IQVIA (Alex J. Cadotte)

See attached file(s)

2400 Ellis Road
Durham, NC 27703
iqvia.com

October 19, 2026

Rick Abramson, MD,
Director, Digital Health Center of Excellence (DHCoE)
Center for Devices and Radiological Health (CDRH)
U.S. Food and Drug Administration
C/O Dockets Management Staff (HFA-305)
5630 Fishers Lane, Rm. 1061
Rockville, MD 20852

Submitted Electronically via upload to https://www.regulations.gov/docket/FDA-2026-N-7874

Re: Considerations for the Regulation of Generative AI-Enabled Medical Devices: Discussion Paper
and Request for Feedback, Docket FDA-2026-N-7874

Dear Dr. Abramson:

IQVIA appreciates the opportunity to respond to the Center for Devices and Radiological Health’s (CDRH)
request for feedback, Considerations for the Regulation of Generative AI-Enabled Medical Devices:
Discussion Paper and Request for Feedback. IQVIA is a leading global provider of advanced analytics,
technology solutions, and clinical research services to the life sciences industry. By creating intelligent
connections across healthcare, IQVIA helps customers accelerate the clinical development and
commercialization of innovative medical treatments and improve patient outcomes. IQVIA has approximately
94,000 employees and operates in more than 100 countries.

MCRA, an IQVIA business and part of IQVIA Medtech, assists medical-technology companies of all sizes in
developing and implementing clinical-research and commercialization strategies across the product
lifecycle.2 MCRA provides regulatory guidance to established manufacturers and startups across the
spectrum of AI-enabled medical devices, including software as a medical device (SaMD), software in a
medical device (SiMD), AI/ML-enabled devices, computer-aided detection, triage, and diagnosis devices
(CADe, CADt, and CADx), medical imaging, and quantitative imaging.

IQVIA commends CDRH and the FDA Digital Health Advisory Committee for engaging interested parties in
the development of future regulatory approaches for GenAI-enabled devices. Although the docket questions
address evaluation frameworks, third-party involvement, postmarket monitoring, bias, and clinical evaluation,
FDA should also ensure that its approach appropriately balances the assessment of risk with the benefits of
these technologies. This balance is essential to keeping pace with the rapidly evolving AI-enabled medicaldevice landscape, maintaining a least-burdensome regulatory approach, and supporting life-saving and lifeenhancing innovation – without compromising patient safety. Although agentic AI systems represent one of
the current frontiers of AI technology, they are already spawning new innovations in product design, as well
as research methods across the product life cycle. We therefore encourage FDA to continue relying on
technology-neutral terminology and durable frameworks grounded in intended use and benefit-risk principles.
Such an approach will remain relevant over time as the assessment of AI systems becomes increasingly
complex and nuanced.

Our comments are broken into two parts. Part A summarizes IQVIA’s principal recommendations. Part B lists
our response to all 26 questions across four broad topic areas corresponding to their respective sections of
the document: Section IV. Considerations for the Assessment of Risk for GenAI-Enabled Devices, Section V.
 2400 Ellis Road
Durham, NC 27703
iqvia.com

A Competency-Based Approach for Premarket Evaluation of GenAI-Enabled Devices, VI. Postmarket
Monitoring for GenAI-Enabled Devices, and VII. Other Topics.

PART A. IQVIA’S PRINCIPAL RECOMMENDATIONS

1. Risk/Benefit Framework. We generally agree with FDA’s proposed risk-based framework, which aligns
with the Agency’s prior work and established approach to medical-device oversight. IQVIA recommends,
however, that FDA give anticipated benefits equivalent consideration by expressly weighing the clinical
and operational benefits of automation alongside reasonably foreseeable risks. This balance is important
for three reasons.
• First, clinicians already automate portions of clinical workflows by delegating appropriate tasks to
qualified personnel; evaluating automation against an assumption of direct physician performance
may therefore mischaracterize the existing standard of care and the device’s intended benefit.
• Second, from a human factors perspective, automation may itself provide a meaningful benefit by
reducing workload, improving consistency, and allowing users to focus attention on tasks that require
clinical judgment.
• Third, the same automation that may introduce new risks can also enable new mitigations by
integrating labeling, effectiveness, and safety information directly into device functionality—for
example, through contextual instructions, warnings, use limitations, or workflow controls presented
when they are most relevant.

Accordingly, a balanced framework should consider not only the risks introduced by automation, but also
automation’s ability to improve performance, reduce repetitive-workflow risks, benefit users, and
operationalize mitigations that may be more effective than static labeling alone.

2. Update and Utilize Existing Frameworks. IQVIA recommends that FDA anchor oversight in existing
frameworks for intended use and residual risk. Regulatory expectations should reflect the device’s
intended use, labeling, intended users, degree of automation, workflow, claims, and residual risk after
mitigation. FDA has appropriately recognized in many cases that AI is a technological characteristic
capable of enabling new intended uses, and it should continue this approach for GenAI.

3. Documented Process for Clinically Important Variables. IQVIA recommends that FDA establish,
through guidance, a consistent and transparent process for determining which variables and thus
subgroups are clinically relevant for premarket testing and postmarket monitoring. Guidance should
differentiate which types of variables would be generally better addressed in postmarket vs premarket
settings, recognizing that it will vary by device. This process is critical to ensure that any post-market
process for a given device is designed appropriately for showing signal instead of noise. Because the
relevant variables, datasets, endpoints, and benchmarking methods will vary by device indication, actual
device-specific risks, and clinical application, FDA should provide high-level guidance while preserving
sufficient flexibility for sponsors to develop device-specific evaluation strategies. The framework should
distinguish variables that may materially affect device performance from those used primarily to explore
broader questions of generalizability and should specify when subgroup data are sufficiently robust to
support a regulatory conclusion. Postmarket monitoring should be proportionate to the variable’s clinical
relevance, the magnitude and detectability of the potential risk, the strength of the available evidence,
and the expected public-health value of additional monitoring.
 2400 Ellis Road
Durham, NC 27703
iqvia.com

4. Third Party Involvement. IQVIA recommends that FDA support qualified third parties in conducting
benchmarking and clinical-validation activities by establishing clear standards for competency,
independence, conflicts of interest, certification, and oversight—and then placing meaningful reliance on
the conclusions of organizations that satisfy those standards. GMLP considerations should also extend
to benchmarking to ensure benchmark datasets remain valid. FDA should also reform the existing ThirdParty Review Program to expressly include AI- and GenAI-enabled devices and align the review scope
of the Third-Party Review program with any future framework for third-party benchmarking as similar
trust via certification will be needed for both initiatives to be successful. The Agency should remain
responsible for setting standards, certifying and monitoring participating organizations, and taking
corrective action where necessary, while avoiding restrictions or duplicative review that prevent qualified
third parties from exercising the judgment for which they were certified. Without meaningful FDA trust
and reliance, third-party benchmarking would add process without increasing review capacity, efficiency,
competition, or innovation.

5. Technical Considerations Guidance and Guidance Updates. As a follow-up to this important
discussion paper, IQVIA recommends that FDA focus on describing how existing regulatory frameworks
apply to the appropriate regulation of AI-enabled medical devices, including GenAI-enabled devices. We
envision a set of integrated guidance documents including: 1) a new technical guidance document laying
out the challenges and special considerations posed by GenAI, 2) updates to multiple existing medical
device guidance documents reflecting these considerations, and 3) a set of in-depth case examples
examining AI-enabled devices that the Agency can build out as AI technologies evolve over time.
Throughout this comment letter, we have pointed out multiple foundational guidance documents where
updates are now warranted to address key topics: software, human factors, clinical performance, change
management, and benefit/risk determinations. We believe that a coordinated, technology-neutral
approach would clarify how established regulatory principles apply across the spectrum of AI-enabled
devices, improve consistency among review teams, and avoid creating a separate GenAI framework
where existing guidance can instead be refined to address relevant technological characteristics.

PART B. RESPONSE TO QUESTIONS POSED IN THE DISCUSSION PAPER
This part of the letter provides IQVIA’s feedback regarding all 26 questions listed in the discussion paper, by
section topic.

