FDA GenAI Medical Device Regulation 2026: Competency-Based Approach, Risk Assessment, Premarket Evaluation & Postmarked Monitoring Guide

FDA Discussion Paper on Generative AI Medical Devices, Competency Assessment, Risk Framework, Foundation Models, Agentic AI & Regulatory Readiness

Generative artificial intelligence (GenAI) is rapidly changing the development of medical software and digital health technologies, creating new opportunities for diagnosis, clinical decision support, medical imaging, documentation, patient communication, and other healthcare applications.

On 18 August 2026, the U.S. Food and Drug Administration (FDA) issued a discussion paper titled “Considerations for the Regulation of Generative AI-Enabled Medical Devices: Discussion Paper and Request for Feedback.”

The paper seeks stakeholder input on how the FDA could approach the regulation of GenAI-enabled medical devices, including risk assessment, premarket evaluation, postmarked monitoring, foundation models, agentic AI, and other regulatory considerations.

The FDA defines GenAI as a class of AI models that can generate derived synthetic content from input data, including images, video, audio, text, and other digital content.

Importantly, the document is a discussion paper only. It is not draft or final guidance, does not establish new regulatory requirements, and does not communicate final FDA expectations for future marketing submissions. Instead, it is intended to obtain early stakeholder input and inform potential future regulatory approaches.

Why FDA GenAI Medical Device Regulation Matters

Key regulatory areas include:

• GenAI medical-device identification
• Intended-use assessment
• Risk characterization
• Device autonomy
• Clinical consequences of incorrect outputs
• Premarket evaluation
• Competency assessment
• Non-clinical benchmarking
• Clinical confirmation
• Postmarked monitoring
• Performance drift
• Foundation-model considerations
• Agentic AI
• Human oversight
• Software and model changes
• Total product lifecycle management

GenAI-enabled devices may introduce unique risks compared with traditional software and conventional AI-enabled devices because outputs can be variable, generated dynamically, and influenced by broad or open-ended inputs.

FDA Regulatory Oversight

1. U.S. Food and Drug Administration — FDA

The FDA regulates medical devices in the United States under applicable federal law and established medical-device frameworks.

Depending on the product's intended use, risk, technology, and classification, applicable premarket pathways may include:

• 510(k)
• De Novo
• Premarket Approval (PMA)

The appropriate pathway depends on the characteristics and regulatory classification of the specific device.

2. Center for Devices and Radiological Health — CDRH

CDRH leads FDA's regulation of medical devices and is responsible for the current GenAI regulatory discussion.

3. Digital Health Center of Excellence — DHCoE

The FDA's Digital Health Center of Excellence within CDRH is leading the discussion paper and broader regulatory-science activities involving digital health and AI-enabled technologies.

What Is a GenAI-Enabled Medical Device?

Companies should first determine whether GenAI functionality is incorporated into a product that meets the applicable definition of a medical device.

Potential applications may include:

• Diagnostic assistance
• Clinical decision support
• Medical image analysis
• Clinical documentation
• Patient-specific information
• Treatment support
• Medical information generation
• Multimodal analysis
• Patient communication
• Autonomous clinical activities

Regulatory assessment should focus on the complete medical-device system and its intended use, rather than if the underlying GenAI or foundation model alone determines regulatory risk.

FDA's Proposed Risk Assessment Framework

The discussion paper introduces a possible two-axis framework for assessing risk.

The framework considers two major dimensions:

1. Level of independence or autonomy

This considers how independently the device operates and whether human users remain involved in reviewing or acting on outputs.

2. Consequences of incorrect output

This considers the potential impact if a user relies on an incorrect or inappropriate output.

A device producing general informational content may present different risks from a system generating recommendations that directly influence diagnosis or treatment.

The FDA suggests that the combination of autonomy and consequence could help inform a risk-proportionate regulatory approach.

This framework remains under discussion and does not currently establish new FDA requirements.

Competency-Based Premarket Evaluation

A central concept in the discussion paper is a potential competency-based approach to premarket evaluation.

The FDA describes an approach inspired at a high level by how physicians are trained and evaluated.

Rather than attempting to evaluate every possible GenAI output, the proposed concept would assess whether the complete device demonstrates the competencies necessary for its intended use.

The proposed approach includes two major components:

Non-clinical device benchmarking

Clinical confirmation

The objective would be to determine whether the device performs as intended before it reaches patients.

Non-Clinical Device Benchmarking

Device benchmarking could provide a scalable method for assessing the performance of GenAI-enabled medical devices.

Potential areas for assessment may include:

• Clinical knowledge
• Analytical performance
• Safety behavior
• Communication
• Generalizability
• Consistency
• Response to uncertainty
• Performance across diverse scenarios
• Relevant device-specific competencies

Manufacturers may therefore need to establish structured datasets, benchmark scenarios, performance criteria, safety tests, and reproducible evaluation methods.

The focus would be on the device as deployed, rather than simply measuring the performance of an underlying foundation model.

Clinical Confirmation

The second element of the proposed competency-based framework is clinical confirmation.

Clinical confirmation could help determine whether competency demonstrated during non-clinical testing translates appropriately into real-world clinical use.

Potential evidence approaches could depend on the device's risk and intended use and may involve:

• Retrospective studies
• Prospective clinical studies
• Clinician assessment
• Clinical simulations
• Structured user interactions

The required evidence would potentially become more rigorous as the consequences of incorrect outputs and the device's autonomy increase.

