Generation Patient comments on the FDA discussion paper on generative AI-enabled medical devices

Written By Sneha Dave
Generation Patient comments on the FDA discussion paper on generative AI-enabled medical devices

In August 2026, the Food and Drug Administration (FDA) published a discussion paper on how it might regulate medical devices that use generative artificial intelligence (AI) and invited stakeholders to file comments under docket FDA-2026-N-7874. Generation Patient filed comments asking FDA to issue guidance disqualifying AI companion tools from the wellness exception, assess the risk of conversational AI devices based on the most directive function they can perform, and require device sponsors to disclose the foundation models their devices use, among other recommendations.

Download the Generation Patient comments on the FDA discussion paper

Read the Generation Patient comments on the FDA discussion paper below.

October 19, 2026
Submitted electronically via www.regulations.gov

Dockets Management Staff (HFA–305)
Food and Drug Administration
5630 Fishers Lane, Room 1061
Rockville, MD 20852

Re: Considerations for the Regulation of Generative AI-Enabled Medical Devices; Discussion Paper and Request for Feedback, Docket No. FDA-2026-N-7874

Dear Dr. Tarver:

Generation Patient is an organization created by and for young adult patients living with chronic and rare medical conditions such as lupus, inflammatory bowel disease, Lyme disease, tuberous sclerosis, and rheumatoid arthritis. We seek to ensure a better future for our generation of patients by providing direct support through peer support groups while driving systems-level change through policy work, leadership programming, and advocacy initiatives. Through our direct support work, we have led over 650 peer support meetings and continue to build the evidence base for holistic support for young adults with chronic and rare conditions.

Thank you for the opportunity to comment on the Center for Devices and Radiological Health (CDRH) discussion paper, Considerations for the Regulation of Generative AI-Enabled Medical Devices. American young adults are increasingly using conversational tools enabled by generative artificial intelligence (AI) for mental health support. The discussion paper fails to mention young adults, mental health, suicide, or AI companion tools.1 Generation Patient urges CDRH to:

  1. Issue guidance disqualifying AI companion tools from the wellness exception
  2. Assess AI devices based on their most directive function and most severe consequences
  3. Strengthen premarket standards and postmarket monitoring
  4. Direct conversational generative AI devices to De Novo and restrict predicate eligibility
  5. Disaggregate data on device performance and adverse events by age, including young adults
  6. Treat foundation models as device components and require mandatory disclosures

1Issue guidance disqualifying AI companion tools from the wellness exception

Young adults are increasingly using conversational tools enabled by generative AI for mental health support. A nationally representative survey found that 19.2 percent of Americans aged 12 to 21 had used AI chatbots for mental health advice as of late 2025.2 Use among age groups ran highest at 18 to 21, at 24.1 percent.3 Respondents who had discussed their mental health with a physician in the prior six months used AI chatbots for mental health advice at higher rates.4 Among people aged 15 to 30, those with a chronic illness had more than four times the odds of attempting suicide.5 Products that simulate a relationship, engage users in distress, and present themselves as emotional support operate as mental health interventions even when manufacturers describe them as wellness tools. FDA oversight should rest on design features and foreseeable harm to users, including young adult patients, rather than on marketing claims alone.

Section 3060(a) of the 21st Century Cures Act permits that approach. Congress wrote the wellness exception as a conjunctive test, removing a software function from the device definition only where the function is "intended… for maintaining or encouraging a healthy lifestyle and is unrelated to the diagnosis, cure, mitigation, prevention, or treatment of a disease or condition." (emphasis added)6 AI companion tools sit outside the device definition only while both conditions hold. Whether a particular tool meets those conditions is a determination for FDA to make on the facts of each product. Labeling, advertising, and representations made by manufacturers are evidence of intended use, but FDA may also consider objective design, user interface, functionality, instructions for use, and deployment context.7 If the function otherwise meets the definition of a device under section 201(h) of the FD&C Act, FDA may regulate it as a device.8

Products engineered to sustain an ongoing simulated relationship, to keep users engaged during moments of emotional distress, and to present themselves as a source of emotional support fail the second condition in section 3060(a) of the 21st Century Cures Act.9 Generation Patient asks FDA to treat design features of that kind as defeating the wellness exception.

FDA already treats design features as disqualifying under its own wellness policy. Revised General Wellness guidance issued on January 6, 2026, states that products "are not general wellness products if their labeling, advertising, user interface, or functionality" includes alerts or prompts that recommend specific clinical action, treatment guidance that directs medical management, or intended-use statements targeting management of a disease or condition. (emphasis added)10 FDA can issue guidance clarifying that design features of that kind disqualify AI companion tools and chatbots from the wellness exception in section 3060(a) of the 21st Century Cures Act.

