This is the full text of the comment as filed. The FDA posts filings to its public docket as it reviews them. The questions are quoted from the FDA’s discussion paper.
Framework for our responses
These comments draw on our experience developing and prospectively evaluating patient-facing clinical AI through FDA’s pre-submission process. We offer four principles and responses to the discussion questions where our experience may be useful. The principles connect issues that arise across risk assessment, premarket evidence, postmarket monitoring, and modifications to authorized devices.
RecovryAI has participated in nine FDA pre-submissions. Developing a device that can make defined clinical decisions independently during post-operative recovery has required us to confront clinical reference standards, prospective evaluation, challenging test cases, model changes, and ongoing performance monitoring.
Four principles
Principle 1Distinguish levels of clinical autonomy by the decisions a device makes independently and the limits of its validated clinical competency.
Clinical AI can create new clinical capacity when appropriately validated devices independently perform defined clinical work. For these comments, we distinguish three levels of clinical autonomy:
Clinician-directed AI: AI analyzes clinical information or recommends clinical actions, but a licensed clinician reviews and approves consequential clinical decisions before they are communicated or carried out.
Protocol-bounded autonomous AI: AI independently makes and communicates clinical decisions within a defined and validated clinical function, without contemporaneous clinician approval. It escalates situations outside its demonstrated competency or when clinically meaningful uncertainty remains unresolved.
Broadly autonomous clinical AI: AI independently exercises clinical judgment across a wider range of conditions, presentations, and clinical decisions without relying on a predefined protocol for each situation. Its clinical authority requires correspondingly broader evidence.
For example, a protocol-bounded post-operative recovery device may assess symptoms, provide recovery guidance, and determine when to direct the patient to a clinician. It need not diagnose or manage unrelated medical conditions. Regulatory evaluation is best grounded in the specific clinical decisions the finished device is authorized to make, rather than the general capabilities of its foundation model.
Principle 2Match the strength and type of evidence to the clinical decisions the device makes independently and the potential harm of an incorrect decision.
We see FDA’s two-axis framework as a useful basis for determining how much clinical evidence is needed before a device is authorized. Prospective clinical studies, retrospective evidence, clinician-adjudicated reference standards, validated benchmarks, and independent evaluation each contribute different kinds of assurance. As a device exercises greater independent clinical judgment and the consequences of error increase, we expect stronger premarket evidence to carry greater weight. For lower-risk functions, reliable postmarket monitoring may support accepting more uncertainty at authorization. We encourage FDA to provide practical examples of how these evidentiary choices could vary across its proposed framework, while allowing manufacturers to justify alternative methods appropriate to their intended use.
These approaches are not a fixed hierarchy. A well-designed retrospective study may provide stronger evidence for a particular clinical claim than a poorly designed prospective study, and independently adjudicated reference data do not necessarily require a separate testing organization. Postmarket monitoring remains relevant throughout the framework, but it cannot substitute for demonstrating competency before consequential autonomous decisions reach patients.
Principle 3Evaluate the finished medical device, including the controls that govern its clinical decisions.
A medical-device manufacturer may use a foundation model developed by a third party without controlling its weights, training data, architecture, or future updates. The manufacturer remains responsible for validating the complete clinical system, including controls that define which decisions the device may make, test those decisions against clinical evidence, keep decisions within validated limits, preserve records of consequential decisions, and monitor performance over time. The appropriate focus of regulatory evaluation is the
finished medical device and its demonstrated clinical performance for its intended use, rather than the underlying foundation model in isolation.
Principle 4Consider whether the clinical information available to the device is sufficient to support its decisions.
Two devices may exercise similar clinical autonomy and pose similar consequences of error while making decisions from substantially different information. A patient’s description of swelling provides different evidence than a photograph, video, or longitudinal record with relevant laboratory results and wearable measurements. We do not propose a literal third axis in FDA’s framework. Rather, the clinical relevance, reliability, detail, and variety of the information available should inform what decision-making competency can be demonstrated. More data alone does not establish that a clinical decision is valid.
