Metabody AI (Karl Persson, Jennifer Beatty)

See attached file(s)

Metabody AI — Comment on FDA Docket
FDA-2026-N-7874
Docket FDA-2026-N-7874 — Considerations for the Regulation of Generative
AI-Enabled Medical Devices: Discussion Paper and Request for Feedback

Submitted to U.S. Food and Drug Administration, Center for Devices and Radiological
Health, Digital Health Center of Excellence

Attention Rick Abramson, M.D., Director, Digital Health Center of Excellence

Submitted by Karl Persson, Ph.D., Head of Product & Engineering
Jennifer Beatty, D.O., M.S., FACS, Medical Director

Organization Metabody AI Inc.
2943 Parkway Blvd, Unit 374, West Valley City, Utah 84119

Subject Lifecycle assurance for generative and agentic AI medical devices: a
runtime safety envelope

Questions addressed 1, 3, 5, 6, 12, 14, 15, 18, 19, 20, 22, 24, 25 and 26 (Sections IV, V, VI and
VII)

Basis of comment Operating experience running an AI co-clinician inside a licensed
telehealth practice

Filing Submitted electronically via Regulations.gov, October 19, 2026
Metabody AI Inc.
2943 Parkway Blvd, Unit 374
West Valley City, Utah 84119

October 19, 2026

Submitted electronically via Regulations.gov
Rick Abramson, M.D.
Director, Digital Health Center of Excellence
Center for Devices and Radiological Health
U.S. Food and Drug Administration

Re: Docket No. FDA-2026-N-7874 — Considerations for the Regulation of Generative
AI-Enabled Medical Devices: Discussion Paper and Request for Feedback

Dear Dr. Abramson:

Metabody AI Inc. appreciates the opportunity to comment on CDRH's discussion paper. We write as
a company that operates generative AI inside a licensed clinical setting today, and our comments
draw on that operating experience rather than on abstract policy.

Metabody operates a continuous metabolic-care platform: a longitudinal patient record built from
wearable, laboratory and clinical data; an AI co-clinician that drafts cited guidance from that record;
and licensed clinicians who make every clinical decision, including prescribing and dose changes.
Our first clinical focus is metabolic health, including GLP-1 therapy, which provides the clinical
setting for the examples below. We do not operate an FDA-authorized device, and we do not treat
the discussion paper as guidance. We do not ask this docket to determine the regulatory status of
our current functions. Nothing below should be read as a claim that every control we describe is
implemented or validated in our current system; the architecture, measures and parameters are
proposals.

We address Questions 1, 3, 5, 6, 12, 14, 15, 18, 19, 20, 22, 24, 25 and 26. Our central
recommendation is that CDRH allocate assurance across the lifecycle explicitly: premarket review
establishes the integrated device's initial performance and qualifies its safety controls; runtime
controls govern each interaction; postmarket evidence tests whether performance persists and
drives controlled change. Within that allocation we ask for one thing above all: a small set of named
tolerance parameters and operating conditions, so that core safety functions can be tuned to clinical
risk, user capability and actual access to care. Sponsors should justify those settings rather than
treat the same configuration as appropriate everywhere. We recognize that the paper does not
establish regulatory expectations and does not resolve questions of legal authority.

Executive Summary
Human clinicians’ ability to provide accurate diagnosis should not be the ceiling. In one national
analysis, Newman-Toker et al. estimate that roughly 795,000 Americans die or are permanently
disabled each year because a dangerous disease is misdiagnosed [8]. Generative AI devices should
aim well above today’s human baseline for the harms that matter most. Runtime checks provide a
way to pursue that improvement on every interaction; sponsors should demonstrate whether those
checks actually improve performance. At the same time the bar must not be set so high, or so
uniformly, that the devices never reach people whose realistic alternative is delayed or absent
clinical advice. The way to reconcile these is to establish core safety functions and tune the
parameters.

Six recommendations:

1.​ Allocate assurance across the lifecycle. Premarket evidence establishes the integrated
device's initial performance and qualifies its safety controls; runtime checks govern each
interaction and action; postmarket evaluation tests persistence and informs controlled
change. None substitutes for the others (Figure 1).
2.​ Adopt a four-route runtime policy as an inspectable runtime control. The policy
distinguishes blocking, holding for clinician review, eligibility for release, and urgent
escalation. Urgency takes precedence over routine routing. Deterministic enforcement
handles permissions and limits; recognition of harm is a separate, measurable task. Routes
are policy outcomes FDA can test, not claims that the device knows whether harm will occur
(Figure 2b).
3.​ Set the bar above the human baseline, with tunable tolerances. Define the bar per
function as materially better than the realistic counterfactual, with minimum safety
requirements for the highest-severity outcomes. Standardize tolerance parameters and
operating conditions; let sponsors justify their values by user type, clinical risk and care
setting (Part III).
4.​ Measure failure mechanisms separately. Supervisory misses, unsafe releases, omissions
and both directions of escalation error are different failures with different denominators.
Report each with uncertainty, stratified by route, user type, version and subgroup; sample
released outputs, not only held ones.
5.​ Treat a foundation-model change as a sponsor-run revalidation under audit, not a new
submission by default. Within an authorized predetermined change control plan, the
sponsor re-runs its prespecified battery, records the result and keeps the prior pinned version
until it passes. Changes the plan does not cover follow existing modification rules.
6.​ Keep irreversible actions behind human authorization. Autonomous prescribing, device
control and other irreversible or high-consequence actions are currently not candidates for
the greater reliance on postmarket evidence we support under Question 18.