2Assess AI devices based on their most directive function and most severe consequences

Conversational devices enabled by generative AI produce outputs across an extended exchange. CDRH acknowledges that those devices "may begin by performing an informational function and migrate, over the course of a conversation, to an action-directing function."11 CDRH is therefore considering an approach that would assess risk "across realistic conversational trajectories, not only at the level of individual functions."12 However, nothing in the paper explains which of the functions a device performs determines its placement in the risk framework that CDRH describes.

Generative AI models grow more likely to produce unsafe outputs as conversations progress. Three models in simulated psychiatric dialogues crossed their first safety boundary after 9.21 turns on average, and after 4.64 under adaptive probing.13 A benchmark of 600 medical dialogues across 20 models measured unsafe agreement at 5.9 percent at the initial query and at 75.7 percent by the fifth turn.14 OpenAI reports its safeguards "work more reliably in common, short exchanges" and "can sometimes be less reliable in long interactions."15 ChatGPT may "correctly point to a suicide hotline when someone first mentions intent," but "after many messages over a long period of time, it might eventually offer an answer that goes against" those safeguards.16

Generation Patient asks CDRH to evaluate risk of conversational AI devices based on the most directive function they can perform and its most severe consequences, regardless of how late in a conversation it emerges or how often it appears.17 CDRH should require sponsors to test trajectories in which users disclose distress, minimize symptoms, or resist escalation, and to report the most directive function the device performs. Assessing conversational AI devices based on predominant use would be difficult to implement and gameable, because sponsors could dilute the prevalence of a directive function by over-representing harmless conversations.

3Strengthen premarket standards and postmarket monitoring

CDRH is considering whether it would be appropriate to "accept greater premarket uncertainty" about generative AI devices "through greater reliance on postmarket monitoring."18 CDRH also asks for which device types that approach would be inappropriate.19 The paper describes periodic re-testing against benchmarks, review of real-world outputs by independent clinicians, and monitoring for performance degradation as possible approaches.20 Each of these rests with the manufacturer, and the paper fails to say how FDA would enforce its own authority over devices already on the market.21 Neither "adverse event" nor "recall" appears anywhere in the paper.

Replacing premarket evidence with postmarket monitoring, or weighing it heavier than premarket evidence, would shift the burden of harm onto patients. For products where a foreseeable failure is a missed suicidal crisis,22 a postmarket signal may come only after a patient has been seriously harmed. Products that engage users in emotional distress must be required to demonstrate safety, including crisis response performance, before they reach patients. Generation Patient has for a long time asked for stronger postmarket surveillance, but as a supplement to premarket evidence instead of a substitute. We ask FDA to strengthen postmarket monitoring of devices enabled by AI but without reducing standards for premarket evidence.23

Strengthening postmarket monitoring of devices enabled by AI requires practical changes to how failures are recorded, how patterns across users are detected, and what triggers review. Conversational tools enabled by generative AI can fail through concept drift, covariate shift, algorithmic instability, and disparate error rates, among other failure modes. “None of these issues can be well-categorized using the typical constructs that FDA uses for reporting a device 'malfunction.'”24 Failures without a matching adverse event category are described in the report narrative rather than captured in a code, which makes aggregate analysis far more difficult.25 The Manufacturer and User Facility Device Experience (MAUDE) database is built around individual cases, while failure patterns in conversational AI devices often appear only across many users.26 Nothing in the current framework specifies what kinds of adverse events typical of conversational AI devices would trigger a recall,27 and the CDRH discussion paper failed to address this issue.

Generation Patient asks FDA to develop more granular taxonomies reflecting typical performance failures in AI devices and the harms they can contribute to.28 For conversational tools, that would require new device problem terms for sycophantic responses, fabricated statements, and clinically wrong recommendations. FDA should also add patient problem terms for a suicide attempt, self-inflicted injury, and dependence on a device. Adding new terms would change how problems are described, not what is reportable under 21 CFR 803.50.29 We also ask FDA to require periodic performance reporting for generative AI devices to surface patterns that appear only across users.30 We further ask FDA to specify what a reported failure requires of a sponsor and of the agency, and to use the postmarket surveillance authority in section 522 for AI devices.31