Section IV: Considerations for the Assessment of Risk for GenAI-Enabled Devices

1. Does the two-axis risk framework, organized around device activity and the consequence of
relying on an incorrect output, appropriately capture the dimensions most relevant to the risk of a
GenAI-enabled software function? If there are additional dimensions—such as the reversibility of a
resulting action, the availability of downstream safeguards, the time pressure of the deployment
setting, or the traceability of the output (i.e., to primary source materials)—that should be
represented in a risk framework, please describe and provide examples of how they should be
represented.
 2400 Ellis Road
Durham, NC 27703
iqvia.com

IQVIA Response
We support FDA’s efforts to establish a framework for evaluating generative artificial intelligence (GenAI)-
enabled medical devices. Reversibility and time pressure are part of severity-of-harm considerations, which
existing risk management standards already cover, (e.g., ISO 14971). 1 They fit within the consequence axis
and do not need a separate axis. Downstream safeguards and traceability to primary sources are
mitigations. IQVIA supports counting them as risk reducers when assessing residual risk after mitigation.
However, we also recommend that the Agency refine its approach to ensure that it remains consistent with
the established benefit-risk principles applied across the 510(k), De Novo, and premarket approval
pathways.

We do not believe that the overarching risks associated with GenAI-enabled devices are fundamentally new.
Risks such as false-positive and false-negative results, device misuse, and device failure for diagnostic
devices are already addressed under existing medical device frameworks. What distinguishes GenAIenabled devices is how these risks may manifest based on the technology’s characteristics, degree of
automation, output type, intended use, comparisons of device performance to that of healthcare
professionals, and the extent to which such comparisons may influence user expectations, reliance, or
perceptions of the device’s capabilities. We therefore recommend that FDA distinguish between established
device-level risks and the technology-specific sub-risks associated with GenAI, such as (i) outputs that are
wrong but sound confident and believable; (ii) different answers to the same question; (iii) sensitivity to how a
question is phrased; and (iv) drift out of scope during a multi-turn conversation, rather than treating GenAI as
presenting an entirely separate category of new risk. A risk framework is more effective when it is
technology-neutral and spans non-AI and AI based functions.

FDA’s guidance regarding quantitative imaging provides a useful precedent. 2 That guidance differentiates
among levels of automation and establishes corresponding expectations for performance testing and
labeling. We recommend that FDA consider a comparable approach for GenAI-enabled devices by defining
relevant categories of automation and functionality, identifying the sub-risks associated with each category,
and providing representative examples of appropriate validation and labeling expectations.
International Organization for Standardization (ISO). Medical Devices – Application of Risk Management To Medical
Devices. ISO 14971:2019. Accessed 10/14/2026 at https://webstore.ansi.org/standards/iso/ISO149712019.
U.S. Food and Drug Administration. Technical Performance Assessment of Quantitative Imaging in Radiological
Device Premarket Submissions, Guidance for Industry and Food and Drug Administration Staff, June 2022. Accessed
10/14/2026 at https://www.fda.gov/regulatory-information/search-fda-guidance-documents/technical-performanceassessment-quantitative-imaging-radiological-device-premarket-submissions.
 2400 Ellis Road
Durham, NC 27703
iqvia.com

We also recommend that FDA expressly incorporate the net benefits of automation into the framework. An
assessment focused primarily on worst-case outcomes, technological limitations, and potential bias does not
provide a complete benefit-risk analysis. In our view, the framework should give meaningful and equivalent
consideration to the potential benefits of automation that are driving the adoption of such technologies,
including benefits relevant to the device’s intended users, use environment, and clinical purpose. Where AI
automates routine functions that physicians already delegate to non-physician personnel, non-physicians as
well as the clinical team can benefit from AI. Blanket regulatory approaches that don’t recognize non-clinician
contributions to the practice of medicine may risk requiring physicians to reenter those workflows, may
negate the technology’s principal benefit, and may not reflect how clinical teams already share work today.
Furthermore, although GenAI may introduce new sub-risks and enable new intended uses, it may also
benefit device safety by extending labeling-based mitigations beyond static instructions for use and enabling
a new class of active mitigations integrated directly into the device’s design and operation.

With regard to FDA’s determination of risks, we recommend that existing frameworks for risk determination --
specifically the guidance documents pertaining to benefit-risk factors for 510(k) and de novo premarket
approvals -- be updated to include AI and GenAI examples. 3 4 In our experience, it is vital to assess risk
probability and other key factors as discussed in these guidance documents to help distinguish device risks
from device hazards. Two central factors include 1) foreseeable misuse and 2) bias reduction. For
foreseeable-misuse risks, we recommend that FDA distinguish between an incorrect output arising when a
device is used in accordance with its intended use and labeling and an incorrect output resulting from use
outside those parameters. These circumstances do not necessarily present equivalent device risks. Although
foreseeable misuse should be appropriately considered and mitigated, it should not automatically be treated
as equivalent to device failure risks under labeled conditions of use due to differences in probability of
occurrence and other factors related to risk calculation. For GenAI-enabled devices, the device's own
guardrails, such as keeping in-scope and refusing out-of-scope requests, are how the labeling gets enforced
in practice.
U.S. Food and Drug Administration. Benefit-Risk Factors to Consider When Determining Substantial Equivalence in
Premarket Notifications (510(k)) with Different Technological Characteristics, Guidance for Industry and Food and
Drug Administration Staff, September 2018. Accessed on 10/18/2026 at https://www.fda.gov/regulatoryinformation/search-fda-guidance-documents/benefit-risk-factors-consider-when-determining-substantialequivalence-premarket-notifications-510k.
U.S. Food and Drug Administration. Factors to Consider When Making Benefit-Risk Determinations in Medical Device
Premarket Approval and De Novo Classifications, Guidance for Industry and Food and Drug Administration Staff,
August 2019. Accessed on 10/18/2026 at https://www.fda.gov/regulatory-information/search-fda-guidancedocuments/factors-consider-when-making-benefit-risk-determinations-medical-device-premarket-approval-and-de.
 2400 Ellis Road
Durham, NC 27703
iqvia.com

When assessing bias-reduction risks, we frequently encounter new concerns related to bias reduction where
both the severity and probability of occurrence are very low. Many of these bias concerns can be theoretical
and difficult to measure, making them extremely difficult and cost-prohibitive to mitigate, often resulting in
least burdensome discussions. Thus, we think these are areas where a deeper appreciation for and
integration of the existing risk/benefit guidance is needed, along with more AI- and GenAI-specific case
examples. .

In conclusion, we recommend that FDA structure the framework around three complementary
considerations: established device-level risks, GenAI-specific sub-risks, and the benefits of
automation. In our view, this approach would align the evaluation of GenAI-enabled devices with FDA’s
established benefit-risk principles while providing sufficient flexibility to address the distinct characteristics of
the technology. We further recommend updating existing guidance documents related to benefit/risk to be
more compatible with this framework.

2. CDRH seeks input on how to account for the spectrum of GenAI-enabled informational functions
that vary in the degree to which they direct a user to a particular action (i.e., between “non-directive”
and “action-directing”). What characteristics of an output—such as its wording, specificity,
personalization, or context—could be considered as modifiers of the risk associated with an
informational function, after accounting for the device’s overall functionality and intended use? What
additional information would provide manufacturers with sufficient clarity and predictability around
risk assessment for informational functions while recognizing that directiveness may exist along a
continuum rather than as a binary distinction?

IQVIA Response
We believe these considerations ultimately tie back to the device’s intended use and labeling. Although
GenAI-enabled devices may more closely mimic natural human language, provide detailed explanations of
their outputs, and interact with users through conversational interfaces, these capabilities do not alter the
fundamental role of intended use in determining device risk. Within the bounds of the intended use, output
characteristics that may increase directiveness include (i) specificity, such as a named disease, dose, or
deadline versus general information; (ii) personalization to the individual patient; (iii) the expressed level of
certainty; and (iv) whether the output presents options or a single course of action. FDA’s existing concepts
for adjunctive, assistive, semi-autonomous, and autonomous functions remain applicable, and many of the
concepts discussed in the white paper are neither unique to GenAI nor to AI more generally. For example,
the four outputs in FDA's lisinopril illustration highlighted in the discussion paper correspond to existing
informational, adjunctive, assistive, and directive functions. We therefore recommend that FDA use
established terminology and existing risk-assessment frameworks wherever possible, adding new terms only
when necessary to describe genuinely novel concepts. This approach would promote consistency across
 2400 Ellis Road
Durham, NC 27703
iqvia.com

regulatory frameworks and reduce confusion, particularly for products that incorporate multiple device
functions with differing technological characteristics.
Consistent with the device’s intended use, outputs should remain within established clinical frameworks, use
accepted clinical terminology and be subject to appropriate guardrails governing the scope of permissible
outputs and the extent to which the device may expand upon an interpretation. Examples include fixed
output templates, limits on the topics or actions the device may address, linking each output to its source
material, and blocking specific dosing instructions unless they fall within the intended use. Clearly defining
these boundaries is more meaningful to the assessment of device risk than focusing primarily on worst-case
scenarios that fall outside the device’s intended use and labeling.

