FDA discussion paper on generative AI devices asks how manufacturers should handle changes to third-party models. Comments close on 19 October

A request for input, not guidance

The paper comes from the FDA's Digital Health Center of Excellence and is explicit about its status: it "does not represent draft or final guidance" and is "not intended to communicate CDRH's proposed (or final) regulatory expectations." It also says it is "not intended to propose or implement policy changes", and does not address whether the approaches it discusses fall within the FDA's existing legal authorities. It poses 26 numbered questions. The FDA's page says respondents can answer only those relevant to them, and partial responses are accepted.

Risk on two axes

The paper offers, as "a possible organizing heuristic", a way of assessing risk on two axes. One is how independently a function acts, running from non-directive information through action-directing information and supervised action to fully autonomous action. The other is the severity of harm if a user relies on an incorrect output. The paper's own contrast: "An incorrect recommendation about an over-the-counter remedy for a minor symptom is meaningfully different from an incorrect recommendation about adjusting an insulin dose."

Evaluating a device the way clinicians are credentialed

For premarket evaluation, CDRH is considering a "competency-based approach", inspired, at a high level, by how human clinicians are evaluated and credentialed. It would combine non-clinical benchmarking with clinical confirmation. The thing evaluated would be "the final user-facing device, as configured and intended to be deployed for real-world use", not the foundation model on its own.

That benchmark could then be reused. A device modified after authorisation could be "re-benchmarked" against the same capabilities to show whether the change affected safety or effectiveness.

The model underneath belongs to someone else

Many generative AI devices are built on foundation models from third parties, and the paper returns to this repeatedly. Question 24 puts it directly: "For devices built on third-party foundation models, changes to the underlying model may be initiated by the third-party model developer rather than the device manufacturer. How can a manufacturer detect, evaluate, and respond to such changes in a timely manner?" It asks whether contractual, technical or predetermined change control plan (PCCP) mechanisms could provide assurance.

The paper also seeks feedback on the feasibility of voluntary Foundation Model Device Master Files (MAFs), built on the FDA's existing Device Master File programme. Foundation model developers and platform providers could submit information such as model cards or system cards, which the FDA would hold confidentially and device sponsors could reference with the file holder's permission. A footnote lists examples of what might be included, among them known limitations and failure modes, results on healthcare-relevant benchmarks and update notification commitments. Submitting one would not authorise the model for any use, and manufacturers would remain responsible for demonstrating their own device is safe and effective. The paper acknowledges the weakness in its question 25: "model developers may have limited incentive to disclose safety-relevant information."

Trading premarket evidence for postmarket monitoring

In question 18, CDRH says it is considering whether it may be appropriate to "accept greater premarket uncertainty" about a device's benefit-risk profile "through greater reliance on postmarket monitoring". It asks what a monitoring programme would need to justify reduced premarket evidence, and for which device types or risk profiles the approach would not be appropriate. Question 20 asks whether postmarket monitoring approaches can be "facilitated by machine-based supervisory agents", and how the reliability of those agents would itself be evaluated.

How to respond

Feedback goes to docket FDA-2026-N-7874 on Regulations.gov by 19 October 2026. The FDA invites comment from manufacturers, clinicians, researchers and the public.