FDA AI Medical Device Consultation Leaves Hospital Monitoring Gap

What the FDA put on the table

On August 18, 2026, the Food and Drug Administration released a discussion paper on how it might regulate medical devices built on generative AI. It opened docket FDA-2026-N-7874, and comments were due October 19.811 The paper came from the Digital Health Center of Excellence inside the Center for Devices and Radiological Health. It poses 26 questions about risk assessment, premarket evaluation and postmarket monitoring. The agency says plainly that it is not guidance and does not change policy.7 One outlet dated the release August 25 rather than August 18.6 Most coverage, legal analyses and the agency's own press materials use August 18.1118

The paper's main ideas got consistent coverage. The first is a two-axis risk framework. One axis measures how independently a tool acts, from offering background information to taking autonomous steps such as starting a clinical order. The other measures how much harm a wrong output could cause.1120 The second is "competency-based" premarket review, loosely modeled on how physicians are credentialed. It pairs large-scale benchmarking with clinical confirmation. That confirmation could be a retrospective review, a "shadow deployment" that runs alongside care without affecting it, or a full prospective trial.618 The third is a voluntary Foundation Model Device Master File. Companies that build the underlying models could use it to share details with the FDA confidentially, but filing one would not count as authorizing the model.11

The most consequential idea in the paper is the one legal analysts at Arnold & Porter flagged. The FDA asks whether it could accept more uncertainty at authorization in exchange for stronger monitoring after a product reaches the market.18 That trade-off is the right lens for judging what the agency is asking and what it is leaving out.

The questions the docket doesn't reach

The headline gap is scope. As of early 2026, the FDA had not authorized any generative AI or large-language-model medical device.13 So the whole consultation is about a category that does not yet exist on the U.S. market. The FDA's AI-Enabled Medical Device List, meanwhile, had 1,614 entries as of its September 4, 2026 update.19 Those are mostly traditional "locked" algorithms, not generative systems.14 Counts differ by source and date. One policy brief cited more than 1,250 authorized devices as of July 2025, and a separate review counted more than 1,451 by the end of 2025.426 Every count points the same way: a large and growing base of deployed AI, much of it in imaging, that this docket barely touches.

The pace has not slowed while the comment period was open. In October 2026 alone, imaging trade press reported FDA clearances for:

• a tool that estimates fractional flow reserve from coronary CT angiography
• software that segments the aorta on chest CT
• a brain MRI tool that predicts whether mild cognitive impairment will progress to Alzheimer's disease14

Most AI devices reach the market through the 510(k) pathway, which requires showing "substantial equivalence" to a device already on the market.10 The Bipartisan Policy Center notes that ongoing postmarket monitoring requirements are more common for De Novo and PMA devices than for 510(k) clearances. It also concludes that the FDA's current tools do not add up to a comprehensive framework for monitoring AI in real-world settings.4

To be fair, the agency did ask about the installed base, just not in this docket. In September 2025 it requested comment on how to measure the real-world performance of AI-enabled devices. Its questions covered metrics, monitoring triggers, data sources and human-AI interaction, with comments due December 1, 2025.32 Congress also told the FDA, in the FY2026 appropriations, to assess within 90 days whether it needs new statutory authority to oversee AI devices after deployment.10 The coverage reviewed here does not describe a resulting policy from either effort. Nearly a year later, the generative AI paper still treats postmarket monitoring as an open question.

The authority question is also unresolved in the new paper itself. It explicitly does not address whether its approaches fall within the FDA's existing legal powers.7 Analysts at Applied Policy note that this leaves open real conflicts, such as Utah's state-run AI prescribing pilot, which the paper suggests could be a federally regulated device.13

Who does the monitoring?

