate options for information or action.”

14 FedRAMP, Release of Emerging Technology Prioritization Framework (June 27, 2024),
https://www.fedramp.gov/2024-06-27-release-of-et-framework/.
15 Discussion Paper, supra note 1, at 2.
16 Id. at 10.
17 OECD, supra note 8, at 3 (background information); Council of Europe Framework Convention on
Artificial Intelligence and Human Rights, Democracy and the Rule of Law art. 2, opened for signature Sept.
5, 2024, C.E.T.S. No. 225; Council of Europe Treaty Office, Signatures and Ratifications, C.E.T.S. No. 225,
https://www.coe.int/en/web/conventions/full-list?module=signatures-by-treaty&treatynum=225.

WPF Comments - FDA Discussion Paper Page 5 of 23
and FDA's own Glossary defines a machine learning model as:

"...[a] mathematical construct that generates an inference or prediction for input data."18

These changes as discussed outline the most current shifts in articulating the properties of AI
systems.

C. Proposed revision of definition of agentic AI-enabled systems
Agentic AI systems occupy a particularly crucial place in forthcoming technology systems. As
such, the definition the Discussion Paper uses is important, and worth revisiting.

The Discussion Paper defines agentic AI-enabled systems as:

"...GenAI-enabled systems that autonomously plan and execute multi-step tasks, use
external tools, or take actions across a sequence of steps."

This definition would benefit from revision. The Discussion Paper's own stated reasons for
treating agentic systems differently are properties of action, not of generation. Specifically, the
Discussion Paper names three distinct risks: 1) "The elevated19 risk associated with autonomous
multi-step action, tool use, and reduced opportunity for human review" and 2) "action sequences
[that] result in control of another medical device" and, 3) in the benchmarking element for
agentic devices, a planned "action sequence" that "would exceed its intended use or safety
envelope," "erroneous tool outputs," and "human-oversight checkpoints before irreversible or
high-consequence actions." 20

We urge the FDA to adopt a definition (or version of a definition) that links agentic AI to the
properties described above rather than to the "generative" technique that powers most such AI
systems today. We propose the following definition:

"An agentic AI-enabled device software function is a device software function that, in the
course of operation, determines which actions to take toward an objective and takes
them, including through tools, services, or other systems outside the function, such that
the sequence of actions is not fixed in advance by the manufacturer, the actions produce
persistent changes outside the function, and no human initiates or approves each
action."21

The proposed definition is consistent with the definition of an AI agent in ISO/IEC 22989:2022,
the standard on which FDA's glossary already draws. The ISO/IEC standard defines AI agent as:

18 15 U.S.C. § 9401(3); FDA Glossary, supra note 10 (entries "Artificial Intelligence" and "Machine
Learning Model").
19 Discussion Paper, supra note 1, at 4, 22. The definition carries no source in the Discussion Paper, and
the FDA Glossary has no entry for agentic AI. FDA Glossary, supra note 10.
20 Discussion Paper, supra note 1, at 23, 26.
21 Definition proposed by World Privacy Forum, based on ISO/IEC 22989:2022.

WPF Comments - FDA Discussion Paper Page 6 of 23
 an ".... automated entity that senses and responds to its environment and takes actions to
achieve its goals"22

NIST scopes its definition of an AI agent systems to those which are:

"capable of taking actions that affect external state, i.e., persistent changes outside of the
AI agent system itself."23

This definition applies however the function is implemented, and it applies whether or not the
device software function generates content. By using this proposed revised definition, the FDA
will be better able to precisely name the components it is seeking to give advice on.

II. Core Concepts and Legal Protections Missing from or
underdeveloped in the Discussion Paper: Privacy, Consent,
Voluntary Consensus Standards, and inference and
composition need to be present as defined and utilized terms

A. Privacy and Consent are absent from the Discussion Paper
The word “privacy” does not appear in the Discussion Paper. Neither does “consent.” Neither
does “retention.” The Discussion Paper’s only reference to the legal protections that attach to
patient data is a footnote noting that requirements in 21 C.F.R. parts 50, 56, and 812 “may
apply” to the clinical confirmation approaches, with the extent of their application stated as out
of scope (p. 15 n.20). WPF made the same observation of the 2025 draft guidance on the use of
artificial intelligence in regulatory decision-making for drugs and biological products, and the
observation applies here in the same words:

“We note that that privacy was not addressed at all in the guidance, nor was the role of
consent. There is not a single citation to a privacy framework for deeper reference. There
are meaningful privacy considerations throughout the AI cycle and ecosystem, including
in data reliability, gathering, quality and completeness, traceability, analysis, tuning,
storage, and end use, among other considerations. There are also substantial issues
connected to consent in many datasets used for AI training, another topic that was not
addressed in the guidance. While the draft did mention safety, safety is not
commensurate with privacy, and privacy as a legal norm in the U.S. and in most
jurisdictions is not defined as a subset of safety, including in the context of AI.”24

22 ISO/IEC 22989:2022, Information technology — Artificial intelligence — Artificial intelligence concepts
and terminology § 3.1.1 (adopted in the United States as INCITS/ISO/IEC 22989:2022).
23 Request for Information Regarding Security Considerations for Artificial Intelligence Agents, 91 Fed.
Reg. 698, 700 (Jan. 8, 2026) (Docket No. NIST-2025-0035).
24 World Privacy Forum, Comment Letter on Considerations for the Use of Artificial Intelligence To Support
Regulatory Decision-Making for Drug and Biological Products; Guidance for Industry and Other Interested