Additionally, CDRH should establish permanent mechanisms to collect safety signals from AI tools that operate outside the device definition. FDA collects evidence about excluded software functions through docket FDA-2018-N-1910, which typically opens for roughly thirty days every two years.32 That docket implements section 3060(b) of the 21st Century Cures Act, which directed the Secretary to examine information about "any risks and benefits to health associated with software functions described in section 520(o)(1)" and to include input from outside experts such as representatives of patients and consumers.33 Generation Patient asks FDA to keep docket FDA-2018-N-1910 continuously open for public comment. Nothing in section 3060(b) prescribes a comment period or a closing date, and FDA already maintains standing dockets on this model.34

4Direct conversational generative AI devices to De Novo and restrict predicate eligibility

Clearances made through the 510(k) pathway rest on chains of earlier decisions. Applicants can secure FDA clearance by showing "substantial equivalence" to a "predicate" device.35 The integrity of the 510(k) pathway thus depends on which devices serve as predicates, the evidence FDA used to assess them, and the rigor of postmarket surveillance to ensure they remain safe. However, the 510(k) pathway “cannot be transformed into a premarket evaluation of safety and effectiveness as long as the standard for clearance is substantial equivalence to any previously cleared device.”36 For instance, researchers examining 156 devices subject to Class I recalls found that, among the 127 with identifiable predicates, 44.1 percent cited predicates that had undergone Class I recalls, and that 119 of the 156 underwent no premarket clinical testing.37

Generative AI strains the 510(k) pathway further. Clearance through the 510(k) pathway requires either the same technological characteristics as the predicate or different characteristics that raise no different questions of safety and effectiveness. Section 513(i)(1)(B) of the FD&C Act defines different technological characteristics as "a significant change in the materials, design, energy source, or other features of the device from those of the predicate device."38 A foundation model is such a feature.39 AI devices can be built on any of hundreds of foundation models and versions currently available on the market.40 Safety behavior varies substantially across model families and scale.41 Even models from the same developer have shown different performance across successive versions.42 Two devices built on different foundation models therefore raise different questions of safety and effectiveness, even if the same manufacturer makes both.

CDRH has already authorized more than 1,600 devices enabled by AI. Over 96 percent of those devices have been cleared through the 510(k) pathway.43 In a study of AI devices cleared from 2019 through 2021, about a third were cleared on the basis of predicates that researchers classified as not using AI.44 Predicate chains can also reach back decades. FDA cleared UpDoc in 2025 via the 510(k) pathway to manage insulin for type 2 diabetes, with a "conversation service."45 The manufacturer describes UpDoc as "AI that delivers clinician-level care."46 UpDoc was cleared based on a predicate lineage that traces to a drug dose calculator authorized in 2001.47 Devices on FDA's list of AI-enabled devices have lineages dating back to 1999.48 FDA has also cleared AI devices against predicates that were under an open design-related recall.49

Generation Patient asks FDA to direct conversational devices enabled by generative AI to the De Novo pathway under section 513(f)(2) of the FD&C Act as the default.50 Those devices should be evaluated on their own clinical evidence, including crisis response performance. Clearance through 510(k) should be available only where the predicate employs the same foundation model and version as the device under review. FDA should also set predicate eligibility criteria for AI devices, including that neither a device subject to an open design-related recall nor a device whose foundation model has been updated since authorization may serve as a predicate.

5Disaggregate data on device performance and adverse events by age, including young adults

CDRH is considering benchmarking elements that would evaluate whether safety and clinical proficiency "hold consistently across clinically relevant populations, including populations that may be underrepresented in training data or face structural barriers to healthcare access."51 Testing medical devices across populations is appropriate and consistent with what Congress has directed.52 However, CDRH never explains whether sponsors would have to make the results of that testing public, or how those results would be disaggregated by age group.53

Most devices enabled by AI and authorized by FDA reach the market without publicly available age-disaggregated evidence. Researchers examining 903 devices enabled by AI and authorized by FDA found age-related subgroup information in 117 of 505 clinical performance studies.54 They conclude that available information was often insufficient to assess clinical generalizability of such devices. A separate review of 692 authorized devices found the age of intended subjects reported in 19.4 percent of summaries.55 That review suggests that "the evaluation and approval process of medical AI devices by the FDA lacks comprehensive data on age diversity."56

Generation Patient asks FDA to require submissions to report data disaggregated by age bracket for devices enabled by generative AI, beginning with ages 18 through 29. Sponsors should apply those brackets to the benchmarking elements submitted before market and to performance and adverse event data afterward. FDA should require a sponsor without age data in specific subgroups to justify the absence, and the agency should make that justification public. For conversational AI devices, enrollment goals should name young adults as a distinct group.