3. CDRH seeks input on whether and when a GenAI-enabled function that results in delivery of
clinical information to patients, as opposed to HCPs, could present different or higher risks, while
also recognizing the potential benefits associated with improved patient empowerment, engagement,
and access to clinical information. What device characteristics, output features, or safeguards might
mitigate risks that could arise when a user lacks the domain knowledge to independently evaluate an
output, without unnecessarily underestimating patient capability?

IQVIA Response
We do not believe these considerations are specific to GenAI, as they apply across the spectrum of existing
AI-enabled and non-AI medical devices. For example, a device should be designed and tested for the
intended user it names, whether that is a patient or a clinician, just as current devices are limited to their
intended users and labeled conditions of use. For example, a device described as “aiding” a user should not
be utilized by unqualified users who are not capable of being aided. Although GenAI-enabled devices may
present different risks or require different mitigations, we do not believe those risks are necessarily greater
than the risks associated with existing devices. With appropriate guardrails governing the type, level, and
presentation of information communicated to patients and healthcare professionals, these risks can be
appropriately controlled within existing regulatory frameworks. These guardrails, and the associated
verification and validation testing, should address leading or manipulative inputs, such as users rephrasing a
request until the device produces a desired answer.

Human factors testing should play a significant role in evaluating the effectiveness of these mitigations,
including whether users understand the information presented, interpret the device’s outputs appropriately,
potential for automation bias, and use the device consistently with its intended use and labeling. Because
GenAI outputs are fluent and may appear confident, human factors testing should also assess automation
bias, including whether users recognize when the device is uncertain or operating near the limits of its
intended use, not only whether they can read and understand the output. We therefore recommend that FDA
 2400 Ellis Road
Durham, NC 27703
iqvia.com

apply established human factors principles to GenAI-enabled devices rather than presume that the
technology presents fundamentally different or categorically higher risks.

4. CDRH seeks input on whether and how the distinction between generalist and specialist
physicians might inform the assessment of risk for HCP-facing GenAI-enabled functions. Under what
circumstances, if any, might risk be affected when an HCP who lacks the relevant clinical specialist
knowledge receives information that falls within a specialist area of practice? What device
characteristics or safeguards might mitigate such risks?

IQVIA Response
We do not believe this issue is specific to GenAI, as it arises across a broad range of existing AI-enabled and
non-AI medical devices. Although the applicable mitigations may not be comprehensively described for all
current device types, FDA’s experience regulating existing technologies provides a substantial foundation for
developing guidance that addresses device use by both healthcare professionals and patients. We therefore
recommend that FDA address this topic independently of the GenAI framework and develop principles
applicable across device types, supported by examples spanning GenAI and other established technological
characteristics. Such an approach would provide a more comprehensive and durable framework for this
issue, as well as the related considerations concerning patient use. Consistent with existing clinical and
regulatory frameworks, device use should remain aligned with applicable clinical guidelines and credentialing
requirements.

Appropriate labeling, transparency and traceability related to decision points, user training, and clear
identification of the intended users and their necessary qualifications can help ensure that devices are used
as intended and that associated risks are appropriately controlled. For example, a device could flag when a
query falls outside the user's typical area of practice and recommend specialist input, a simple design control
that does not require a new framework. Sponsors may also choose to maintain a reviewable record of device
inputs and outputs, which allows the care team to see the basis for a recommendation, supports traceability,
and enables later postmarket review. Such records should be an available risk-reduction option rather than a
mandatory requirement, given their associated storage and privacy costs.

5. For multi-turn conversational GenAI-enabled devices that may migrate from providing “nondirective” information to “action-directing” information over the course of an exchange, how should
risk be assessed across realistic conversational trajectories? How could the intended use of such a
device be characterized when its behavior is emergent across a conversation?

IQVIA Response
We believe the risk assessment should be driven by the device’s intended use, with the highest-risk intended
 2400 Ellis Road
Durham, NC 27703
iqvia.com

use -- as opposed to largest-magnitude hazard -- informing the applicable performance-testing and riskmitigation requirements, consistent with the approach applied to non-GenAI devices. Although GenAI
represents a new technological characteristic, FDA has substantial experience evaluating devices that
combine multiple functions and provide information at different points in a clinical workflow, including CADe,
CADx, and quantitative imaging functions integrated into existing workflows. The intended use, nature of the
device’s actions, intended users, and proposed claims should therefore determine the required level of
validation and evidence. In particular, a transition from a non-directive or informational role to directive
recommendations may materially change the intended user population and the qualifications necessary to
use the device appropriately. As part of the multifunctional nature of the device, GenAI design can include
specific requirements, design specification, verification, and validation that ensure the output stays within
acceptable bounds as an active risk mitigation.

IQVIA recommends that the intended use and labeling clearly define the boundaries among informational,
adjunctive, and directive outputs, as well as the qualifications of the intended users. Once those boundaries
are established, FDA can align performance evaluation and risk mitigations with the highest-risk function.
The highest-risk function should be determined by what the device actually does when its guardrails operate
as designed, not by what it could theoretically produce. Where a sponsor demonstrates that design controls
keep the device within its intended informational or adjunctive role, the risk level should reflect that validated
behavior. For multifunction devices, this may require either constraining the device to specifically defined
workflows or evaluating its performance holistically within the complete workflow, rather than assessing each
output independently and without regard to how the outputs operate together. Consistent with the
benchmarking approach discussed in our response to question 7, such testing should use realistic multi-turn
conversation scripts rather than isolated single questions.

6. For GenAI-enabled care escalation functions, CDRH is considering how the evaluation may
account for both under-escalation and over-escalation. How could manufacturers characterize and
weigh these two directions of error, given that they may not be commensurable and that acceptable
trade-offs may vary by clinical context?

IQVIA Response
We do not consider “care escalation” to be a distinct intended use or regulatory category. Rather, the
underlying issue concerns the device's role in triage and notification, a function FDA already addresses
through established categories such as computer-aided triage (CADt) devices. We therefore recommend that
FDA avoid introducing new terminology where existing concepts adequately describe the device function,
intended use, and associated risk.
 2400 Ellis Road
Durham, NC 27703
iqvia.com

We recognize that over-escalation carries real costs, including unnecessary emergency visits and testing,
and that these costs should be weighed alongside the risks of under-escalation in assessing a device's net
benefit. We believe current terminology and review practices consider these risks. Applying established
diagnostic and triage terminology would improve consistency and facilitate implementation and review by
FDA, sponsors, and other stakeholders. The trade-off between under- and over-escalation is the same
sensitivity–specificity trade-off that applies to existing diagnostic and triage devices. Sponsors should
prespecify the operating threshold before testing and justify it based on the clinical setting and the relative
consequences of each type of error. If a genuinely novel concept requires a new term, that term should be
narrowly defined and incorporated into the existing framework rather than used to create a separate GenAIspecific taxonomy.

Section V: A Competency-Based Approach for Premarket Evaluation of GenAI-Enabled Devices

7. Is the competency-based approach described above, i.e., device benchmarking followed by clinical
confirmation, a useful and appropriate framework for evaluating GenAI-enabled devices?

IQVIA Response
We agree that the benchmarking concept is among the strongest elements of the discussion paper. Although
benchmarking is analogous to bench performance testing already used for many AI-enabled device types,
the proposed approach is appropriately tailored to the multiple and potentially interdependent outputs of
GenAI-enabled devices. We recommend that FDA expand this GenAI-specific concept in future guidance,
similar to other “Technical Considerations” guidance documents, by addressing appropriate test scenarios,
datasets, performance measures, endpoints, and methods for evaluating outputs both individually and
holistically.

