IFC Group (Christopher Hernandez)

Submitted by: Christopher Hernandez, IFC Group LLC, Charleston, South Carolina
Re: Docket FDA-2026-N-7874, Considerations for the Regulation of Generative AI-Enabled Medical Devices

IFC Group LLC is a small South Carolina company developing patient-facing software that helps people organize and understand their own health records before they talk with their clinicians. The software is in early development and not yet available. We appreciate CDRH’s early, open process and its stated aim of a nimble, least-burdensome approach. We comment on two topics.

1. Agentic AI: patient-agent to clinician-agent exchange (Question 26)
We expect patients’ AI agents to share summaries with clinicians’ AI agents or clinic systems. Such exchange should be consented, read-only, logged, and controlled by the patient, with no authority to act: the patient chooses what is shared, can revoke access, and can see what was sent. This keeps a human in the loop by design. Few comments in this docket appear to address this case. We ask FDA to clarify:
- who the intended user is when the immediate recipient of an output is another AI system;
- how the independent-review criterion for clinical decision support applies when an intermediate agent filters or reformats information before a clinician sees it; and
- what audit expectations apply: provenance of each data element, records of what was exchanged and when, and disclosure to both parties that AI was involved.

2. Risk assessment and postmarket monitoring (Questions 1 and 19)
In our development work, we have seen that instructions given only in a prompt can drift over long sessions: a model told not to discuss prognosis or treatment can gradually move toward that language. The paper notes the same risk: a conversational device "may begin by performing an informational function and migrate, over the course of a conversation, to an action-directing function" (Section IV). We encourage FDA to give credit, in risk assessment and in evidence expectations, for controls enforced by the software rather than by prompts, such as:
- fixed, reviewed templates for any statement about a person’s own data;
- automated output checks that block diagnostic, prognostic, or treatment language before release;
- fresh model sessions rebuilt from source-linked, structured records for each new batch of data, instead of long chat history;
- source evidence kept separate from AI-generated text, so users and clinicians can tell what the record says from what the software wrote; and
- audit logs of inputs, template versions, check results, and outputs.

These controls make each output traceable to its source, a dimension Question 1 itself lists; we support weighing traceability as a risk reducer alongside reversibility and downstream safeguards. The same controls give postmarket monitoring concrete signals, such as output-check hit rates. Where a function goes beyond education, clinician review (every output, or sample-based per Question 19) should count in the risk assessment. Finally, we ask for a predictable, proportionate path for small developers: published examples, clear thresholds between risk levels, and accessible early feedback.

Thank you for considering these comments.
Christopher Hernandez
IFC Group LLC, Charleston, SC