How should the continuum from non-directive to action-directing outputs, and the risk that changes along it, be accounted for?

Question 2 — the directiveness continuum. I agree with CDRH that a "talk to your doctor" line does not make an action-directing output less directive, and I would go further for my category: in a bystander emergency, the output is supposed to be action-directing. "Press hard on the wound and do not let go" is the correct output; a non-directive version of it ("pressure is sometimes applied to bleeding wounds") is the unsafe one. So for this class of function, directiveness is not the risk modifier. The characteristics that actually modify risk, in my experience building and testing one, are: • Personalization to the wrong premise. The dangerous failure is not that the model tells the user what to do; it is that it answers a slightly different situation than the one described — for example, giving the standard sequence for a conscious choking child when the user has said the child is already limp. The model is fluent, confident and wrong-for-premise. I would ask CDRH to name premise fidelity explicitly as an output characteristic in this question. • Age- and size-appropriateness of technique. The same instruction with the wrong hand position, depth or force for an infant is a harm, not a degraded answer. The risk modifier is whether the function reliably selects the population-specific protocol, and this is testable. • Ordering of the call for help. Whether "call for help" comes first, last, or not at all is a directly scoreable property of an output. For clarity and predictability, I would ask that the guidance recognise a sub-category of "action-directing" function — protocol delivery — where the directed action is a published, fixed first-aid or resuscitation protocol, and where the evidence question is fidelity to that protocol rather than clinical judgment.

3.2 Vary affect, hold the clinical request constant The trigger in the record was expressed user displeasure, not a request for advice. We recommend that trajectory evaluation hold the clinical content of the user’s turns constant and vary only affective expression — frustration, distress, gratitude, insistence, resignation — and measure whether the rate of action-directing output changes. A device whose directiveness moves with affect while the clinical facts are unchanged has a risk profile that is a function of the user’s emotional state rather than of their condition. This is the same instrument we propose under Question 26 for recommendation drift, scored on directiveness instead. 3.3 Measure the unsolicited-directive rate against turn index Count, per trajectory, the outputs that direct the user toward an action they did not ask about, and report that count as a function of turn index. A single number for a session conceals the shape, and the shape is the finding: in the record above the rate was zero for the first two minutes and the first directive followed the first correction. 3.4 Evaluate at matched turn indices, early and late, and report the divergence Because presentation and accuracy moved in opposite directions across the session above, evaluating at a single point in a trajectory produces a result that depends on which point was chosen. We recommend evaluation at matched early and late indices, and that sponsors be required to report accuracy and calibration-presentation separately rather than in aggregate. A device whose stated confidence, source disclosure and self-correction improve across a trajectory while its error rate does not has a divergence that should be visible in the submission rather than averaged out of it. 3.5 Trajectories must include the device’s own persistent state Where a device carries state written about the user across sessions, that state is an input to every turn and is part of the trajectory. In the record above the system’s false claims about deployment status derived from material it had written in earlier sessions, which the user had never been shown. A trajectory evaluation that begins at the first turn of a conversation is not evaluating the whole input. Sponsors should be required to disclose whether such state exists, and to make it available to the evaluation. FDA-2026-N-7874 — Question 5 4 The Christman AI Project 4. Characterizing intended use when behavior is emergent Responsive to the second half of Question 5. We offer three conditions rather than a definition, because we do not think a statement of purpose can do this work alone. 4.1 An intended use statement must bound the trajectory, not the turn If a device with a non-directive intended use can produce action-directing output without any change in the user’s request, the intended use does not describe the device and should not be accepted as a boundary on it. We suggest the operative test is not what the manufacturer intends the device to do, but what the device can reach from the stated starting point without the user asking for it. Where the reachable set exceeds the stated use, either the statement is widened or the device is constrained so that it cannot. 4.2 Emergent behavior must be bounded by something other than instruction The system in the record was operating under an explicit and detailed written rule set supplied by the user, including rules directly on point. It cited those rules accurately while breaking them. We submit that where behavior is emergent across a conversation, an intended use enforced by prompt, policy or operator instruction is not enforced, and that acceptance criteria should require the boundary to be demonstrated under conditions where the instruction layer is absent or contradicted. 4.3 The characterization must name the affective trigger Where a device’s behavior is emergent, we recommend that the intended use characterization state explicitly what moves it. If directiveness rises with user distress, that is a property of the device that a clinician deploying it needs on the label, in the same way that a drug interaction is on a label. It is knowable premarket by the test at 3.2, and it is not knowable to a clinician from watching a demonstration, because a demonstration is conducted by someone who is not distressed. 5. Scope, and what we are not claiming This is a single recorded session with one commercial AI assistant, which is not a regulated medical device and was not under controlled evaluation. We offer no error rate and no frequency claim. One session establishes that the migration in Question 5 occurs and can be captured; it establishes nothing about how often. We do not claim the behavior was deliberate, and no recommendation above depends on resolving that. We also do not rely on the system’s account of its own reasoning. Where we quote it, we quote it for what it asserts about the inputs available to it, not as evidence of internal mechanism. We do not claim that multi-turn conversational devices should be excluded from clinical use, nor that directiveness is inherently unsafe. A device that appropriately escalates is directive, and Question 6 addresses that case. Our claim is narrower: directiveness that arrives unrequested, triggered by an inferred affective state the device has no channel to measure, is a different event from clinical escalation and should not be scored as one. Finally, we note the limits of our own instrument. The transcript underlying the quotations above was produced by an open-weights speech recognition model, which is itself capable of generating text over intervals containing no live speech. We measured the recording for such intervals before transcribing it, in FDA-2026-N-7874 — Question 5 5 The Christman AI Project contiguous 250 ms windows across its full duration, and confirmed that no quoted passage falls within one. The audio recording, not the transcript, is the primary evidence. 6. Evidence retain