Part I — Why assurance belongs across the lifecycle
The paper correctly identifies the two properties that make one-time premarket evaluation insufficient
[1]: the input space is open-ended, and the device can change after authorization. We would state
the consequence directly. For a device built on a third-party foundation model, vendor changes can
shorten the useful life of a performance estimate; sponsors need controls for when that happens.
Three sources of drift make this true in practice: model drift, as developers update weights, safety
tuning and refusal policies on their own cadence; context drift, as a conversation migrates from
information to direction over many turns; and population and workflow drift, as the people and
clinicians around the device change in response to it.
A benchmark is a snapshot, not a promise that performance will remain unchanged. This is not an
argument against premarket evidence. It is an argument about what each stage of the lifecycle can
and cannot establish. Premarket studies can establish that the integrated device, with its generator,
retrieval, safety controls, interface and clinician workflow, performs its claimed function at launch and
that its controls work. They cannot, by themselves, establish that performance persists. Runtime
controls can hold or block a given output before it reaches a patient. They cannot establish clinical
benefit. Postmarket evidence can show whether performance persists and where it degrades. It
cannot substitute for basic proficiency at launch.

Figure 1. A proposed allocation of assurance across the lifecycle. Premarket evidence establishes the integrated
device's initial performance and control effectiveness. Runtime checks manage covered interactions and actions.
Postmarket evaluation tests continued performance and informs controlled changes. The feedback loop does not
authorize automatic learning or unrestricted deployment.

Two boundaries keep this proportionate. First, irreversible and high-consequence action-taking
functions remain behind deterministic hard-stops and human authorization and are not candidates
for reduced premarket evidence. Second, the safety system is itself a safety-relevant component
that must meet premarket evidence expectations of its own, including evidence that it fails closed.
Where likely harm is rapid, irreversible or poorly observable, greater premarket certainty or narrower
initial use is needed; more interaction volume alone does not make evidence stronger.

We recognize that some mechanisms below may require authorities beyond those CDRH currently
exercises, and that the paper does not address that question. Where that is the case, we encourage
CDRH to engage stakeholders on the path forward.

Part II — The runtime safety envelope: five layers, four routes
We propose a concrete form of the runtime assurance described in Part I. It has five layers; at its
center is a routing policy with four outcomes. The envelope is a risk-control architecture around a
defined clinical function, not an alternative intended use and not a guarantee against harm. The
framework uses common harm categories, while clinical significance and routing depend on the
patient's context.
Figure 2a. The five layers of the runtime safety envelope. Premarket evaluation establishes their initial performance
and how they work together; runtime controls govern use, and postmarket evaluation tests whether performance
persists.

II.1 Separate enforcement from recognition
Deterministic enforcement is appropriate for structured permissions, allowed tools, numeric
constraints, transaction limits and the requirement for an authenticated approval. Recognition of
indirect dosing advice, symptom meaning, contraindications or out-of-scope reasoning is a semantic
task with measurable error rates. Enforcement can be deterministic even when the clinical judgment
that triggers it is fallible. We ask CDRH to hold sponsors to that distinction, and we hold ourselves to
it: the hard-stops in layer 0 are rules; the harm judge in layer 2 is a model whose miss rate must be
measured. UpDoc, an illustrative cleared device, keeps its insulin-dosing logic deterministic behind
the conversational layer, and its change control plan preserves that separation [3].

A supervisory model is a safety-relevant component, not a clinical sign-off. Its incremental
contribution should be evaluated against clinician adjudication, including false negatives, false
positives, correlated failure with the generator and adversarial inputs through user messages,
retrieved content and tool responses. Model-family diversity may help but does not establish
independence; sponsors should document shared data, knowledge and infrastructure, and preserve
a separately enforceable execution boundary.

II.2 Four routes
The policy assesses urgency and material information gaps before generation where feasible, and
repeats the relevant checks before release or execution. The policy distinguishes four routes. Urgent
escalation takes precedence and may accompany blocking an unsafe candidate or releasing
validated emergency instructions.
Blocked. The candidate is withheld because it is prohibited or identified as unsafe, or an execution
is unauthorized. The clinical request is preserved and a validated safe alternative or care route is
offered where appropriate. Corrected content undergoes the applicable checks rather than inheriting
a prior approval.

Held for clinician review. Personalized output or action is withheld while material uncertainty,
missing information or a required authorization remains. The reason, the responsible reviewer and a
clinically justified deadline are recorded. Review ends in correction, rejection, escalation or
authorized release. This includes outputs not already flagged as unsafe but whose plausible
pathways to harm warrant clinician review.

Eligible for release. Release only within a prospectively defined and validated policy, with required
context available, checks passed and no outstanding authorization. Eligibility is not certification of
correctness. The delivered content is logged and this route is independently sampled.

Urgent escalation. A time-sensitive clinical need is routed through a validated pathway that does
not wait in the routine queue. Self-harm, overdose, abuse and other clinically important disclosures
are preserved, not filtered. Emergency instructions and handoff behavior need their own clinical and
usability validation.

Figure 2b. Four routes in a proposed runtime policy. Urgency can be identified at input, during a conversation or
during review and overrides routine routing. A block withholds the unsafe candidate, not access to care. Held
content requires resolution and final checks. Only eligible content or authorized actions proceed. All routes, including
timeouts and failures to act, remain subject to logging and independent review.

Missing information is uncertainty, not reassurance. An absent medication entry is not evidence that
a patient takes no medication. Sponsors should specify the material data each function requires, its
source and freshness, and the response to unavailable, contradictory or stale data: restrict
personalization, seek clarification or obtain review when uncertainty is material, without blocking safe
general information.
II.3 How outputs are placed in the held route: distance from harm
We are developing distance-from-harm as a method for deciding which outputs need clinician
review. The hypothesis is that making the pathway from an output to an unacceptable outcome
explicit can make deferral more consistent and explainable than a harmful/not-harmful label alone.
The method and its thresholds will evolve through validation. We describe the current design here
and the research plan in Appendix B.