In contrast, clinical validation is not fundamentally unique to GenAI. Not all AI-enabled devices require
prospective clinical data to demonstrate safety and effectiveness, and FDA should continue to apply existing
clinical-validation expectations based on the device’s intended use, risk, and claims. However, the measures
and endpoints used to evaluate GenAI-enabled devices may need to account for the breadth and interaction
of their outputs rather than focusing on a single performance factor at a time, as may occur in traditional
reader studies. Simulated data, real-world evidence, and postmarket performance monitoring may also be
appropriate where they provide meaningful information regarding performance across the range of
anticipated outputs and conditions of use. Accordingly, FDA should distinguish between the GenAI-specific
need for multi-output benchmarking and the broader clinical-validation principles that already apply across
medical device types.
 2400 Ellis Road
Durham, NC 27703
iqvia.com

8. How might the two-axis risk framework described in Section IV be considered within the
competency-based approach described above to help determine the level of evidence needed for a
premarket submission?

IQVIA Response
We believe FDA’s Technical Performance Assessment of Quantitative Imaging in Radiological Device
Premarket Submissions provides a useful model for evaluating GenAI-enabled devices because it
establishes a structured framework, uses existing terminology, and includes practical examples. 5 We
recommend that FDA develop comparable guidance for GenAI-enabled devices using the same established
terminology wherever applicable. Within a competency-based framework, each study type should serve a
clearly defined objective: benchmarking is particularly well suited to characterizing device outputs and
activities under controlled conditions, whereas clinical performance studies and real-world evidence may be
used to evaluate the effects and consequences of inaccurate outputs under the proposed conditions of use.
However, the framework should not evaluate risk alone. As discussed under Question 1, we recommend
adding anticipated benefit as an additional axis so that the evidence generated through each study type
supports a balanced benefit-risk determination. This is particularly important because the benefits of
automation, including improvements in workflow efficiency and the performance of routine tasks, may be
central to the device’s intended use and adoption. Accordingly, the framework should assess both the
potential consequences of inaccurate outputs and the anticipated benefits of accurate performance within the
intended workflow.

9. Would a benchmarking structure such as the one described above be likely to provide adequate
evidence of clinical knowledge, analytic capabilities, safety behavior, communication, and
generalizability to support a reasonable assurance of safety and effectiveness? Are there elements
that are missing, redundant, or inappropriately categorized? Are there externally developed
standards that could be leveraged?

IQVIA Response
We generally agree that existing transparency considerations for non-GenAI devices remain applicable to
GenAI-enabled devices. We recommend that FDA avoid creating a separate GenAI-specific terminology set
except where existing terminology does not adequately describe a genuinely novel characteristic. Using
established terminology will minimize confusion and promote consistency across current and future
U.S. Food and Drug Administration. Technical Performance Assessment of Quantitative Imaging in Radiological
Device Premarket Submissions, Guidance for Industry and Food and Drug Administration Staff, June 2022. Accessed
10/14/2026 at https://www.fda.gov/regulatory-information/search-fda-guidance-documents/technical-performanceassessment-quantitative-imaging-radiological-device-premarket-submissions.
 2400 Ellis Road
Durham, NC 27703
iqvia.com

technological characteristics. As previously noted, the framework should also incorporate anticipated benefit
as an integral component of the overall benefit-risk assessment.

Benchmarking may provide a predictable, consistent, and repeatable approach to evaluating GenAI-enabled
devices, particularly if supported by consensus standards developed with FDA involvement. A sufficiently
standardized benchmarking framework may also support broader use of predetermined change control plans
or evaluation by qualified third parties, including through existing third-party review mechanisms or other
appropriately certified entities. At the same time, FDA should recognize the inherent limitations of
benchmarking data generated under controlled conditions, which may not fully represent device performance
in real-world use. Generalizability and subgroup performance should therefore be evaluated through a
proportionate, lifecycle-based approach that combines appropriate premarket evidence with real-world
evidence and postmarket surveillance, rather than treating those considerations as categorical barriers to
development. This approach would allow device performance to be assessed across broader populations
and actual conditions of use while maintaining a predictable and repeatable premarket review framework.

10. CDRH recognizes that publicly available benchmarking assets may be subject to data
contamination, saturation, and limited real-world representativeness. How should a sponsor
establish that performance on a given benchmark predicts safe and effective real-world behavior for
the device’s intended use? What evidence should support the construct validity of a benchmark used
to gate device evaluation, and what role should sponsor-developed benchmarks play given potential
concerns around independence and optimization to the test?

IQVIA Response
We recognize that published literature identifies numerous potential sources of bias in medical-device
performance; however, it is neither technically feasible nor necessary to eliminate every theoretical source of
bias. We recommend that FDA adopt a reasonable, risk-based approach that focuses premarket
benchmarking on known, detectable, and clinically meaningful sources of bias. Where a potential bias cannot
be reliably distinguished from background variability or measurement noise, additional optimization or testing
may increase development burdens without producing a corresponding public-health benefit. The variables
selected for premarket analysis, (including demographic and health equity variables), should be justified by
the device’s intended use, clinical application, expected sources of performance variability, and potential
consequences of differential performance. Other factors relevant primarily to broader generalizability may be
more appropriately assessed through real-world evidence and postmarket monitoring.

Because the clinically important variables, datasets, endpoints, and appropriate benchmarking methods will
depend heavily on the intended use, sponsors will necessarily play a significant role in developing devicespecific evaluation strategies. We therefore recommend that FDA establish high-level guidance and
 2400 Ellis Road
Durham, NC 27703
iqvia.com

standards describing a consistent process for identifying clinically important variables, selecting appropriate
measures, and evaluating meaningful differences, while preserving sufficient flexibility for sponsors to tailor
that process to each device. The framework should also recognize emerging approaches that optimize
device performance for site-specific populations or disease prevalence and should permit reasonable
flexibility concerning dataset independence when strict separation would frustrate clinically appropriate
optimization without improving the ability to detect bias. Baseline evidence should be established through
appropriate bench and premarket testing, with broader questions of generalizability and performance across
diverse populations evaluated through proportionate postmarket surveillance and real-world evidence.

Finally, these expectations should be applied consistently across review teams and in accordance with
benefit-risk and least-burdensome principles. Bias assessments should reflect realistic conditions of use and
should not penalize a device merely for reproducing limitations inherent in the clinical application, available
data, or current standard of care unless those limitations create an unacceptable risk within the device’s
intended use. Requiring increasingly complex testing when it cannot meaningfully detect or mitigate bias may
increase development and healthcare costs without improving device safety or effectiveness and may itself
have unintended consequences for access to care and health equity. A standardized but flexible framework
would better focus resources on measurable, clinically consequential differences while supporting innovation,
consistency, and FDA’s broader public-health objectives.

11. CDRH is considering that clinical confirmation for a GenAI-enabled device might not require a
prospective clinical study in every case, and has described above a range of approaches of
increasing rigor and patient exposure. How might a sponsor select and justify a confirmation
approach tailored to a device’s intended use and proportionate to the device’s risk profile? Are there
device types or risk profiles for which one or more of these approaches would be insufficient or
inappropriate? How might the anticipated distribution of real-world inputs be taken into
consideration? Are there other methods of clinical confirmation that might help inform the evaluation
of GenAI-enabled devices?

IQVIA Response
We do not believe these considerations are unique to GenAI. Premarket evidence for AI-enabled and other
medical devices already attempts to approximate real-world use, but inherent gaps remain because actual
clinical conditions can be simulated only to a limited extent. We recommend that FDA apply existing riskbased principles by focusing the evidence requirements on clinically important variables, the device’s
intended use, the degree of automation and user involvement, the anticipated benefits, and the difference
between risks before and after mitigation. Although GenAI may produce broader outputs and enable more
extensive user interactions than some existing AI technologies, appropriate guardrails and labeling can
 2400 Ellis Road
Durham, NC 27703
iqvia.com

constrain the device to its intended use and may result in a risk profile comparable to other AI-enabled
devices.

The type and level of evidence should therefore correspond to the device’s residual risk after mitigation
rather than to theoretical risks associated with GenAI as a technological category. Software as a medical
device also has practical limits on the severity of risk it can independently create, particularly when it does
not directly control treatment or perform an irreversible action. FDA’s classification of certain AI-enabled
device types through the De Novo pathway reflects the applicability of general and special controls for novel
technologies, although this approach should be articulated more clearly in written guidance. Consistent with
existing human factors principles, FDA should give the benefits of automation equal consideration alongside
potential risks when determining the appropriate evidence requirements. Automation can reduce burdens
associated with routine tasks, but its overall benefit depends on the degree of user involvement, the intended
workflow, and whether the applicable mitigations preserve safe and effective use. A balanced framework
should therefore evaluate the device’s intended benefits and possibilities together with its residual risks,
rather than allowing hypothetical worst-case scenarios to determine the evidentiary burden.

