Cynthia Brysch

Dear FDA Digital Health Center of Excellence and Center for Devices and Radiological Health Leadership:

I respectfully submit these comments regarding FDA Docket FDA-2026-N-7874, Considerations for the Regulation of Generative AI-Enabled Medical Devices, to address a critical regulatory science question: How can we establish confidence in an algorithm when the integrity, scientific validity, and applicability of its underlying data, including evidence that has yet to be generated, remain uncertain?

Drawing on more than 22 years of international leadership in regulatory affairs, quality assurance, clinical development, and inspection readiness across more than 500 programs and regulatory submissions, I believe the greatest challenge is not the adoption of artificial intelligence, but the ability of existing regulatory systems to demonstrate its continued safety, effectiveness, and compliance throughout the product lifecycle.

Traditional waterfall-based design controls rely on defined requirements, documented verification and validation, and controlled progression through development. Generative AI introduces a fundamental challenge to the sufficiency of a static application of this model: algorithmic behavior, data inputs, intended applications, and performance risks may evolve beyond those established at initial authorization. Without prospective controls governing data provenance, model validation, acceptance criteria, change management, and continued performance verification, neither initial regulatory authorization nor retrospective documentation can independently demonstrate sustained compliance.

This distinction is particularly consequential to the meaning of “current” in cGMP. A device may successfully obtain marketing authorization yet subsequently demonstrate deficiencies during regulatory inspection. Premarket authorization and ongoing quality-system compliance are distinct obligations. For AI-enabled technologies, both must be supported by objective, reproducible evidence and effective lifecycle oversight.

I recommend that FDA prioritize five actions:

1) Establish scientifically defensible requirements for data provenance, integrity, representativeness, traceability, and the limitations of algorithmic inference, particularly where clinical or technological evidence has not yet been generated.

2) Define a risk-based, phase-gated approach integrating design controls, prospective acceptance criteria, model and method validation, human oversight, change control, and continued performance monitoring under applicable QMSR requirements.

3) Clarify how manufacturers must demonstrate sustained inspection readiness and effective risk management as algorithms, datasets, and intended applications evolve following authorization.

4) Harmonize FDA’s internal scientific review, compliance, and inspectional practices through consistent interpretations, workforce competency development, practical implementation procedures, and measurable accountability.

5) Establish clear traceability between the Federal Food, Drug, and Cosmetic Act, applicable implementing regulations, and AI-specific recommendations, distinguishing legally binding requirements from non-binding guidance while preserving scientifically justified alternative approaches.

My participation in the September 2026 FDA/MDIC Regulatory Science Innovations forum further reinforced the need to address these challenges through practical collaboration between regulators, industry, and scientific stakeholders. Regulatory expectations must be scientifically supportable, operationally achievable, and consistently applied by those responsible for evaluating and enforcing them.

FDA has an opportunity to establish a precedent that extends beyond the regulation of AI itself: a regulatory science framework in which innovation, evidentiary integrity, lifecycle accountability, and inspection readiness advance together rather than independently.

The measure of regulatory success should not be the speed at which an AI-enabled technology reaches the market, but the continued ability to substantiate its safety, effectiveness, and compliance through objective evidence.

Innovation without execution remains potential. Innovation without evidence remains uncertainty. Innovation without accountability places the patients we seek to serve at risk.

I would welcome the opportunity to continue to contribute directly to FDA’s regulatory science initiatives, technical working groups, and/or collaborative efforts to translate these recommendations into practical, risk-based, and globally relevant implementation strategies.

Respectfully,

Dr. Cynthia N. Brysch, PhD
Vice President & Chief Operating Officer
Devine Guidance International, Inc.

Submitted in my individual professional capacity. Please refer to my attached comprehensive public comment for the supporting regulatory analysis and detailed recommendations.