Our method anchors on unacceptable outcomes rather than trying to define the best answer for
every patient. Clinicians define those outcomes for the function and assign severity on a prespecified
clinical scale [4]. A binary harm judge blocks outputs it identifies as unsafe in the patient's context.
For outputs not already flagged, the current method represents distance through two separate
readings: inference steps on a clinically reviewed, versioned map of medical relationships, and the
support for the weakest step, provisionally labeled necessary, probable or possible. The
representation draws on structured-reasoning methods [14, 17]; the labels are not calibrated
probabilities. A routing grid assigns cases to held or eligible, subject to the other release conditions.
The review band is the set of cases held, and its edge is the release boundary. Higher-severity
pathways receive a broader review band. A guard band based on observed reviewer disagreement
adds a margin around that boundary; validation will test whether it reduces unsafe releases caused
by boundary errors. Deferral and guard-banding provide methodological starting points [11–13], not
clinical validation of this implementation. Every output is logged for postmarket sampling and pattern
review, so newly identified hazards can inform controlled updates.

Two properties matter for regulation. Patient context changes the pathway to harm; the review policy
determines when that pathway requires clinician review. For example, a substantial change in
vitamin-K-rich food intake requires different assessment when warfarin use is known, excluded by a
verified history, or unknown (Figure B3). Consistent vitamin K intake matters during warfarin
treatment; the food itself is not inherently unacceptable [22]. Widening the review band shifts more
cases to review, whose benefit depends on accurate and timely clinician response. The general
parameter is how broadly the system defers to a clinician; distance-from-harm is our evolving
method for setting that boundary. That is the dial we propose for CDRH to define.

II.4 Clinician authority and clinically safe fallback
A clinician used as a risk control needs authority to stop or modify the proposed action, access to
source evidence separated from model inference, appropriate expertise and time to act. Oversight is
operational, not nominal. Review latency, override and edit rates are process indicators, not proof of
effective oversight; a low override rate may mean good outputs or weak scrutiny, so error detection
should also be tested with seeded mistakes and realistic workload. Sponsors should specify staffed
capacity, urgency-specific deadlines, escalation ownership and queue limits, and measure delay
distributions and overdue cases, not only averages.

When supervisory services fail, records are unavailable or queues exceed capacity, the device
moves to a validated restricted mode or alternative clinical pathway. It should not silently release
unchecked personalized content or leave an urgent patient waiting. An output gate covers only the
events it intercepts, so patient-facing content is buffered until required checks finish, and time-based
monitoring catches omitted escalation, absent responses and silent tool failures.
II.5 Agentic actions and the postmarket evidence engine
Proposing an action is separated from executing it. Least-privilege credentials, allowed tool lists,
parameter validation, rate and transaction limits, and an independently testable stop mechanism
apply. Approval is bound to the exact patient, action, parameters and relevant record state, and
invalidated after a material change. In the metabolic-care workflow we describe, prescribing and
dose changes remain clinician decisions.

Every interaction is logged in a tamper-evident record with a configuration hash: model version,
prompt version, retrieval corpus, judge version, reference-map version and policy version. A
configuration hash identifies what the sponsor recorded; it does not prove an external service's
behavior was unchanged, so vendor version identifiers, request identifiers and service failures are
captured alongside it. The gate's learning process runs on two clocks. The fast loop turns each
reviewer decision into a labeled example. The slow loop compares clusters formed independently of
the judge with its decisions to surface new harm categories; a human reviews any new category
before the system uses it. Every update to the unacceptable-outcome set, the reference map, the
grid assignments or the judge is versioned and validated before it goes live. The envelope is a
safety-relevant software component, managed within the device's software lifecycle and applicable
machine-learning practices [5, 6].

Validation. The primary release-safety measure is unsafe content or actions that reach the
user. Supervisory misses are measured separately: some are caught downstream, while
unsafe releases can also arise from later edits or execution errors. Other measures capture
missed care, delay, burden and benefit. Sample sizes must match the claims: with zero failures in
N independent tests the 95% upper bound on the failure rate is about 3/N [15], so a one-in-a-million
miss rate cannot be shown with a few thousand cases, and correlated conversations are not
independent trials. The validation set is clinician-labeled and held out from any tuning of the judge or
the review band. Part IV sets out the measures.

Part III — What the bar is, and how it should be tuned

III.1 The human baseline
The question underneath several of the paper's questions, and underneath the clinician-licensure
analogies the paper draws on, is whether the bar for a GenAI device is "as good as a clinician" or
something higher [1, 18, 19]. The answer depends on what clinicians actually achieve, and the
evidence is sobering.

●​ One national analysis estimates that 795,000 Americans a year die or are permanently
disabled because dangerous diseases are misdiagnosed across ambulatory, emergency and
inpatient care; its most conservative sensitivity analysis still exceeds 500,000. For the
vascular events, infections and cancers modeled in that study, the estimated weighted
diagnostic error rate was 11.1% [8].
●​ Outpatient diagnostic errors affect about 5% of U.S. adults each year, roughly 12 million
people, about half of them potentially harmful [9].
●​ In a review of 2018 admissions at eleven Massachusetts hospitals, at least one adverse
event occurred in 23.6% of admissions; 6.8% of admissions had a preventable adverse event
 and 1.0% a preventable event that was serious, life-threatening or fatal. Adverse drug events
were the most common category [10].
These figures describe different kinds of failure and use different denominators. They establish the
need for improvement; each device still needs targets matched to its function.