12. How should sponsors achieve statistically meaningful performance measurement for GenAIenabled devices? Where synthetically generated inputs supplement real patient data, how should
sponsors account for differences between the synthetic and real-world distributions when estimating
performance, and under what conditions, if any, is it appropriate to combine benchmarking evidence
and clinical confirmation evidence to support a single performance estimate?

IQVIA Response
We do not believe these considerations are unique to GenAI, as they apply across the spectrum of existing
medical device technologies. Premarket evaluation necessarily relies on a body of evidence that predicts
how a device will perform in the U.S. population, and no single study, endpoint, or output can fully replicate
actual conditions of use. We therefore recommend that FDA continue to evaluate the totality of the evidence,
including real world evidence, rather than focus on developing a single, theoretically perfect test. The nature
and extent of premarket evidence should be guided by the device’s intended use, level of automation,
degree of user involvement, risk profile, anticipated benefits, and available data concerning clinically
important variables. Depending on the device’s risk profile, premarket evaluation may appropriately place
greater emphasis on safety, while lower-risk questions involving variables not demonstrated to be clinically
important may be addressed through proportionate postmarket monitoring. For GenAI-enabled devices, the
breadth of potential outputs and interactions may warrant additional guardrails, labeling, or workflow
constraints; however, these characteristics do not necessarily create risks that are fundamentally different
from those of other AI-enabled devices. It is also unclear whether testing an isolated output would
meaningfully improve the transparency or demonstrate the utility of a multifunction device when its outputs
 2400 Ellis Road
Durham, NC 27703
iqvia.com

operate together within an intended workflow. Accordingly, FDA should apply a flexible, risk-based
framework that evaluates the device holistically, considers residual risk after mitigation, and gives the
potential clinical and operational benefits of automation weight comparable to that given to theoretical risks.

13. For which clinical domains, device functions, or subpopulations is synthetic data particularly
well-suited, or particularly inadequate, as a supplement to real-world evidence? What safeguards
would mitigate the risk that synthetic data generated by models of the same class as the device
under evaluation reproduces the very performance gaps the evaluation is intended to detect,
particularly for underrepresented subgroups?

IQVIA Response
We do not believe this consideration is unique to GenAI. To some extent, it is already addressed by ASME
V&V 40 and FDA’s guidance on the use of modeling and simulation in medical-device development and
regulatory submissions. We recommend that FDA build on these existing frameworks rather than establish a
separate GenAI-specific approach. Synthetic data should be acceptable when it provides a sufficiently
realistic, credible, and fit-for-purpose representation of the conditions necessary to evaluate device
performance. For example, synthetic images may provide valuable evidence for the performance evaluation
and validation of certain radiology-related software as a medical device.

The appropriate use of synthetic data, including the need for subgroup analyses, will often depend on
whether a particular subgroup or variable is clinically important to the device’s intended use and
performance. We therefore recommend that FDA provide clearer guidance to industry and review staff on
how to determine which variables are clinically important and how that determination should inform study
design, dataset composition, subgroup analysis, and performance evaluation for all medical devices, not only
GenAI-enabled devices. Premarket testing should focus on known and clinically meaningful sources of
variability, while broader questions concerning generalizability across populations and clinical settings may
be evaluated through a proportionate combination of real-world evidence and postmarket monitoring. This
technology-neutral approach would preserve the principles reflected in ASME V&V 40 and FDA’s modeling
and simulation guidance, accommodate appropriate uses of synthetic data, and direct testing resources
toward variables that could meaningfully affect device safety, effectiveness, or benefit-risk.

14. For open-ended device outputs, how should performance comparators and acceptance criteria be
selected? When a panel of qualified clinicians serves as the comparator, how should the applicable
standard (for example, the standard of care versus the performance of a median clinician in practice)
be defined and justified? Should generalist or specialist physicians be used as a performance
standard? When should human-AI team performance, rather than the device operating alone, serve
as the basis for evaluation?
 2400 Ellis Road
Durham, NC 27703
iqvia.com

IQVIA Response
We do not believe that open-ended device functions should be evaluated solely through a single statistical
endpoint or by attempting to measure the diagnostic accuracy of every possible output. Physicians
performing comparable open-ended tasks are not evaluated on the basis of error-free performance across
every possible scenario, and even highly qualified physicians make mistakes. Similarly, exhaustive testing of
every potential output from an open-ended device function may be neither technically tractable nor clinically
meaningful. We recommend that FDA consider a more holistic, competency-based evaluation framework
that uses multiple clinically relevant measures, representative scenarios, and benchmarks reflecting how
physicians or other appropriate comparators are evaluated when performing similar tasks. This approach
could produce a performance profile or “report card” across relevant competencies rather than reducing
performance to a single aggregate endpoint.

The evaluation should consider the nature and distribution of errors, the circumstances in which the device
performs better or worse than an appropriate human comparator, and the clinical consequences of those
differences. Controlled statistical analyses may contribute to the totality of evidence, but they may not fully
represent the device’s performance in actual use. Clinical outcomes, real-world performance, and
longitudinal postmarket surveillance may therefore be particularly important for characterizing open-ended
functions over time. The benefit-risk assessment should also recognize that the benefits of these devices
may extend beyond diagnostic accuracy to include automation, efficiency, timeliness, access, and reductions
in workflow burden. Clear intended-use statements and labeling should define the scope of permissible
outputs, applicable guardrails, intended users, and reasonable user expectations so that the device’s
broader capabilities remain appropriately bounded and understood.

15. Are there ways in which performance might be assessed relative to the care, technology, or
course of action likely to occur in the absence of the device, rather than to the comparators
described in this section? What approaches might be used to identify and justify a comparator such
as unaided clinical judgment, delayed specialist review, or no intervention?

IQVIA Response
We believe the question is framed too narrowly if it assumes that diagnostic accuracy is the principal benefit
of the device. The assessment should also consider the broader clinical and operational benefits of
automation, including improved decision-making, workflow efficiency, patient management, and timeliness of
care. Indeed, delayed specialist review represents a potential risk associated with the absence of automation
and should be considered alongside the risks introduced by the device. The proposed comparison may also
be inappropriate where the device performs better than the relevant human comparator or automates a task
that physicians already routinely delegate to other qualified personnel. In those circumstances, requiring
direct physician performance or involvement as the benchmark may not reflect the existing standard of care,
the actual clinical workflow, or the device’s intended benefit. We therefore recommend evaluating the device
within its intended clinical workflow and selecting comparators that reflect how the relevant function is
 2400 Ellis Road
Durham, NC 27703
iqvia.com

currently performed in practice. A balanced benefit-risk assessment should consider diagnostic performance
together with the consequences of inaccurate outputs, the benefits of automation, and the risks and lost
benefits associated with delayed, inefficient, unavailable, or unnecessarily physician-dependent review.

16. Should independent third parties be involved in some or all aspects of a competency-based
approach, including device benchmarking and clinical confirmation? If so, in what ways might
qualified, independent third-party participation contribute to this approach, and what qualifications
and independence criteria should apply? Are there aspects of the assessment for which third-party
involvement would be impractical or inadvisable? What safeguards or program design features
would be critical to prevent third-party participation from limiting competition or preventing
innovation?

IQVIA Response
We agree that qualified third parties could perform benchmarking and clinical-confirmation activities.
However, the effectiveness of such an approach will depend on whether FDA establishes a framework that
provides meaningful authority to, and demonstrates appropriate trust in, organizations that satisfy defined
standards for independence, technical competence, clinical expertise, and regulatory experience. FDA’s
experience with the existing 510(k) Third-Party Review Program 6 raises concerns because, in practice, the
program has had a limited role in the review of AI-enabled devices. If third-party participation in GenAI
benchmarking and clinical confirmation is subject to similar restrictions, the program is unlikely to provide
meaningful value, increase review capacity, or support innovation.