Responses to the FDA’s discussion questions
Does the two-axis risk framework, organized around device activity and the consequence of relying on an incorrect output, appropriately capture the dimensions most relevant to the risk of a GenAI-enabled software function? If there are additional dimensions—such as the reversibility of a resulting action, the availability of downstream safeguards, the time pressure of the deployment setting, or the traceability of the output (i.e., to primary source materials)—that should be represented in a risk framework, please describe and provide examples of how they should be represented.
FDA’s two axes provide a useful starting point: greater independent clinical decision-making and greater potential harm call for stronger evidence and safeguards. Other factors can change the consequences of an incorrect decision. For example, an incorrect recommendation that is reviewed by a clinician before reaching a patient has a different risk than the same recommendation delivered directly to a patient. An error that can be corrected before treatment has different consequences than one that causes a missed emergency referral. Human review is one possible safeguard, but need not remain a permanent requirement for clinical decisions a device has been validated to make independently.
CDRH seeks input on how to account for the spectrum of GenAI-enabled informational functions that vary in the degree to which they direct a user to a particular action (i.e., between “non-directive” and “action-directing”). What characteristics of an output—such as its wording, specificity, personalization, or context—could be considered as modifiers of the risk associated with an informational function, after accounting for the device’s overall functionality and intended use? What additional information would provide manufacturers with sufficient clarity and predictability around risk assessment for informational functions while recognizing that directiveness may exist along a continuum rather than as a binary distinction?
The practical question is what clinical action a device encourages or directs, and how likely a patient or clinician is to act on it. “Contact your surgeon today about increasing calf swelling” is more directive than general information about possible causes of swelling, regardless of whether either sentence uses the word “recommend.” Examples that compare actual clinical directions, patient circumstances, and consequences of following an incorrect direction would help manufacturers assess this continuum.
CDRH seeks input on whether and when a GenAI-enabled function that results in delivery of clinical information to patients, as opposed to HCPs, could present different or higher risks, while also recognizing the potential benefits associated with improved patient empowerment, engagement, and access to clinical information. What device characteristics, output features, or safeguards might mitigate risks that could arise when a user lacks the domain knowledge to independently evaluate an output, without unnecessarily underestimating patient capability?
Patient-facing delivery alone does not warrant a higher risk tier. The relevant considerations are the consequence of an incorrect output, the degree of independent clinical authority, and the safeguards around the function. Bounded intended use, limits on the clinical actions the device may recommend or direct, validated escalation behavior, and evidence appropriate to the consequence of error can support patient-facing autonomous functions without underestimating patient capability. Human-factors evaluation can also establish whether patients with different levels of health literacy understand the device’s clinical directions and know when to seek additional care.
CDRH seeks input on whether and how the distinction between generalist and specialist physicians might inform the assessment of risk for HCP-facing GenAI-enabled functions. Under what circumstances, if any, might risk be affected when an HCP who lacks the relevant clinical specialist knowledge receives information that falls within a specialist area of practice? What device characteristics or safeguards might mitigate such risks?
For HCP-facing functions, the intended user’s expertise can affect whether an error in specialist information will be recognized and corrected. A generalist receiving a specialist treatment recommendation may require different safeguards from a specialist assessing the same recommendation. Testing with the intended users and specialist review of the clinical content can help establish those safeguards.
For multi-turn conversational GenAI-enabled devices that may migrate from providing “non-directive” information to “action-directing” information over the course of an exchange, how should risk be assessed across realistic conversational trajectories? How could the intended use of such a device be characterized when its behavior is emergent across a conversation?
Evaluate multi-turn AI-patient conversations as complete exchanges, including how the device asks follow-up questions, responds to changing symptoms, and moves from information gathering to clinical recommendations or directions. The intended use needs to describe the clinical decisions the device may make during the conversation, not only its individual responses. Complete, time-stamped AI-patient conversations, including patient inputs, follow-up questions, device responses, clinical dispositions, and relevant system versions, should be preserved with appropriate privacy protections. These records allow consequential clinical decisions to be reconstructed and investigated if harm occurs.