III.2 Our position on the bar
We recommend that CDRH decline both of the obvious answers. Matching current practice should
not be the limit of ambition; perfection should not be the price of access. We propose instead:

1.​ A relative bar per function. The device, as deployed, should perform materially better than
the realistic comparator for the function and setting: the median practicing clinician
performing the function where the device displaces clinical judgment; usual care or the
patient's information environment where it does not. Comparators should be characterized
prospectively and justified, not assumed.
2.​ Minimum safety requirements for the highest-severity outcomes. For outcomes
clinicians classify as critical or catastrophic, including the red-flag presentations in the
product's own labeling, under-escalation tolerance should be set near zero regardless of the
comparator. The human baseline is not a defense here. Safety-critical checks should not be
skipped because the routine review queue is full.
3.​ Striving, not just clearing. Sponsors should be asked to state a target error rate below the
human baseline for each severity level and to report progress against it postmarket.
Newman-Toker et al. estimate that a 50% reduction in diagnostic errors for the five diseases
causing the most serious harms (stroke, sepsis, pneumonia, venous thromboembolism and
lung cancer) could potentially prevent roughly 150,000 serious harms a year [8]. That is an
opportunity for improvement, not a demonstrated benefit of any particular AI device.
The improvement must be specified in advance and matter to patients; it need not mean superiority
on every metric.

III.3 Same mechanisms, tunable parameters
GenAI devices of this kind should perform the same core safety functions: enforce boundaries,
assess risk, route uncertain cases, preserve clinical authority, and support monitoring and feedback.
Implementations can evolve. We ask CDRH to standardize a small set of tolerance parameters and
operating conditions, while sponsors justify their values. Common definitions would make
submissions easier to compare without prescribing the same settings for every function.

Parameter What it controls How it is tuned (illustrative)

Review band width How broadly outputs are Broader for higher-risk functions; narrower only where
held for review; represented evidence supports the intended users and setting. A
through distance-from-harm three-step band is an illustrative research setting, not a
in our research method. clinical threshold.

Under-escalation Allowed rate of missed or Near zero for critical and catastrophic outcomes in
tolerance, by late escalation among every setting; this parameter does not relax for user
severity episodes judged to require it type or access. A disclosed bound for serious
outcomes. State the maximum acceptable miss rate,
 the clinical scenarios it covers, and the uncertainty
around the estimate.

Over-escalation Allowed rate of unwarranted Set according to the clinical consequences of
tolerance escalation unnecessary referral and the capacity of the receiving
service.

Release-eligibility Data that must be present Patient-facing: the current medication history and
conditions and fresh before laboratory data material to the function; restrict
personalized output is personalization when those data are missing. A
released clinician-facing draft may identify gaps for review;
acknowledgment alone does not satisfy missing
requirements for treatment or execution.

Review deadline, by Maximum time an output Urgent cases enter the urgent pathway immediately;
urgency class may sit in the held route other review deadlines are set by the consequence of
delay.

Required user Understanding that intended Patient-facing: the intended population's literacy,
comprehension users must demonstrate language and accessibility range. Clinician-facing: the
before launch intended users' expertise levels

Sampling intensity Share of released outputs Higher at launch, after any change and wherever the
independently adjudicated eligible route has been widened; lower in steady state
with the same event triggers

Table 1. Tolerance parameters and how they may be tuned

Sponsors should state the tested ranges and combinations of settings, and who may change them.
Parameter changes are controlled changes, not informal adjustments to meet workload.

Three illustrations. A patient-facing dose-titration function for a patient on insulin and a GLP-1
receptor agonist sits at the conservative end of every parameter: wide review band, near-zero
under-escalation tolerance for hypoglycemia, every dose instruction held for a clinician. A
clinician-facing visit summary for the same patient may justify a narrower band where testing
supports clinician detection of the relevant errors; provenance and clinician review remain
necessary. Where timely clinical advice is otherwise unavailable, e.g., in a county with no
endocrinologist and a six-week wait for primary care, a wider eligible route may offer greater benefit
than delayed or absent guidance. That choice must be supported by evidence from the intended
setting, with unchanged serious-harm limits and review and escalation pathways that can actually be
delivered. More than 90 million Americans live in federally designated primary-care shortage areas
[20]; timely clinical advice cannot be assumed and a framework that ignores that will protect them
from the device and not from the disease.

III.4 Patient-facing and clinician-facing functions
The user role should not, by itself, move a function up the consequences axis, and a professional
title should not, by itself, buy a less conservative release policy. The same envelope covers both. A
single system can produce both kinds of output: guidance to the patient between visits, and
summaries or draft orders to the clinician. User role should be an input to the parameter values,
chiefly the review band and required comprehension, rather than a substitute for testing the actual
workflow. Where testing shows that intended clinicians can detect and correct the relevant errors, a
narrower review band may be justified. For patient-facing outputs, communication is tested across
health-literacy and language levels; the band reflects the resulting evidence, and the clinician is the
release authority for anything held. Neither patient incapacity nor superior clinician detection should
be assumed; both should be tested.

III.5 Foundation-model changes
We want to be precise about what we are and are not proposing. A change to the underlying
foundation model should not, by itself, require a new premarket submission or an FDA evaluation,
and we do not ask CDRH to build a facility or a process for one. It should be treated as a release
event in the sponsor's quality system, inspectable under the Quality Management System
Regulation [7]: the sponsor pins versions, places the device on the prior pinned version or in a
restricted mode when a change arrives, re-runs its prespecified regression battery on the new
version, records the results and promotes only on a pass. No new premarket submission is needed
when the change is covered by an authorized predetermined change control plan (PCCP) and
implemented under its protocol; applicable documentation, labeling and notification obligations
remain, and records are available for inspection and audit [2]. Changes the plan does not cover, or
that fail its criteria, follow existing modification rules, which may mean a new submission. A vendor's
label of "like-for-like" is not sufficient; the change must be within the plan’s scope and pass its
validation protocol. Where version pinning or rollback is unavailable, the validated alternative is to
suspend or restrict the function or use a qualified replacement, and switching vendors is itself a
change to assess.

Part IV — Measuring separate failure mechanisms
A single accuracy number hides the failures that matter. We ask CDRH to expect prespecified
definitions and denominators for at least the following, each reported with uncertainty and stratified
by route, user type, version, site and clinically relevant subgroup.