6Treat foundation models as device components and require mandatory disclosures

Devices enabled by generative AI are often built on foundation models developed by third parties. Those foundation models can control "refusal behavior, content policies, output formatting, version control, and safety-critical behaviors integral to device safety and effectiveness."57 However, third-party models "offer varying levels of transparency into their training data, architecture, and evaluation methods, making it difficult to attribute specific behaviors and errors to the device or its underlying model."58 CDRH also notes that updates may be initiated by model developers rather than device manufacturers.59 In response, CDRH is considering a voluntary mechanism under which model developers would submit information to FDA confidentially.60 Yet CDRH concedes that model developers "may have limited incentive to disclose safety-relevant information."61 In that context, CDRH also asks whether there are alternative mechanisms “for obtaining information about underlying foundation models.”62

Third-party software incorporated into a medical device has long been subject to FDA oversight.63 Under FDA's quality management system regulation, manufacturers must also arrange for software suppliers to tell them about changes.64 FDA also asks sponsors to identify third-party software by title, supplier, and version.65 Where a device employs off-the-shelf (OTS) software and a failure could cause death or serious injury, sponsors are expected to provide assurance that "the product development methodologies used by the OTS software developer are appropriate and sufficient for the intended use of the OTS software within the specific medical device."66 Sponsors should also demonstrate that mechanisms exist to assure continued software performance, maintenance and support should its developer change it or terminate support.67

Foundation models incorporated into a medical device should be subject to at least the same requirements.68 Generation Patient asks CDRH to use its existing authority to require disclosures concerning all components of AI devices, including underlying foundation models. FDA should require device sponsors to identify each model and version their product incorporates, including fallbacks or alternates.69 Sponsors should also be required to state what notice, if any, they will receive before models change or are withdrawn.70 FDA should also treat a model substitution made outside an approved change control plan as a modification requiring a new premarket submission. This would be consistent with current FDA guidance, which treats complete algorithm rewrites as potentially significant even when performance claims and risk profile stay the same.71 We further ask FDA to report to Congress and publish, within twelve months, an analysis of its authority to require disclosures from model developers even when they do not market a medical device of their own, and of the statutory gaps Congress would need to close.72

FDA should also cooperate with other federal agencies that have authority to collect information about foundation models under compulsory processes, including the Federal Trade Commission (FTC). FTC has general investigative powers under section 6(b) of the FTC Act, which authorizes the Commission to require corporations whose business affects commerce to file answers in writing to specific questions.73 In September 2025, FTC issued orders to seven companies requiring them to identify the model behind every generative AI companion product, the dates of each model, and whether the company or a third party developed it.74 Each order also requires production of the licensing agreements with every third party named.75 Generation Patient asks FDA to request from FTC any material related to companion tools and to establish a standing information-sharing framework for foundation models incorporated into devices.76

