Hopper Healthcare (Axel Sylvan)

See attached file(s)

Re: Docket FDA-2026-N-7874 — Considerations for the Regulation of Generative AIEnabled Medical Devices

Submitted by Dr. Axel Sylvan, Chief Medical Officer, Hopper Healthcare
axel.sylvan@hopperhealthcare.com

Hopper Healthcare supports the risk-based, competency-based approaches explored in CDRH's
discussion paper. We encourage explicit recognition of validated architectural safeguards and
clearly allocated supplier controls when assessing residual risk and setting evidence
requirements. Reductions in evidentiary burden should be earned through demonstrated control
effectiveness in the deployed device.

Hopper Healthcare develops myrecovery, a platform supporting patients and care teams across
musculoskeletal episodes of care. myrecovery is listed with FDA as a Class I device (product code
OUG) and is developed under an ISO 13485-certified quality management system, with
deployment across the United States, United Kingdom and Australia. We are developing patientfacing conversational functions for voice and messaging with a conversational-infrastructure
partner. Hopper would retain responsibility for the finished device, including its intended use,
clinical logic, validation, and supplier oversight. The regulatory status of these new functions will
be assessed separately from the existing myrecovery listing.

Summary of recommendations
1. Demonstrated control effectiveness should support proportionate reductions in residual
risk and evidence requirements (Q1). Where validated controls constrain the generative
component’s influence over clinically consequential outputs, CDRH should recognize the
resulting risk reduction when determining the evidence required.
2. Patient-facing delivery should not be presumed higher risk (Q3). Risk should reflect the
function’s activity, consequences and safeguards, recognizing the benefits of accessible,
engaging patient education.
3. Conversational devices should be assessed as bounded functions with tested transitions
(Q5). Where boundaries hold across realistic conversational trajectories, evidence should
match each function’s risk while addressing shared components and the integrated user
experience.
4. Clinical confirmation should be proportionate to the function and its risk (Q11, Q15). For
faithful PRO administration, comparative administration studies and standardized-patient
testing may provide adequate confirmation without a separate prospective clinicaloutcome study.
5. Measurement and predictive functions should be validated on their own terms, with the
generative layer assessed for faithful presentation (Q12, Q13, Q17).
Considerations for the Regulation of Generative AI-Enabled Medical Devices

6. Supplier-initiated changes should be addressed through supplier controls and, where
applicable, an authorized PCCP (Q21, Q24, Q25). Controlled configurations,
manufacturer-authorized release and proportionate revalidation should support
continued safety and effectiveness, with conversational-infrastructure suppliers explicitly
included in the proposed MAF approach, supported by structured clinician reporting of
GenAI performance concerns.

Q1: Validated architectural safeguards should inform risk and evidence
We support the two-axis framework and propose that CDRH explicitly recognize the extent to
which validated controls constrain the generative component's influence over clinically
consequential outputs and actions. Demonstrated control effectiveness should be recognized in
residual risk assessment and should support proportionate reductions in premarket evidence
requirements where justified.

Many GenAI-enabled devices will be hybrids. The generative component supports naturallanguage interaction, while conventional software developed through lifecycle processes
consistent with IEC 62304, with risk management consistent with ISO 14971, applies predefined
thresholds, escalation rules and approved care-pathway content. Where these controls
demonstrably restrict the generative component, the assessment should reflect that, while still
accounting for the activity and consequences of the complete function.

We suggest CDRH:
• Credit validated deterministic controls as risk mitigations. Controls governing escalation,
scoring and clinical recommendations should reduce residual risk where supported by
architectural separation and testing under S.1, S.2 and R.1, plus A.1 for agentic
capabilities. Where a deterministic safeguard depends on model-derived interpretation,
validation should cover the full chain from patient input through recognition, routing and
output, including missed triggers, mis-transcribed inputs, bypass attempts and handoff
failures.
• Assess the deployed function, not the underlying model's theoretical capability. A
system restricted to presenting approved content should be assessed against that
function and the robustness of its boundaries. Where generative rephrasing is permitted,
testing should show it does not alter clinical meaning or introduce recommendations.
• Recognize reversibility and timely human review as risk modifiers. Clinician review with
defined ownership, response times and fallback arrangements can mitigate foreseeable
harm, and should be credited where it acts before the patient relies on the output.

We agree that disclaimers such as "talk to your doctor" should not reduce assessed
directiveness. Lower assessed risk should be earned through demonstrated constraints on device
behavior, not wording or architecture alone.