WPF Comments - FDA Discussion Paper Page 7 of 23
A device of this class is, among other things, a privacy instrument of unusual reach. It converses.
It infers (Section II.D below). It retains, or its underlying model’s developer retains, what it is
told. It may be deployed by a covered entity under the Health Insurance Portability and
Accountability Act, by a business associate, or by neither -- a consumer-facing device outside
HIPAA altogether -- and the Discussion Paper’s risk framework does not distinguish the three.25

1. Address Consent, the use of real-world data, and identifiable groups (Section V.C
of the Discussion Paper; Question 13)
The Discussion Paper’s clinical confirmation approach rests on “real patient inputs,” “shadow
deployment” in “a live clinical workflow on real patients,” and real-world data collected in the
United States and outside it (p. 15). It asks for “specific considerations for the use of such data”
(p.15). The first consideration is the legal protections that attach to the data, and the first of
those is consent. WPF’s 2024 joint comment to HHS and the FDA set out the state of the consent
literature and the problem of broad consent in AI training; this analysis carries to clinical
confirmation unchanged, and WPF incorporates it by reference rather than repeating it.26

Question 13 asks for which subpopulations synthetic data is adequate and what safeguards
prevent synthetic data from reproducing the gaps it is meant to detect (p.18). Section V.C of the
Discussion Paper proposes that synthetic data “modeled on real patient data” supplement
evaluation “for small or hard-to-sample subgroups” (p.16). Small subgroups are identifiable
groups. Data modeled on a small, identifiable group can carry the group’s identifiability into the
synthetic set, and findings about the synthetic set can attach to the real group. The National
Institutes of Health confronted exactly this in the All of Us Research Program’s tribal
consultation, and WPF has written about what laws apply to this program in a substantial report
on the issues.27 The analysis applies here with more force, because benchmarking element R.2
Parties, Docket No. FDA-2024-D-4689, at 2 (Apr. 7, 2025), https://downloads.regulations.gov/FDA-2024D-4689-0103/attachment_1.pdf [hereinafter WPF 2025 Comment]. Note 2 of that comment cited, for the
proposition that privacy is defined apart from safety, the OECD AI Principles; the Common Rule, 45 C.F.R.
pt. 46; and the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, 110 Stat.
1936.
25 Robert Gellman & Pam Dixon, World Privacy Forum, A Patient’s Guide to HIPAA: How to Use the Law to
Guard Your Health Privacy (version 2.0, Mar. 5, 2019), https://worldprivacyforum.org/posts/hipaa/.
26 Comments of the World Privacy Forum to the Department of Health and Human Services, HHS Office
for Human Research Protections and the Food and Drug Administration regarding Key Information and
Facilitating Understanding in Informed Consent; Draft Guidance for Sponsors, Investigators, and
Institutional Review Boards; Availability, Docket Number FDA-2022-D-2997, April 30, 2024.
https://worldprivacyforum.org/documents/15/WPF_Comments_FDA_InformedConsent_Guidance_30Apri
l2024-_fs.pdf.
27 Robert Gellman and Pam Dixon, Privacy, the Precision Medicine Initiative, and the All of Us Research
Program -- Will any legal protections apply? World Privacy Forum, 16 March 2017.
https://worldprivacyforum.org/posts/report-privacy-the-precision-medicine-initiative-and-all-of-usresearch-program-will-any-legal-protections-apply/. Nat’l Insts. of Health, All of Us Research Program
Tribal Consultation Final Report (Mar. 2021), https://allofus.nih.gov/all-us-research-program-tribalconsultation-final-report; The NIH report states that the discussion of identifiability at the individual level
“does not take into consideration the concern over group identifiability,” and that singling out
subpopulations “can put these subpopulations at risk for stigma and discrimination.”

WPF Comments - FDA Discussion Paper Page 8 of 23
proposes to test performance “across demographic subgroups” and “non-standard dialects,
accents, colloquialisms” (p.26) -- these are categories that define groups.

WPF recommends that the FDA add to benchmarking element R.2 an assessment of group-level
identifiability for any subgroup evaluated with synthetic data modeled on real patient data, and
require that the generator of such data be identified by developer lineage and version, as Section
III.C recommends for every evaluation instrument.

B. Give people the choice not to use (Question 3)
If people are not given an opportunity to consent, then they should be given the choice to not use
the system, and not be penalized for their choice. Question 3 asks what safeguards mitigate risk
to a user who cannot evaluate an output “without unnecessarily underestimating patient
capability” (p. 9). The safeguard that respects capability most is choice. A patient who can
decline a function of this class and still be seen is a patient whose agency the device has not
displaced. A patient who cannot choose not to use the device is a patient whose agency the
deployment has already decided.

Add to Section IV of the Discussion Paper the user’s ability to decline a function of this class
without loss of access to care, and ask deploying institutions, under Section VI.B, to record
whether and how that choice is offered.

C. Recognize and incorporate Voluntary Consensus Standards
meaningfully
Also missing from the Discussion Paper is a thorough discussion of Voluntary Consensus
Standards. The FDA should recognize under section 514(c) Voluntary Consensus Standards for
the privacy behavior of device software functions of this class -- at minimum the acquisition
commitments in Section II.H -- and make conformity to them, declared and tested as under the
Accreditation Scheme for Conformity Assessment, a condition of premarket review for devices
deployed in settings that operate under HIPAA and for consumer-facing devices alike.

