FDA Starts Shaping the Rulebook for Generative AI Medical Devices

The U.S. Food and Drug Administration (FDA) has opened a new regulatory discussion around one of the hardest problems in medical AI: how do you regulate a medical device when the underlying technology can generate different outputs, evolve over time and rely on third-party foundation models?

On August 18, 2026, the FDA released its discussion paper, Considerations for the Regulation of Generative AI-Enabled Medical Devices, and requested public feedback on risk assessment, premarket evaluation, postmarket monitoring, foundation models and agentic AI.

The deadline for comments is October 19, 2026, under docket FDA-2026-N-7874.

The distinction is important: this is not a new FDA regulation or final guidance. FDA explicitly says the paper is for discussion purposes and does not establish proposed or final regulatory expectations, implement policy changes, or determine whether additional legal authority would be required.

But it is an important regulatory signal.

Why GenAI changes the regulatory problem

FDA already has significant experience with AI-enabled medical devices.

In January 2025, the agency said it had authorized more than 1,000 AI-enabled medical devices through established premarket pathways. By November 2025, an FDA Digital Health Advisory Committee transcript referred to more than 1,200 authorized AI-enabled devices.

Generative AI introduces a different set of challenges.

Traditional AI-enabled devices are often built around defined functions, such as detecting an abnormality in an image or classifying a clinical finding.

GenAI systems can generate new text, images or other outputs and may rely on large foundation models that can be adapted to multiple applications. The FDA has previously highlighted concerns including variable outputs, model changes, hallucinations and the difficulty of evaluating systems whose behaviour may not be completely predictable from a fixed test set.

For a medical device, those characteristics matter because safety cannot be established solely by showing that an algorithm performs well on a static benchmark.

The FDA’s new paper therefore focuses on the device’s intended use, risk and performance as a system, rather than treating the underlying model as the entire product.

FDA’s proposed direction: a two-axis risk framework

One of the paper’s most significant proposals is a possible two-axis framework for assessing risk.

The objective is to help determine how much regulatory scrutiny a particular GenAI-enabled medical device should receive.

The FDA is not presenting this as a final classification system. It is asking stakeholders whether such an approach would work and what factors should determine risk.

That is significant because GenAI products can vary enormously.

A system that drafts administrative notes presents a different risk profile from one that generates information used to support a diagnosis, treatment decision or other high-impact clinical action.

The regulatory framework therefore needs to distinguish between different levels of potential patient harm rather than treating every GenAI medical application in the same way.

The FDA’s most interesting idea: “competency assessment”

For premarket evaluation, the FDA discusses a potential approach based on competency assessment.

The concept is inspired, at a high level, by how physicians are trained and evaluated.

Instead of evaluating only whether an underlying AI model achieves a particular technical score, the agency is considering whether the GenAI-enabled medical device is competent to perform its intended function.

The paper describes two potential components:

Non-clinical device benchmarking
Clinical confirmation

The aim would be to determine whether the complete device performs as intended before it reaches patients.

This could mark an important shift in how GenAI medical devices are evaluated.

The relevant unit of assessment may increasingly be the whole clinical system, including the model, software, data, interface, safeguards and intended workflow, rather than model accuracy alone.

Foundation models create a chain-of-responsibility problem

Another issue the FDA is explicitly examining is the role of foundation models.

A medical-device manufacturer may not develop the underlying large language model or multimodal model itself. Instead, it may build a medical application on top of a model developed by another technology company.

That creates a regulatory dependency.

If the foundation model changes, the medical-device developer may need to determine whether the change affects safety or effectiveness.

If the model provider changes its behaviour, who is responsible for validating the medical application?

And if several models or external tools are combined within an agentic system, how should the resulting device be evaluated?

The FDA’s discussion paper specifically asks stakeholders to consider these issues, including the implications of foundation models and agentic AI systems.

Postmarket monitoring could become critical

The FDA is also signalling that premarket testing will not be enough.

In 2025, the agency separately requested public comment on how to measure AI-enabled medical-device performance in real-world use. FDA noted that many devices are evaluated through retrospective testing or static benchmarks, but those methods may not predict performance in changing clinical environments.

The agency specifically identified performance drift, including changes in inputs and outputs, as an area requiring better monitoring.

That concern becomes even more important with GenAI.

A medical AI system may encounter new patient populations, different clinical workflows, new data distributions or changes to the underlying model after deployment.

The FDA’s new discussion paper therefore considers risk-proportionate postmarket monitoring as part of the regulatory framework.

The direction is clear: FDA increasingly sees AI-device oversight as a lifecycle problem, not a one-time approval event.

This builds on an existing FDA strategy

The August 2026 paper is the latest step in a regulatory approach that has been developing for years.

In 2021, FDA released its AI/ML-based Software as a Medical Device Action Plan, describing a total product lifecycle approach to AI oversight.

In December 2024, FDA finalized guidance on Predetermined Change Control Plans (PCCPs) for AI-enabled device software. PCCPs are designed to allow certain planned AI modifications while maintaining reasonable assurance of safety and effectiveness.

In January 2025, FDA issued draft guidance covering lifecycle management and marketing-submission recommendations for AI-enabled device software. The agency specifically addressed post market performance monitoring, transparency, and bias.

The GenAI discussion paper therefore represents an extension of an existing regulatory trajectory rather than a completely new FDA policy.

What changes for medical-AI companies?

The immediate legal requirements have not changed because of this paper.

However, the direction of travel matters for companies developing GenAI medical devices.

Intended use becomes even more important

Companies will need to clearly define what the device is designed to do and the clinical decisions it is intended to support.

Model performance will not be enough

Validation may increasingly need to demonstrate that the complete device performs reliably in its intended clinical context.

Model changes need a regulatory strategy

Companies using continuously updated or third-party models should be able to identify what can change, how those changes affect risk and how they will be validated.

Postmarket monitoring should be designed early

Manufacturers should consider how they will detect performance changes, unexpected outputs and emerging failure modes after deployment.

Third-party AI dependencies matter

A medical-device company’s regulatory risk may extend beyond software it directly controls when its product depends on an external foundation model.

The bigger regulatory shift

The most important development is not that FDA has suddenly “regulated GenAI.”

It has not.

The important development is that the agency is now formally asking how its existing medical-device framework should adapt to AI systems that can generate, change and operate in ways that traditional software does not.

FDA CDRH Director Michelle Tarver said the agency wants an approach that “keeps pace with the rapid innovation of digital health technologies” while protecting patients and supporting innovation.

That is the regulatory challenge in one sentence.

The FDA has already authorized more than 1,200 AI-enabled medical devices, but GenAI raises questions that static performance testing cannot fully answer.

The next phase of medical-AI regulation is therefore likely to focus less on whether an AI model works once and more on whether a medical AI system remains safe, effective and appropriately controlled as it is deployed, updated and used in the real world.

For companies building GenAI medical devices, that makes regulatory strategy part of product architecture, not simply a submission-stage exercise.

The FDA has not written the GenAI rulebook yet. With this discussion paper, it has started asking the industry what that rulebook should contain.

Sources

Author

Surbhi Ashri

FDA Starts Shaping the Rulebook for Generative AI Medical Devices