Report results against the prespecified limits, by severity and urgency where applicable. Also report
compliance with release conditions, user-comprehension results, and planned versus achieved
independent sampling.

Measure Definition and denominator Why it is reported separately

Supervisory Unsafe candidates missed by the harm Measures the judge, not the device;
false-negative rate judge, divided by all independently a miss can still be caught
adjudicated unsafe candidates; state the downstream
sampling frame

Unsafe final-release Unsafe delivered outputs divided by The direct measure of unsafe
rate delivered outputs assessed; unsafe release; an override can cause it
executions divided by executions despite a correct judge
assessed. Report separately by
automated versus clinician-authorized
release.

Over-block rate Acceptable outputs blocked, divided by The risk of withholding useful care; a
acceptable outputs device that blocks hazards but omits
 needed care has not shown benefit

Omission measures Missed or late required actions among Checking each output is not
episodes independently judged to require coverage of the workflow
those actions.

Under- and Missed or late escalation among episodes Asymmetric; a low average hides a
over-escalation requiring it; unnecessary escalation safety-critical pattern
among episodes not requiring it. Report
urgency mismatch and consequences.

Review volume, latency Share of outputs held; delay distributions Oversight is a control only if it is
and overdue cases and overdue counts, not averages staffed and timely

Reviewer agreement Agreement between adjudicators; share of Whether reviewers apply the
and routing validation each grid cell independently judged to definitions consistently and the
require review, with unsafe outputs routing table identifies cases
identified separately. requiring review

Containment Time to detection, where estimable; time Measures how quickly exposure is
from detection to containment; and limited
interactions affected.

Clinical outcomes Benefit and harm endpoints per patient or An unsafe output is not an adverse
episode, with follow-up, comparator and event, and no complaints is not no
missing-outcome analysis harm

Table 2. Failure mechanisms to be reported separately, with definitions and denominators.

Sampling matters as much as the metrics. Independently sample outputs that were released, not
only those held for review; combine a probability sample for population estimates with targeted review
of rare and high-consequence scenarios, and keep the two distinguishable. Retrospective clustering and
novelty detection identify candidates for investigation; they do not replace clinical adjudication or
outcome follow-up. Reassessment should combine a periodic floor with event triggers: any change
to model, prompt, retrieval, tool set or judge; a breach of a prespecified threshold; a novelty alarm; a
new failure mode, complaint pattern or adverse event; and a material change in users, workflow or
labeling. Clinically urgent signals cannot wait for a scheduled review.

Part V — Responses to discussion questions
The responses below connect the proposals in Parts I–IV to FDA's discussion questions.

Question 1 — Does the two-axis framework capture the relevant dimensions?

It is the right starting point and we support it. Of the additional dimensions the question lists, we
agree that reversibility of the resulting action and the availability of downstream safeguards belong in
the framework, and we would represent time pressure in part through time to harm: the interval
before an error can cause clinically significant harm. We would add detectability by the actual user,
and we would state downstream safeguards precisely as controllability: whether an independent,
validated runtime control can hold, block or escalate the output before release. Traceability to
primary sources should also be represented, as a factor that raises detectability: an output that
identifies the record entries and references it relies on, with source evidence kept separate from
model inference, lets the clinician or patient check it. Traceability helps a user catch an error; it does
not by itself lower the consequence of acting on one. A safeguard may lower the probability that a
dangerous recommendation reaches a patient without changing the severity of the harm if it
escapes; CDRH should credit demonstrated controls explicitly rather than assume every safeguard
moves a function down the grid. ISO 14971 supplies the risk-management framework for that
analysis, not acceptable-risk thresholds for conversational outputs [4]. We ask CDRH to publish
worked examples showing the original hazard, the claimed control, the evidence needed to credit it
and the resulting evidence burden, including metabolic dosing.

Question 3 — Patient-facing versus HCP-facing functions

Do not infer risk from the user role alone. As set out in Part III.4, base the review policy on what the
output can cause, demonstrated user capability, and tested controls in the actual workflow.

Question 5 — Multi-turn conversations

The trajectory is the unit of analysis. Per-turn labels alone are insufficient; the device's boundaries
should be tested across whole conversations. Testing should run scripted multi-turn scenarios with
standardized user profiles, including users who understate symptoms, resist referral or keep asking
for a treatment change, and should measure how far the conversation moves toward direction, how
long escalation takes and how often the envelope is breached. The harm judge evaluates each
output in the context of the full exchange. On characterizing intended use: behavior that emerges
over a conversation does not require an intended use that is itself emergent. The sponsor can state
intended use as a bounded envelope: the clinical function, the intended users, the most directive
output the device is permitted to give within that function, and the behavior required when a
conversation approaches or crosses that limit, such as restating scope, declining, routing to a
clinician or escalating. Risk assessment should reflect the most directive permitted use, while also
evaluating foreseeable scope breaches and failures of the controls intended to prevent them. A
conversation that moves past the envelope is a scope failure to be measured, as in FDA's
benchmarking element S.2, not automatically evidence of a broader intended use. The permitted
level of directiveness for each function is a natural addition to the parameters in Part III.3.

Question 6 — Under-escalation and over-escalation

Missed escalation and unnecessary escalation harm different people in different ways, and they
should be measured as two numbers, each against a clinically adjudicated denominator, never
averaged into one. Sponsors should state in advance how much of each they will tolerate and why.
In GLP-1 care, symptoms consistent with acute pancreatitis, acute gallbladder disease, or
hypoglycemia with concomitant insulin or insulin secretagogues, all identified in semaglutide
labeling, call for a tolerance for missed escalation close to zero; for routine titration questions a
stated, bounded rate of cautious over-referral is acceptable [21]. The proposed tolerances require
clinical justification; they are not numerical thresholds specified by the drug labeling.