There is substantive precedent here under ISO/IEC 29100:2024.28 VCS have been a success story
at the FDA. Over 1,700 standards are recognized in FDA’s Recognized Consensus Standards
database.29

28 ISO/IEC 29100:2024, Information Technology — Security Techniques — Privacy Framework; ISO/IEC
27701:2025, Information Security, Cybersecurity and Privacy Protection — Privacy Information
Management Systems — Requirements and Guidance; ISO/IEC 27018:2019, Code of Practice for
Protection of Personally Identifiable Information (PII) in Public Clouds Acting as PII Processors. For the
security precedent, IEC 81001-5-1:2021, Health Software and Health IT Systems Safety, Effectiveness and
Security — Part 5-1: Security — Activities in the Product Life Cycle (FDA Recognition No. 13-122,
Recognition List No. 059, entered Dec. 19, 2022) (recognized in full).
29 U.S. Food & Drug Admin., Recognized Consensus Standards: Medical Devices,
https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfStandards/search.cfm (last visited Oct. 19, 2026).

WPF Comments - FDA Discussion Paper Page 9 of 23
The Discussion Paper also does not cite FDA’s guidance Off-The-Shelf Software Use in Medical
Devices (August 2023). A third-party foundation model is off-the-shelf software at its outer limit,
and the Master File proposal sits beside that guidance unconnected.

Of note: WPF addressed the iPledge problems directly with the FDA, and the FDA took on a
privacy consideration in the iPledge Program and it posted a formal privacy policy for the
program, even though it did not have to. That act did not make the FDA become a privacy
regulator. And the FDA has recognized a security standard without becoming a security
regulator, and said so on the entry for IEC 81001-5-1:2021, Health Software and Health IT
Systems Safety, Effectiveness and Security. What both actions accomplished was to facilitate the
FDA to continue to be trusted. The security precedent had a statute behind it: section 524B,
added in 2022, made cybersecurity a premarket requirement.30 Privacy has no section 524B,
which is why recognition under section 514(c) is the right instrument: it requires no new
mandate.

D. Inference and Composition need to be added substantively to and
expressly discussed in the Discussion Paper
1. Add Inference to the Discussion Paper (Questions 1, 2, 3)
The consequence axis measures the harm of relying on an incorrect output (p. 6). A second kind
of risk survives both an incorrect output and it survives a correct output, and that is inference. A
device function that converses with a patient infers. It infers from phrasing, from what is omitted,
from the order of symptoms, from the hour of the day, from the way the person spoke or typed,
from the number of typos, from the speed of typing, from the tone of the comments, from the
inferred mental state....and more. Some of those inferences concern the person’s condition and
some concern the person -- pregnancy, substance use, a psychiatric history, a physical limitation,
to name just a few -- and the function may rely on these inferences, phrase its outputs around
these inferences, or route the person on the basis of its own inferences, all of this whether or not
the inferences were true, whether or not the person disclosed them or knew they were drawn, or
can retract them. The output can be incorrect and harm a patient. But the inferential output can
also be correct and still harm the patient through overreach, among other possibilities. WPF’s
research on scoring and inference over two decades documents this risk in consumer and health
contexts in meaningful detail; the structure is the same here; what has changed is that the
velocity is higher.31

Question 2 of the Discussion Paper asks what characteristics of an output -- “wording, specificity,
personalization, or context” -- modify the risk of an informational function (p. 9). Personalization
is inference by another name. A function that personalizes has inferred, and the modifier the

30 Federal Food, Drug, and Cosmetic Act § 524B, 21 U.S.C. § 360n-2 (added in 2022).
31 Pam Dixon & Robert Gellman, World Privacy Forum, The Scoring of America: How Secret Consumer
Scores Threaten Your Privacy and Your Future (Apr. 2, 2014),
https://worldprivacyforum.org/documents/122/WPF_Scoring_of_America_April2014_fs.pdf.

WPF Comments - FDA Discussion Paper Page 10 of 23
Discussion Paper is looking for is the inference load of the output: how much the output depends
on facts about the person that the person did not supply.

Add inference to the risk framework as a modifier that moves a function up the consequence
axis, in the same way the Discussion Paper already moves measurement functions (pp. 7–8) and
patient-facing functions (p. 8) up that axis. Define inferential risk for the purposes of the
Discussion Paper as the risk that a function produces, relies on, or discloses an inference about a
person that the person did not supply, cannot see, and cannot retract. Treat a function’s
inference load as a characteristic to be benchmarked (see Section III below and revised Figure 2).

2. Include composition as the unit of assessment (Questions 1, 5)
The Discussion Paper assesses risk per function (pp. 4–5). It also says, in four places, that the risk
it is worried about forms between functions. A conversation migrates from informational to
action-directing (p. 8; Question 5). A product contains several functions, not all of them device
functions (pp. 4–5). An action sequence may control another device (p. 23). A third-party model
changes beneath the device (pp. 20–21). In each case the risk is absent from each part assessed
alone and present in the combination. Question 5 already asks for assessment “across realistic
conversational trajectories” rather than “at the level of individual functions” (p. 8). WPF
recommends that the Center generalize that answer: the unit of assessment is the composition —
the trajectory, the product, the chain of devices, the stack of layers — and the two-axis position
of a function is a point on a path, not a fixed address.