Sincerely,

Luis Gil Abinader
Policy Director
Generation Patient
luis@generationpatient.org

Notes

  1. Joint Comment Letter on Docket No. FDA-2026-N-7874 § 1 (Oct. 19, 2026) (signed by Deinfluence, Doctors for America, Generation Patient, InnovateEDU, Innovation For Everyone, Interfaith Center on Corporate Responsibility, National Center for Health Research, Our Bodies Ourselves, Patient Safety Action Network, USA Patient Network, Washington Advocates for Patient Safety, and Young People’s Alliance) (noting that the terms “mental health,” “suicide,” “crisis,” and “companion” never appear in the discussion paper) [hereinafter Joint Comment]. ↩
  2. Ryan K. McBain et al., AI Chatbot Use and Disclosure for Mental Health Among US Adolescents and Young Adults, 180 JAMA Pediatrics 884, 886 (2026), https://doi.org/10.1001/jamapediatrics.2026.2015. ↩
  3. Id. at 886 (“Usage was highest among those aged 18 to 21 years (24.1%).”). ↩
  4. Id. at 884, 886. Use was more common among respondents who had spoken with a physician about their mental health in the prior six months than among those who had not, adjusted odds ratio 1.89 (95% CI 1.18–3.03). ↩
  5. Mark A. Ferro et al., Suicidal Behaviour Among Adolescents and Young Adults with Self-Reported Chronic Illness, 62 Can. J. Psychiatry 845, 845 (2017), https://doi.org/10.1177/0706743717727242. ↩
  6. 21 U.S.C. § 360j(o)(1)(B); 21st Century Cures Act, Pub. L. No. 114-255, § 3060(a), 130 Stat. 1033, 1130–32 (2016). ↩
  7. 21 C.F.R. § 801.4 (intended uses “refer to the objective intent of the persons legally responsible for the labeling of an article,” which “may be shown by such persons’ expressions, the design or composition of the article, or by the circumstances surrounding the distribution of the article”). See also Tech Justice Law, Comment Letter on Docket No. FDA-2026-N-7874, Considerations for the Regulation of Generative AI-Enabled Medical Devices § 2.2.4 (Oct. 19, 2026) (explaining that disclaimers cannot override evidence of a product’s design, distribution, and known use) [hereinafter TJL Comment]. ↩
  8. 21 U.S.C. § 321(h)(1). ↩
  9. See also TJL Comment, supra note 7, § 2.4.2 (concluding that health chatbots fall outside the general wellness exclusion). ↩
  10. U.S. Food & Drug Admin., General Wellness: Policy for Low Risk Devices 6 (Jan. 6, 2026). ↩
  11. U.S. Food & Drug Admin., Ctr. for Devices & Radiological Health, Considerations for the Regulation of Generative AI-Enabled Medical Devices: Discussion Paper and Request for Feedback 8 (Aug. 18, 2026), https://www.fda.gov/media/194242/download [hereinafter Discussion Paper]. ↩
  12. Id. ↩
  13. Youyou Cheng et al., The Slow Drift of Support: Boundary Failures in Multi-Turn Mental Health LLM Dialogues, arXiv:2601.14269 (Jan. 2, 2026) (stress-testing three frontier models against 50 virtual patient profiles in psychiatric dialogues of up to 20 turns; first boundary violation at 9.21 turns on average under static progression and at 4.64 turns under adaptive probing; concluding that “the robustness of LLM safety boundaries cannot be inferred solely through single-turn tests”). Preprint, not peer reviewed. ↩
  14. Saman Sarker Joy & Niloy Farhan, MedPRESS: A Multi-turn Benchmark for Patient-Pressure-Induced Medical Sycophancy in LLMs, arXiv:2608.02520 (Aug. 3, 2026) (600 five-turn medical dialogues evaluated across 20 model configurations; a response is counted as unsafe agreement where it “includes safe caveats but still supports the unsafe patient belief”). The benchmark evaluates general-purpose and medical-domain language models. ↩
  15. OpenAI, Helping people when they need it most (Aug. 26, 2025), https://openai.com/index/helping-people-when-they-need-it-most/, archived at https://web.archive.org/web/20250827id_/https://openai.com/index/helping-people-when-they-need-it-most/. ↩
  16. Id. ↩
  17. See also TJL Comment, supra note 7, § 2.3 (concluding that health chatbots sit at the high end of both axes of the discussion paper’s risk framework). ↩
  18. Discussion Paper, supra note 11, at 19. ↩
  19. Id. at 21 (Question 18). ↩
  20. Id. at 19–20. ↩
  21. Id. at 20 (“While manufacturers are responsible for the postmarket monitoring of their devices ...”). ↩
  22. Pichowicz et al., Performance of Mental Health Chatbot Agents in Detecting and Managing Suicidal Ideation, 15 Sci. Reps. 31652, at 1, 4 (2025); Brewster et al., Characteristics and Safety of Consumer Chatbots for Emergent Adolescent Health Concerns, 8 JAMA Network Open e2539022, at 2 (2025); De Freitas et al., Chatbots and Mental Health: Insights into the Safety of Generative AI, 34 J. Consumer Psych. 481, 486 (2024). See also Digital Health Advisory Committee Meeting Transcript 10 (Nov. 6, 2025) (remarks of Dr. Michelle Tarver) (“to date, there are no generative AI-enabled medical devices that have been authorized for use in mental health conditions”), https://www.fda.gov/media/190451/download. ↩