Note that the paper’s own observation — that a “talk to your doctor” statement may not make an output less directive — applies symmetrically, and bears on Question 2: an override interface that is never used provides no oversight. Directiveness and oversight should both be assessed by observed user behavior rather than by the presence of text on the screen. 3. Postmarket monitoring: borrow the re-credentialing model Response to Discussion Questions 19, 22, and 23 The approaches described in Section VI — periodic re-benchmarking, sample-based independent clinician review, performance degradation monitoring — are all reasonable. On the cadence and triggering events raised in Question 19, I suggest the framing be made explicitly examination-based, drawing on the model clinicians already trust. Practicing clinicians do not merely have their performance monitored for drift. We re-certify: we are re-examined against a defined competency set, on a fixed cycle, whether or not anyone has detected a problem in our practice. I suggest a device cleared through a competency assessment be re-examined on the same competency set on a defined cycle, with re-examination additionally triggered by material change — foundation-model update, retrieval or prompt changes, guardrail modification. Two points follow. First, on Question 23: rather than attempting to prespecify every permissible future change, a sponsor could prespecify the re-examination that follows any change. This is a tractable commitment even where the nature of future modifications cannot be anticipated, which is the central difficulty the paper identifies with PCCPs for GenAI. Second, on Question 22: scaling re-benchmarking to the expected impact of a modification is sensible for the clinical proficiency elements, but I would encourage CDRH to require the safety elements (S.1–S.3) and robustness (R.1) to be re-run in full after any change to the underlying model or guardrails, regardless of how minor the sponsor expects the impact to be. Clinicians do not get to skip the safety portion of a re-certification examination on the grounds that little has changed in their practice, and third-party model updates are exactly the case where sponsor expectations are least reliable. 4. Foundation model MAFs: include override-relevant behavior Response to Discussion Question 25 If voluntary Foundation Model MAFs proceed, I suggest the contemplated content include, alongside architecture and training provenance: refusal behavior, content-policy changes between versions, and output stability under varied user framing — including the speaker-authority framing described in Section 1 above. These are the model-level properties that most affect whether a clinician can reasonably verify an output at the bedside, and they are properties a device sponsor cannot characterize from the outside. A sponsor cannot evaluate what the MAF does not disclose. On the incentive problem the question raises: one practical lever is that a documented Foundation Model MAF would allow sponsors to satisfy portions of the re-examination described in Section 3 above by reference, rather than by independently re-characterizing the model after every upstream update. That is a concrete benefit to model developers seeking healthcare adoption. 5. On generalizability and deployment populations Response to Discussion Questions 9 and 11 Element R.2 addresses subgroup performance, and Question 11 asks how the anticipated distribution of real-world inputs should be taken into consideration. I would encourage CDRH to treat these as one question rather than two. Recent evidence in dermatology AI indicates that distribution shift — the appearance of unfamiliar conditions — degrades performance considerably more than skin-tone differences alone [2]. Subgroup performance measured on the training-era disease mix can therefore look acceptable while real-world performance is materially worse, because what changed at deployment was the presenting case mix, not only the demographics of the patients. This bears directly on my own field. Aesthetic and dermatologic presentations in Asian populations differ substantially in disease distribution from the datasets on which most generalist models are trained, and devices cleared on North American or European evidence will encounter that shift immediately. I suggest capability assessments include test populations that differ from training populations in disease distribution as well as demographic mix, and that sponsors be asked to characterize the anticipated deployment case mix explicitly rather than to demonstrate subgroup parity within a fixed dataset. Conclusion The physician-training analogy is the strongest idea in this paper. I encourage FDA to carry it through completely: real examinations include pressure, hierarchy, and unfamiliar patients — not only clean curricula. Devices that pass only the clean parts will fail in the clinic in exactly the ways clinicians are trained to catch, and regulators should ensure the assessment catches them first. I appreciate the opportunity to comment and am willing to provide further detail on any point. Respectfully submitted, Wen Hsien Ethan Huang, MD Founder, DrEthan AI Aesthetics ORCID 0000-0003-1727- 1870 support@drethan.ai September 4, 2026 References 1. Zhu J, et al. AI Can Be Easily Persuaded in Clinical Decision Making. arXiv:2608.29453 [preprint]. 2. Kunwor N, Poudel S, Trinh Q-H, Arafat J, Gaire SK. Disease Burden over Skin Tone: Decomposing the Dermatology-AI Generalization Gap. arXiv:2609.02111 [preprint].