2 of 10
Considerations for the Regulation of Generative AI-Enabled Medical Devices

3 of 10
Considerations for the Regulation of Generative AI-Enabled Medical Devices

Q3: Patient-facing delivery should not be presumed higher risk

We support CDRH’s recognition of the benefits of patient empowerment and access to clinical
information. Patient-facing delivery should not, by itself, place a function higher on the
consequences axis. Risk should depend on what the function does and the consequences of an
incorrect output, assessed together with the safeguards in place.

Conversational AI can make clinical information more engaging and accessible than static leaflets
or portals. Patients can ask questions in their own words, at the moment they matter, and
receive answers matched to their health literacy, language and stage of care. In recovery after
surgery, this can improve understanding of expected progress, adherence to rehabilitation and
recognition of when to seek help. It can also extend reliable education to patients who struggle
with written materials or have limited access to clinicians between appointments.

Where users cannot independently evaluate an output, the following safeguards can mitigate
risk without underestimating patient capability:

• Grounding in approved content. Information drawn from clinician-approved, pathwayspecific material, with rephrasing tested to show it preserves clinical meaning.
• Comprehension checks. Confirming understanding, where appropriate, rather than
assuming it.
• Clear signposting. Stating plainly what the system can and cannot advise on, and how to
reach the care team.
• Reliable escalation. Recognizing safety-relevant disclosures and routing them to a
defined clinical pathway.
• Testing across health literacy and dialect. Benchmarking under E.4 and R.2 with
representative users.

Assessment should also weigh the risk of not providing accessible information. Patients who
misunderstand written instructions, or cannot reach their care team, also face avoidable harm.

Q5: Conversational drift should be managed by design, then tested across trajectories

We agree risk should be assessed across realistic conversational trajectories. A conversational
device's intended use should identify its permitted functions, the boundaries between them and
the conditions governing transitions, demonstrated through testing of the deployed system.
Patient-reported outcome (PRO) collection illustrates the challenge. A patient completing a
validated knee or hip instrument may volunteer a symptom requiring urgent assessment. The
system must respond safely while preserving the integrity of the collection task. Where it
recognizes symptoms and selects an escalation pathway, that capability should be characterized
and assessed as a function in its own right.

We suggest the following approach:

4 of 10
Considerations for the Regulation of Generative AI-Enabled Medical Devices

1. Bounded functions. Define each function's purpose, permitted outputs and actions,
prohibited behaviors and position on the two-axis framework, in terms patients and care
teams can understand.

2. Controlled transitions. Route safety-relevant or out-of-scope content to a predefined
pathway with clinically approved messaging and handoff. Where generative
interpretation or speech recognition triggers the transition, validate that detection step,
with defined fallback for ambiguous inputs and failed handoffs.

3. Trajectory testing. Benchmarking under S.1, S.2 and R.1 should include multi-turn
scenarios in which in-scope exchanges develop into safety-critical or out-of-scope
situations, assessing missed, delayed and over-escalation across repeated runs and long
conversations.

4. Function-specific assessment. Where boundaries are demonstrably maintained, evidence
should be proportionate to each function's own risk, with integrated testing of shared
components and transitions. Where separation is unreliable, the integrated assessment
should encompass the higher-risk behavior reasonably foreseeable in use.

For validated PRO instruments, the interface should preserve item wording, instructions, recall
periods, response options and scoring rules, allowing only instrument-authorized clarification.
Responses should reflect the patient's explicit selection, confirmed where transcription is
uncertain, and safety interruptions should never silently complete or infer unanswered items.

These controls protect the measurement validity relied on by clinical care and quality programs
such as the CMS THA/TKA PRO-PM. Deriving responses or scores from free text adds an
inference step that requires separate validation and may raise the function's risk.

Q11 and Q15: Proportionate clinical confirmation
We support CDRH's consideration that clinical confirmation need not require a prospective
study in every case. For bounded functions such as faithful PRO administration or delivery of
approved educational content, a staged evidence package may provide adequate confirmation
without a prospective clinical-outcome study or randomized trial, where justified by the
function’s risk and the evidence obtained.

Such a package could combine:
• Standardized patient interactions assessing escalation, scope boundaries and
comprehension, including symptom disclosures during PRO completion, ambiguous
responses, and variation in health literacy, accent and dialect.

5 of 10
Considerations for the Regulation of Generative AI-Enabled Medical Devices

• Comparative administration studies against the instrument's validated reference mode,
assessing item- and score-level agreement, systematic bias, completion and subgroup
performance. Established methods for assessing PRO mode equivalence can inform these
studies, with added attention to speech-recognition error and clarification behavior.
These studies may themselves be prospective; the distinction is whether a separate
clinical-outcome study is needed.
• Independent clinical adjudication of representative interaction records, assessing the
appropriateness of escalation and handoffs, continued after release as postmarket
monitoring.

