Should an AI device’s position on the risk map help decide how much evidence it must bring before market?

Question 8 — Aligning with existing credibility frameworks FDA already has useful language for this kind of risk assessment. CDRH guidance on computational modeling, which draws on ASME V&V 40, looks at model influence and decision consequence. CDER’s draft AI guidance uses the same terms. The discussion paper appears to describe the same basic idea, but with different words. Using different terms for the same concept will create confusion, especially for sponsors working with more than one FDA center. Recommendation. Use the existing terms “model influence” and “decision consequence,” or clearly state that the paper’s two axes mean the same thing. The resulting risk tier should then guide the level of evidence needed, including benchmarking, rigor, and clinical confirmation. This would give sponsors one risk assessment they can use for both premarket planning and postmarket change control.

Question 8 - Using the two-axis framework to determine premarket evidence The two-axis framework can appropriately scale the rigor and breadth of evidence. As activity becomes more independent and the consequences of an incorrect output become more severe, FDA can reasonably expect stronger benchmarking, more demanding clinical confirmation, greater subgroup coverage, more explicit failure-mode testing, and more robust change-control and postmarket plans. The framework should scale evidence continuously rather than create rigid bins. A highly consequential but HCP-supervised function may warrant different evidence than a lower- consequence autonomous function. The additional modifiers described in response to

Question 8 — How should risk inform the evidence required? Low-risk AI should earn autonomy quickly. High-risk AI should earn it slowly. A low-stakes informational function can rely on benchmarking, structured testing, and human-factors evaluation. A high- risk autonomous function should require progressively stronger evidence: shadow deployment, prospective clinical evaluation, human-AI team evaluation, and predefined stopping rules. This scales the regulatory pathway to the risk, rather than forcing every GenAI system through the same process.

Question 8 — How should risk influence the amount of premarket evidence required? Response Premarket evidence requirements should increase with the foreseeable consequence of failure, but the risk framework itself must be broad enough to capture the ways healthcare AI can actually harm people. As discussed above, risk should not be limited to incorrect output. FDA should also consider:  omission;  failure to recognize latent clinical need;  inappropriate delay;  inability to identify urgent circumstances;  inappropriate escalation;  autonomous action;  lack of meaningful human review;  and the degree to which the system can influence patient behavior or access to care. A patient-facing system that can influence whether someone seeks emergency evaluation should require more rigorous evidence than an AI that reformats documentation. Deborah “Nurse Deb” Ault | Response to FDA Discussion Paper | Page 20 FDA-2026-N-7874 | Generative AI-Enabled Medical Devices A system that can initiate or deny consequential actions should require more evidence than one that merely assists a qualified professional who independently reviews the recommendation. The governing principle should be simple: The greater the foreseeable clinical influence, the greater the burden of demonstrating safety.

Question 8 — Relating the risk framework to evidence requirements This is, in my view, the most consequential question in the paper for whether the framework succeeds in practice. A competency-based approach without a published risk-tier-to-evidence mapping is not a least-burdensome pathway. It is discretionary, case-by-case review with a new vocabulary. Sponsors cannot plan submissions against it, cannot budget against it, and cannot know in advance whether their evidence is adequate — which in practice means either over-generating evidence defensively or under-generating it and absorbing review cycles. Both outcomes are costly, and the second is worse for patients because it delays devices that would have qualified. I recommend CDRH publish a mapping table specifying, for each cell or band of the risk grid: the minimum benchmarking elements required; the minimum acceptable clinical confirmation tier from the Section V.C 5 of 19 Docket No. FDA-2026-N-7874 ladder; whether third-party involvement is expected; and the minimum postmarket monitoring configuration. The mapping need not be rigid — a documented, justified deviation pathway should exist — but the default must be published and stable. Predictability is the mechanism by which a risk-based framework actually reduces burden.

FDA Question 8 - Risk framework used to scale evidence Trace ID. TR-Q08 | FDA Q8; Sec. V.E; App. B; pp. 18-19 / 28-29 BCR response. Use activity and consequence for initial tiering, then scale evidence using the full boundary vector and hard gates. A low average position cannot reduce evidence when irreversibility, hidden tool action, poor observability, or severe subgroup failure exists. BCR rule basis. BCR-R02,R09,R10,R14,R15 Solution-stack link. S2,S4,S7 Closure evidence. Evidence-tier rationale tied to highest material boundary/hard gate Pass / re-open. Evidence burden justified by highest material branch, not average position Re-open when: New or elevated boundary/hard-gate condition.

Response to Question 8: Pathway Decision Matrix — A Prerequisite for Industry Mapping the two-axis risk framework to specific regulatory pathways is not merely useful — it is a prerequisite for the framework to function. Responsible manufacturers will not commit development resources to a clinical AI program without knowing whether their device is headed toward a 510(k) review, a De Novo classification request, or a PMA. These pathways carry dramatically different time, cost, and evidence burdens. Investment decisions, partnership structures, clinical study design, and commercial timelines all depend on this clarity. FDA must publish a decision matrix — a clear, public reference linking risk tier (derived from the two-axis framework) to regulatory pathway and corresponding premarket evidence requirements — before finalizing this regulatory approach. Without it, the competency-based framework, however conceptually sound, will produce prolonged pre-submission uncertainty for manufacturers and an uneven submission landscape for FDA reviewers. We recommend that the decision matrix be included as an appendix to any final guidance document, with explicit examples for representative device categories.