We recommend that the FDA state in Section IV that risk is assessed for compositions as well as
for functions, and name four compositions the Discussion Paper already describes: across turns,
across functions in a product, across devices in an action chain, and across layers from the
underlying model to the device. Define compositional risk for the purposes of the Discussion
Paper as risk that is absent from each component assessed alone and present when the
components are combined.

E. Add a component that requires users to be able to see the basis of an
output (Question 3)
The activity axis counts what the device does: informs, directs, acts under supervision, acts alone
(p. 6). Read from the other end, it counts what the person no longer decides. The Discussion
Paper’s findings in Section IV are findings about that quantity. A disclaimer does not undo an
instruction (p. 7). A fluent-looking, confident output is accepted without scrutiny -- the
Discussion Paper’s own definition of automation bias (p. 25). A patient cannot evaluate what a
clinician can (p. 8). Each of these is a statement about the decision that remains with the human.
The Discussion Paper also warns, rightly, against “medical parentalism that may underestimate
patient capability” (p. 8). The quantity that reconciles the two concerns is the decision that is
retained: whether the person can see the basis of the output, whether the person can decline the
function and still receive care, and whether what the device did is recorded so that the person, or
a clinician, can revisit it and take it through a full audit.

WPF Comments - FDA Discussion Paper Page 11 of 23
Users should be able to see the basis of an output. Add to Section IV the user's ability to see and
decline a function of this class without loss of access to care, and the user's ability to see the basis
of an output that directs them in some way. Treat both as risk modifiers on the consequence axis.

F. A Register is missing from the Discussion Paper (Section VI of the
Discussion Paper; Questions 18, 19, 20, 21, 22, 23, 24; Section VII.A;
Question 25.)
Continuous change needs an instrument that provides continuity. The Discussion Paper does not
discuss a register.32 A register is a record, kept in the course of operation, in which each change is
entered as it occurs. These comments call it a configuration register.

The Discussion Paper describes a device that changes in the course of operation. Using the
terminology from the Discussion Paper, it lists the components whose change alters behavior as:

“...the underlying model, prompts, retrieval strategies, guardrails, orchestration logic,
and/or user interface” (p. 2) -- and it distinguishes three kinds of change: discrete
modifications the sponsor makes, “model-evolution changes” that occur “more passively,
continuously, or incrementally,” and “unplanned changes arising from updates to an
underlying third-party foundation model” (p. 20). It then proposes instruments that act at
moments. The premarket competency-based assessment is a baseline (pp. 20–21).

Periodic re-benchmarking is a return to the baseline “on a defined cadence and after
defined triggering events” (p. 19). A Predetermined Change Control Plan is permission to
change within an envelope (p. 20). A Foundation Model Device Master File is a
description of the model at the time of filing (p. 22). Each is a photograph of a moving
object. Between the photographs, the record is silent, and Question 24 asks the question
that silence produces: how a manufacturer can “detect, evaluate, and respond to” a thirdparty model change “in a timely manner” (p. 22).

What is not recorded cannot be audited, and a baseline with no record of departures from it is a
point, not a line. The instrument that records departures is a register. Registers of this kind are
old and well understood: a register of title, a register of clinical trials33, a register of controlled
materials. What distinguishes a register from a log is that the entry is constitutive. The thing is
not transferred, flagged, or dispensed until the entry is made. The Discussion Paper comes
nearest to a register in a footnote, which lists “update notification commitments” and “audit log
availability” among the information a foundation model developer might voluntarily file (p. 22
n.24). A notice is not an entry, and a log is not a register. The FDA keeps a register of its own. A
device that is not on the device list the statute requires is misbranded.34 For a change to a listed
32 Discussion Paper, supra note 1.
33 World Health Org., Glossary, Int’l Clinical Trials Registry Platform, https://who.int/tools/clinical-trialsregistry-platform/about/glossary (last visited Oct. 19, 2026) (defining a clinical trial register as “[t]he
formal record of an internationally agreed minimum amount of information about a clinical trial” and the
registry as the entity that houses it).
34 Federal Food, Drug, and Cosmetic Act § 502(o), 21 U.S.C. § 352(o).

WPF Comments - FDA Discussion Paper Page 12 of 23
device, however, the entry is annual: listing information is confirmed once a year, and a change
may be reported sooner but need not be.35 For change, FDA’s own register is a photograph.

WPF recommends that CDRH require, for every device of this class, a configuration register: a
record of each change to any component on which the behavior of the device depends, entered
as the change occurs and maintained by the manufacturer, with a public portion. Rebenchmarking, the Predetermined Change Control Plan, and the Foundation Model Device
Master File should be keyed to entries in that register. A change that is not entered is not a
change the device may run under its authorization.

G. Identity is absent from the Discussion Paper: Identity, agency, and
acting functions (Section IV and Section VII.B of the Discussion Paper;
Appendix A, element A.1; Questions 3, 26)
The word “identity” does not appear in the Discussion Paper. Its user categories --patient-facing
and clinician-facing (p.8), generalist and specialist (p.8), “intended user” (p.25) -- are designtime categories. These are not identity categories. At runtime, a device of this class must know
whom it is addressing, and an acting function must know on whose authority it acts. A patientfacing function and a clinician-facing function can be the same model behind a different binding,
and the binding is a fact about the deployment, not about the model. Identity decides who may
act, on whom, and by what authority. A Discussion Paper about devices that act on behalf of
clinicians and patients cannot leave identity out of the document.

