The FDA released a discussion paper inviting public input on regulating generative AI-enabled medical devices, focusing on risk assessment, premarket evaluation, postmarket monitoring, and related regulatory topics as part of keeping pace with rapid digital health innovation.

A core proposal calls for competency-based assessment, combining nonclinical benchmarking with clinical confirmation to gauge performance before market entry, while acknowledging that benchmarks alone may not capture real-world prompts and scenarios.

The effort aims to set a global example and potentially shape regulatory approaches worldwide as part of a broader strategy to modernize oversight for digital health technologies.

The plan recognizes that updates from external models or data sources are hard to manage, suggesting predetermined change control plans to handle updates without triggering a new marketing submission for every change.

Legal and procurement teams are urged to tighten clauses on model updates, retraining, and changes that could modify how a device behaves clinically.

Practical pressure tests for organizations include assembling evidence, designing monitoring, and enforcing change control across procurement and product development.

Premarket validation cannot guarantee identical behavior after updates; therefore postmarket monitoring, periodic re-benchmarking, clinician reviews, incident investigations, and maintaining detailed version histories are essential.

Experts stress the need for clear definitions, scope, and guardrails to prevent unintended legal and clinical consequences.

Governance must cover the entire technology stack, including hardware, software, cloud services, and external models, with updates, validation access, version control, audit logs, and robust cross-ecosystem monitoring.

Strategic recommendations include weaving regulatory considerations into engineering workflows, automating traceability, drafting PCCPs early, integrating SBOM/security checks in CI/CD, and performing QMSR gap assessments.

Governance needs for foundation models and agentic AI systems are highlighted, particularly around update rights and revalidation needs.

Risks cited include model hallucinations, unclear intended use bounds, limited visibility into third-party foundation models, and potential performance degradation over a product’s life cycle.