Question 12 — Statistically meaningful performance measurement

Size studies to the claim, and do not count correlated outputs as independent observations. For a
missed-escalation claim, the relevant denominator is episodes independently judged to require
escalation. We recommend that sponsors report episode-level performance alongside the outputand action-level measures in Part IV, with confidence intervals that account for that clustering, and
keep two samples separate: a probability sample of real use for population estimates, and a targeted
sample of rare, high-consequence scenarios for finding failure modes. The targeted sample should
not be pooled into the population estimate, because it oversamples hard cases by design. Synthetic
inputs are most useful in the targeted sample, where they extend coverage of rare presentations;
population estimates should use data sampled or appropriately weighted to represent the
intended-use population; synthetic challenge cases should be reported separately. Benchmarking
and clinical-confirmation results should be combined into one estimate only when they measure the
same endpoint on comparable units under a prespecified model; otherwise they should be reported
side by side.

Questions 14 and 15 — Comparators and acceptance criteria

Distinguish the reference standard (what counts as an acceptable output), the comparator (the care
otherwise received), and the unit evaluated (device or human-AI team). We recommend a clinical
reference standard reflecting applicable evidence and guidelines, established through
qualified-panel adjudication, for judging outputs; the comparator should be the median practicing
clinician performing the same function. The device should meet the reference standard on the
minimum safety requirements in Part III.2 and perform materially better than the median clinician on
its prespecified improvement measures. Using the panel's consensus as the comparator would
benchmark the device against panel deliberation rather than individual clinical practice; using
median performance as the reference standard would treat today's error rates as correct answers.
Comparator clinicians should be those who actually perform the function in the intended setting,
typically generalists for primary-care metabolic management, with specialists represented on the
adjudication panel for safety-critical items. Evaluate the human-AI team for output a clinician reviews
before it reaches the patient, and the device alone for output released without review. Where
clinician judgment is not displaced, a comparator drawn from the intended population's actual
information environment may be justified through sampling. A poor counterfactual does not remove
the minimum safety requirements.

Question 18 — Accepting greater premarket uncertainty

Yes, under conditions, and we believe this is the central question in the paper. Greater reliance on
postmarket evidence is appropriate only after sufficient evidence supports initial use for the bounded
function. Suitable residual questions include durability over time, workload and case-mix shifts within
scope, and refinement of estimates for uncommon events. It is not appropriate to postpone evidence
of basic proficiency, urgent escalation, essential permissions, usable oversight or safe failure
behavior. The conditions: a runtime envelope operational at launch; a residual-uncertainty plan
stating the question, the exposure limits, the endpoints, the owners and the thresholds for restriction
or suspension; drift surveillance with independent adjudication; demonstrated rollback or a validated
alternative fallback; and detection and containment fast enough to keep exposure within the
prespecified limits. The exclusion should turn on reversibility and detection latency rather than risk
category alone, but autonomous, irreversible, high-consequence action-taking functions will fail that
test and should remain behind full premarket evidence.

Question 19 — Postmarket evaluation approaches and cadence

We support all three approaches in Section VI.A and recommend a monitoring matrix linking each
signal to an owner, cadence, action threshold, containment measure and resumption criterion
(signals and triggers in Part IV). As an illustrative starting point for a staffed conversational-care
service: continuous technical and urgent-event detection; daily operational review of incidents and
overdue queues; weekly independent adjudication; monthly stratified performance review. These are
planning intervals, not universal requirements. Where CDRH wants pooled visibility across sponsors,
we support independently governed, outcome-linked data systems with appropriate privacy
protections. Restrict or suspend the affected function when a threshold is breached; resume only
after root-cause review, corrective action, revalidation and accountable approval.

Question 20 — Machine-based supervisory agents

Supervisory agents can and should carry much of the load, subject to the validation and separation
requirements in Part II.1 and the fallback requirements in Part II.4. Tamper-evident logs and
component-specific change control are also necessary. Without demonstrated performance under
these conditions, the agent should not justify reduced premarket evidence.

Question 22 — Scaling re-evaluation to the change

Scale re-benchmarking to the components a change touches and to what those components protect.
A change to a safety-critical component, such as the foundation model, the harm judge, the urgency
pathway or the hard-stops, re-runs the full prespecified battery. A change confined to one function
re-runs that function's tests together with the safety tests. Presentation-only wording changes may
be assessed through communication and comprehension testing when clinical meaning and safety
behavior remain unchanged; changes to prompts or clinical content require testing proportionate to
their potential clinical impact. Within an authorized PCCP these are QMS release events, as Part
III.5 describes for foundation-model changes; changes outside the plan, or that fail its criteria, follow
existing modification rules. Potential PCCP categories, where the modifications are sufficiently
specified, bounded and validated, include foundation-model version changes, updates to the harm
judge, the reference map and the unacceptable-outcome set (Part II.5), and changes to the
tolerance parameters in Part III.3 within their tested ranges. A change that widens the eligible route,
adds a function or user group, or moves a function toward action-taking should not be treated as
minor, because it changes the risk the original evidence addressed.

Question 24 — Third-party foundation model changes

See Part III.5. Treat vendor changes as sponsor-controlled release events, with revalidation under
an authorized PCCP where applicable and existing modification rules for changes outside it. Of the
mechanisms the question names, contractual commitments come first. Sponsors should document
the vendor commitments their change control depends on: advance notice before a pinned version is
changed or retired; a deprecation window long enough to complete the prespecified revalidation
battery; and disclosure of changes to safety tuning, refusal behavior or content policy, including
changes made under an unchanged version identifier. We recommend that CDRH expect sponsors
to state the notice period they require and justify it against the time their battery takes, rather than
set one period for all devices. Technical detection is still needed, because notice can be late or
incomplete: a fixed probe set run against the production endpoint on a schedule, with a shift in
safety-critical behavior treated as a change event, and vendor and request identifiers logged as
described in Part II.5. The PCCP should name the foundation-model changes it covers, the battery
and acceptance criteria, and the fallback when notice is not given or the battery fails: hold the pinned
version, restrict the function or move to a qualified alternative. Where a vendor will not commit to
notice or pinning, the sponsor should say so and show that detection and fallback keep exposure
within its prespecified limits.