For measurement fidelity, the comparator is the validated administration mode and scoring
method. Clinical adjudication serves a different purpose: evaluating the surrounding interaction
and any clinical response. Sponsors should prespecify endpoints, acceptance criteria and sample
sizes, and deliberately test uncommon but consequential failures.

More extensive confirmation will be appropriate for personalized recovery recommendations,
treatment changes, or triage. "Recovery coaching" is best broken into its constituent functions
when setting evidence requirements.

On Q15, we support comparison with what happens without the device. For PRO collection,
usual practice often leaves postoperative responses missing, so improved paired completion is a
meaningful benefit, demonstrated against a justified comparator alongside response validity and
safety. Improved completion should not compensate for clinically important measurement error
or unsafe advice.

Q12, Q13 and Q17: Measurement, prediction and multimodal functions

GenAI-enabled devices will increasingly incorporate, or present the outputs of, non-generative
measurement and prediction models, such as motion analysis from smartphone video or recovery
trajectories from wearable activity data. Competency-based benchmarking is well suited to the
generative and multimodal components of such devices. It should complement, not replace,
established validation of the measurement and prediction functions they rely on. We encourage
CDRH to evaluate these functions on their own terms, and to assess the generative layer for
how faithfully it presents their outputs.

• Validate measurement against reference standards. Where users cannot verify a
measurement, the primary evidence should remain agreement with a clinical reference
standard, capture-quality checks, declining to report when inputs are inadequate, and
reported uncertainty. A generative layer should present validated values faithfully,
without reinterpreting or recalculating them (E.3).

6 of 10
Considerations for the Regulation of Generative AI-Enabled Medical Devices

• Credit non-directive, clinician-facing predictive outputs. Trajectory or risk outputs that
inform clinician review, rather than direct patient action, should sit low on the activity
axis, consistent with the paper’s own risk-score example.
• Accept well-characterized real-world data, including data from outside the US. Large
retrospective cohorts from routine care and consumer health platforms, and data from
international health systems, can provide representative evidence for clinical
confirmation where quality, provenance and population relevance are demonstrated.
• Use synthetic data to extend subgroup coverage, then confirm with real data. For visionbased functions, synthetic data can broaden coverage of skin tone, body habitus, clothing
and environment. Performance should be confirmed in real-world subgroups, and
safeguards should address the risk that synthetic data generated by models similar to the
device reproduces the same performance gaps.
• Accept detection-based control for dependencies outside contractual control (see also
Q24). Some inputs depend on consumer platforms that manufacturers cannot contract
with, such as operating systems that process sensor data on the device. For these, CDRH
should accept manufacturer-side controls in place of supplier notification: recording
platform and device versions with each data point, monitoring input distributions for
unexplained shifts, re-verifying against major platform releases, and suspending or
flagging affected outputs when a shift cannot be explained.

Q21, Q24 and Q25: Integrated suppliers and third-party change control
We support keeping accountability with the finished-device manufacturer, and encourage CDRH
to clarify how that accountability is supported when a conversational platform sits between the
manufacturer and the foundation model.

A common architecture has three layers: a foundation model developer; a conversationalinfrastructure supplier providing telephony, speech recognition, speech synthesis and dialogue
orchestration; and a manufacturer responsible for the clinical logic and finished device. Each
layer can change safety-critical behavior. Contracts allocate supplier responsibilities but do not
transfer the manufacturer's accountability.

Established conversational-infrastructure suppliers can bring mature security, resilience and
change-management processes that support consistent implementation of logging, deployment
and orchestration controls.

We encourage CDRH to allow manufacturers to reference demonstrated supplier capabilities
and supporting evidence, including through MAFs, reducing duplicative evaluation while
retaining assessment of the device’s intended use, configuration and integration.

Supplier controls depend on close, ongoing collaboration between manufacturers and suppliers,
not on contractual allocation alone. Effective arrangements include shared change planning, early

7 of 10
Considerations for the Regulation of Generative AI-Enabled Medical Devices

visibility of roadmap and upstream changes, joint investigation of incidents and performance
signals, and clear escalation routes between engineering, quality and clinical teams.

We encourage CDRH to recognize structured manufacturer–supplier collaboration as a
component of effective supplier control across the total product lifecycle.

