FDA's Comment Window on Generative AI Medical Devices Closes October 19

The U.S. Food and Drug Administration (FDA) is taking public feedback until October 19, 2026 on how it might regulate medical devices that use generative AI. Generative AI is a kind of AI that creates new content, such as text, images or audio. The agency's device center released a discussion paper on August 18, 2026. The paper poses 26 questions. Comments go to docket FDA-2026-N-7874 on Regulations.gov.

The paper is not a rule. In its own words, it is for discussion only and does not represent draft or final guidance. It says it does not propose policy changes or set out what evidence the FDA will expect. It also does not address whether the agency has the legal authority for the approaches it describes. The AI in Medicine Regulation Tracker lists it among the FDA's steps on medical AI.

In the FDA's announcement, device center director Michelle Tarver said patients and clinicians deserve a regulatory approach that keeps pace with rapid innovation.

Why does generative AI need a different approach?

The paper says these devices behave differently from the software the FDA usually reviews. They may accept open-ended inputs, perform several subtasks and give different answers to similar inputs. Some can change over time as their underlying model, prompts or guardrails are updated.

Many are built on foundation models. These are large, general-purpose AI models, often made by other companies, that can be adapted to specific uses. The paper notes that those developers offer varying levels of transparency into training data and testing. That can make it hard to tell whether an error comes from the device or the model beneath it.

The risks the paper lists include:

• Hallucinations, which it also calls confabulations: wrong outputs that may look authentic to users.
• Blurred limits, meaning uncertainty about the bounds of what a device is meant to do.
• Hidden parts, with limited visibility into third-party models.
• Degrading performance, both across test settings and in real-world use.

Review of software with fixed outputs has traditionally relied on testing a representative sample of inputs and outputs. For generative AI, the paper says, the range of possible inputs and outputs may be too large for that to be practical.

How would the FDA judge the risk?

The paper floats a two-axis framework as a possible organizing tool. One axis is how independently a function acts. It runs from giving information that does not direct an action to acting fully on its own. The other axis is how severe the harm could be if someone relies on a wrong output. Risk rises toward the corner where both are high.

In the paper's examples, a wrong suggestion about an over-the-counter remedy for a minor symptom differs from a wrong suggestion about an insulin dose. A tool that advises a parent about a child's sore throat differs from one that tells a patient with chest pain whether to go to the emergency department.

The FDA is considering treating "action-directing" functions, which steer a user toward a step, as higher risk than plain information. Some functions take action, such as assigning a diagnosis or prescribing a medication. The FDA is considering that these are typically higher risk than ones that only inform.

The agency is also considering whether a line such as "talk to your doctor" leaves advice just as directive. Other questions cover chats that drift from information into instructions over many turns. For triage tools, the paper says both under-escalation and over-escalation matter. Over-escalation, it says, can lead to anxiety, unnecessary tests and needless emergency visits.

What is a competency-based review?

For review before a device goes on sale, the FDA describes an approach loosely inspired by how doctors are trained and licensed. It would have two parts:

• Device benchmarking. Non-clinical tests of the device's clinical knowledge, safety behavior and communication. They would also check whether results hold up across inputs and patient groups. Agentic devices, which plan and carry out multi-step tasks, would face extra tests.
• Clinical confirmation. Evidence that the device works for its intended patients under real or clinically realistic conditions.

The test subject would be the finished device as it would actually be used, not the foundation model alone. Where experts grade outputs, the paper says they would be independent of the device maker and of any outside model developer. That would apply even if the grader is itself a large language model.

Clinical confirmation might not need a prospective clinical study every time. The paper lists options in rough order of rigor and patient exposure:

• testing on previously collected patient data
• "shadow" use on real patients, with outputs hidden from clinicians and patients
• trained actors playing patients in set scenarios
• independent clinician review of real cases
• a prospective study, in some cases a randomized controlled trial

What happens after a device reaches the market?

The FDA is considering whether to accept more uncertainty before authorization in return for greater reliance on monitoring afterward. Options include periodic re-testing against the original benchmarks, sample reviews by independent clinicians and monitoring for performance decline.

After launch, changes to a foundation model may come from its developer rather than the device maker. FDA guidance already covers predetermined change control plans for AI-enabled devices. Such a plan describes planned changes in advance, so the changes it covers do not each need a new submission. The paper asks how that idea could work when future changes cannot be fully spelled out.

It also floats voluntary foundation model master files, based on an existing FDA program. Model developers could send the FDA information such as model cards, which are structured summaries of how a model was built and tested. The FDA would keep the files confidential. Device makers could cite those files with the developer's permission. Filing one would not count as FDA authorization of the model.

How does the UK's plan compare?

On October 14, 2026, the Medicines and Healthcare products Regulatory Agency (MHRA) published its 2030 strategy. Its explainer for medical technology firms sets goals for regulating AI as a medical device by 2030. They include continuous real-world monitoring, staged authorization and expanded change control plans. They also include exploring foundation model master files.

The explainer says the MHRA will set up a Centre for AI and Digital Health. It also says the agency will work with the FDA to explore mutual recognition for medical devices. An earlier article covers the UK government's response on regulating health AI.

What comes next?

The FDA has not said when it will act on the feedback. The paper says comments may inform the development of further policy. On October 17, 2026, the FDA's page still gave October 19 as the deadline. Medical Device Network, AuntMinnie and AHA News reported the paper when it came out in August.

Other FDA work on AI devices is still open. Its January 2025 draft guidance on the full life cycle of AI-enabled devices was still marked as a draft on October 17, 2026. The FDA also says it will explore ways to tag devices on its list of AI-enabled devices that incorporate foundation models.