For GenAI-enabled care escalation functions, CDRH is considering how the evaluation may account for both under-escalation and over-escalation. How could manufacturers characterize and weigh these two directions of error, given that they may not be commensurable and that acceptable trade-offs may vary by clinical context?
Under-escalation and over-escalation warrant separate performance measures and acceptance criteria matched to clinical context. A missed emergency referral can cause immediate harm, while unnecessary referrals impose burdens on patients and clinicians and erode the capacity benefit the device is intended to provide. Aggregate accuracy should not conceal either kind of error.
Is the competency-based approach described above, i.e., device benchmarking followed by clinical confirmation, a useful and appropriate framework for evaluating GenAI-enabled devices?
The competency-based approach is useful, but benchmarking and clinical confirmation are strongest when connected to the same clinical reference rather than treated as unrelated phases. For consequential autonomous functions, competency is best demonstrated against qualified human clinical judgment in conditions that reflect actual use.
How might the two-axis risk framework described in Section IV be considered within the competency-based approach described above to help determine the level of evidence needed for a premarket submission?
The two-axis framework can guide evidence requirements: greater independent clinical authority and greater potential harm call for stronger evidence before deployment. A practical mapping from risk position to expected evidence would give manufacturers greater predictability while preserving case-specific judgment.
Would a benchmarking structure such as the one described above be likely to provide adequate evidence of clinical knowledge, analytic capabilities, safety behavior, communication, and generalizability to support a reasonable assurance of safety and effectiveness? Are there elements that are missing, redundant, or inappropriately categorized? Are there externally developed standards that could be leveraged?
The proposed benchmarking structure is directionally useful, but clinical competency must include the ability to stay within validated scope and escalate when appropriate. A human-established reference standard can identify both clear cases and genuine clinical ambiguity. Human-factors methods provide a more appropriate evaluation of communication and user comprehension than a benchmark score alone.
CDRH recognizes that publicly available benchmarking assets may be subject to data contamination, saturation, and limited real-world representativeness. How should a sponsor establish that performance on a given benchmark predicts safe and effective real-world behavior for the device’s intended use? What evidence should support the construct validity of a benchmark used to gate device evaluation, and what role should sponsor-developed benchmarks play given potential concerns around independence and optimization to the test?
A benchmark is most useful when shown to predict clinical performance for the device’s intended use. Sponsor-developed benchmarks can be appropriate if the cases, clinician reference standards, adjudication methods, and versioning are documented and independently assessed as appropriate. For clinical decisions with the greatest potential harm, clinician-adjudicated reference cases provide the strongest basis for the performance standard, including the handling of serious missed conditions. A high aggregate benchmark score can conceal errors with serious clinical consequences; such errors warrant separate reporting.
CDRH is considering that clinical confirmation for a GenAI-enabled device might not require a prospective clinical study in every case, and has described above a range of approaches of increasing rigor and patient exposure. How might a sponsor select and justify a confirmation approach tailored to a device’s intended use and proportionate to the device’s risk profile? Are there device types or risk profiles for which one or more of these approaches would be insufficient or inappropriate? How might the anticipated distribution of real-world inputs be taken into consideration? Are there other methods of clinical confirmation that might help inform the evaluation of GenAI-enabled devices?
Clinical confirmation can be tailored to the clinical decisions a device makes and the consequences of error. Prospective evaluation against qualified clinical judgment is especially valuable when a patient-facing device independently asks follow-up questions and gives consequential clinical directions: the conversation itself determines what information the device receives. Retrospective records may not capture those changing questions, responses, and decisions, though they can provide useful complementary evidence.