If the FDA is willing to trade premarket certainty for postmarket vigilance, someone has to do the watching. Here the coverage is most revealing, because the paper asks how monitoring duties should be split among manufacturers, clinicians, health systems, professional societies and standards bodies, without proposing an answer.18

The evidence on hospital readiness is not encouraging. A recent review found that only 58.1% of hospitals in a national sample did any post-implementation monitoring in 2024, and most of those had no continuous drift detection.26 The same review cites survey data showing that 47.4% of hospitals did not evaluate accuracy after deployment and 51.4% had no bias assessment protocols.26 Its example of what can go wrong: a COVID-19 chest X-ray model that scored above 0.95 AUROC on open datasets fell to about 0.70 once deployed prospectively across hospitals.26 The Bipartisan Policy Center adds that some academic centers can monitor, but many lower-resourced and rural providers cannot.4

The institutions that do monitor show how much work it takes. Mayo Clinic has put 17 radiology algorithms into clinical practice since 2019. It now tracks usage, failure modes, data drift and user feedback on daily, weekly and yearly cycles. Its automated alerts have caught problems such as images no longer reaching the right algorithm.22 A regional group of five NHS trusts in southwest London built a shared monitoring dashboard and used it to drop underperforming tools and retrain staff.21 Radiology Business reports that changes as ordinary as a new scanner, a software update or a different CT slice thickness can cause drift. That is why one expert there argues hospitals need "clinical AI stewardship," not just IT infrastructure.23

The main stakeholders disagree on where the burden should sit. The American Hospital Association, in its December 2025 letter, wanted risk-based monitoring standards aimed at vendors and developers and warned against burdening end users. It also asked the FDA to state that monitoring standards would not cover clinical decision support tools excluded under the 21st Century Cures Act.1 Europe's radiologists start from the other side. European Society of Radiology consensus recommendations accept that legal responsibility rests with software providers but expect radiologists to help monitor. They call for systematic data collection at the institution level rather than voluntary reports from individual doctors.27 The EU AI Act makes that formal by assigning duties to deployers, including human oversight, keeping logs and reporting incidents.24 Its postmarket monitoring requirements for medical AI, however, may slip to August 2028 under a proposed amendment.28

Vendor compliance is no reassurance either. Kicky van Leeuwen noted that none of the 13 manufacturers visited by Dutch inspectors in 2023–2024 met postmarket surveillance requirements. She also questioned whether it is sustainable for every hospital to re-validate the same fracture-detection tool on its own.24 Independent efforts are emerging to fill the gap. In August 2026, ECRI expanded its Problem Reporting Network to capture errors and near misses involving AI tools, explicitly including diagnostic imaging.29 In the UK, the Royal College of Radiologists published step-by-step guidance on post-deployment monitoring for NHS departments.30

The patients the framework doesn't name

Commentators have pointed to other omissions. Medical Daily argues that the questions clinicians and companies are least likely to raise matter most: whether patients will be told when AI shaped their care, and what recourse they have when an AI-assisted recommendation is wrong.7 Psychologist David Ruttenberg notes that the paper never mentions neurodivergent users. He argues that devices used in psychiatric or developmental care should have to show comparable performance across neurotypes before clearance.16

The paper does recognize some patient-specific risk. It treats patient-facing functions as potentially higher risk because laypeople may not spot a wrong answer.11 It also asks whether a "talk to your doctor" disclaimer actually makes such a tool any less directive.20 Organized medicine wants the framework pushed further. The neurosurgeons' societies urged the FDA to judge risk by how strongly outputs influence clinical decisions, to assess whole multi-turn conversations rather than single replies, and to require safeguards that kick in when a model's confidence is low.12

The reading

The FDA deserves credit for a serious attempt to fit device regulation to software that does not behave the same way twice. Legal and industry commentators broadly agree on that.1718 But the debate is happening in the wrong order. The agency is designing a postmarket-heavy regime for generative systems it has not yet authorized. Meanwhile, the predictive tools already reading scans in U.S. hospitals sit under a monitoring framework that the FDA's own commentators call incomplete.413

The postmarket trade-off depends on whether the people asked to do the monitoring can actually do it, and on the agency's legal authority, which the FDA has so far left unaddressed.7 Until those questions are answered, accepting more uncertainty before approval could in practice shift the risk to hospitals that lack monitoring capacity. The survey data suggest that describes many of them.26