FDA Opens Comment Window on Generative AI Medical Device Rules

A New Regulatory Conversation Begins

The Food and Drug Administration has opened a formal public conversation about how it might eventually regulate generative artificial intelligence in medical devices, publishing a discussion paper on Aug. 18, 2026, that raises far more questions than it answers 19. The paper, titled "Considerations for the Regulation of Generative AI-Enabled Medical Devices," was produced by the Digital Health Center of Excellence within the FDA's Center for Devices and Radiological Health, and it explicitly is not draft or final guidance 914. It creates no new legal obligations and does not even attempt to settle whether the ideas it floats fall within the agency's current authority 910. Comments are due by Oct. 19, 2026, under docket FDA-2026-N-7874 1913.

Officials frame the effort as both a domestic and global undertaking. Acting Commissioner Kyle Diamantas said the United States "must lead in shaping how this technology is developed and used safely and responsibly," while CDRH Director Michelle Tarver described the initiative as a transparent process that could serve as "a potential model for regulators around the world" 1112. Digital Health Center of Excellence Director Rick Abramson, who took over the office in February, called generative AI-enabled devices poised to "reshape the health technology landscape," adding that the agency has a responsibility to provide "thoughtful leadership for this new era" 311. The initiative also dovetails with the current administration's stated priority of using AI to speed innovative medical products to market 113.

The Core Proposal: A Two-Axis Risk Framework

At the heart of the discussion paper is a possible two-axis risk framework for calibrating regulatory scrutiny 1014. One axis would weigh the clinical significance of a device's output — whether it is merely informational, diagnostic or therapeutic. The second would weigh the system's degree of autonomy, ranging from tools that keep a clinician firmly in the loop to systems that act with little or no human oversight 1013. This dual calibration is meant to extend the agency's existing total product life cycle approach, under which oversight intensity is supposed to track a device's intended use and technical characteristics 1011.

The framework acknowledges a problem unique to generative systems: they are non-deterministic. Unlike traditional locked software, a generative model may not produce the same output twice, can "confabulate" or hallucinate convincing but false information, and may drift in performance as data, users or clinical settings change over time 1215. The FDA's paper explicitly lists these risks — hallucinations that look authentic, unclear boundaries on intended use, degradation over time and limited visibility into how underlying models actually work — as reasons GenAI devices cannot simply be evaluated the way conventional software has been 12.

Testing AI Like It's a Medical Resident

For premarket evaluation, the agency's most novel idea is a competency-based assessment, conceptually modeled on how physicians are trained and licensed rather than on how static software is validated 310. The approach would combine two stages: nonclinical benchmarking, which tests a device's baseline accuracy and reliability against standardized cases, followed by clinical confirmation, which evaluates the finished, user-facing product in real or simulated clinical use before it reaches patients 1015. Rather than attempting to test every conceivable input a generative system might encounter — an impossible task given the scale of these models — the FDA appears to be leaning toward representative case testing paired with a doctor-style credentialing philosophy 12.

The amount and type of evidence required would likely scale with the consequences of a wrong output and the device's specific intended use, an approach the paper presents for feedback rather than as settled policy 15.

Postmarket Monitoring: The Harder Half of the Problem

If premarket evaluation is complicated, postmarket oversight may be even more so. The FDA is weighing risk-proportionate monitoring obligations that would track adverse events, hallucinations and unexpected outputs after a device is deployed 1015. Crucially, the agency is asking whether manufacturers should be responsible not only for monitoring their own branded product but also the third-party foundation model that may power it underneath 714. Because many device makers build on large, pre-trained foundation models they do not themselves control, the paper raises pointed questions about transparency, accountability and how regulatory responsibility should be divided across a supply chain that may span multiple companies 1014.

One concept floated is a voluntary program in which foundation-model developers could confidentially file "model cards" or "system cards" with the FDA, which device makers building on those models could then reference — though the agency itself flags the incentive problem, since model developers "may have limited incentive to disclose safety-relevant information" 12. The paper also introduces agentic AI systems — software capable of autonomously planning and executing multistep tasks or using external tools — as a category demanding its own regulatory thinking, distinct from simpler generative tools that merely summarize or draft text 101514.

The Washington Times coverage highlighted a related tension embedded throughout the document: generative AI could democratize access to clinical information for patients, but patients generally lack the training to catch a confidently wrong answer, whereas treating all patient-facing AI as automatically higher-risk could block tools that genuinely empower patient engagement 12.

Why Radiology Is the Proving Ground

While the new paper addresses generative AI broadly, imaging remains the dominant real-world testbed for AI oversight at the FDA. A systematic review published in JAMA Network Open found that of 950 AI/ML devices authorized through June 2024, 723 — or 76% — were radiology devices 1920. Industry trackers report the pace has only accelerated: MedTech Dive noted 331 AI devices were authorized in 2025 alone, the most in agency history, pushing the cumulative total past 1,400 devices since 1995 8. Other trend analyses put full-year 2025 authorizations at roughly 295 clearances, with radiology again accounting for the large majority 7.

That volume has not been matched by rigorous clinical testing. The JAMA review found that among radiology devices with available submission documentation, only 29% incorporated clinical testing, just 5% underwent prospective testing, and only 8% included a human operator in the testing process; a mere six devices combined prospective testing, clinical testing and human-in-the-loop evaluation 1920. Ninety-seven percent of all AI/ML devices were cleared through the 510(k) pathway, which requires demonstrating substantial equivalence to an existing device rather than independent proof of clinical performance 1920. The researchers concluded that FDA clearance and genuine clinical generalizability are not the same thing, and pointed to studies showing that AI assistance helps strong-performing radiologists more than weaker ones — a heterogeneity that complicates blanket claims about AI's clinical benefit 19.

Building on Existing Guidance

The discussion paper does not arrive in a vacuum. It builds on a January 2025 draft guidance covering the lifecycle of AI-enabled device software functions, which already asked manufacturers to address data drift, cybersecurity, bias and postmarket performance monitoring 1617. It also follows the FDA's final guidance on Predetermined Change Control Plans, which lets manufacturers pre-authorize specific future AI updates — covering both fleet-wide and site-specific adaptations — without filing an entirely new marketing submission for every change, provided updates stay within the approved plan 18. Separately, the agency has continued loosening related rules, including draft guidance clarifying when clinical decision-support software is exempt from device regulation altogether, part of a broader effort to speed AI and wearable products to market 5.

What Comes Next

For now, nothing changes for patients, hospitals or manufacturers. The FDA has been explicit that the paper sets no expectations for future marketing submissions and does not resolve whether new legal authority would even be needed to implement any of the ideas discussed 910. The agency is inviting device manufacturers, clinicians, researchers and the general public to weigh in, and stakeholders are not required to answer every question posed in the document 915. Legal advisers are already urging companies to audit their product portfolios against the proposed two-axis framework, scrutinize contracts with foundation-model suppliers, and map existing validation programs onto the competency-assessment concept before the October deadline 1014.

What happens after the comment period closes will determine whether this becomes the foundation for binding guidance or simply one more data point in a rapidly evolving conversation about how to police software that, unlike anything the FDA has regulated before, can generate new answers and keep changing after it reaches a hospital's servers.