Question 25 — Foundation Model Device Master Files

Yes, if files are version-specific and kept current. A Foundation Model Device Master File would help
smaller sponsors most, since they have the least leverage to obtain this information by contract, and
would make review more consistent across devices built on the same model. To be useful in review,
each file should identify the model versions it covers with their support and deprecation dates, and
should include the developer's update-notification commitments (the commitments described under
Question 24), a changelog of safety-relevant behavior including refusal and content-policy changes,
known limitations and failure modes in healthcare use, healthcare-relevant evaluation results
including subgroup performance, and the availability of audit logs and request identifiers. A file that
falls behind the deployed model can mislead reviewers, so each should carry an as-of date and a
commitment to amend it when a covered version changes. Developers have a reason to participate
if a current file that many sponsors can reference replaces repeated one-off disclosures to each
customer. Where developers do not participate, sponsors can still obtain comparable information by
contract, and qualified third parties could evaluate a model version once for many sponsors to
reference. Referencing a file should not create a presumption that a model is authorized for a clinical
use, and the sponsor remains responsible for validating its integrated device [1].

Question 26 — Agentic systems

Scale oversight with authority to act, not the label "agent." Apply Part II.5's controls and assess
prohibited-action and unauthorized-tool-call rates, human-checkpoint adherence, tool-failure
recovery and time to containment alongside task success.

Conclusion
CDRH's instinct to evaluate GenAI-enabled devices through demonstrated competency, enforced
boundaries and clinical confirmation is the right one. We ask the Center to take it two steps further:
to allocate assurance explicitly across the lifecycle, and to name the tolerance parameters and
operating conditions so that core safety functions can be tuned to the user, the condition and the
setting. Existing care is the comparator, not the ceiling. Runtime controls should help sponsors
pursue and demonstrate better performance, without imposing one setting that keeps useful devices
from the people who need them most.

We would welcome the opportunity to discuss these proposals with the Digital Health Center of
Excellence, including evaluation scenarios specific to metabolic care and GLP-1 therapy, and to
share operating experience as our monitoring infrastructure matures.

Respectfully submitted,

Karl Persson, Ph.D. Jennifer Beatty, D.O., M.S., FACS
Head of Product & Engineering Medical Director
Metabody AI Inc. Metabody AI Inc.
karl@metabody.ai jenn@metabody.ai
Appendix A — References
1.​ U.S. Food and Drug Administration, CDRH. Considerations for the Regulation of Generative
AI-Enabled Medical Devices: Discussion Paper and Request for Feedback. August 2026.
Docket No. FDA-2026-N-7874. https://www.fda.gov/media/194242/download
2.​ U.S. Food and Drug Administration. Marketing Submission Recommendations for a
Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software
Functions. Final guidance, August 2025.
https://www.fda.gov/regulatory-information/search-fda-guidance-documents/marketing-submi
ssion-recommendations-predetermined-change-control-plan-artificial
3.​ U.S. Food and Drug Administration. UpDoc, K253281: 510(k) decision review. Decision
December 23, 2025; PCCP discussion, pages 5–6.
https://www.accessdata.fda.gov/cdrh_docs/reviews/K253281.pdf
4.​ ISO 14971:2019. Medical devices — Application of risk management to medical devices
(with ISO/TR 24971:2020 guidance).
5.​ IEC 62304:2006/AMD1:2015. Medical device software — Software life cycle processes.
6.​ International Medical Device Regulators Forum. Good Machine Learning Practice for Medical
Device Development: Guiding Principles. IMDRF/AIML WG/N88 FINAL:2025, 27 January
2025.
https://imdrf.org/sites/default/files/2025-02/IMDRF_AIML%20WG_GMLP_N88%20Final.pdf
7.​ U.S. Food and Drug Administration. Medical Devices; Quality System Regulation
Amendments (Quality Management System Regulation), 21 CFR Part 820. Final rule, 89 FR
7496, February 2, 2024; effective February 2, 2026.
https://www.federalregister.gov/documents/2024/02/02/2024-01709/medical-devices-quality-s
ystem-regulation-amendments
8.​ Newman-Toker DE, Nassery N, Schaffer AC, et al. Burden of serious harms from diagnostic
error in the USA. BMJ Qual Saf. 2024;33(2):109-120. doi:10.1136/bmjqs-2021-014130
9.​ Singh H, Meyer AND, Thomas EJ. The frequency of diagnostic errors in outpatient care:
estimations from three large observational studies involving US adult populations. BMJ Qual
Saf. 2014;23(9):727-731. doi:10.1136/bmjqs-2013-002627
10.​Bates DW, Levine DM, Salmasian H, et al. The Safety of Inpatient Health Care. N Engl J
Med. 2023;388(2):142-153. doi:10.1056/NEJMsa2206117
11.​JCGM 106:2012. Evaluation of measurement data — The role of measurement uncertainty in
conformity assessment.
12.​ILAC-G8:09/2019. Guidelines on decision rules and statements of conformity.
13.​Chow CK. On optimum recognition error and reject tradeoff. IEEE Trans Inf Theory.
1970;16(1):41-46.
14.​Pollock JL. Defeasible reasoning with variable degrees of justification. Artif Intell.
2001;133(1-2):233-282.
15.​Hanley JA, Lippman-Hand A. If nothing goes wrong, is everything all right? Interpreting zero
numerators. JAMA. 1983;249(13):1743-1745.
16.​Cox LA Jr. What's wrong with risk matrices? Risk Anal. 2008;28(2):497-512.
17.​Tafjord O, Dalvi B, Clark P. ProofWriter: Generating Implications, Proofs, and Abductive
Statements over Natural Language. Findings of ACL-IJCNLP 2021:3621–3634.
doi:10.18653/v1/2021.findings-acl.317. https://aclanthology.org/2021.findings-acl.317/
18.​Patel B, Blumenthal D. A Novel Approach to Overseeing the Clinical Application of
Generative AI. JAMA Health Forum. 2026;7(3):e256947.
doi:10.1001/jamahealthforum.2025.6947. Published online March 6, 2026.
19.​Bergman A, Wachter RM, Emanuel EJ. A Licensure Framework for Autonomous Clinical AI.
JAMA. 2026;335(20):1751-1754. doi:10.1001/jama.2026.5483
20.​Health Resources and Services Administration, Bureau of Health Workforce. Designated
Health Professional Shortage Areas, primary care, as of December 31, 2025: 8,467
designations covering 92.3 million people, 48% of need met.
https://data.hrsa.gov/topics/health-workforce/health-workforce-shortage-areas (state table at
https://www.kff.org/other/state-indicator/primary-care-health-professional-shortage-areas-hps
as/)
21.​Novo Nordisk. Ozempic (semaglutide) injection: U.S. prescribing information. Revised May
2026. Sections 5.2, 5.5 and 5.9. https://www.novo-pi.com/ozempic.pdf
22.​National Institutes of Health, Office of Dietary Supplements. Vitamin K: Fact Sheet for Health
Professionals. Section on warfarin and similar anticoagulants.
https://ods.od.nih.gov/factsheets/VitaminK-HealthProfessional/
Appendix B — Distance from harm: the method behind the held route
Status: a sponsor method under development, described so that the parameters in Part III are
concrete. It is not an established release criterion, not a demonstrated Metabody safety control, and
not proposed as a regulatory standard.