Excessive manufacturer involvement may introduce bias when a sponsor’s detailed knowledge of the
device’s design, expected outputs, and anticipated performance can influence study execution or
interpretation. Independent evaluation may help address this concern, but independence alone is insufficient.
Third-party organizations must also possess appropriate medical-device, regulatory, technical, and clinical
expertise. FDA should establish transparent eligibility criteria, competency requirements, conflict-of-interest
controls, and certification and oversight mechanisms. At the same time, FDA should avoid imposing
restrictions that prevent qualified third parties from exercising the judgment for which they were certified. A
program managed through certification but constrained by continuing institutional reluctance to rely on thirdparty conclusions would add process without delivering meaningful regulatory value.
FDA. 501(k) Third Party Review Program (webpage, content current as of 11/20/2024). Accessed on 10/14/2026 at
https://www.fda.gov/medical-devices/premarket-submissions-selecting-and-preparing-correct-submission/510kthird-party-review-program.
 2400 Ellis Road
Durham, NC 27703
iqvia.com

We therefore recommend that FDA reform the existing Third-Party Review Program to permit appropriately
qualified organizations to review AI-enabled devices and align that program with any future policy governing
third-party benchmarking and clinical confirmation. FDA should remain responsible for establishing
standards, certifying participating organizations, monitoring performance, and taking corrective action when
necessary. However, the framework must also allow FDA to rely appropriately on the work of qualified third
parties. Without that trust, third-party participation may merely add another layer to the review process, limit
competition, and discourage innovation rather than improve regulatory efficiency.

17. CDRH is exploring whether a competency-based approach could be applied to devices that
incorporate a variety of underlying model architectures, such as multimodal vision-language models
and generative or predictive world models. Are there aspects of the described approach that might
be ineffective or inapplicable to these devices? What additional or distinct considerations might need
to be addressed?

IQVIA Response
We believe the most significant challenge is that the technology is evolving more rapidly than regulatory
frameworks can be developed and updated. As model architectures, capabilities, and development
processes change, new uncertainties will arise, and evidence generated for current GenAI technologies may
not remain applicable to future technological characteristics. We therefore recommend that FDA treat any
framework developed today as a flexible, high-level foundation that can evolve with the technology rather
than as a fixed set of architecture-specific requirements.

Appropriate guardrails and oversight should apply not only to third parties, but also throughout FDA’s review
process. FDA’s existing regulatory framework already recognizes that technological changes may raise new
questions concerning safety and effectiveness, and the need for this oversight will continue. Premarket
testing should establish an appropriate baseline for the technology under review, while real-world evidence
and ongoing postmarket surveillance should help characterize performance under actual conditions of use
and identify issues associated with emerging capabilities. This lifecycle approach would preserve necessary
FDA oversight while allowing evidentiary expectations, third-party competencies, and applicable controls to
evolve as the technology advances.

Section VI: Postmarket Monitoring for GenAI-Enabled Devices

18. CDRH is considering whether it may be appropriate to accept greater premarket uncertainty
regarding a GenAI-enabled device’s benefit-risk profile through greater reliance on postmarket
monitoring. Under what conditions might such an approach be appropriate, and what characteristics
of a monitoring program would need to be in place to justify reduced premarket evidence? Are there
device types or risk profiles for which this approach would not be appropriate?
 2400 Ellis Road
Durham, NC 27703
iqvia.com

IQVIA Response
Fundamental to ensuring the effectiveness and safety of a medical device is to appropriately identify the
clinically meaningful risks for the intended use and to weigh the feasibility on assessing them before and
after regulatory approval. Thus, IQVIA supports postmarket monitoring as an appropriate supplement to
premarket evidence when the following conditions are met: (1) baseline safety has been demonstrated for
primary endpoints with a reasonably representative dataset; (2) a monitoring plan is prespecified using
sound statistical methods that address multiplicity concerns by focusing on pre-selected clinically important
variables and not a blanket monitoring approach including all possible variables that may not relate to an
individual device; (3) the monitoring design is cable of actually detecting the changes it is designed to
monitor; and (4) there is a clear plan for action when a signal appears.

As discussed above in our third general comment, we recommend that FDA establish a transparent process
for determining when a variable is clinically important. The accompanying guidance should address when
subgroup data are sufficiently robust to support a regulatory conclusion, statistical power, multiplicity,
measurement variability, detectable effect size, and the distinction between an actual performance difference
and a false-positive signal. This would be similar to the principles described in CDER’s guidance addressing
multiplicity, which discusses when subgroup findings can support reliable conclusions for both sponsors and
review staff. 7 Absent statistically sound criteria, the mere existence of uncertainty regarding an
underrepresented or unpowered subgroup should not, by itself, establish a meaningful safety signal or justify
extensive monitoring obligations. FDA should also consider whether the required monitoring is capable of
detecting the effect in question, because a monitoring program cannot meaningfully mitigate a potential bias
that cannot be reliably measured or distinguished from background variation.
U.S. Food and Drug Administration. Multiple Endpoints in Clinical Trials Guidance for Industry, October 2022.
Accessed on 10/14/2026 at https://www.fda.gov/regulatory-information/search-fda-guidance-documents/multipleendpoints-clinical-trials. This guidance pertaining to drugs and biologics discusses factors related to the assessment of
uncertainty that should be considered in premarket evaluations for medical devices as well. See page 5: “Even when a
single outcome variable is being assessed, if multiple facets of that outcome are analyzed (e.g., multiple dose groups,
multiple time points, or multiple subject subgroups based on demographic or other characteristics) and if any one of
the analyses is used to conclude that the drug has been shown to produce a beneficial effect, the multiplicity of
analyses may cause inflation of the Type I error rate.” Often in requests for additional information in premarket review
FDA uses the term “uncertainty” in the context of unpowered subgroups within statistically powered studies that may
not provide enough information to infer how that subgroup performs compared to a primary performance endpoint.
This is done to help ensure devices generalize across patient populations and hardware related input variables. Often,
when an unpowered subgroup performs poorly when compared to overall performance, manufacturers collect more
data and add it to the study to eliminate this “uncertainty”.
 2400 Ellis Road
Durham, NC 27703
iqvia.com

19. Please comment on the potential approaches to postmarket performance evaluation, including
periodic re-benchmarking, sample-based clinician review, and performance degradation monitoring.
What additional approaches should CDRH consider, and how should the cadence and triggering
events for reassessment be determined?

IQVIA Response
We support periodic re-benchmarking, particularly where the sponsor uses the same fixed reference test set
each time so results are comparable over time and recommend that Good Machine Learning Practice
(GMLP) Guiding Principles be followed to ensure datasets are periodically updated to include new data.
Sample-based clinician review is useful but resource-intensive, and the sample size should be scaled to the
device's risk. We also support performance degradation monitoring, using established statistical process
control methods as discussed below. 8 We recommend that FDA build on the process described in our prior
comment for identifying clinically important variables. Postmarket monitoring should be limited to variables
that are clinically important to the device’s intended use and should be designed to provide a reasonable
likelihood of detecting meaningful changes in performance. Periodic real-world performance monitoring and
adverse-event reporting may provide important assurance, but only when conducted within a scientifically
sound framework and directed toward questions that can meaningfully inform device safety, effectiveness,
and public health.

FDA could draw on well-established quality and process-monitoring methods used in other industries, such
as sampling theory and statistical process control. Many industries have repeatedly addressed analogous
monitoring challenges, and FDA should draw on these established methods rather than apply premarket
testing concepts directly to postmarket monitoring without considering their suitability for longitudinal process
assessment. An inappropriately designed monitoring program may generate false-positive signals, require
repeated investigations that provide little useful information, and substantially increase the cost of deploying
and maintaining a medical device without producing a corresponding public-health benefit.

Accordingly, the scope, methodology, sampling plan, alert thresholds, and cadence for reassessment should
be grounded in accepted scientific and quality principles. These elements should reflect the clinical
importance of the variable, expected sources of variation, the magnitude and detectability of a meaningful
change, the device’s intended use and risk profile, and the action that could reasonably be taken in response
to a signal. For GenAI-enabled devices, useful monitoring signals may include performance on a fixed
U.S Food and Drug Administration. Good Machine Learning Practice for Medical Device Development: Guiding
Principles (Content current as of 12/19/2025). Accessed on 10/14/2026 at https://www.fda.gov/medicaldevices/artificial-intelligence-enabled-medical-devices/good-machine-learning-practice-medical-device-developmentguiding-principles.
 2400 Ellis Road
Durham, NC 27703
iqvia.com

reference test set over time, the rate at which the device refuses or escalates requests, the rate at which
clinicians override or edit outputs, and complaint trends. Reassessment should be triggered by defined
events, such as a version change in the underlying foundation model or changes to prompts, retrieval
sources, or guardrails—each of which the discussion paper identifies as a way GenAI-enabled devices
change. Postmarket monitoring should not be required merely to collect additional data or recreate
premarket testing on a recurring basis; it should be designed to detect clinically meaningful changes and
provide actionable assurance regarding continued safety and effectiveness. This approach would better align
postmarket monitoring with least-burdensome principles while supporting an actual and measurable publichealth benefit.