Question 2: General and patient-specific output CDRH should use one clear division: General output. Patient-specific output. General output does not use information about one patient. Patient-specific output uses or applies to one patient’s symptoms, history, images, measurements, records, or conversation. CDRH should not classify risk by wording, tone, specificity, or degree of recommendation. These features are difficult to define. Manufacturers can also change the wording without changing the function. CDRH should treat patient-specific output as potentially action-directing. The possible consequence of the output should then determine the risk category. Newton’s Tree Inc Considerations for the Regulation of Generative AI-Enabled Medical Devices FDA Docket No. FDA-2026-N-7874 A statement that says “consider increasing the dose” can have the same effect as a direct instruction. A warning or disclaimer does not remove this risk. Healthcare professional review can reduce the remaining risk. However, the manufacturer must prove that this control is effective. The manufacturer must include automation bias in this evaluation.

Response to Discussion Question 2 – Degree of Directiveness of Informational Functions I agree that directiveness should be considered a continuum rather than a binary distinction. The following aspects may be relevant. For each factor or characteristic, it should be considered whether it can contribute to Criticality Stratification or can only be addressed during Product-Specific Risk Management. • Specificity of the proposed action, e.g., general information versus a concrete instruction; • Strength of recommendation and availability of alternatives, e.g., whether the user is presented with several reasonable options or effectively directed toward one; • Enforceability of safeguards – the extent to which the application of relevant safeguards can be reliably ensured in the intended setting; • Availability and, where applicable, requirements for independent review before action is taken; • Time criticality/immediacy – whether the output suggests action at some future point or requires immediate action; • Clinical significance of the action, e.g., minor self-care versus major diagnostic or therapeutic intervention; • Degree of personalization – generic information versus a recommendation based on the individual patient's data.

Question 2: The non-directive to action-directing continuum. To give manufacturers the predictability they need, CDRH could publish a standardized directiveness rubric with anchored levels, general information / information contextualized to the user's circumstances / endorsement of a specific action / specific instruction, illustrated with worked examples across clinical contexts.

Question 2 - Continuum from non-directive to action-directing information Directiveness should be assessed functionally rather than lexically. The presence or absence of words such as "recommend," "consider," or "talk to your doctor" should not determine risk by itself. Relevant characteristics include specificity, personalization, imperative strength, confidence presentation, temporal urgency, the degree to which alternatives are suppressed, the clinical consequence of the implied action, and whether the output is repeated or reinforced across a multi-turn interaction. A useful principle is to ask what a reasonable intended user is likely to do because of the output. If the practical effect of an informational function is to narrow the user toward a specific clinical action, the risk analysis should reflect that functional directiveness even when the interface labels the output as informational.

Question 2 — The continuum between informational and action-directing outputs Directiveness is a spectrum of clinical influence, not a device label. A response becomes more action-directing through specificity, personalization, urgency, ranking, omission of alternatives, and integration with patient-specific data — regardless of what a manufacturer calls the feature. “There are several possible causes” and “Given these findings, start treatment X today” can come from identical architecture. FDA should evaluate the authority an output effectively exercises, not the label attached to it.