FORMAL PUBLIC COMMENT

Scientific Integrity, Regulatory Accountability, and Operational Readiness in the Oversight of Generative
AI-Enabled Medical Devices

October 19, 2026

Submitted electronically via Regulations.gov

Rick Abramson, MD
Director
Digital Health Center of Excellence
Center for Devices and Radiological Health
U.S. Food and Drug Administration
10903 New Hampshire Avenue
Silver Spring, MD 20993

RE: Docket No. FDA-2026-N-7874 — Considerations for the Regulation of Generative AI-Enabled
Medical Devices

Dear FDA Digital Health Center of Excellence and Center for Devices and Radiological Health
Leadership:

I appreciate the opportunity to comment on the Agency’s discussion of generative artificial intelligence
(GenAI)-enabled medical devices. I support innovation that advances patient care, but submit that the
principal regulatory science question is whether the evidence, qualified workforce, internal governance,
and operational methods needed to evaluate these technologies are sufficiently established to support
consistent oversight. My final position is that the regulatory standard must be evidence-based, lifecycleaccountable, and executable by both manufacturers and FDA personnel; technological novelty cannot
justify ambiguity in what is required, what has been demonstrated, or who is responsible for the decision.

My perspective reflects more than 22 years of leadership across global regulatory affairs, quality
assurance, clinical development, medical devices, pharmaceuticals, biotechnology, biopharmaceuticals,
and combination products. My work includes more than 500 development programs and regulatory
submissions, support of over 200 inspections, and portfolios spanning more than 150 countries. I serve as
Vice President and Chief Operating Officer of Devine Guidance International, Inc. (DGII), a
multidisciplinary life sciences consultancy supporting established and emerging organizations from
scientific concept and feasibility through clinical development, regulatory authorization, manufacturing,
and commercialization. DGII integrates regulatory strategy, quality systems, clinical science, and
operational governance through risk-based program management.

I am a certified ISO 13485:2016 International Lead Auditor and Business Management Improvement
(BMI) Specialist, and serve as a Chair within the Quality Management Division of Exemplar Global.
Across hundreds of international programs, I have advocated that quality and compliance are not
retrospective obligations: they are the architectural framework for scientific integrity, sustainable
innovation, and successful commercialization.

1. The regulatory question: can the algorithm be trusted?

My forthcoming training framework, “Can You Trust the Algorithm? AI in Clinical Trials: A Proven
Risk-Based Model for Validation, Integration, and Global Regulatory Control,” begins with a question
that should also guide device oversight: can the manufacturer demonstrate that the model, its source
evidence, and the decisions it informs are credible, validated, controlled, and fit for the specified context
of use? An apparently accurate output is not proof of source integrity, clinical validity, or adequate risk
control.

At the September 25, 2026 FDA/MDIC Regulatory Science Innovations Catalyzing Medical Device
Development meeting, where I facilitated an AI-focused breakout discussion, I raised with Agency
representatives and colleagues the integrity and applicability of data mined by AI, particularly where the
data needed to characterize an emerging device have not yet been generated. My account of those
discussions reflects my professional observations, not an official FDA or MDIC position. A recurring
implementation concern was the need for practical training, technical support, and qualified evaluators,
rather than assuming additional guidance alone will create operational readiness.

AI is computational, but medical-device performance is ultimately constrained by physical, biological,
and clinical reality. Theoretical or mechanistic models can generate hypotheses; simulated outputs,
synthetic data, and model extrapolations cannot substitute for appropriate device-specific bench,
analytical, nonclinical, or clinical evidence. AI can help design experiments and generate new
observations when embedded in a controlled scientific process, but cannot establish the validity of
evidence that has not been collected.

2. Establish evidence provenance and applicability before relying on model outputs

I recommend a documented evidence hierarchy distinguishing measured observations, qualified reference
data, model-derived estimates, simulations, synthetic datasets, and unverified hypotheses. Source
suitability should be evaluated for the specific device, population, clinical workflow, use environment,
and decision consequence. An algorithm trained on adjacent technologies or historic populations may
perform plausibly yet be nonrepresentative of a new device or indication.

 Document source lineage, collection methods, consent and use constraints where applicable, dataset
inclusion/exclusion criteria, missingness, representativeness, labeling quality, and known biases.
 Define dataset and model versioning, provenance checks, access controls, audit trails, retention, and
traceability from raw observations to final regulatory conclusions.
  Set evidence sufficiency and uncertainty thresholds; require escalation, abstention, or additional
prospective testing when thresholds are not met.
 For regulatory intelligence, distinguish statute and regulations from nonbinding guidance; record
document version, effective status, jurisdiction, and limits of historical archive completeness.