WPF has worked on identity ecosystems since 2004 and set out a core governance position in its
2019 report, Digital Identity Ecosystems, elaborated with extensive peer-reviewed and published
field research in A Failure to Do No Harm36; the position is that identity is the lever by which
every other control in a system is applied or withheld, and that its bounds must be set so that no
actor, public or private, can use it to overreach. In the health context the same lever is what
connects a device’s output to a patient’s record, a clinician’s order, and a payer’s file.

1. Authority to act must be conferred and recorded
Element A.1 tests “compliance with human-oversight checkpoints before irreversible or highconsequence actions” (p.26). Section VII.B notes that an acting function may control another
medical device (p.23). Question 26 asks how “autonomous multi-step action, tool use, and
reduced opportunity for human review” should be reflected in oversight (p.23).

A checkpoint that leaves no record is a behavior, not a control. WPF recommends that for every
acting function, each action be bound to an identified principal -- the patient, the clinician, or the
institution on whose behalf the device acts -- and to a recorded authorization that states what
35 See 21 C.F.R. § 807.22(b)(3)–(4) (2026).
36 Pam Dixon, Digital Identity Ecosystems, World Privacy Forum,(Feb. 4, 2019) (position paper presented
at the Harvard Kennedy School, Feb. 5, 2019), https://www.worldprivacyforum.org/2019/02/digitalidentity-ecosystems/. See also Pam Dixon, A Failure to Do No Harm — India’s Aadhaar Biometric ID
Program and Its Inability to Protect Privacy in Relation to Measures in Europe and the U.S., 7 Health & Tech.
539 (2017), https://doi.org/10.1007/s12553-017-0202-6.

WPF Comments - FDA Discussion Paper Page 13 of 23
was authorized, by whom, when, and whether it still holds. This is the question of provenance of
authority, and it is the governance object that distinguishes an acting function from a speaking
one. The configuration register in Section II.F records what the device is; a record of conferred
authority records what the device was permitted to do, and for whom.

WPF recommends that FDA add “principal” and “user binding” to the definitions in Section III.
Also, add to Appendix A an element A.2, “Authority binding and inscription.” This element
should test whether each action of an acting function is bound to an identified principal and a
recorded authorization, and whether each human-oversight checkpoint produces a record.

H. Add the idea of acquisition of data to the Discussion Paper: every
"turn" is an acquisition
The Discussion Paper treats data as training data only. The Master File may describe “training
data provenance” (p.22 n.24), and benchmarking element E.1 considers evidence “not reflected
in [the model’s] training” (p. 25). But a deployed device of this class does not stop acquiring data
when training ends. Every conversational turn is an acquisition. Every retrieved document, every
tool output, every sensor reading the device ingests is an acquisition, and the device, not the
patient and not the clinician, initiates most of them. Where the device is built on a third-party
model, those acquisitions commonly cross to infrastructure the manufacturer does not control,
under terms the patient has never seen, and may be entering a digital space neither subject to
HIPAA nor the Common Rule. Whether operational inputs are retained by the model developer,
whether they are used to train or tune the model, for how long they are kept, and by whom they
may be read (or subpoenaed in a civil lawsuit) are facts about the device’s behavior in operation,
and the Discussion Paper does not ask for any of them.

WPF recommends that the FDA add to the Master File contents (p.22 n.24), and to the public
portion of the configuration register, the developer’s acquisition commitments for operational
inputs: whether inputs are retained, whether they are used for training or tuning, the retention
period, and the parties with access. Add to Section VI a monitoring approach for changes in
those commitments, since a change in retention or secondary use is a change in the device.

I. Add the requirement of a Privacy Impact Assessment and a complete
AI Impact Assessment
Require, as part of the competency-based assessment, a complete Privacy Impact Assessment and
a complete AI Impact Assessment for the device as deployed, covering the operational data flow
from user to device to underlying model and back. WPF made this recommendation to the FDA
in 2025 and repeats it here in the same terms: “There are no substantive reasons to not do this,
and it is considered a basic best practice in even very complex AI systems at this point.”37 The
NIST AI Risk Management Framework and its Generative AI Profile both provide for impact
assessment; the Discussion Paper cites neither.

37 WPF 2025 Comment, supra note 24, at 10.

WPF Comments - FDA Discussion Paper Page 14 of 23
III. Recommendations regarding defining and addressing the
corrections needed on the topic of Benchmarking

The Discussion Paper chooses the term “benchmarking” over the term “evaluation” by footnote
(p. 11 n.17), and it imports the term “competency” from the credentialing of human clinicians
(pp. 10–11). This is problematic because both terms carry established meanings in the technical
literature that differ from the established meanings they carry in clinical training, and both will
be read by legislative staff in the plain sense.

WPF recommends that Section III of the Discussion Paper specifically define “benchmark,”
“competency,” and “reproducibility” for the purposes of this Discussion Paper, as it defines the
other terms, and that the definition of reproducibility say plainly what the Discussion Paper’s
benchmarking element R.1 already assumes: that for a function that produces variable outputs to
similar inputs, reproducibility is a property of safety-critical behavior across runs, not of text (p.
25). Our specific recommendations regarding the terms are to re-base the definition that is
currently held in Section III. Keep “generative” as the description of a technique. Define “acting
function” separately. Define “benchmark,” “competency,” and “reproducibility” for the purposes
of the Discussion Paper.