How should sponsors achieve statistically meaningful performance measurement for GenAI-enabled devices? Where synthetically generated inputs supplement real patient data, how should sponsors account for differences between the synthetic and real-world distributions when estimating performance, and under what conditions, if any, is it appropriate to combine benchmarking evidence and clinical confirmation evidence to support a single performance estimate?
Statistically meaningful evaluation requires prespecified clinical performance measures, acceptance criteria, and estimates of uncertainty appropriate to the intended use. Clinically consequential errors, including failures to recognize emergency conditions, warrant separate analysis so that strong aggregate performance does not obscure serious failures. Separate reporting of benchmarking and clinical-confirmation results is appropriate when the tests use different patient populations or study designs. Testing can distinguish routine presentations from rare, complex, or high-consequence clinical cases. It can also evaluate how patients express the same clinical concern differently, including differences in literacy, language, communication style, incomplete descriptions, and contradictory information. These clinical and communication variations can test whether the system reaches appropriate decisions consistently. Pooling results into a single performance estimate is appropriate only when the sponsor can justify how the different datasets represent expected clinical use.
For which clinical domains, device functions, or subpopulations is synthetic data particularly well-suited, or particularly inadequate, as a supplement to real-world evidence? What safeguards would mitigate the risk that synthetic data generated by models of the same class as the device under evaluation reproduces the very performance gaps the evaluation is intended to detect, particularly for underrepresented subgroups?
Synthetic data can be particularly useful for testing rare, complex, or high-consequence clinical situations that are inadequately represented in prospective studies. Our preferred approach is to begin with real patient cases that have been independently adjudicated by qualified clinicians, then systematically introduce clinical and communication variations. These may include additional complications, comorbidities, incomplete information, differences in health literacy, and variations in how patients describe their symptoms.
Modified cases and their expected clinical decisions should undergo independent clinical review, particularly when a modification could change the appropriate clinical response. Clinician-created cases may supplement this approach where real examples are unavailable, but require additional scrutiny for clinical plausibility and potential bias. Synthetic cases generated by AI should not rely on that same AI to establish the correctness of their expected clinical decisions.
For open-ended device outputs, how should performance comparators and acceptance criteria be selected? When a panel of qualified clinicians serves as the comparator, how should the applicable standard (for example, the standard of care versus the performance of a median clinician in practice) be defined and justified? Should generalist or specialist physicians be used as a performance standard? When should human-AI team performance, rather than the device operating alone, serve as the basis for evaluation?
The reference standard should match the clinical claim and intended use. Depending on the function, credible comparators may include independent clinician adjudication, validated clinical datasets or instruments, and real-world outcomes. When clinicians adjudicate, their qualifications should match the clinical task, and disagreement among reviewers should be reported rather than concealed in a single binary label. Acceptance criteria should account separately for errors with serious consequences. Human–AI team performance is the appropriate comparator when clinician review is part of the intended use; independently acting devices need evidence of their own clinical performance.
Are there ways in which performance might be assessed relative to the care, technology, or course of action likely to occur in the absence of the device, rather than to the comparators described in this section? What approaches might be used to identify and justify a comparator such as unaided clinical judgment, delayed specialist review, or no intervention?
Alternative comparators can be useful, but the comparator needs to match the claim. Retrospective or counterfactual comparison to usual care may support utilization or workflow claims; concordance with qualified clinical judgment supports claims about the appropriateness of the device’s clinical decision. A utilization comparator alone cannot establish the clinical appropriateness of a triage decision.
Should independent third parties be involved in some or all aspects of a competency-based approach, including device benchmarking and clinical confirmation? If so, in what ways might qualified, independent third-party participation contribute to this approach, and what qualifications and independence criteria should apply? Are there aspects of the assessment for which third-party involvement would be impractical or inadvisable? What safeguards or program design features would be critical to prevent third-party participation from limiting competition or preventing innovation?
Independent third-party participation can improve confidence in evidence when qualified reviewers independently select or adjudicate clinical cases and evaluate performance. Credible independence depends on relevant clinical qualifications, control of the evaluation process, and disclosure of conflicts of interest. A requirement to use a single third-party certification body or testing provider may limit competition and innovation.