The withdrawal or unavailability of a historical guidance document does not erase its historical role;
neither should its presence in a retrieval system be presented as evidence that it remains applicable.
Claims that AI platforms comprehensively capture historical regulatory requirements require
independently verifiable coverage and exception handling.

Regulatory intelligence as a controlled source of evidence

Consider a manufacturer using a generative AI regulatory-intelligence platform to determine whether an
algorithm update requires a new premarket submission. The platform may retrieve an individual
consultant’s blog post, a superseded guidance document, a current FDA guidance, and binding provisions
of the Federal Food, Drug, and Cosmetic Act and implementing regulations. If the system synthesizes
these materials into one confident recommendation without identifying their origin, authority, effective
status, jurisdiction, and applicability, a user may mistake commentary or historical policy for a current
legal requirement. Conversely, even several mutually reinforcing sources may reproduce the same
outdated or unsupported interpretation. Source volume and linguistic confidence are not substitutes for
independent verification.

I therefore recommend that FDA address regulatory intelligence explicitly within AI data governance. For
each material regulatory assertion, a manufacturer should be able to retrieve the underlying source;
distinguish primary legal authority from FDA guidance, consensus standards, secondary analysis, and
opinion; establish publication and revision dates and current status; confirm device- and jurisdictionspecific applicability; and document a qualified human review of consequential interpretations. Where
authoritative sources are missing, conflicting, withdrawn, or inaccessible, the system should disclose the
limitation, preserve the evidence trail, and escalate rather than generate an unqualified conclusion. These
controls should be tested through representative scenarios, version-controlled, subject to change
assessment, and maintained as inspection-ready records. The central question is not simply whether an
algorithm can find regulatory information, but whether its source-to-conclusion chain can withstand
independent scientific and legal scrutiny.

3. Translate AI risks into design controls and a functioning quality management system

AI governance should not become a parallel document-generation exercise. It must be operationalized
within the manufacturer’s applicable quality management system, including the Quality Management
System Regulation (21 CFR Part 820, incorporating ISO 13485:2016 by reference), and coordinated with
design and development, supplier controls, software lifecycle activities, clinical evaluation, production,
complaint handling, and postmarket feedback. The regulatory classification and intended use determine
which obligations apply; a standalone model is not automatically a regulated medical device.

I recommend that FDA explain how manufacturers should connect the following controls across the
actual product lifecycle:

 Design inputs and intended use: specify user, patient population, clinical task, degree of autonomy,
performance boundaries, operating environment, and foreseeable misuse.
 Risk management: identify hazards from incorrect, omitted, delayed, biased, or overconfident
outputs; data leakage; prompt manipulation; automation bias; model drift; third-party dependencies;
and erroneous autonomous actions.
 Risk estimation and control: evaluate severity, probability where supportable, uncertainty,
detectability as appropriate, and residual risk; prefer controls designed into the system over reliance
solely on labeling or clinician vigilance.
 Verification and validation: trace each critical requirement and risk control to objective test evidence,
acceptance criteria, deviations, and disposition; validate integrated workflows, not just model
benchmarks.
 Supplier and change governance: qualify model, cloud, data, and software suppliers; define
contractual notification obligations, configuration baselines, release authority, change impact
analysis, and revalidation triggers.
 Feedback and corrective action: connect complaints, field signals, model performance monitoring,
nonconformities, CAPA, and management review to documented decisions about containment,
retraining, updates, and market action.

These controls should be proportionate to risk and the applicable legal framework, not prescribed
identically for low-risk informational tools and high-consequence autonomous systems. ISO 14971, IEC
62304, IEC 62366-1, and applicable cybersecurity expectations offer complementary methods, but do not
remove the need for device-specific scientific justification.

Design-control sequencing, evolving AI, and the meaning of “Current” in cGMP

Traditional waterfall development organizes design inputs, outputs, verification, validation, and transfer
into defined stages with documented approval points. That structure remains valuable for accountability
and traceability. However, AI-enabled devices may depend on datasets, learned relationships, model
configurations, and operating conditions that evolve after an initial design baseline. A one-time,
sequential validation cannot, by itself, establish continuing fitness for intended use if the underlying data
distribution, model behavior, or clinical context subsequently changes. FDA should therefore clarify how
existing design controls apply to iterative AI development without allowing iteration to bypass approved
requirements, independent verification, clinical validation where needed, or formal change assessment.