A. The Discussion Paper’s benchmarking discussion is a standards
concept
The Discussion Paper notes that “benchmarking” is understood to mean “the use of well-defined,
published, reusable tests and datasets (‘assets’) to measure and compare the performance of AIenabled products at a specific point in time” (p.12). However, published, reusable, comparable:
those are the attributes of a standard. The Discussion Paper then describes who writes the test:
“sponsors would define the scope of testing based on the device’s intended use and risk profile,
prespecify evaluation methods, describe and justify scoring rubrics, identify qualified expert
adjudicators where applicable, and prespecify and justify acceptance criteria” (p.13). The general
principles that follow -- prespecification, rubrics grounded in guidelines, adjudicators structurally
independent of the sponsor and of the model developer, scope sufficient to the intended use,
data representative of deployment (p.14) -- are again the contents of a standard, stated as
principles because no standard yet exists.

When the sponsor writes the test, the test measures the sponsor. Question 10 recognizes this; it
asks what role “sponsor-developed benchmarks” should play “given potential concerns around
independence and optimization to the test” (p.18). The concern is structural, and it is answered
structurally: the method is written by many parties in the open and the reference is held by none
of the parties being measured. That is what a voluntary consensus standard is.

WPF Comments - FDA Discussion Paper Page 15 of 23
B. The machinery already exists: Use Voluntary Consensus Standards
for Benchmarking and Privacy
The Discussion Paper’s single reference to voluntary consensus standards is descriptive:
laboratories accredited under the Accreditation Scheme for Conformity Assessment “perform
testing on devices in accordance with FDA-recognized voluntary consensus standards and test
methods” (p. 17). The Discussion Paper cites no consensus standard by designation, and it does
not mention the statute and the Circular that govern federal use of such standards. WPF sets
them out because they answer Questions 9, 10, and 16 directly.

Section 12(d) of the National Technology Transfer and Advancement Act of 1995 directs federal
agencies to use technical standards developed or adopted by voluntary consensus standards
bodies in carrying out policy objectives, except where inconsistent with law or otherwise
impractical.38 OMB Circular A-119, revised in 2016, implements that direction for regulatory,
procurement, and program activities, and it defines a voluntary consensus standard by the
attributes of the process that produces it: openness, balance, due process, an appeals mechanism,
and consensus.39 Those attributes are the answer to the second half of Question 16 -- what
“safeguards or program design features would be critical to prevent third-party participation
from limiting competition or preventing innovation” (p.19). A standard written in the open by a
balanced body under due process is the safeguard.

Section 514(c) of the Federal Food, Drug, and Cosmetic Act gives FDA the mechanism:
recognition of consensus standards, with a published list already built and functioning, and a
guidance that describes how CDRH identifies, evaluates, recognizes, and withdraws the
standards.40 Section 514(d), as amended in 2022, underwrites the Accreditation Scheme for
Conformity Assessment the Discussion Paper cites, under which accredited laboratories test to
recognized standards and FDA accepts a declaration of conformity with a summary test report.41

38 National Technology Transfer and Advancement Act of 1995, Pub. L. No. 104-113, § 12(d), 110 Stat.
775, 783 (1996) (codified at 15 U.S.C. § 272 note).
39 Office of Mgmt. & Budget, Exec. Office of the President, OMB Circular A-119, Federal Participation in
the Development and Use of Voluntary Consensus Standards and in Conformity Assessment Activities §§
2(d)–(e), 5 (rev. Jan. 27, 2016),
https://www.whitehouse.gov/wp-content/uploads/2020/07/revised_circular_a-119_as_of_1_22.pdf.
Section 5 states the general rule that agencies must use voluntary consensus standards in regulatory,
procurement, and program activities in place of government-unique standards unless doing so would be
inconsistent with applicable law or otherwise impractical; section 2(e) lists the attributes of the
development process.
40 Federal Food, Drug, and Cosmetic Act § 514(c), 21 U.S.C. § 360d(c); U.S. Food & Drug Admin.,
Recognition and Withdrawal of Voluntary Consensus Standards: Guidance for Industry and Food and Drug
Administration Staff (Sept. 15, 2020), https://fda.gov/media/71995/download; U.S. Food & Drug
Admin., Appropriate Use of Voluntary Consensus Standards in Premarket Submissions for Medical Devices:
Guidance for Industry and Food and Drug Administration Staff (Sept. 2018),
https://www.fda.gov/media/71983/download. The list of recognized standards is published through
FDA’s Recognized Consensus Standards database.
41 U.S. Food & Drug Admin., Accreditation Scheme for Conformity Assessment (ASCA),
https://www.fda.gov/medical-devices/standards-and-conformity-assessment-program/accreditationWPF Comments - FDA Discussion Paper Page 16 of 23
The Medical Device Development Tools program, also cited by the Discussion Paper (p.17),
qualifies tools, including evaluation tools. The Discussion Paper asks whether “analogous thirdparty frameworks could be utilized” (p.17). They can, and the first step is the one the
Accreditation Scheme presupposes: a recognized standard to test against.

C. Test methods, scoring, and acceptance criteria should be developed
as VCS (Questions 7, 9, 10, 12, 13, 14, 15, 16, 17)
WPF recommends that the FDA state in Section V that the test methods, scoring rubrics, and
acceptance criteria for the benchmarking elements in Figure 2 are intended to be carried, as they
mature, in FDA-recognized voluntary consensus standards developed in an open process, and
that CDRH will initiate that development through its standards program with the relevant
standards development organizations. Until such standards exist, apply the general principles of
Section V.B.2 as interim criteria and say so.