  23. See 21 C.F.R. pt. 803 (medical device reporting); id. pt. 806 (reports of corrections and removals); 21 U.S.C. § 360h(e); 21 C.F.R. pt. 810 (mandatory device recall authority). See also Joint Comment, supra note 1, § 2. ↩
  24. Boris Babic et al., A General Framework for Governing Marketed AI/ML Medical Devices, 8 npj Digit. Med. 328 (2025) (examining concept drift, covariate shift and algorithmic instability, with disparate error rates across demographic subgroups as a manifestation of instability). ↩
  25. See Babic et al., supra note 24, at 5. ↩
  26. Babic et al., supra note 24 (the adverse event reporting system “is designed at a patient/case level to identify local/individual issues, but many problems associated with AI/ML devices will present only at an aggregate or global level”). ↩
  27. See 21 C.F.R. pt. 806 (reports of corrections and removals); 21 U.S.C. § 360h(e) (authorizing a mandatory recall where there is “a reasonable probability that a device intended for human use would cause serious, adverse health consequences or death”). ↩
  28. Cf. Shaheen E. Lakhan, Postmarket Safety Surveillance of FDA-Cleared Prescription Digital Therapeutics Using the Manufacturer and User Facility Device Experience (MAUDE) Database: A Pharmacovigilance Study, 17 Cureus e85343 (2025), doi:10.7759/cureus.85343 (“A more granular, indication-specific taxonomy for digital products would improve signal detection and public transparency.”). ↩
  29. 21 C.F.R. § 803.50(a) (manufacturer must report where information reasonably suggests a device “may have caused or contributed to a death or serious injury,” or has malfunctioned in a way that would be likely to do so were the malfunction to recur). ↩
  30. Babic et al., supra note 24 (proposing that “manufacturers must flag both when training data is significantly updated and when deployment conditions are substantially amended,” together with a quarterly performance update to identify instabilities). ↩
  31. 21 U.S.C. § 360l(a)(1) (authorizing postmarket surveillance orders for class II or class III devices whose failure would be reasonably likely to have serious adverse health consequences). ↩
  32. Docket No. FDA-2018-N-1910 (opened for comment five times since 2018, most recently for thirty days closing Aug. 13, 2026); see Generation Patient, Comment Letter on Docket No. FDA-2018-N-1910 (Aug. 13, 2026), https://www.regulations.gov/comment/FDA-2018-N-1910-0385 (asking FDA to keep the docket continuously open). ↩
  33. 21st Century Cures Act, Pub. L. No. 114-255, § 3060(b), 130 Stat. 1033, 1132–33 (2016) (covering all software functions under section 520(o)(1), including those excluded as wellness software). ↩
  34. Stakeholders may submit comments on human drug compounding at any time. 80 Fed. Reg. 12504 (Mar. 9, 2015) (Docket No. FDA-2015-N-0030); see also 80 Fed. Reg. 65765 (Oct. 27, 2015) (Docket No. FDA-2015-N-3534). Public comments on a guidance document may likewise be submitted at any time. 21 C.F.R. § 10.115(g)(5). ↩
  35. 21 U.S.C. § 360c(i) (FD&C Act § 513(i)) (permitting clearance where a device has the same intended use as a legally marketed predicate and either the same technological characteristics as the predicate or different characteristics that do not raise different questions of safety and effectiveness). ↩
  36. Inst. of Med., Medical Devices and the Public’s Health: The FDA 510(k) Clearance Process at 35 Years 193, 196 (2011) (recommending that FDA obtain the information needed to design a framework to replace the 510(k) process, and that Congress then enact it). ↩
  37. Kushal T. Kadakia et al., Use of Recalled Devices in New Device Authorizations Under the US Food and Drug Administration’s 510(k) Pathway and Risk of Subsequent Recalls, 329 JAMA 136 (2023), https://doi.org/10.1001/jama.2022.23279. Predicates were identified for 127 of the 156 index devices, of which 56 (44.1 percent) cited a predicate that had itself undergone a Class I recall. ↩
  38. 21 U.S.C. § 360c(i)(1)(B). Clearance on the basis of different technological characteristics additionally requires information demonstrating that the device is as safe and effective as a legally marketed device. Id. § 360c(i)(1)(A)(ii)(I). ↩
  39. Discussion Paper, supra note 11, at 22 (models supplied by third parties may control “refusal behavior, content policies, output formatting, version control, and safety-critical behaviors integral to device safety and effectiveness”). ↩
  40. Model documentation published by OpenAI, Anthropic, Google (Gemini API and Vertex AI), Amazon Web Services (Bedrock), Microsoft (Azure OpenAI), Meta, Mistral, xAI and DeepSeek (reviewed Sept. 10–11, 2026). ↩