Principles. Define unacceptable outcomes, not a single ideal answer: the gate screens for safety
concerns rather than choosing the best care. Not flagged is not certified: a candidate still needs to
meet the other release conditions. Block outputs identified as unsafe; for the remaining candidates,
use the severity of the possible outcome to set the breadth of review [4]. Distance has two readings
kept separate: represented steps and support for the weakest step. Neither is a calibrated
probability, and they are not multiplied into a risk score. The research question is whether this
representation improves routing. An error need not cause harm to count against clinical proficiency;
material gaps in the evidence supporting personalized advice require resolution before release.

Figure B1. Block identified unsafe outputs; use severity to set the review band for remaining candidates. This policy
schematic separates the blocking decision from the research question of how broadly to defer. The severity scale
and review settings are prespecified by the sponsor and evaluated clinically; the graphic is not a calibrated risk
scale.

Stages. Input and urgency checks; model; output duplication (a copy retained for retrospective
review); binary harm judge; distance-from-harm assessment; routing; retrospective review. Urgent
escalation overrides routine routing at any stage. Missing material information or an unassessable
pathway triggers clarification or a hold. Retrospective findings enter the live policy only after clinical
review, validation and change control.
 Figure B2. The proposed distance-from-harm workflow. A candidate not flagged as unsafe enters the research
assessment, but still must satisfy context, evidence and authorization requirements. Urgent escalation can override
the routine path at any point. All routes feed independent review; changes return to the live policy only after
validation.

The grid. Represented steps to the unacceptable outcome run across the top; provisional support
for the weakest step runs down the side. Held cells form the review band; its edge is the release
boundary. The assignments below are research settings to be evaluated by severity. Eligible means
subject to the other release conditions, not certified safe.

Weakest step on the path 1 step 2 steps 3+ steps

Necessary Held Held Held

Probable Held Held Eligible

Possible Held Eligible Eligible

Table 3. An example distance-from-harm routing grid based on research settings (not clinical thresholds)
 Figure B3. The same proposed dietary change, three information states. Known warfarin use prompts clinical
review; a verified history without a material concern may support eligibility after the remaining checks; missing
relevant history requires clarification or a hold. Sudden changes in vitamin K intake can alter anticoagulant effect
during warfarin treatment [22]. The branches illustrate context-sensitive routing, not validated numerical distances.

Figure B4. Testing a guard band around the release boundary. A candidate review boundary is extended by a
margin informed by reviewer disagreement. The illustrated limits are research settings; their size and performance
will be determined through validation. The margin does not establish that an unrecognized pathway to harm has
been excluded.

Limits. Step counts depend on how relationships are represented, so the reference map and step
definitions are fixed before an evaluation. Structured-reasoning methods offer a starting point [17],
but logical distance is not time to harm, severity or probability. A missing pathway may reflect an
incomplete record, a missing relationship or a shared error. Where a material pathway cannot be
assessed, seek clarification or hold; do not treat missing information as permission to release.
Agreement on step count does not establish that the pathway is complete. The grid is a routing table
to be tested, cell by cell, against independent clinical judgments; its assignments change only under
change control [16].

Validation design. Prespecify the clinical function, hazard definitions, pathway representation,
adjudication rubric and release constraints. Compare direct harm classification plus conventional
controls against the same system with distance features, using held-out episodes and independent
clinical adjudication. Report unsafe-release rate at matched review capacity and review burden at
matched detection. An initial research target is Cohen's kappa of 0.7 or higher for grid assignment;
clinical routing performance is evaluated separately. Test agreement with clinician adjudication,
stability across repeat runs and meaning-preserving paraphrases, and responses to relevant
changes or gaps in the record. Evaluate retrospectively and in shadow mode before the feature
affects release decisions; reviewed production examples never change release boundaries
automatically.