The FDA should adopt an openness rule for any benchmark used to gate a premarket decision,
with three conditions, each separable: first, the metric and the method are public; second, the
reference set is held by a party independent of the sponsor and of the developer of any
underlying model; third, the reported score is reproducible by a third party from the published
method.

The FDA should also adopt a disclosure rule for every reported benchmark score, premarket and
postmarket: each score names the layer it measured (the deployed device configuration, the
underlying model, or a component), the author of the test, the party that ran it, the version of
the device configuration tested, the version of each underlying model, and the date. A score that
cannot be placed at a layer, a version, and a date cannot be compared with the score that follows
it, and comparison across time is the whole point of re-benchmarking (pp. 20–21).

Treat sponsor-developed benchmarks as supplements, admissible under the disclosure rule
above, and not as the sole gate for the safety elements S.1 through S.3.

For Question 10, require that a benchmark used to gate be shown to predict clinical-confirmation
outcomes for the device’s intended use, and that this construct-validity evidence be published
rather than held in the submission.

The Discussion Paper’s evaluation instruments -- adjudicator models (p.14), synthetic data
generators and “virtual patient avatars” (p. 13), and “machine-based supervisory agents” (p. 20)
-- are tools of governance, and tools of governance carry flaws of their own. WPF’s 2023 report
Risky Analysis documented this for AI governance tools then in use, including explainability tools
adopted as governance instruments without evaluation of the tools themselves.42 The Discussion
Paper already states the right principle for adjudicators: structural independence from the

scheme-conformity-assessment-asca (content current as of Jan. 28, 2026). The page states that the
program is implemented under section 514(d) of the Federal Food, Drug, and Cosmetic Act as amended by
the Food and Drug Omnibus Reform Act of 2022, that laboratories are accredited against ISO/IEC
17025:2017 and ASCA specifications, and that FDA generally does not request additional information on
test methods where a declaration of conformity and an ASCA summary test report are included.

WPF Comments - FDA Discussion Paper Page 17 of 23
sponsor and from the model developer, even “when the expert adjudicator is itself an LLM”
(p.14). WPF recommends extending that principle to every evaluation instrument, and adding
two requirements: that each instrument be identified by developer lineage and version in the
record of the evaluation, and that an instrument sharing developer lineage with the device’s
underlying model be disclosed as such. Question 13 states the reason in the Discussion Paper’s
own words: synthetic data “generated by models of the same class as the device under
evaluation” may reproduce “the very performance gaps the evaluation is intended to detect”
(p.18). An adjudicator of the same class will miss them for the same reason.

For Questions 14 and 15, the comparator -- standard of care, median clinician, generalist or
specialist, human-AI team or device alone, or the course of care in the device’s absence -- is a
choice that determines the result. It belongs in the record of the evaluation with its justification,
under the disclosure rule above, and it should be held constant across re-benchmarking of the
same device unless the change is itself recorded.

For Question 16, structure third-party roles on the pattern the Discussion Paper already cites:
recognized standards, accredited laboratories, and qualified tools. The roles the Discussion Paper
lists: holding sequestered datasets, adjudicating, developing standards (p. 17) — are again
standards roles. The safeguard against third parties limiting competition is the one Circular A119 supplies: there are requirements for openness, balance, due process, appeals, nondominance, and consensus in the body that writes the standard. This is a feature list that
governs, in variations, standards bodies today. ISO, ANSI, BSI, and other formal standard bodies
all have a version of this same list.

IV. Revised Figures

A. Revised Figure 1
Appendix A to these comments presents a revised Figure 1 that keeps the Discussion Paper’s two
axes and adds the three elements above: inference as a vertical modifier, composition as a
trajectory through the plane rather than a point in it, and the human-side reading of the activity
axis.

B. Revised Figure 2
Appendix A presents a revised Figure 2 that keeps the Discussion Paper’s four groups and their
element codes, adds the elements implied by Sections II, IV, and V of these comments, and adds
the two rules above — the source of each element’s method, and the registration and
independence of the instruments that run it.

42 Kate Kaye & Pam Dixon, World Privacy Forum, Risky Analysis: Assessing and Improving AI Governance
Tools (Dec. 2023),
https://worldprivacyforum.org/wp-content/uploads/2023/12/WPF_Risky_Analysis_December_2023_fs.pd
f. The report’s case study of explainability tools used as governance instruments discusses LIME and SHAP.

WPF Comments - FDA Discussion Paper Page 18 of 23
V. Conclusion

WPF appreciates the Discussion Paper and the care with which it describes a new regulatory
object. The Discussion Paper is right that these devices change continuously, that benchmarks
can be optimized to the test, that adjudicators must be independent, and that a disclaimer may
not make an output less directive. The Discussion Paper is incomplete in the respects that these
comments address: its definition is keyed to a technique rather than to the properties that
matter; its risk framework omits inference and composition; its evaluation approach leaves the
writing of the test to the party being tested when the now well-understood and established
process for developing Voluntary Consensus Standards already exists; and its postmarket
approach has no instrument that records change. The Discussion Paper is silent on privacy,
consent, and identity.