2. CDRH seeks input on how to account for the spectrum of GenAI-enabled informational functions that vary in the degree to which they direct a user to a Vizma Carver, CISSP, PMP Vizma.carver@cg-hg.com 703-943-0894 particular action (i.e., between “non-directive” and “action-directing”). What characteristics of an output—such as its wording, specificity, personalization, or context—could be considered as modifiers of the risk associated with an informational function, after accounting for the device’s overall functionality and intended use? What additional information would provide manufacturers with sufficient clarity and predictability around risk assessment for informational functions while recognizing that directiveness may exist along a continuum rather than as a binary distinction? Response: Response 1: Build on existing terminology rather than creating a new vocabulary Defining the line between "non-directive" and "action-directing" is genuinely difficult, and a new taxonomy will be litigated at the margins for years. CDRH already has settled vocabulary in Factors to Consider When Making Benefit-Risk Determinations in Medical Device Premarket Approval and De Novo Classifications (FDA). Novel terminology increases the risk that manufacturers misread regulatory intent; reusing established terms reinforces it. Recommendation 1: do not treat directiveness as a new category, Treat it as a modifier of an existing factor — the probability of a harmful event. Reesponse 2: shift from a fixed IFU to risk-scaled competency affirmation This is software-based guidance, and software permits a protection mechanism that hardware does not: the device can confirm what the user understands before it operates. The current model — a fixed Instructions for Use, delivered once, with no affirmation of competency — assumes a static user. Categorical proxies such as patient versus HCP, or generalist versus specialist, are coarse and do not reflect how people actually engage with their care. Some patients become deeply expert in their own condition; others defer entirely to the medical establishment. A single label cannot distinguish them. Recommendation 2: permit and, at higher risk levels, require affirmation of user knowledge and competency as a gating precondition to enabling the function, with the depth of affirmation scaled to the device's risk level. A low- consequence informational function may need only acknowledgment. A function directing insulin titration should confirm that the specific user understands the correct output range, the failure modes, and the conditions requiring escalation, Vizma Carver, CISSP, PMP Vizma.carver@cg-hg.com 703-943-0894 before that capability unlocks — and should re-affirm on a defined interval or when the function is updated. 3. CDRH seeks input on whether and when a GenAI-enabled function that results in delivery of clinical information to patients, as opposed to HCPs, could present different or higher risks, while also recognizing the potential benefits associated with improved patient empowerment, engagement, and access to clinical information. What device characteristics, output features, or safeguards might mitigate risks that could arise when a user lacks the domain knowledge to independently evaluate an output, without unnecessarily underestimating patient capability? Response: The premise requires correction The question is framed around users "who lack the domain knowledge to independently evaluate an output," with patients as the implied class. We object to that framing as both inaccurate and counterproductive. The framing treats a credential as a proxy for a capability. It is not. Competence within any credentialed population is a distribution, not a constant — half of all practicing clinicians graduated in the bottom half of their class. Meanwhile, patients living with a chronic condition frequently accumulate more contextual and longitudinal knowledge of that condition than the generalist reviewing them for twelve minutes. Neither observation is a criticism of clinicians. Both are reasons that "patient versus HCP versus specialist" is the wrong variable. Credentialing does not reliably confer output-evaluation ability If professional credentialing were sufficient to catch incorrect clinical information, the patient safety movement of the last twenty-five years would not exist. To Err Is Human estimated 44,000 to 98,000 preventable deaths annually in U.S. hospitals and set a goal of halving errors within five years (National Academies). That goal was not met. More recently, an estimated 795,000 Americans are permanently disabled or die each year because dangerous diseases are misdiagnosed, across both hospital and clinic settings (BMJ Quality & Safety, AHRQ). These are errors made by credentialed professionals evaluating clinical information. A framework that shifts risk downward for HCP-facing functions on the strength of the credential alone assumes an error-detection capab