20. Please comment on whether the proposed approaches to postmarket monitoring can be
facilitated by machine-based supervisory agents. What considerations, including the evaluation and
reliability of the supervisory agent itself, should CDRH take into account for such an approach?

IQVIA Response
We agree that appropriately validated machine-based supervisory agents can facilitate postmarket
monitoring of deployed GenAI-enabled devices, for example by continuously reviewing outputs, flagging outof-scope or anomalous responses, and tracking performance against a fixed reference set. Supervisory
agents used by a manufacturer to monitor its own device are best treated as quality-system tools, validated
under the manufacturer's quality system consistent with FDA's Computer Software Assurance approach,
rather than as separately regulated devices.

Validated AI tools developed in accordance to GMLP may offer meaningful benefits by processing larger
volumes of information more rapidly and consistently than may be feasible through human review alone.
Such tools could support the review of performance data, comparison with precedent devices, assessment
against clinical guidelines, and identification of relevant benchmarks. FDA should therefore evaluate these
tools based on their actual role in the assessment workflow rather than presume that use of AI to evaluate
another AI system necessarily presents heightened risk. Appropriate validation, labeling, transparency, and
guardrails should define the scope of the tool’s outputs, the qualifications of intended users, the degree of
permissible reliance, and the circumstances requiring independent human review. A key consideration is that
a supervisory agent built on the same class of model as the device may share its blind spots. Reasonable
safeguards include using a different model or method where feasible, periodic human spot-checks of a
sample of the agent's determinations and monitoring the agent itself for drift. This approach would allow
validated AI tools to improve the consistency, scalability, and efficiency of regulatory assessments while
maintaining controls proportionate to their intended use and potential effect on patient care.
 2400 Ellis Road
Durham, NC 27703
iqvia.com

21. What roles might clinicians, healthcare institutions, professional societies, standards-setting
bodies, and other stakeholders appropriately play in postmarket monitoring, and how can these roles
be structured without diffusing manufacturer accountability?

IQVIA Response
Clinicians can report issues and contribute to sample-based reviews; health systems can run local
performance checks, building on the AI governance committees many already have; professional societies
can define what good output looks like in their specialty; and standards bodies can develop shared
monitoring methods so results are comparable across devices and sites. The manufacturer should remain
accountable for the device's postmarket performance. Other stakeholders contribute signals and clinical
context, with their roles defined through labeling, contracts, and the manufacturer's quality system.
IQVIA recommends that the respective roles, qualifications, interactions, and oversight of FDA, third parties,
manufacturers, clinicians, standards-development organizations, and other relevant entities such as EMR
vendors be a central topic at any future public meeting on this subject. We emphasize that FDA’s
responsibilities should also not be diffused and should play a central role in establishing the standards for
how these entities qualify, operate, interact, and contribute to the regulatory process. This should include
balancing AI-driven evaluation with evidence from real-world clinical workflows and the experience and
judgment of qualified clinicians. AI may improve the consistency, scalability, and efficiency of evaluation,
while clinicians provide the context necessary to understand whether device performance supports safe and
effective use in practice. The framework should leverage the strengths of both rather than rely exclusively on
either automated evaluation or human judgment.

22. CDRH envisions that a manufacturer’s premarket competency-based assessment might serve as
a baseline against which post-deployment modifications could be re-evaluated. How might the extent
of re-benchmarking or other evidence be scaled to the nature and expected impact of a given
modification? For example, are there categories of change that might not significantly affect safety or
effectiveness of a GenAI-enabled device, or might be appropriately managed within a sponsor’s
quality management system versus requiring FDA premarket review and authorization before
implementation? Are there categories of changes that might be appropriate for inclusion in a PCCP?

IQVIA Response
We believe FDA’s existing guidance, Deciding When to Submit a 510(k) for a Software Change to an
Existing Device, already addresses many of these considerations. 9 However, the guidance was last updated
U.S. Food and Drug Administration. Deciding When to Submit a 510(k) for a Software Change to an Existing Device
Guidance for Industry and Food and Drug Administration Staff, October 2017. Accessed on 10/14/2026 at
https://www.fda.gov/regulatory-information/search-fda-guidance-documents/deciding-when-submit-510k-softwarechange-existing-device.
 2400 Ellis Road
Durham, NC 27703
iqvia.com

in 2017 and does not provide AI- or GenAI-specific considerations or examples. New intended uses and
evolving technological characteristics create a need for additional clarity. We recommend that FDA update
the existing framework rather than develop a separate GenAI-specific approach, incorporating examples that
address both AI- and GenAI-enabled device changes.

In practice, review staff often consider changes to a device’s core algorithmic pipeline to require a new
510(k), although this expectation is not clearly documented in guidance. Conversely, changes outside the
algorithmic pipeline that do not affect the device’s inputs, outputs, intended use, or safety and effectiveness
may often be documented through a letter to file. FDA should clearly define and consistently apply the
factors that distinguish changes requiring a new submission from those that may be documented internally or
implemented under an authorized change protocol. This would improve regulatory predictability, reduce
unnecessary FDA involvement, and support timely innovation while maintaining appropriate oversight.

Predetermined change control plans may provide an effective pathway for managing planned modifications
to AI- and GenAI-enabled devices without requiring a separate submission for each change. We recommend
that FDA update its Predetermined Change Control Plan (PCCP) policies and existing AI guidance together
with the software-change guidance to establish a coherent framework for determining which modifications
may be managed through a PCCP, which may be documented through a letter to file, and which require a
new premarket submission. The framework should include AI- and GenAI-specific examples involving
changes to model architecture, the core algorithmic pipeline, inputs and outputs, performance, intended use,
labeling, and workflow integration. A coordinated update would reduce unnecessary and time-consuming
review activity, improve consistency across review teams, and permit efficient device improvements while
preserving FDA involvement for changes that could materially affect safety or effectiveness.

23. How might PCCP concepts or other change-control approaches be adapted for GenAI-enabled
devices when the nature or scope of future modifications cannot be fully prespecified?

IQVIA Response
We have observed that FDA’s implementation of predetermined change control plans has increasingly
required a high degree of prespecification, resulting in a notable reduction in flexibility and reliance on
manufacturers’ established quality systems and competencies. PCCPs evolved from policy concepts
explored through the Software Precertification Pilot Program, which considered whether demonstrated
organizational excellence could support more streamlined oversight of software modifications. As trust and
flexibility are progressively replaced by increasingly detailed prespecification requirements, the value of
PCCPs diminishes for both industry and FDA.
 2400 Ellis Road
Durham, NC 27703
iqvia.com

For manufacturers, the value proposition may become limited when the review process adds extensive detail
and constraints to a PCCP, reducing its ability to accommodate reasonably foreseeable changes. For FDA,
the review of highly detailed PCCPs can require substantial resources and may undermine the original
efficiency objective of allowing certain lower-risk changes to proceed without repetitive review. This concern
is particularly important when FDA’s review resources are constrained. A PCCP process intended to reduce
unnecessary regulatory involvement should not itself become so resource-intensive and prescriptive that it
provides little advantage over reviewing each modification separately.

We recommend that FDA establish a clearer, risk-based balance between necessary and discretionary
prespecification when implementing PCCPs for both narrow AI and GenAI-enabled devices. The amount and
specificity of information required should correspond to the device’s intended use, the nature of the proposed
modifications, the potential effects on safety and effectiveness, and the strength of the manufacturer’s
validation and change-management processes. FDA should provide review staff with clearer criteria and
examples distinguishing essential pre-specifications necessary to ensure safety and effectiveness from
details that are useful but not necessary for authorization of the PCCP. Such guidance would improve
consistency across review teams, promote broader adoption, and reduce unnecessary regulatory burden.

