FDA Seeks Input for Regulating GenAI-Powered Medical Devices

The U.S. Food & Drug Administration (FDA) is seeking feedback on a regulatory framework that could be used to evaluate generative artificial intelligence (GenAI)-enabled medical devices. Such devices could create new types of risks because their outputs can vary and evolve, unlike more traditional software-enabled devices. An August 18, 2026, discussion paper (“Considerations for the regulation of GenAI-enabled medical devices”) discusses potential regulatory considerations for GenAI-enabled medical devices. 

The FDA’s Center for Devices and Radiological Health (CDRH) says its goal is to develop a nimble regulatory approach that ensures patients have timely access to safe and effective medical devices.  

Medical- device manufacturers that are developing or deploying GenAI tools with any clinical function — as well as academic medical centers where research into such tools is conducted — should review the paper and consider weighing in during the comment period. Comments are due by October 19, 2026. 

Four Key Topics Outlined in FDA’s Discussion Paper  

1. User-Facing GenAI-enabled Medical Devices May Be More Regulated Under New Guidance:

GenAI-enabled devices have unique characteristics and behaviors that are distinct from more traditional software-enabled devices. The FDA is signaling that AI used in medical devices may need to be regulated more carefully than other types of embedded software. For example, such devices might accept open-ended inputs, perform multiple subtasks, and produce variable outputs. In some cases, GenAI-enabled devices could evolve over time through changes to features such as the underlying model, prompts, retrieval strategies, guardrails, orchestration logic, and/or user interfaces. These characteristics can make it more difficult to confine a product's intended use, according to the FDA. The agency says manufacturers should carefully consider how to evaluate and monitor a GenAI-enabled device for its intended use, ensuring that accuracy, relevance, and reliability are maintained after deployment.  

The agency is also evaluating conversational GenAI-enabled devices. Such devices could produce outputs in the context of an extended exchange with a patient and move from an informational function to an action-directing conversation. The CDRH is assessing the risk of such devices across realistic conversational trajectories. The agency is also considering whether a patient-facing informational function is any less directive if it includes a “talk to your doctor” disclaimer. The paper acknowledges that some users might not be able to identify incorrect outputs and may rely on them to their detriment.  

Considerations for device manufacturers: Companies that have previously classified their GenAI-enabled tools as being outside FDA jurisdiction — or as subject only to enforcement discretion — should reevaluate that determination considering the FDA’s evolving position. Particular attention should be paid to:  

• Patient-facing applications that provide clinical or health information, even if framed as educational. 
• Conversational AI tools used in clinical settings. 
• Clinical documentation and administrative AI tools that also generate clinical content. 
• Any product where the AI output could foreseeably direct a patient or clinician toward a specific clinical action. 

2. A Two-Axis Framework Could Be Used to Evaluate Potential Risks:

The discussion paper outlines a possible "two-axis" risk framework. One axis (the activity axis) represents the degree and independence of the device’s functions. The other axis represents the consequences of potential harm from relying on an incorrect output from the device. Along the activity axis, the paper describes four positions: Informational/Non-Directive, Informational/Action-Directing, Action-Taking/HCP-Supervised, and Action-Taking/Fully Autonomous. A function that provides a risk score for a future cardiovascular event, for example, would be considered Informational/Non-Directive. A function that directs an action, such as a strongly worded recommendation to seek emergency care, would be considered Informational/Action-Directing. 

A GenAI-enabled "action-taking" function, such as the assignment of a clinical diagnosis, the prescription of a medication, or the initiation of a clinical order set, will generally carry greater risk than an informational function. However, the degree of risk is not uniform across all action-taking functions. The consequences axis plays a critical moderating role: autonomously prescribing antibiotics for a confirmed strep throat infection, for instance, poses a lower risk profile than autonomously initiating a thrombolytic therapy order set in a stroke workflow, even given similar levels of HCP supervision. This nuance matters for manufacturers, as it suggests that regulatory scrutiny of action-taking functions will be calibrated rather than categorical. Separately, the agency flags in vitro diagnostic, measurement, and signal processing functions as warranting heightened attention. Because users often cannot independently verify the basis for these outputs, the agency is considering placing such functions higher on the risk-consequences axis, even though they are non-directive in nature. 

