FDA Seeks Public Feedback On Regulatory Approach For Generative AI-Enabled Medical Devices

On August 18, 2026, the U.S. Food and Drug Administration’s (FDA) Digital Health Center of Excellence (DHCoE) within the Center for Devices and Radiological Health (CDRH) issued a discussion paper seeking stakeholder input on regulation of generative artificial intelligence (GenAI)-enabled medical devices (Discussion Paper). Among other topics, the Discussion Paper addresses considerations for assessing risk, premarket evaluation, postmarket monitoring, and other issues relevant to the regulation of GenAI-enabled medical devices. CDRH notes that GenAI-enabled devices may present regulatory challenges distinct from traditional software and other artificial intelligence (AI)-enabled devices because they can accept open-ended inputs, produce variable outputs, perform multiple subtasks, and evolve over time through changes to models, prompts, retrieval strategies, guardrails, and other components.

The paper is premised on the understanding that characteristics specific to GenAI-enabled devices raise unique questions regarding validation, intended-use boundaries, and postmarket oversight. While FDA has issued numerous policies relating to software, artificial intelligence, and machine learning, this document represents a comprehensive effort to evaluate whether existing regulatory approaches are sufficient for generative AI-enabled medical devices. As a result, the feedback received through this process is likely to help shape future FDA expectations regarding evidence generation, postmarket oversight, and management of GenAI-enabled product changes.

CDRH describes a two-axis framework when considering the risk of GenAI-enabled software functions. The framework places independence of device activity on one axis and the consequences, or severity of harm, associated with relying on an incorrect device output on the other axis, implying a gradient of increasing risk. Consistent with prior FDA digital health policies, the framework recognizes that the risk of a software function depends in part on how independently it directs or takes action (e.g., providing a non-directive risk score for a future cardiovascular event versus directing a patient to seek emergency care). The Discussion Paper notes that the distinction between “non-directive” and “action-directing” information may not be binary, but instead may exist along a continuum.

The Discussion Paper also identifies several factors that could affect the risk profile of a GenAI-enabled function. For instance, CDRH is considering whether patient-facing functions may present different or greater risks than functions used by health care professionals because patients may be less able to independently assess the reliability of an output. CDRH also raises questions regarding functions used by generalists rather than specialist clinicians, multi-turn conversational systems that may become increasingly directive over the course of an interaction, and care-escalation tools for which both under-escalation and over-escalation may create safety concerns.

For premarket review, CDRH is considering a “competency-based” evaluation approach that would combine non-clinical device benchmarking with clinical confirmation, with the level of evidence tailored to the device’s intended use and risk. The competency-based model is inspired by how human clinicians are evaluated and credentialed, but would be adapted for the technical, practical, and legal considerations applicable to medical device regulation. Benchmarking could evaluate clinical knowledge, analytic capabilities, safety behavior, communication, generalizability, and, for agentic systems, the ability to safely plan and execute multi-step tasks.

Clinical confirmation could range from retrospective evaluation using real patient inputs and “shadow deployment,” in which the device operates in a live workflow without affecting patient care, to clinician adjudication or prospective clinical studies, depending on the device and its risk profile. CDRH emphasizes that a prospective clinical study may not be necessary in every case and is seeking input on how sponsors should select and justify an appropriate clinical confirmation approach. CDRH is also considering whether qualified independent third parties could support benchmarking, maintain evaluation datasets, conduct portions of a competency assessment, or serve as expert clinical adjudicators.

A notable theme of the Discussion Paper is FDA’s apparent willingness to consider a balancing of premarket and postmarket assurance for certain GenAI-enabled devices. Recognizing that open-ended and adaptive systems may be difficult to comprehensively evaluate before marketing, FDA asks whether greater uncertainty could be tolerated at the time of authorization if accompanied by robust postmarket monitoring, re-evaluation, and change-control mechanisms. The Discussion Paper describes a variety of potential approaches to postmarket oversight, including periodic re-benchmarking, periodic sample-based clinician review, and monitoring for performance degradation or drift. Notably, CDRH asks whether, in some circumstances, it may be appropriate to accept greater uncertainty regarding a GenAI-enabled device’s benefit-risk profile at the premarket stage in exchange for more robust postmarket monitoring. CDRH also seeks input on how postmarket monitoring responsibilities should be allocated among manufacturers and other stakeholders, including clinicians, health care institutions, professional societies, standards-setting bodies, and other participants in the broader health care ecosystem. Although FDA has previously employed lifecycle-oriented oversight approaches for software and AI-enabled products, the Discussion Paper suggests that such tools may play an especially important role for GenAI-enabled devices whose performance may evolve over time or depend on rapidly changing third-party foundation models.

