GenAI: Stakeholders offer competing views on FDA's regulatory approach
More than 500 comments have been submitted in response to the US Food and Drug Administration’s (FDA) discussion paper on generative AI (genAI)-enabled medical devices, and stakeholders have offered the agency a wide variety of advice on the best way to regulate these technologies.
In August 2026, FDA published a discussion paper seeking feedback on a proposed two-axis risk framework for genAI-enabled medical devices as well as how to account for wide variety of genAI-enabled information functions, when patient-facing functions pose a risk, considerations for clinicians with different levels of specialist knowledge using these devices, assessing risk of conversational drift, and what to consider when evaluating care escalation. The discussion paper also called for feedback on whether a competency-based approach for evaluating genAI-enabled devices is sufficient, and when it is appropriate to prioritize postmarket monitoring over premarket evidence.
Assessing risk
Commenting on the discussion paper, the Advanced Medical Technology Association (AdvaMed) said that while genAI may bring about new regulatory considerations, the regulatory approaches for these devices “should remain centered around risk-based principles” that are at the core of medical device regulation.
“The existing risk-based premarket and postmarket frameworks are designed to support innovation and novel technologies in medical devices while ensuring device safety and effectiveness,” Advamed wrote. “When technology introduces novel considerations, existing frameworks and principles can be adapted in a targeted and risk-proportionate manner, rather than creating separate technology-specific regulatory frameworks or taxonomies. This approach preserves regulatory predictability, promotes global convergence, and ensures that oversight remains centered on the clinical risks and benefits of the device rather than a specific technology.”
The Medical Device Manufacturers Association (MDMA) and Danaher Corporation also echoed AdvaMed’s request to keep the existing device regulation when assessing genAI-enabled medical devices. Danaher noted that there should be a “single risk-based framework for software functions” that follows International Medical Device Regulators Forum software as a medical device principles as well as existing device classification with additions for genAI-specific considerations.
The Digital Medicine Society (DiMe) said genAI-enabled medical devices “should be evaluated across their total product lifecycle with their intended users and in their intended use environments.”
“Technical performance alone cannot establish safety and effectiveness when outcomes also depend on whether intended users can correctly interpret and act on outputs and whether the device's safeguards are adequate,” they wrote.
Other stakeholders favored the two-axis risk framework, including the Association of Clinical Research Organizations (ACRO), The International Society for Pharmaceutical Engineering (ISPE), while other organizations such as the National Health Council, Stanford Institute for Human-Centered Artificial Intelligence (HAI), and US Chamber of Commerce recommended modifying the proposed framework.
“Use the proposed two-axis risk framework as a starting point while accounting for additional considerations, including reversibility, detectability of error, time sensitivity, traceability to source information, reliance and automation bias, user context, and the availability of meaningful human review,” the National Health Council wrote.
When assessing risk of patient-facing functions, FDA should consider clinical context and consequences of reliance “rather than presuming higher risk solely because the intended user is not a health care professional,” they added.
Stakeholders from Stanford said the two-axis risk framework should have evidence that human oversight is an effective risk control based on the task and should be more specific about how the consequences axis is determined.
The US Chamber of Commerce requested FDA refine the framework and use it for risk management and expectations of evidence.
“The Chamber urges FDA to develop a framework that matches oversight to actual risk, preserves established regulatory pathways, draws on standards and evaluation methods developed collaboratively with industry and recognized standards bodies, and gives manufacturers the clarity they need to invest and innovate,” they wrote.
This refined framework should allow for lower-risk devices to navigate a path based on performance and monitoring, create rules for managing device updates that are clear and fair, and center around safety and effectiveness of medical devices while also preserving statutory exclusions and supporting manufacturers in their ability to safely monitor and deploy AI-based tools.
“Getting this framework right matters—for patients who stand to benefit from these technologies, for the companies investing in them, and for the United States’ ability to lead in the responsible development of medical AI,” they said.
In their comment, the Program On Regulation Therapeutics, And Law (PORTAL) and MIT Critical Data said the same factors that make genAI-enabled medical devices useful also pose a risk.
“The FDA’s approach to regulating these tools should account for the different clinical roles they can play, whether providing information, directing action, or taking action with or without clinician supervision, and the level of scrutiny they receive should be commensurate with the risks associated with their claimed capabilities,” they wrote.
IQVIA also cautioned FDA about balancing risk and benefit with genAI-enabled medical devices.
“This balance is essential to keeping pace with the rapidly evolving AI-enabled medical device landscape, maintaining a least-burdensome regulatory approach, and supporting life-saving and life enhancing innovation—without compromising patient safety,” they wrote.
Competency-based approach
FDA proposed using a competency-based approach for regulating these devices in its discussion paper, which would assess genAI-enabled medical devices in a similar manner to how human clinicians are tested and credentialed.