CDRH is exploring whether a competency-based approach could be applied to devices that incorporate a variety of underlying model architectures, such as multimodal vision-language models and generative or predictive world models. Are there aspects of the described approach that might be ineffective or inapplicable to these devices? What additional or distinct considerations might need to be addressed?
A common competency-based approach can apply across model architectures, with evidence tailored to the clinical information each device actually uses. Changing text entry to voice, while retaining the same clinical content and decision function, may chiefly require testing transcription reliability and human factors. Adding photographs or video to evaluate swelling or mobility introduces new clinical information and calls for validation of that assessment and its effect on the final decision. The relevant question is whether a new architecture or input changes the clinical function or creates new failure modes, not the model label.
CDRH is considering whether it may be appropriate to accept greater premarket uncertainty regarding a GenAI-enabled device’s benefit-risk profile through greater reliance on postmarket monitoring. Under what conditions might such an approach be appropriate, and what characteristics of a monitoring program would need to be in place to justify reduced premarket evidence? Are there device types or risk profiles for which this approach would not be appropriate?
FDA’s two-axis framework offers a useful basis for determining acceptable premarket uncertainty. Devices with limited independent clinical decision-making and a low potential for harm may reasonably rely more on postmarket evidence, provided problems can be detected and corrected promptly. As a device makes more consequential clinical decisions independently, stronger evidence is needed before deployment. Postmarket monitoring cannot adequately substitute for premarket demonstration of competency when an incorrect decision could cause immediate or irreversible harm, such as failure to direct a patient with emergency symptoms to urgent care.
Please comment on the potential approaches to postmarket performance evaluation, including periodic re-benchmarking, sample-based clinician review, and performance degradation monitoring. What additional approaches should CDRH consider, and how should the cadence and triggering events for reassessment be determined?
The premarket competency assessment offers a useful baseline for postmarket evaluation. A fixed, versioned clinical reference set can support repeatable testing, alongside periodic clinician review and monitoring of consequential errors. An evaluation mechanism that is separate from the model making the clinical decisions can detect changes without allowing the device simply to grade itself; this need not involve an outside institution. Reassessment can be periodic and triggered by changes in the model, prompts, clinical controls, or observed performance.
Please comment on whether the proposed approaches to postmarket monitoring can be facilitated by machine-based supervisory agents. What considerations, including the evaluation and reliability of the supervisory agent itself, should CDRH take into account for such an approach?
Machine-based supervision can support postmarket monitoring if the supervisory method has itself been tested against an independent clinical reference and its limitations are known. Where feasible, a deterministic or separately validated monitoring process reduces the risk that the monitor repeats the device’s own errors. Changes to the supervisor also require controlled evaluation. Clinically significant exceptions should remain reconstructable and available for human review.
What roles might clinicians, healthcare institutions, professional societies, standards-setting bodies, and other stakeholders appropriately play in postmarket monitoring, and how can these roles be structured without diffusing manufacturer accountability?
Clinicians and healthcare institutions can identify and report adverse events and recurring patterns of error. Professional societies and standards organizations can help develop common definitions, reference cases, and evaluation methods. Independent clinical or technical review of serious incidents may also identify lessons useful across manufacturers. These contributions would complement, not transfer, the manufacturer’s responsibility for investigating, reporting, correcting, and monitoring its own device.
CDRH envisions that a manufacturer’s premarket competency-based assessment might serve as a baseline against which post-deployment modifications could be re-evaluated. How might the extent of re-benchmarking or other evidence be scaled to the nature and expected impact of a given modification? For example, are there categories of change that might not significantly affect safety or effectiveness of a GenAI-enabled device, or might be appropriately managed within a sponsor’s quality management system versus requiring FDA premarket review and authorization before implementation? Are there categories of changes that might be appropriate for inclusion in a PCCP?