We suggest CDRH confirm that the following controls, managed under the purchasing controls
of the Quality Management System Regulation (21 CFR Part 820, incorporating ISO 13485:2016
clause 7.4), can provide reasonable assurance against supplier-initiated change, with
responsibilities allocated according to each component’s role and potential impact on device
safety and effectiveness:

Controlled configurations. Documented identification and control of the deployed model,
prompts, retrieval content, orchestration, guardrails, tools and speech services. Changenotification and assessment responsibilities should reflect each supplier’s role and control over
upstream components. Where a dependency cannot be pinned, alternative controls should
demonstrate that the deployed device remains within its validated performance limits, with
defined fallback arrangements where this cannot be assured.

Manufacturer-authorized release. Access to proposed changes that may affect device safety or
effectiveness, as determined through the manufacturer’s change assessment, enabling the
manufacturer to complete proportionate verification, validation and re-benchmarking before
deployment, with predefined arrangements for urgent security updates.

Change detection and traceability. Model identity, version information, model or system
documentation, and interaction and configuration logs, complemented by technical monitoring
for behavioral change without a reported version change.

Recovery. Rollback to a validated configuration where feasible, or suspension of the affected
function or a validated fallback, with arrangements for ongoing interactions and outstanding
alerts.

Independent adjudication. Where expert adjudication is warranted, adjudicators should be
independent of the manufacturer, platform supplier, and foundation model developer. This
should not preclude supplier participation in test development, engineering verification or
provision of supporting evidence, provided any required independent adjudication remains
separate.

These controls could support a Predetermined Change Control Plan (PCCP), where applicable,
with eligible modifications, validation methods, acceptance criteria, and impact assessments
defined in advance. Re-benchmarking against the premarket baseline should be recognized as a
potential verification method for prespecified component updates, supplemented by testing of

8 of 10
Considerations for the Regulation of Generative AI-Enabled Medical Devices

new failure modes and additional validation or clinical confirmation where warranted. Changes
outside an FDA-authorized PCCP would remain subject to applicable change-assessment and
submission requirements.

On Q25, we support voluntary Foundation Model Device Master Files (MAFs) and ask CDRH to
clarify their availability to conversational-infrastructure suppliers within the platform-provider
category the paper contemplates. A reusable, version-specific evidence package could reduce
duplicative requests across manufacturers while allowing confidential technical information to be
provided directly to FDA and referenced with the supplier’s authorization. Participation should
remain voluntary, with alternative routes for providing sufficient supporting evidence. Speech
recognition, speech synthesis and orchestration can independently affect subgroup performance,
numerical accuracy and escalation reliability; the content listed in footnote 24 provides a useful
starting point for supplier due diligence.

On Q21, clinicians are often best placed to notice when a GenAI-enabled device behaves
unexpectedly: an inaccurate summary, inappropriate reassurance, a missed or unnecessary
escalation, or a response outside the device’s intended scope. Many of these issues fall short of a
reportable adverse event, yet they are the early signals that postmarket monitoring depends on.
We encourage CDRH to promote clinician reporting of GenAI performance concerns, including
near misses, as a core part of shared ecosystem responsibility.

Reporting could be strengthened by:

• Low-friction, in-workflow reporting. Manufacturers provide a simple way to flag a
concern from within the product or care-team interface, capturing the interaction record
and device configuration so the issue can be investigated.
• A shared vocabulary for GenAI failures. CDRH, professional societies and standards
bodies develop common categories (for example, factual error, unsupported
recommendation, scope breach, escalation failure, inappropriate tone), so reports can be
aggregated across devices and sites.
• Clear routes and feedback. Reports reach the manufacturer promptly, with clear
guidance on when a concern also warrants an FDA report through MedWatch or userfacility reporting. Reporters should be told what action followed, which sustains
participation.
• A non-punitive reporting culture. Healthcare institutions encourage staff to report
concerns about AI performance without attributing blame, consistent with established
patient-safety practice.
• Professional society engagement. Specialty societies help define what good performance
looks like in their domain and support sample-based clinical review.

Deploying organizations can also take on defined monitoring duties, such as confirming alert
receipt and supporting clinical review, set out in contracts and labeling. These contributions

9 of 10
Considerations for the Regulation of Generative AI-Enabled Medical Devices

supplement the manufacturer’s own monitoring. Responsibility for evaluating safety signals and
initiating corrective action remains with the manufacturer.

Hopper Healthcare welcomes CDRH's least-burdensome, total-product-lifecycle approach. We
would welcome opportunities to share our functional framework and supplier-control model, and
to contribute to pilots of competency-based evaluation or Foundation Model MAFs, together
with our technology partners.

Dr. Axel Sylvan
Chief Medical Officer, Hopper Healthcare

10 of 10