Postmarket change control is another significant focus. CDRH notes that GenAI-enabled devices may change through sponsor-initiated software updates or retraining, through ongoing model evolution, or because of updates made by a third-party foundation model developer. The agency is considering approaches ranging from documentation within a manufacturer’s quality management system to FDA authorization before implementation, and identifies Predetermined Change Control Plans (PCCPs) as one potential mechanism for managing certain anticipated changes without a new premarket submission. CDRH also seeks comment on how manufacturers should detect and evaluate changes to third-party foundation models that may affect device safety or effectiveness.

Finally, CDRH seeks input on whether a voluntary “Foundation Model Device Master File” framework could facilitate review of devices built on third-party foundation models. Under the concept described in the Discussion Paper, foundation model developers or platform providers could submit confidential information regarding a model to FDA for reference by device sponsors in individual marketing submissions. CDRH also separately requests feedback on agentic AI systems, including whether autonomous multi-step action, external tool use, and reduced opportunities for human review warrant additional evaluation or oversight considerations.

The concepts discussed have some overlap with FDA’s existing approach to clinical decision support (CDS) software. As discussed in our January 2026 Advisory, FDA’s updated CDS guidance considers, among other things, whether software is intended to support rather than replace or direct a health care professional’s judgment and whether the health care professional can independently review the basis for the software’s recommendation. The Discussion Paper carries some of those same concepts into the GenAI context, while recognizing that GenAI-enabled functions can be more dynamic. For instance, a conversational tool might begin by providing general information but become increasingly directive over the course of an interaction. CDRH expressly notes that its consideration of whether a user has sufficient clinical knowledge to independently evaluate an output appears consistent with the CDS statutory exclusion’s independent-review criterion. The Discussion Paper does not change FDA’s existing CDS policy, and the two frameworks do not map onto each other precisely; rather, the paper suggests that familiar CDS concepts concerning human judgment, independent review, and the nature of a software output may help inform FDA’s developing approach to GenAI-enabled devices.

The Discussion Paper could raise several practical implications for manufacturers developing GenAI-enabled medical devices. As FDA considers a framework that evaluates both the degree of independence of a software function and the consequences of incorrect outputs, sponsors may need to devote greater attention to characterizing how their products operate, the extent to which users are expected to rely on device outputs, and the potential risks associated with those outputs. More broadly, FDA’s focus on periodic re-benchmarking, performance monitoring, and management of model drift suggests that post-market surveillance and lifecycle oversight may become increasingly important aspects of regulatory compliance for GenAI-enabled devices. Companies developing products in this space may therefore wish to consider submitting comments on FDA’s proposed competency-based assessment framework, post-market monitoring concepts, and approaches for managing changes to foundation models before the October 19, 2026 comment deadline.

The Discussion Paper is nonbinding, is not draft or final guidance, and does not propose changes to FDA policy or establish evidentiary expectations for future marketing submissions. Rather, FDA characterizes the paper as an early-stage effort to solicit stakeholder input that may inform future regulatory approaches for GenAI-enabled devices. An unanswered question is whether implementing the framework proposed in the Discussion Paper will require legislative changes, with FDA noting that the paper is not intended to address whether the approaches therein are within FDA’s existing legal authorities or whether new legal authorities would be necessary.

Comments are due by October 19, 2026, and should be submitted under docket number FDA-2026-N-7874 on Regulations.gov.

We will continue to monitor FDA’s consideration of stakeholder feedback and any further developments regarding the regulation of GenAI-enabled medical devices. If you have any questions or would like more information, please reach out to one of the authors of this Advisory or your existing Arnold & Porter contacts.