  41. Joy & Farhan, supra note 14 (reporting “substantial variation across model families, model scale, and prompt type”; unsafe agreement across the twenty model configurations tested ranged from 21.9 percent to 67.9 percent; across scales within one release, GPT-OSS-20B at 52.4 percent and GPT-OSS-120B at 34.9 percent). ↩
  42. Id. (successive versions at the same scale, Llama-3.1-70B-Instruct at 41.9 percent and Llama-3.3-70B-Instruct at 34.7 percent). ↩
  43. U.S. Food & Drug Admin., List of Artificial Intelligence-Enabled Medical Devices (content current Sept. 4, 2026), https://www.fda.gov/medical-devices/artificial-intelligence-enabled-medical-devices/list-artificial-intelligence-enabled-medical-devices. Of the 1,614 devices listed, 1,553 were cleared under section 510(k), 40 granted through De Novo classification, and 21 approved through premarket approval. FDA states that the list “is not a comprehensive resource of AI-enabled medical devices.” ↩
  44. Urs J. Muehlematter, Christian Bluethgen & Kerstin N. Vokinger, FDA-cleared artificial intelligence and machine learning-based medical devices and their 510(k) predicate networks, 5 Lancet Digit. Health e618 (2023). ↩
  45. U.S. Food & Drug Admin., 510(k) Summary, UpDoc, K253281 (Dec. 23, 2025), https://www.accessdata.fda.gov/cdrh_docs/pdf25/K253281.pdf. Indications for use: “medication management for patients aged 18 years and older who have been diagnosed with type 2 diabetes.” Cleared under 21 C.F.R. § 868.1890, product code NDC. ↩
  46. UpDoc, https://updoc.ai (visited Sept. 26, 2026), describing the product as “AI that delivers clinician-level care” and as “agentic AI that acts where only physicians could.” The site does not identify the model the device uses. ↩
  47. UpDoc names as its predicate the d-Nav System, K181916 (Feb. 4, 2019), an “Insulin Dose Calculator.” d-Nav names My Insulin Doser/IDS, K082512 (Nov. 7, 2008), whose summary states that the device “is identical to the predicate device in functionality except for a few features” and “[u]ses the same algorithm.” That device names the TRxF Intelligent Dosing System, K011571 (Aug. 9, 2001). All four were cleared under 21 C.F.R. § 868.1890. ↩
  48. Kneevoice Cartilage Evaluation System, K252076 (Feb. 6, 2026), names as its primary predicate the Biomet 3-Channel Knee Electronic Amplified Stethoscope, K991756 (Dec. 10, 1999); the summary’s table is headed “Predicate Trade Name (Primary Predicate is listed first).” K991756 does not appear on FDA’s AI-enabled device list, and its summary, available only as a scanned image, contains no reference to artificial intelligence. ↩
  49. Embrace, K181861 (Dec. 20, 2018), has been subject to recall Z-0159-2024 since July 13, 2023; FDA records the cause as “Device Design” and the status as open. EpiMonitor, K232915 (Feb. 15, 2024), names Embrace as its primary predicate, as does Nelli, K251506 (Nov. 21, 2025), a device from a different manufacturer. The recall is Class II. ↩
  50. 21 U.S.C. § 360c(f)(2). ↩
  51. Discussion Paper, supra note 11, at 26 (Appendix A, element R.2). ↩
  52. 21 U.S.C. § 360j(g)(9)(A) (requiring sponsors of clinical studies supporting device submissions to set enrollment goals, beginning 180 days after FDA issues final guidance); Pub. L. No. 117-328, § 3602 (2022) (directing FDA guidance on enrollment goals “disaggregated by age group”). ↩
  53. Element E.1 refers to “pregnant patients, pediatric and geriatric patients” as populations a device should have knowledge about, not as categories for reporting performance. Discussion Paper, supra note 11, at 25. ↩
  54. Daniel Windecker et al., Generalizability of FDA-Approved AI-Enabled Medical Devices for Clinical Use, 8 JAMA Network Open e258052 (2025), https://doi.org/10.1001/jamanetworkopen.2025.8052. Of 903 AI-enabled devices listed by FDA as of August 31, 2024, clinical performance studies were reported for approximately half. Among 505 such studies, 117 (23.2 percent) provided information on age-related subgroups. ↩
  55. Vijaytha Muralidharan et al., A scoping review of reporting gaps in FDA-approved AI medical devices, 7 npj Digital Medicine 273 (2024). Of 692 AI/ML-enabled devices authorized from 1995 through 2023, 134 summaries (19.4 percent) carried information on the age of intended subjects. ↩
  56. Id. ↩
  57. Discussion Paper, supra note 11, at 22. ↩
  58. Id. at 2. ↩
  59. Id. at 21, 22 (Question 24). ↩
  60. Id. at 22 (describing Foundation Model Device Master Files). ↩
  61. Id. at 23 (Question 25). ↩
  62. Id. ↩
  63. Software incorporated into a device is a component of that device. 21 C.F.R. § 820.3 (defining component to include “software, firmware”); see 21 U.S.C. § 321(h)(1) (device definition includes “any component, part, or accessory”). U.S. Food & Drug Admin., Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions 15 n.35 (Feb. 3, 2026) (“The use of ‘component’ in this guidance is consistent with the definition in 21 CFR 820.3.”). ↩