Several stakeholders recommended FDA continue using a risk-based framework, rather than a competency-based approach, for evaluating genAI-enabled medical devices. AdvaMed said FDA should use the agency’s “existing foundation of risk assessment and device classification,” while MDMA noted that a risk-based evaluation of performance would be “more appropriate” than a competency-based approach. ACRO said they favored a “technology-neutral approach that builds on existing FDA frameworks” for genAI-enabled medical devices.
Other organizations, such as ISPE and National Health Council welcomed the competency-based framework, and the Danaher Corporation stated the competency-based approach could be implemented through existing pathways and policy.
“Competency-based evaluation should be implemented through existing premarket pathways, FDA-recognized consensus standards, the Q-Submission program, and FDA’s existing AI policies, including its PCCP guidance and the guiding principles developed with Health Canada and the MHRA, and should reflect lessons learned from the Software Precertification Pilot Program,” they wrote.
The PORTAL group said that the core of the agency’s strategy should be “clinical evidence, generated before authorization in the settings where the device will be used, that establishes safety and effectiveness.”
“Longitudinal, real-world evidence of safety and effectiveness, validated with the patient and clinician communities affected by each tool, should then confirm that pre-authorization performance,” they explained.
In their comment, the Yale Collaboration for Regulatory Rigor Integrity and Transparency (CRRIT) agreed that “clinical interaction, rather than the isolated output,” was the appropriate validation measure in patient-facing genAI-enabled devices under a competency-based framework.
Johnson & Johnson also told FDA that the focus should be on performance under conditions of intended use instead of determining competency.
“GenAI performance is conditional on users, inputs, workflows, deployment environments, model versions, and external dependencies. Therefore, the relevant regulatory question is not whether a system has demonstrated competency, but whether available evidence provides reasonable assurance of safety and effectiveness under intended-use conditions,” they wrote. “Risk characterization should inform the nature and amount of evidence required, but should not independently determine device classification, predicate eligibility, submission pathway, or substantial-equivalence conclusions.
Device benchmarking
The Mayo Clinic noted in their comment that as genAI improves in its ability to support clinical judgment, there should be a “clear distinction” between assessing competency of a genAI-enabled medical device and credentialing of a clinician.
“Device competency should remain tied to the specific clinical task and intended use, while clinicians retain responsibility for professional judgment within the scope of their role and the human-AI workflow,” they said.
When benchmarking a genAI-enabled medical device, stakeholders emphasized the need to prioritize safety for patients and have the benchmarks remain specific to the AI function’s intended use.
“Premarket benchmarking should be tied to the specific clinical task and complemented by clinical confirmation that reflects representative users, populations and workflows,” the Mayo Clinic wrote.
“Keep the benchmarks pivotal to an authorization, or a manufacturer's move to a new model version, independent of the manufacturer and of the model developer,” Anthropic wrote in its comment to FDA. “Keep the test cases for those benchmarks apart from the regression set that the manufacturer re-runs after each change. Set a common standard for how a benchmark is built, and review a manufacturer's own benchmark against that standard.”
The PORTAL group said initial benchmarks should have a “baseline level of safety before any device is used on patients” in addition to requirements that ensure the quality of the device performance over time. “The FDA should use all of the regulatory levers at its disposal, and clearly articulate to GenAI developers what AI clinical activities fall within its jurisdiction,” they said.
Danaher and Doctors for America said benchmarks should be considered as supporting evidence or a surrogate, rather than an endpoint.
“Benchmarking is valuable but should not, on its own, establish a reasonable assurance of safety and effectiveness,” Danaher Corporation wrote. “Evidence expectations, including independence safeguards, should be proportionate to risk.”
“Like surrogate markers in drug development, benchmark results will correlate with clinical outcomes to varying degrees, and that correlation deserves critical scrutiny and continued improvement,” Doctors for America said.
Postmarket monitoring
In the postmarket setting, AdvaMed said postmarket surveillance is a “shared responsibility with distinct responsibilities for manufacturers based on device-specific considerations,” while ACRO said they support a “risk-based, pragmatic postmarket monitoring and change control.”
MDMA said that there is no need for a novel postmarket monitoring framework for authorized FDA devices, arguing that they have already met the standard for safety and effectiveness as a medical device in the pre-market phase.
“The fact that a device or function incorporates GenAI should not call into question FDA’s determination and does not warrant an additional, novel layer of postmarket oversight,” they wrote.
Other organizations, such as ISPE, said that uncertainty in the premarket phase could be balanced by a more robust postmarket monitoring approach.
“The design of the postmarketing monitoring program should be based on the estimated residual risk from the premarket development program, particularly when residual risk reduction would be most effective through a carefully designed postmarketing evaluation program,” they wrote.