The additions WPF recommends in these comments share one shape. Each puts a record where
the Discussion Paper has a behavior: a register where there is a baseline, a standard where there
is a sponsor’s test, a disclosure where there is a score, a binding where there is a checkpoint.
With the record in place, a growing technical capacity should not pose a threat. That is how good
governance works, and it is what allows innovation and human flourishing to sit side by side.

We would be pleased to assist with any questions you may have about our analysis and
comments.

Respectfully submitted,

Pam Dixon
Founder & Executive Director,
World Privacy Forum
www.worldprivacyforum.org

WPF Comments - FDA Discussion Paper Page 19 of 23
Appendix A. Revised Figures 1 and 2

Revised Figure 1: Adding inference and composition to the figure.

Revised Figure 1 illustrates risk for a device software function of this class: two axes, three
additions. The Discussion Paper’s two axes are kept: activity (horizontal) and consequence of
relying on an incorrect output (vertical). Three elements are added. (1) Inference is drawn as a
vertical modifier, moving a function up the consequence axis in proportion to its inference load,
as the Discussion Paper already does for measurement functions and patient-facing functions. (2)
Composition is drawn as a trajectory through the plane: the same function at successive turns,
the chain from one function to the next, and the shift that follows a change in a component or an
underlying model; the unit of assessment is the path, and each move along it is an entry in the
configuration register. (3) The activity axis carries a second scale beneath the first, reading the
same positions from the human side: the decision retained by the person, from retained to
displaced.

WPF Comments - FDA Discussion Paper Page 20 of 23
Revised Figure 2 adds evaluatory benchmarking elements to the figure as well as identity and
register components. VCS components are added.

Revised Figure 2 — Benchmarking elements, with sources of method and instruments of
evaluation. The Discussion Paper’s four groups and element codes are kept. Four elements are
added and marked: S.4 Inference boundary (the function does not rely on, produce, or disclose
inferences about the person outside its intended scope, and surfaces those it relies on); R.3
Composition (safety and proficiency properties hold across turns, across functions in the product,
across devices in an action chain, and across a change in an underlying model); A.2 Authority
binding and inscription (each action bound to an identified principal and a recorded

WPF Comments - FDA Discussion Paper Page 21 of 23
authorization; each checkpoint produces a record); and a fifth group, Record, with P.1
Configuration register, P.2 Acquisition commitments, and P.3 Score record (every score with its
layer, author, measurer, version, and date). A left-hand rail shows the source of each element’s
method -- an FDA-recognized voluntary consensus standard where one exists, a disclosed
sponsor-developed method where one does not --and a bottom band shows the instruments of
evaluation (adjudicator models, synthetic data generators, supervisory agents) as registered,
independent in provenance, and disclosed.

Appendix B. Lexicon

WPF developed this lexicon to facilitate writing these comments. We add it here in case it is
useful.

- Acting function — as used in these comments, a device software function of the class
addressed by the Discussion Paper that initiates actions (orders, tool invocations, control of
another device) rather than producing information only.

- Accreditation Scheme for Conformity Assessment (ASCA) — FDA’s voluntary program under
which recognized accreditation bodies accredit testing laboratories to test devices against FDArecognized consensus standards; implemented under section 514(d) of the Federal Food, Drug,
and Cosmetic Act.

- CDRH — Center for Devices and Radiological Health, FDA.

- Compositional risk — as used in these comments, risk that is absent from each component
assessed alone and present when the components are combined (across turns, functions, devices,
or layers).

- Configuration register — as used in these comments, the constitutive record of every change
to any component on which the behavior of a device software function of this class depends
(Section II.F).

- Device software function — a software function that meets the definition of “device” in section
201(h) of the Federal Food, Drug, and Cosmetic Act (Discussion Paper, p. 4).

- Foundation Model Device Master File (MAF) — the Discussion Paper’s proposed voluntary,
confidential submission by a model developer under the existing Device Master File program
(Discussion Paper, p. 22).

- Inference load — as used in these comments, the degree to which an output depends on facts
about the person that the person did not supply.

- Inferential risk — as used in these comments, the risk that a function produces, relies on, or
discloses an inference about a person that the person did not supply, cannot see, and cannot
retract.

WPF Comments - FDA Discussion Paper Page 22 of 23
- Medical Device Development Tools (MDDT) — FDA’s program for qualifying tools used in
device development and evaluation (Discussion Paper, p. 17).

- NTTAA — National Technology Transfer and Advancement Act of 1995, Pub. L. No. 104-113;
section 12(d) governs federal use of voluntary consensus standards.

- OMB Circular A-119 — Office of Management and Budget, Federal Participation in the
Development and Use of Voluntary Consensus Standards and in Conformity Assessment Activities
(revised 2016).

- Predetermined Change Control Plan (PCCP) — an FDA-authorized plan describing planned
modifications to a device, the methods for making them, and their impact assessment, permitting
certain changes without a new premarket submission.

- Principal — as used in these comments, the identified person or institution on whose behalf an
acting function acts.

- Provenance of authority — as used in these comments, the record of what an acting function
was authorized to do, by whom, when, and whether the authorization still holds.

- Total product life cycle (TPLC) — FDA’s term for regulation spanning premarket through
postmarket.

- Voluntary Consensus Standard or VCS — a standard developed or adopted by a voluntary
consensus standards body through a process characterized by openness, balance, due process, an
appeals mechanism, and consensus (OMB Circular A-119, § 2).

WPF Comments - FDA Discussion Paper Page 23 of 23