  64. 21 C.F.R. § 820.10(a) (requiring a quality management system that complies with ISO 13485); ISO 13485:2016 cl. 7.4.2, incorporated by reference at 21 C.F.R. § 820.7(b); see Warning Letter from Ctr. for Devices & Radiological Health, U.S. Food & Drug Admin., to Unilam Co., Ltd. (Sept. 22, 2026) (MARCS-CMS 738562), https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/unilam-co-ltd-738562-09222026 (citing “[f]ailure to maintain written agreements requiring suppliers to notify the firm of changes to purchased product prior to implementation, as required by ISO 13485:2016 Clause 7.4.2”). The predecessor provision, 21 C.F.R. § 820.50(b) (2025), required such an agreement only “where possible” and was removed when the Quality Management System Regulation took effect on Feb. 2, 2026. ↩
  65. U.S. Food & Drug Admin., Off-The-Shelf Software Use in Medical Devices 7 (Aug. 11, 2023) (specifying, for each OTS software component, “Title and Manufacturer of the OTS software” and “Version Level, Release Date, Patch Number, and Upgrade Designation, as appropriate”); see IEC 62304 cl. 8.1.2 (identification of each software-of-unknown-provenance item by name, manufacturer and version), recognized by FDA, Recognition No. 13-79. ↩
  66. Off-The-Shelf Software Use in Medical Devices, supra note 65, at 10. Enhanced Documentation applies where “a failure or flaw of any device software function(s) could present a hazardous situation with a probable risk of death or serious injury,” assessed prior to implementation of risk control measures. Id. at 6 n.9. ↩
  67. Id. at 10 (“Demonstrate the existence of appropriate mechanisms for assuring the continued performance, maintenance and support of the OTS software should the original OTS software developer either make changes to the OTS software and/or terminate their support of the OTS software.”). ↩
  68. U.S. Food & Drug Admin., Executive Summary for the Digital Health Advisory Committee Meeting: Total Product Lifecycle Considerations for Generative AI-Enabled Devices 14 (Nov. 20–21, 2024) (observing that “an analogous lack of software lifecycle control over an incorporated foundation model may raise certain challenges”). ↩
  69. 21 C.F.R. § 807.87 (content of a premarket notification submission); see 21 U.S.C. § 360i(a) (FD&C Act § 519(a)) (authorizing FDA to require reports and records). ↩
  70. See supra note 64 (existing requirement that manufacturers arrange for suppliers to tell them about changes). ↩
  71. 21 C.F.R. § 807.81(a)(3); id. § 807.81(b)(1)(ii); 21 U.S.C. § 360e-4 (FD&C Act § 515C); U.S. Food & Drug Admin., Deciding When to Submit a 510(k) for a Software Change to an Existing Device 16 (Oct. 25, 2017) (“a complete rewrite of the algorithm, even with the same performance claims and risk profile, may be significant enough to require submission of a new 510(k)”). ↩
  72. See also Joint Comment, supra note 1, § 3 (making the same requests). ↩
  73. 15 U.S.C. § 46(b) (FTC Act § 6(b)) (authorizing the Commission to require covered entities to file “annual or special, or both annual and special, reports or answers in writing to specific questions”). The Commission describes section 6(b) as authorizing “wide-ranging studies that do not have a specific law enforcement purpose.” Federal Trade Commission, Press Release, FTC Launches Inquiry into AI Chatbots Acting as Companions (Sept. 11, 2025). ↩
  74. Federal Trade Commission, Order to File a Special Report, Matter No. P254500, Specification 11(a) (Sept. 2025), https://www.ftc.gov/system/files/ftc_gov/pdf/AICompanionChatbot6(b)Order.pdf (requiring each company to show “the relevant AI Model for each AI Companion Product or Service, indicating the dates of each model, whether the model was developed by You or a third party and, if applicable, Identifying the third party”). Orders issued Sept. 11, 2025 to Alphabet, Character Technologies, Instagram, Meta Platforms, OpenAI OpCo, Snap, and X.AI. ↩
  75. Id., Specification 11 (“If applicable, produce the relevant licensing or other agreements with each third party referenced in Your response.”). ↩
  76. 15 U.S.C. § 57b-2(d)(1)(B) (FTC Act § 21(d)(1)(B)) (permitting the Commission to disclose “the results of any investigation or study carried out or prepared by the Commission” where no trade secret and no privileged or confidential commercial or financial information is identified). The Commission commits to reporting confidential commercial information on an aggregate or anonymous basis. Order to File a Special Report, supra note 74, at 2. ↩
Sneha Dave
Previous

Joint comments on the FDA discussion paper on generative AI-enabled medical devices
Next

Generation Patient comments on the draft PDUFA VIII commitment letter