PCCPs were initially presented as a mechanism that could support iterative modification of AI-enabled
devices, including potentially self-updating functions. That potential has not yet been fully realized in practice.
Before extending the PCCP framework to the broader and more dynamic changes anticipated for GenAI,
FDA should evaluate the current implementation for narrow AI and identify where excessive prespecification
has reduced flexibility without producing a corresponding safety benefit. A more proportionate PCCP
framework would preserve appropriate FDA oversight while allowing qualified manufacturers to implement
validated, lower-risk changes efficiently and predictably. This balance is necessary if PCCPs are to reduce
FDA workload, support timely innovation, and provide meaningful value to both FDA and industry.

24. For devices built on third-party foundation models, changes to the underlying model may be
initiated by the third-party model developer rather than the device manufacturer. How can a
manufacturer detect, evaluate, and respond to such changes in a timely manner? What
mechanisms—for example, contractual, technical, or through a PCCP—could provide reasonable
assurance that third-party developer-initiated changes do not compromise the safety or effectiveness
of the device?

IQVIA Response
We believe most foundation models would remain locked as components of the device configuration
reviewed and authorized by FDA. A predetermined change control plan (PCCP) would be the appropriate
mechanism for permitting defined updates to, or substitutions of, an underlying foundation model without
 2400 Ellis Road
Durham, NC 27703
iqvia.com

requiring a new submission for each change. Under such a PCCP, the foundation model could be managed
similarly to software of unknown provenance or off-the-shelf software, with documented processes governing
its selection, qualification, integration, validation, monitoring, and change control. The device should be
evaluated as a whole in its final configuration, and the medical-device manufacturer should remain
responsible for demonstrating that the finished device is safe and effective following any change to the
underlying foundation model.

The burden should generally remain with the medical-device manufacturer rather than the foundation-model
provider when the provider is not itself offering the foundation model for a medical-device intended use and
is therefore outside the scope of FDA’s device oversight. The manufacturer would need to establish the
necessary relationship with the foundation-model provider and obtain sufficient information to evaluate
changes and maintain compliance. This relationship would likely need to be driven by the manufacturer
rather than FDA; however, FDA can facilitate effective implementation by clearly describing the information
and controls manufacturers are expected to obtain or establish.
We recommend that FDA update its software, AI, and PCCP guidance to include examples involving
foundation models. These examples should address when a model must remain locked, when modifications
may be managed under a PCCP, how manufacturers should assess changes to an underlying model, and
when a change requires additional FDA involvement. The examples should also address circumstances in
which a manufacturer lacks full visibility into a third-party model’s architecture, training data, or development
process. Clear expectations would help manufacturers structure relationships with foundation-model
vendors, determine what information is necessary to maintain the device’s validated state, and apply FDA’s
established change-management framework consistently.

Section VII: Other Topics

25. Would voluntary Foundation Model MAFs be practical for foundation model developers to provide
and to keep current, and what content might they include? Given that participation would be
voluntary and that model developers may have limited incentive to disclose safety-relevant
information, what would make such a program sufficiently useful for premarket review? Are there
alternative mechanisms CDRH should consider for obtaining information about underlying
foundation models?

IQVIA Response
We agree that voluntary Medical Device Master Files (MAFs) could provide a useful mechanism for
foundation-model vendors to make relevant technical information available to FDA while protecting
proprietary information. However, the practical limitation is whether a voluntary mechanism would provide
sufficient incentive for vendors to participate. Foundation-model vendors may be reluctant to engage with
 2400 Ellis Road
Durham, NC 27703
iqvia.com

FDA or assume obligations associated with medical-device oversight, particularly when their models are
general-purpose products not offered for a medical-device intended use.

We therefore recommend that FDA focus first on clarifying the information and controls expected of medicaldevice manufacturers that incorporate third-party foundation models. Clear guidance would help
manufacturers communicate those expectations to foundation-model vendors and negotiate appropriate
access to information concerning model specifications, known limitations, update practices, version control,
performance characteristics, and change notification. Examples involving voluntary MAFs would be helpful,
but FDA should not assume that vendors will participate merely because such a pathway is available.

This challenge may be particularly significant when a foundation model is incorporated during research or
early-stage development, before the medical-device manufacturer’s design controls fully apply and when the
foundation-model vendor may not operate under comparable controls. FDA guidance should therefore
address how manufacturers may qualify and evaluate foundation models introduced at different stages of
development, including circumstances in which complete information about the model’s architecture, training,
or development processes is unavailable. Ultimately, responsibility for the finished medical device should
remain with the medical-device manufacturer, but FDA should establish clear, risk-based expectations that
enable manufacturers to obtain the information and contractual commitments necessary to satisfy that
responsibility.

26. Are there additional considerations that inform the premarket and postmarket evaluation of
agentic GenAI-enabled devices, beyond those applicable to non-agentic GenAI-enabled devices?
How should the elevated risk associated with autonomous multi-step action, tool use, and reduced
opportunity for human review be reflected in acceptance criteria and oversight?

IQVIA Response
While we acknowledge human oversight may be reduced, humans should remain more than nominally
present in the workflow so as not to compromise patient safety. Based on potential risk, human reviewers
should receive proportionate amounts of information and time to assess that information. Human reviewers
should have the authority to intervene and stop, modify, or reverse proposed actions. Thus, requirements,
design specifications, and both verification and validation efforts should reflect that appropriate focus is
placed on the performance of the human-AI team not only for diagnostic tasks but also for multistep actions
surrounding a task that may create different risks than the task alone. 10
U.S Food and Drug Administration. Good Machine Learning Practice for Medical Device Development: Guiding
Principles (Content current as of 12/19/2025). Accessed on 10/14/2026 at https://www.fda.gov/medicaldevices/artificial-intelligence-enabled-medical-devices/good-machine-learning-practice-medical-device-developmentguiding-principles.
 2400 Ellis Road
Durham, NC 27703
iqvia.com

Overall, we believe the appropriate level of oversight should depend on both the risk associated with the
automated function and the benefits the automation is intended to provide. As discussed above, the clinical
and operational benefits of automation may outweigh its reasonably foreseeable risks in many
circumstances. A framework that focuses disproportionately on theoretical risks could prevent patients,
caregivers, and healthcare professionals from realizing meaningful benefits, including improved access,
efficiency, consistency, and timeliness of care.

We recommend that FDA more rigorously characterize the real-world severity and probability of the identified
risks before establishing regulatory requirements. Internal analyses, academic literature, and simulated
studies may identify plausible hazards, but they do not necessarily establish the frequency, magnitude, or
clinical consequences of those hazards under actual conditions of use. More comprehensive empirical
evidence is needed to validate FDA’s underlying risk hypotheses and determine whether proposed controls
would produce a measurable public-health benefit. Regulatory requirements should be proportionate to
demonstrated or reasonably estimable risk, account for the effectiveness of available mitigations, and
consider the consequences of delaying or limiting beneficial automation.

FDA should also consider the broader effects of its policies on innovation, patient access, and the
competitiveness of the United States in developing and deploying these technologies. Overly restrictive
requirements based primarily on theoretical or insufficiently characterized risks may delay beneficial
products, increase development and healthcare costs, and place the United States at a competitive
disadvantage without a corresponding improvement in safety. We therefore recommend that FDA give
anticipated benefits equivalent consideration in its regulatory decision-making and require stronger real-world
evidence regarding the severity and probability of hypothesized risks before imposing substantial regulatory
burdens. A balanced approach should evaluate not only the risks introduced by automation, but also the
risks and lost benefits associated with delaying, restricting, or foregoing automation.

Thank you for considering IQVIA’s feedback on this important discussion paper. We applaud the FDA’s
leadership in navigating the challenging intersection of AI and healthcare and share the Agency’s vision for a
technology-neutral, intended-use-based, least-burdensome framework that considers residual risk and
automation benefits. If you have any questions, please do not hesitate to contact me at acadotte@mcra.com.
We are happy to share our ideas and contribute to the public discourse about the regulation and use of
GenAI-enabled medical devices.

Best regards,

Alex J. Cadotte
Alex J. Cadotte, PhD
 2400 Ellis Road
Durham, NC 27703
iqvia.com

VP, Head of Digital Health, AI, and Radiological Regulatory Afffairs
MCRA, An IQVIA Business
cc.
• Glenn Steigman, Senior VP, Regulatory Affairs, MCRA, An IQVIA Business
• Kelley Kennedy, VP, IQVIA Medtech
• Daniel Campion, Director, Public Policy, Legal Department, IQVIA