Considerations for device manufacturers: The FDA is signaling that characterization of a device will be substance-and-context-driven, not label-driven. Medical devices (or features) that incorporate GenAI in a clinical workflow would be mapped against the risk framework. Companies should assess both pre- and post-submission whether their device outputs might be characterized as “action-directing” — even if the product is labeled or marketed purely as informational.  

3. GenAI Device Testing Could Be Analogous to Physician Credentialing:

In contrast to more traditional software and AI-enabled products that have bounded inputs and fixed outputs, GenAI-enabled medical devices offer a range of possible inputs and outputs. As such, these devices should undergo a different evaluation process, according to the FDA. The discussion paper outlines a competency-based approach for the premarket evaluation of GenAI-enabled devices that would be similar to the way physicians are assessed. The evaluation process would include benchmarking tests (akin to board exams) and real-world clinical performance confirmation (akin to supervised practice). This approach, which may need to be adapted for technical, practical, and legal considerations, could include two phases: 

Phase 1: Device Benchmarking: This process tests whether a device has the necessary clinical knowledge, analytical capabilities, safety behaviors, communication, and generalizability to be safe and effective. The paper states it does not anticipate that all benchmarking elements would apply to all devices. Instead, the elements would be chosen based on applicability to the device's intended use and risk profile. 

Phase 2: Clinical Confirmation: Manufacturers would be expected to provide evidence that a device performs as intended. Acceptable approaches may include retrospective evaluation of patient inputs, shadow deployment, standardized patient interactions, clinician adjudication of real cases, or — at the highest end — a prospective clinical study or randomized controlled trial.  

Considerations for device manufacturers: Under the model outlined in the discussion paper, medical device manufacturers would not evaluate the underlying foundation model used in a device in isolation. Rather, testing would be conducted on the final user-facing device, as configured and intended to be deployed for real-world use. Manufacturers should consider designing development programs that include a benchmarking infrastructure. This should include pre-specified evaluation methods, acceptance criteria, independent adjudicators, and, where appropriate, clinical-confirmation protocols. 

4. More Post-Market Monitoring May Be Needed:

FDA is considering whether it is appropriate to accept greater premarket uncertainty regarding a GenAI-enabled device's benefit-risk profile through greater reliance on post-market monitoring. This reflects the agency’s recognition that a premarket evaluation would likely be unable to fully capture the behavior of a device that can generate variable outputs and undergo changes over time, such as through intentional modifications, passive-model evolution, or third-party foundation model updates, any of which could affect safety and effectiveness. 

The discussion paper outlines three possible components of a post-market monitoring program: (a) periodic device re-benchmarking against pre-specified thresholds, (b) periodic sample-based clinician review of real-world inputs and outputs, and (c) performance-degradation monitoring to detect drift from changes in the input population, the data environment, or underlying model components. The FDA's post-market framework may be built around a Predetermined Change Control Plan (PCCP), a document that describes how a manufacturer intends to modify a device post-market. The PCCP could be used to facilitate certain device changes without requiring a new premarket submission. 

Considerations for device manufacturers: Device manufacturers should build post-market surveillance programs into their GenAI product infrastructure from the beginning. PCCP planning should begin during product design because the document must be submitted as part of the initial marketing authorization. 

The paper provides the FDA’s initial strategy around the regulation of GenAI in medical devices, suggesting a flexible approach. The FDA is “committed to working collaboratively with sponsors, clinicians, patients, health care institutions, and other stakeholders to develop efficient, scientifically sound, and least burdensome approaches to the premarket evaluation and post-market monitoring of GenAI-enabled devices.” This presents companies with a unique opportunity to help shape FDA’s regulatory oversight of GenAI-enabled medical devices.   

Crowell & Moring will continue to monitor for further guidance. Please reach out if you would like assistance in providing any comments to the FDA’s request.