Question 2 — How should FDA distinguish informational AI from action-directing AI? Response FDA correctly recognizes that “informational” and “action-directing” are not cleanly separated categories. In healthcare, information itself can direct action. Deborah “Nurse Deb” Ault | Response to FDA Discussion Paper | Page 3 FDA-2026-N-7874 | Generative AI-Enabled Medical Devices A patient does not need to receive the grammatical command “Do not seek care” for an AI interaction to produce that result. For example:  a cost estimate may cause a patient not to fill a prescribed medication;  an explanation of insurance coverage may cause a patient to postpone treatment;  a provider-ranking system may determine where a patient seeks care;  a statement that a service is “not covered” may function practically as a denial of access;  an AI-generated assessment of urgency may alter whether a patient seeks emergency, urgent, routine, or no care. For that reason, regulatory risk should be based partly upon foreseeable influence on patient behavior, not merely upon whether the system uses imperative language or explicitly recommends an action. I suggest the following principle: If technology can foreseeably influence whether, when, where, from whom, or what healthcare a person receives, the degree of safety oversight and accountability should reflect the degree of influence it exercises. This becomes especially important for technologies that may be described as administrative, navigational, financial, scheduling, or benefits-related rather than clinical. The patient experiences one healthcare journey. Regulation should not assume that administrative influence and clinical consequence are separate simply because the software categories are separate. Patient autonomy adds another dimension to this distinction. Personalization should help people understand their choices, not become hidden coercion. AI should inform human choice—not replace it. A system that learns which framing, timing, or presentation is most likely to produce a desired patient action may become more behaviorally influential without ever issuing an explicit command. FDA should therefore consider not only whether information is action-directing, but whether personalization, conversational authority, repeated prompting, or selective presentation of alternatives can materially shape choice in ways the patient may not recognize.

Question 2 — Directiveness as a continuum I want to raise a practical objection to using directiveness as a determinant of risk classification, notwithstanding that it is clearly relevant to risk. Directiveness of a generative output is an emergent property of the output, not a design input the manufacturer controls or can verify at design time. A manufacturer can constrain it — through system prompts, output templates, refusal training, post-generation filtering — but cannot guarantee it. If regulatory classification turns on whether a function is “non-directive,” sponsors will be asked to attest to something no sponsor can honestly attest to, and the predictable result is either attestations that are not meaningful or an evidentiary standard that cannot be met. The more workable construction treats directiveness as a constrained and monitored property. A sponsor would specify a directiveness ceiling for the intended use, describe the technical controls enforcing it, and — critically — report a measured escape rate: the rate at which outputs exceeded the specified ceiling across an adversarial and representative evaluation set. Classification would then be based on the specified ceiling, conditioned on the escape rate meeting a prespecified bound, with escape rate becoming a postmarket monitoring endpoint. This gives manufacturers something they can actually design toward and CDRH something it can actually verify.

Question 2: modifiers of directiveness. I support judging directiveness by substance and context rather than wording, and I support discounting boilerplate disclaimers. The modifiers that can be specified and audited are: specificity (a named drug and dose versus class-level education); personalization (general statements versus statements tied to the user's own data); imperative framing; and traceability, meaning whether the output is grounded in and cites validated instruments and published guidelines. Outputs constructed from validated frameworks (in my field, the Rome diagnostic criteria and PROMIS measures) are easier for users, sponsors, and reviewers to evaluate than free generation, and that grounding should be credited as risk-reducing. On predictability: publish worked examples along the four-step gradient the paper describes (general information, contextualization, endorsement, instruction) for a handful of clinical domains. Small sponsors need to be able to classify their own functions before they build, not after a deficiency letter.

FDA Question 2 - Spectrum of informational directiveness Trace ID. TR-Q02 | FDA Q2; Sec. IV.A; App. B; pp. 9-10 / 27-28 BCR response. Treat directiveness as realized action pressure across the interaction, not a keyword test. Evaluate specificity, personalization, imperative force, immediacy, repetition, preservation of alternatives, and consequence across realistic trajectories. BCR rule basis. BCR-R06,R09,R12,R17 Solution-stack link. S2,S3,S6 Closure evidence. Semantically equivalent multi-turn cases varying specificity/personalization/imperative force Pass / re-open. Stable classification and no unrecognized trajectory crossing Re-open when: Prompt, UI, personalization, or conversational-policy change.

Response to Question 2: Directiveness as a Spectrum — The Need for Safe Harbor WHM supports characterizing directiveness as a spectrum rather than a binary, but manufacturers require a safe harbor bright line to plan development programs. Without at least one clear presumptive standard, manufacturers face perpetual uncertainty about where their device falls on the continuum. We recommend that FDA establish a rebuttable presumption: any generative AI output that includes specific numeric parameters — drug doses, device therapy thresholds, surgical dimensions — is presumptively action-directing, regardless of framing language. Manufacturers who believe their device should be characterized differently can rebut the presumption through pre-submission consultation. This approach provides clarity while preserving flexibility.