The evidence required for a modification can follow its likely effect on validated clinical decisions and safety. Changes to clinical reasoning, escalation criteria, supported conditions, or patient populations may call for additional clinical testing, or implementation under an authorized PCCP where covered. A change in foundation model need not automatically require a new clinical study if testing demonstrates that the device continues to meet its established clinical acceptance criteria. Changes such as navigation, screen layout, or presentation of existing clinical guidance may be addressed through targeted human-factors testing and quality-system controls when they do not change the clinical function. A PCCP can establish methods and acceptance criteria for defined categories of future modifications.
How might PCCP concepts or other change-control approaches be adapted for GenAI-enabled devices when the nature or scope of future modifications cannot be fully prespecified?
PCCPs for GenAI can prespecify the boundaries, methods, evidence, and acceptance criteria for classes of foreseeable change even when the exact future implementation cannot be named. The plan can define what clinical behavior may change, how continued competency will be demonstrated, and what triggers escalation beyond the PCCP. It can also permit predefined expansion within a demonstrated competency framework when the sponsor meets prespecified evidence and acceptance criteria, rather than requiring every future implementation to be known in advance.
For devices built on third-party foundation models, changes to the underlying model may be initiated by the third-party model developer rather than the device manufacturer. How can a manufacturer detect, evaluate, and respond to such changes in a timely manner? What mechanisms—for example, contractual, technical, or through a PCCP—could provide reasonable assurance that third-party developer-initiated changes do not compromise the safety or effectiveness of the device?
Manufacturers relying on third-party foundation models need technical methods for detecting and evaluating changes, beyond contractual notification. Versioned clinical reference datasets, repeated regression testing, and independent monitoring of the complete medical-device system can help establish whether a model change has affected validated clinical performance.
Because earlier model versions may no longer be available, and individual failures may not be reliably reproducible, the response to a model change should focus on demonstrating continued clinical competency rather than identifying and reversing every underlying cause. When an available replacement model cannot demonstrate acceptable clinical performance, manufacturers need a defined contingency for maintaining patient safety, including transitioning clinical decisions to appropriate human oversight until competency can be re-established.
Would voluntary Foundation Model MAFs be practical for foundation model developers to provide and to keep current, and what content might they include? Given that participation would be voluntary and that model developers may have limited incentive to disclose safety-relevant information, what would make such a program sufficiently useful for premarket review? Are there alternative mechanisms CDRH should consider for obtaining information about underlying foundation models?
Voluntary Foundation Model Master Files could reduce duplicative review by providing version-specific information, known limitations, safety-relevant evaluations, and change notifications. Responsibility for device safety and effectiveness would remain with the medical-device manufacturer. Participation should remain genuinely voluntary: the absence of a Master File ought not create a procedural delay or substantive disadvantage for a sponsor that can independently establish the safety and effectiveness of its finished device. A predictable alternative pathway would preserve access to qualified models whose developers do not participate.
Are there additional considerations that inform the premarket and postmarket evaluation of agentic GenAI-enabled devices, beyond those applicable to non-agentic GenAI-enabled devices? How should the elevated risk associated with autonomous multi-step action, tool use, and reduced opportunity for human review be reflected in acceptance criteria and oversight?
The term ‘agentic’ alone is not a sufficient basis for determining regulatory requirements. Evaluation can focus on what the device can do without human approval, including whether it can use external tools, contact patients or clinicians, initiate orders, or control another medical device. Evaluation needs to cover the full sequence of actions, the clinical consequences of error, whether an action can be reversed, and where intervention is possible. Higher-consequence actions may require human approval unless the manufacturer demonstrates that the device can perform those specific actions safely and independently.
Regulatory status: The Virtual Care Assistant is an investigational device, limited to investigational use under U.S. law. It has received Breakthrough Device Designation from the FDA and is not authorized for commercial distribution. Nothing on this page predicts the outcome of any regulatory submission or any FDA action on the discussion paper.