A central unresolved question is how manufacturers define and maintain the meaning of each controlled
element: the intended use, model and dataset versions, training and test populations, acceptable
uncertainty, performance thresholds, drift criteria, retraining triggers, and boundaries of authorized
change. These definitions must be established prospectively and documented against available evidence.
For novel technologies, data not yet generated cannot be treated as known, and future datasets cannot be
presumed representative, reliable, or sufficient merely because an algorithm can process them. The
appropriate control is a documented evidence-gap assessment with provisional assumptions, prespecified
acceptance criteria, prospective data-generation plans, and explicit decisions about when a model must
not advance or must be reassessed.

This is also the practical significance of the “C” in “Current Good Manufacturing Practices”: controls
must remain scientifically appropriate to the technologies, risks, and knowledge available at the time of
manufacture and throughout applicable lifecycle obligations. Premarket clearance or approval is not a
substitute for a functioning quality management system, nor does it guarantee a satisfactory subsequent
inspection. Manufacturers can obtain marketing authorization and later receive inspectional observations
or face compliance deficiencies if implemented processes, records, change controls, or corrective actions
fail to meet applicable requirements. FDA should connect AI-specific data integrity and model
governance directly to inspection-ready objective evidence, including contemporaneous records,
reproducible dataset lineage, version-controlled design history, validation traceability, supplier controls,
deviations, CAPA, and documented postmarket monitoring. The Agency should likewise align premarket
review expectations with the methods and competencies used by field investigators to assess those same
controls. An authorization is not a certification of ongoing manufacturing compliance: a product may
lawfully receive marketing authorization and subsequently exhibit quality-system deficiencies during
inspection. That distinction should be explicit in GenAI policy, including how model updates, changing
data distributions, and supplier-controlled changes are reviewed after authorization. The relevant
inspectional inquiry is not whether a waterfall document package was completed once, but whether
current, implemented, risk-proportionate controls can be demonstrated through objective records.

Documented regulatory precedent: AI-enabled cardiac monitoring clearance followed by FDA
Form 483 observations

iRhythm Technologies provides a directly relevant, publicly documented example. On August 29, 2018,
FDA cleared the Zio AT ECG Monitoring System under 510(k) K181502, including a modification of its
ZEUS analysis software from rule-based/machine-learning rhythm classification to a deep-learning
implementation. FDA subsequently cleared the ZEUS System under K222389 on February 15, 2023.
These decisions concerned specified intended uses and submitted performance evidence; they did not
establish that all subsequent manufacturing, quality-system, or postmarket obligations had been satisfied.

Following a July 15–31, 2024 inspection of iRhythm’s Cypress, California facility, FDA issued a Form
FDA 483 identifying deficiencies in procedures for monitoring algorithm sensitivity. The inspectional
observations described an absence of sufficiently established instructions for calculating algorithm
sensitivity consistently against cleared performance specifications, despite existing detection criteria and
monitoring records. In a separate July 2024 Form FDA 483 issued to iRhythm’s San Francisco facility,
FDA investigators documented examples of arrhythmia algorithm misclassification or missed detection
that were not incorporated into an algorithm-functionality monitoring metric. The observations also
addressed complaint handling and evaluation. These are investigator observations, not final Agency
determinations; the cited public records do not establish that the 2018 deep-learning modification itself
caused the observed deficiencies.

This example is material to FDA’s GenAI policy because it demonstrates the regulatory separation
between a cleared algorithm-enabled product and the manufacturer’s subsequent obligation to maintain
objective, inspection-ready evidence of real-world algorithm performance, complaint trending, data
integrity, calculation methods, and effective corrective action. Although ZEUS is a deep-learning cardiac
analysis system rather than a generative AI device, the precedent supports a stronger prospective
framework for defining performance metrics, incorporating all relevant postmarket signals, controlling
model changes, and ensuring that premarket review and field inspection assess coherent lifecycle
evidence.

4. Require validation that is scientific, statistical, clinical, and operational

Validation should demonstrate fitness for the intended purpose, not merely acceptable aggregate
accuracy. An adequate plan begins with the claims being made and the decisions the system is permitted
to influence. It should predefine independent datasets and acceptance criteria, subgroup and edge-case
analyses, robustness to distribution shifts, calibration and uncertainty performance, human factors, and the
clinical consequences of false positive, false negative, or unsupported outputs.

