In the rapidly developing field of AI-enabled medical devices, the technology is advancing faster than the regulatory framework. The US FDA’s willingness to share its emerging thinking therefore provides useful insights for developers planning a route to market.
The FDA's Center for Devices and Radiological Health (CDRH) published a discussion paper in August setting out its early thinking on how generative AI (GenAI)-enabled medical devices might be regulated, and inviting feedback from stakeholders. The paper is explicitly not draft or final guidance and does not commit CDRH to any particular approach, but it is a useful signal of the direction of travel for a category of device that existing frameworks were not designed for.
Why GenAI needs a different conversation
CDRH's starting point is that GenAI-enabled devices behave differently from traditional software and AI-enabled devices. They can accept open-ended inputs, perform multiple sub-tasks, produce variable outputs to similar inputs, and evolve over time through changes to the underlying model, prompts, guardrails or user interface. Many are built on third-party foundation models with limited transparency into training data or architecture, making it difficult to attribute specific behaviours or errors to the device itself. Alongside the benefits (more personalised outputs, better adaptability, richer user interaction) come risks that are just as distinctive, including hallucinations that can appear entirely credible, uncertainty about the true bounds of a device's intended use, and performance that degrades once the device meets the real world.
A two-axis approach to risk
To bring some structure to the analysis, CDRH proposes a two-axis framework for thinking about risk. This involves one axis for the device's activity (increasing from purely informational outputs through to fully autonomous action-taking) and the other for the consequences of relying on an incorrect output with the level of risk increasing from limited to severe. A function that merely provides a risk score is treated differently from one that issues a strongly worded, action-directing recommendation, and a function acting under continuous clinician supervision is treated differently from one acting entirely autonomously. The paper works through some genuinely tricky edge cases here, including how to weigh under- and over-escalation in care-triage functions, and whether outputs aimed at patients rather than healthcare professionals should be treated as inherently higher risk.
Evaluating devices like clinicians, not like static software
Perhaps the most striking proposal is a shift away from evaluation models built for software with bounded inputs and fixed outputs, on the view that testing every conceivable input a GenAI-enabled device might encounter simply is not practical. Instead, CDRH is exploring a competency-based approach inspired by how human clinicians are trained and credentialed, adapted for the realities of device regulation. In practice this means two stages: device benchmarking, a scalable non-clinical assessment of clinical knowledge, safety behaviour, communication and generalisability; followed by clinical confirmation, evidence that the device performs as intended under real or clinically representative conditions.
Clinical confirmation need not always mean a full prospective clinical study. CDRH sets out a spectrum running from retrospective evaluation on real patient data, through shadow deployment and standardised patient interactions, to clinician adjudication and, where warranted, a prospective study or randomised controlled trial. The expectation is that sponsors would select and justify an approach proportionate to the device's risk profile.
Life after launch: Postmarket monitoring and change control
Because premarket testing cannot fully capture how a continuously evolving, open-ended device will behave, CDRH is considering whether it may be appropriate to accept greater premarket uncertainty in exchange for more robust postmarket monitoring. Possible approaches include periodic re-benchmarking against the original thresholds, sample-based clinician review of real-world inputs and outputs, and dedicated monitoring for performance degradation or drift.
On change control, CDRH sees a manufacturer's premarket competency-based assessment as a potential baseline against which post-deployment modifications could be re-evaluated, with a Predetermined Change Control Plan (PCCP) as one possible mechanism for handling certain changes without a fresh premarket submission. The paper acknowledges a particular issue for devices built on third-party foundation models. The model itself may change at the initiative of its developer, not the device manufacturer, raising specific questions about how such changes would be detected and controlled.
Foundation models and agentic AI
The paper considers the possibility of a voluntary Foundation Model Master Access File, under which foundation model developers could submit information such as model cards to FDA on a confidential basis for sponsors to reference in their own submissions, without that submission amounting to authorisation of the underlying model for any particular use. CDRH also recognises that agentic AI systems, which plan and execute multi-step tasks and use external tools with reduced human oversight, may raise additional concerns, particularly where an agentic system's actions end up controlling another medical device.
A road-map for the future
CDRH is clear that this is currently an area for discussion and dialogue. The paper poses a long list of detailed discussion questions throughout, on issues such as the risk framework, the competency-based evaluation approach, postmarket monitoring, and the treatment of foundation models and agentic systems, and it is actively encouraging stakeholders to respond.
Comments on the discussion paper are being accepted until 19 October 2026, and we can expect to see these concepts being developed further before a regulatory framework is finalised.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]