Where appropriate, evidence packages should address analytical or technical validation, clinical
validation, software verification, integration testing, usability, and real-world performance. Data leakage
between training and evaluation sets, repeated tuning on the test set, inadequate reference standards, and
retrospective selection of favorable metrics should be treated as threats to evidentiary credibility.
Synthetic datasets can supplement testing but should not be accepted as independent confirmation of realworld device performance without justification.
In clinical trials, AI outputs can influence protocol design, eligibility, endpoint assessment, safety review,
and data management. The same source-to-decision traceability must therefore connect GCP
responsibilities, data integrity, computerized system validation, and fit-for-purpose qualification of
laboratories or assays under applicable GLP/GCLP expectations. Clinical evidence cannot be assumed
adequate simply because a model performs well on historical datasets.

5. Apply an accountable phase-gate framework from concept through commercialization

My risk-based approach uses five linked decision gates, each requiring a named accountable decisionmaker, objective deliverables, predefined acceptance criteria, documented deviations, and a decision to
advance, remediate, or stop:

Gate 1 — Assess: Intended use, regulatory status, scientific feasibility, evidence gaps, preliminary
hazards, and benefit-risk context.

Gate 2 — Architect: Design requirements, dataset governance, validation plan, traceability, risk controls,
human oversight, and supplier responsibilities.

Gate 3 — Validate: Independent technical, analytical, clinical, and integrated-system evidence against
prespecified acceptance criteria; residual-risk evaluation.

Gate 4 — Operationalize: Controlled release, trained personnel, access and configuration controls, user
instructions, escalation, and monitoring readiness.

Gate 5 — Sustain: Drift surveillance, change control, periodic performance review, CAPA, revalidation,
and continued benefit-risk evaluation.

Predetermined change control plans, when available and appropriate, should describe authorized
modifications, validation methods, and impact assessment. Neither a change plan nor a human-in-the-loop
label should be treated as a substitute for demonstrated control effectiveness.

6. Test whether human oversight is an effective risk control

Human oversight should be validated in the context of actual workflow. A clinician may have clinical
expertise yet lack the model-specific knowledge or information needed to detect erroneous outputs. FDA
should request evidence of operator training, decision authority, time available to intervene, visibility of
uncertainty and source limitations, ability to override or stop the system, and performance under realistic
failure scenarios. Reliance on a clinician as an assumed “safety net” is not an adequate substitute for
robust technical controls.
7. The FD&C Act: statutory authority, evidence, and accountable implementation

The Federal Food, Drug, and Cosmetic Act (FD&C Act), enacted in 1938 and subsequently amended, is a
foundational source of FDA authority to protect public health through oversight of foods, drugs, medical
devices, cosmetics, and other regulated products. For AI-enabled medical devices, the governing question
remains whether the product meets the applicable statutory and regulatory requirements for its
classification and intended use, including appropriate evidence of safety and effectiveness, lawful
marketing, and compliance with applicable quality system obligations. Emerging AI capabilities do not
themselves expand statutory authority, convert nonbinding guidance into enforceable law, or eliminate the
need to substantiate device-specific performance through objective evidence. Equally, FDA’s review and
inspectional practices should remain traceable to the governing legal requirements, rather than to
divergent interpretations of guidance or technology-specific expectations that have not been
operationalized.

I recommend that FDA publish a clear statutory-to-operational crosswalk for GenAI-enabled devices,
identifying (1) the specific FD&C Act provisions and implementing regulations applicable to each device
function and risk profile; (2) which AI-related expectations are binding, recommended, or illustrative; (3)
the evidentiary thresholds for intended use, design verification and validation, clinical evaluation where
appropriate, and postmarket risk controls; (4) how QMSR/ISO 13485 design and development controls,
ISO 14971 risk management, supplier oversight, software change control, and CAPA are to be assessed in
practice; and (5) how reviewer and investigator training, inspectional procedures, and documented
escalation will maintain consistency across premarket and postmarket decisions. FDA should assess
workforce capacity and scientific readiness before setting implementation expectations, provide a
defensible path for alternative approaches permitted by law, and measure success through reproducible
assessments and patient-safety outcomes rather than guidance volume. This would reinforce the Act’s
public-health purpose while protecting the concept-to-commercialization pathway from unnecessary
uncertainty.

8. Demonstrate FDA workforce readiness and alignment of review and inspection

My inspection and remediation experience indicates that divergence among policy, premarket review,
compliance, and field inspection interpretations can impose avoidable costs and destabilize development
plans. Compliance Program Guidance Manuals (CPGMs) are useful operational resources but may not yet
provide sufficient technology-specific methods for consistent AI assessment. The Agency should assess
whether reviewers and investigators possess the same baseline understanding of data provenance,
statistical validation, software risk, model updates, and QMS controls before new expectations are applied
in the field.
I recommend a documented Agency implementation plan with role-based competency matrices, training
and qualification records, cross-functional technical review, calibrated inspectional examples, escalation
routes for conflicting interpretations, and metrics of consistency and outcome. These are requests for
readiness evidence, not claims that staffing or resource deficiencies have already been conclusively
established. This should include scenario-based qualification on model behavior, training-data
provenance, statistical uncertainty, software lifecycle changes, clinical context, and the limits of
retrospective data; shared reviewer–investigator case exercises; and an escalation mechanism for
inconsistent interpretations before they become avoidable inspection disputes.

Under 21 CFR 10.115, guidance generally is nonbinding and alternative approaches may satisfy
applicable requirements. A Form FDA 483 documents inspectional observations and is not a final Agency
determination. Nonetheless, manufacturers can experience considerable pressure when nonbinding
recommendations appear to be treated as de facto requirements. FDA should ensure that inspectional
findings are grounded in law and objective evidence, and that technical disagreements and justified
departures from guidance are handled consistently and transparently.

Harmonization across jurisdictions begins with internal alignment: statute, review expectations,
inspectional practice, and enforcement must be coherent. The Agency should apply the same principles of
competency, documented control, corrective action, and continuous improvement to its own oversight
processes that it expects industry to implement.

9. Specific requests for FDA consideration

1. Publish an implementation gap assessment distinguishing missing regulatory authority from missing
training, methods, or resources.
2. Develop practical, risk-stratified examples showing how AI-specific hazards map to QMSR/ISO
13485 processes, ISO 14971 risk files, software validation, and postmarket controls. Include a
concrete comparison of stage-gated/waterfall design control records with continuous-learning or
periodically updated AI systems, showing precisely when changes trigger risk-file updates,
verification, validation, regulatory assessment, and reauthorization as applicable.
3. Define minimum evidence-provenance and representativeness expectations, with explicit handling of
absent, incomplete, synthetic, or nontransferable data. Require a documented distinction between
data already observed, data projected by algorithms, and data that do not yet exist; prospective
evidence-generation plans should identify which assumptions remain unverified.
4. Clarify expectations for independent validation, acceptance criteria, statistical confidence, subgroup
performance, clinical relevance, and integrated workflow testing.
5. Specify what constitutes demonstrably effective human oversight and what circumstances require
autonomous-function restrictions or abstention.
 6. Define lifecycle monitoring, drift escalation, supplier-change notification, revalidation triggers, and
appropriate predetermined change control plan boundaries.
7. Qualify and support FDA reviewers and field investigators with consistent technical methods, crossfunctional review, and transparent resolution of contradictory interpretations.
8. Measure implementation success through evidence quality, reproducible inspectional conclusions,
workforce readiness, risk reduction, and patient outcomes rather than the volume of guidance
published. Include consistency between premarket authorization decisions and subsequent
inspectional findings without conflating those legally distinct determinations.

Closing perspective and offer of collaboration

I support FDA’s continued engagement with industry and regulatory science professionals in advancing
responsible oversight of AI-enabled medical devices. The priority is not simply to establish new
expectations, but to ensure that the evidence, operational controls, and scientific competencies required to
implement them are demonstrable, consistent, and sustainable. Innovation without execution remains
potential. Innovation without evidence remains uncertainty. Innovation without accountability places the
patients we seek to serve at risk.

I welcome the opportunity to continue contributing to FDA regulatory science working groups, technical
advisory activities, or other collaborative efforts to translate these principles into practical, measurable,
risk-based methods that support safe innovation from concept through commercialization.

Thank you for your consideration.

Respectfully submitted,

Cynthia N. Brysch, PhD, CQA-QMD
Vice President & Chief Operating Officer, Devine Guidance International, Inc. (DGII)
Chair, Quality Management Division | Exemplar Global
Certified ISO 13485:2016 International Lead Auditor | Business Management Improvement (BMI)

Submitted independently in my individual professional capacity. Affiliations are provided for
identification; views expressed are my own.
References and source documents

Primary statutory and regulatory authorities

1. Federal Food, Drug, and Cosmetic Act (FD&C Act), as amended. Statutory framework for medicaldevice regulation; see 21 U.S.C. §§ 301 et seq., including device provisions in §§ 360c–360j.
https://uscode.house.gov/view.xhtml?path=/prelim@title21/chapter9&edition=prelim

2. 21 CFR Part 820, Quality Management System Regulation (QMSR), including incorporation by
reference of ISO 13485:2016.
https://www.ecfr.gov/current/title-21/chapter-I/subchapter-H/part-820

3. 21 CFR 10.115, Good Guidance Practices; legal status of FDA guidance and alternative approaches.
https://www.ecfr.gov/current/title-21/chapter-I/subchapter-A/part-10/section-10.115

FDA device clearance and inspection records

4. FDA, Zio AT ECG Monitoring System, 510(k) K181502, decision dated August 29, 2018.
https://www.accessdata.fda.gov/cdrh_docs/pdf18/K181502.pdf

5. FDA, ZEUS System, 510(k) K222389, decision dated February 15, 2023.
https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfpmn/pmn.cfm?ID=K222389

6. FDA, iRhythm Technologies, Inc., Cypress, California, Form FDA 483, July 31, 2024.
https://www.fda.gov/media/181269/download

7. FDA, iRhythm Technologies, Inc., San Francisco, California, Form FDA 483, July 31, 2024.
https://www.fda.gov/media/180888/download

8. FDA, Form FDA 483: Inspectional Observations (general information on status and purpose).
https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/inspectionreferences/inspection-observations

Consensus standards referenced in the comment

9. ISO 13485:2016, Medical devices — Quality management systems — Requirements for regulatory
purposes.

10. ISO 14971:2019, Medical devices — Application of risk management to medical devices.

11. IEC 62304, Medical device software — Software life cycle processes (applicable edition).

12. IEC 62366-1, Medical devices — Application of usability engineering to medical devices (applicable
edition).

13. IEC 81001-5-1, Health software and health IT systems safety, effectiveness and security — Security
— Activities in the product life cycle (applicable edition).
14. ISO 14155, Clinical investigation of medical devices for human subjects — Good clinical practice
(applicable edition).

Regulatory science and AI guidance cited by topic

15. FDA, Artificial Intelligence and Machine Learning (AI/ML)-Enabled Medical Devices: FDA resource
and device listing.
https://www.fda.gov/medical-devices/software-medical-device-samd/artificial-intelligence-enabledmedical-devices

16. FDA, Predetermined Change Control Plans for Machine Learning-Enabled Device Software
Functions: Guidance for Industry and FDA Staff. Verify the applicable version at the time of submission.
https://www.fda.gov/regulatory-information/search-fda-guidance-documents

17. FDA, Health Canada, and MHRA, Good Machine Learning Practice for Medical Device
Development: Guiding Principles.
https://www.fda.gov/medical-devices/software-medical-device-samd/good-machine-learning-practicemedical-device-development-guiding-principles

18. International Medical Device Regulators Forum (IMDRF), relevant software-as-a-medical-device and
AI/ML publications; identify document and revision before applying to a specific product.
https://www.imdrf.org/documents

19. FDA/MDIC, Regulatory Science Innovations Catalyzing Medical Device Development public
meeting, September 25, 2026; referenced as the author’s firsthand professional participation, not as an
official Agency position.

Source note: References 4–7 are the specific primary FDA records supporting the iRhythm case example.
Form FDA 483 observations are not final Agency determinations. References to standards and general
guidance identify relevant frameworks, not a claim that every document applies to every device. Verify
current revisions and legal applicability before filing.