Foundation Models

Many GenAI-enabled medical devices may depend on third-party foundation models.

This introduces additional regulatory considerations because manufacturers may not control the underlying models:

• Architecture
• Training data
• Training methodology
• Model updates
• Performance characteristics
• Safety controls
• Version changes

The FDA discussion paper considers whether mechanisms such as a potential Foundation Model Master File could provide information useful for regulatory review.

Manufacturers using third-party foundation models should therefore consider model version control, supplier agreements, update notifications, documentation access, validation responsibilities, and monitoring of model-related changes.

Agentic AI Medical Devices

The discussion paper also considers agentic AI systems.

Agentic GenAI systems may have greater ability to plan and execute multi-step tasks, interact with external tools, or take actions with reduced human intervention.

Companies should therefore assess:

• Autonomy
• Human oversight
• Tool access
• External-system interaction
• Action authorization
• Failure modes
• Escalation mechanisms
• Audit trails
• Intervention controls

The FDA is seeking stakeholder feedback on whether agentic systems require additional regulatory considerations because of their ability to perform actions beyond simply generating information.

Postmarked Monitoring

GenAI-enabled devices may evolve after commercialization through:

• Software updates
• Model updates
• Retraining
• Prompt modifications
• Retrieval-system changes
• Guardrail changes
• Third-party model updates

These changes could affect safety and performance.

The FDA is therefore considering risk-proportionate postmarked monitoring approaches for GenAI-enabled devices, including monitoring for performance changes and potential drift.

Companies should establish lifecycle controls that connect model/software changes with validation, risk assessment, monitoring, complaint handling, and regulatory assessment.

Change Control & Lifecycle Management

GenAI devices require effective change-management strategies because modifications may affect the device's behavior.

Companies should evaluate changes involving:

• Model versions
• Training or retraining
• Prompts
• Data sources
• Retrieval systems
• Guardrails
• User interface
• Autonomy
• Clinical functionality

Where appropriate, manufacturers should assess existing FDA mechanisms for managing anticipated AI/ML software changes, including Predetermined Change Control Plans (PCCPs).

FDA GenAI Regulatory Readiness Assessment

FDA GenAI Compliance Roadmap

Common FDA GenAI Compliance Challenges

Companies may face:

• Unclear intended use
• Uncertain regulatory classification
• Insufficient risk characterization
• Inadequate benchmarking
• Limited clinical confirmation
• Poor generalizability assessment
• Weak model-version control
• Third-party foundation-model dependencies
• Insufficient human oversight
• Uncontrolled model updates
• Weak postmarked monitoring
• Failure to detect performance drift
• Insufficient controls for agentic functions

Best Practices & Common Mistakes

Organizations developing GenAI-enabled medical devices should define intended use early, characterize autonomy and clinical consequences, establish a risk-based development strategy, develop structured benchmarking, plan appropriate clinical confirmation, document foundation-model dependencies, implement human oversight, establish change control, and prepare postmarked monitoring mechanisms.

Avoid treating the underlying foundation model as equivalent to the final medical device, relying exclusively on generic AI benchmarks, failing to evaluate clinical consequences, overlooking model changes, or if the discussion paper represents current binding FDA requirements.

The FDA expressly states that the paper is intended for discussion purposes and does not establish new regulatory requirements or communicate final expectations for future marketing submissions.

Business Benefits of FDA GenAI Regulatory Readiness

Future Trends

FDA's GenAI regulatory approach is likely to continue emphasizing:

• Risk-based regulation
• Competency assessment
• Device benchmarking
• Clinical confirmation
• Real-world performance
• Performance drift
• Foundation-model transparency
• Agentic AI oversight
• Human factors
• Change control
• Postmarked monitoring
• Total product lifecycle management

The August 2026 discussion paper signals FDA's interest in developing a regulatory approach capable of addressing the variable outputs, evolving models, and increasing autonomy associated with GenAI-enabled medical devices.

Frequently Asked Questions

1. What did FDA announce in August 2026?

On 18 August 2026, FDA issued a discussion paper seeking feedback on considerations for regulating GenAI-enabled medical devices.

2. Is the FDA GenAI discussion paper a regulation?

No. It is a discussion paper and does not represent draft or final guidance or establish new regulatory requirements.

3. What is the competency-based approach?

It is a potential premarket evaluation framework centered on non-clinical device benchmarking and clinical confirmation.

4. What is device benchmarking?

It is a proposed method for assessing whether the complete GenAI-enabled device demonstrates competencies relevant to its intended use.

5. What is clinical confirmation?

Clinical confirmation would help establish whether the device performs appropriately in relevant clinical contexts.

6. What is FDA's proposed risk framework?

The discussion paper presents a possible two-axis framework considering the device's level of independence/autonomy and the consequences of relying on incorrect output.

7. Does FDA currently require a Foundation Model Master File?

No. The discussion paper raises foundation-model information and potential mechanisms for discussion; it does not establish such a requirement.

8. What is agentic AI?

Agentic AI refers to GenAI-enabled systems capable of performing or coordinating multi-step activities, potentially including interactions with external tools or systems.

9. Why is postmarked monitoring important?

GenAI devices can change through models, software, data, prompt, retrieval, or third party-model updates. Monitoring can help identify performance changes or drift.

10. When are comments due?

Stakeholder comments should be submitted under Docket FDA-2026-N-7874 by October 19, 2026.

11. Who can submit feedback?

FDA encourages feedback from manufacturers, clinicians, researchers, consumers, the public, and other interested stakeholders.

12. How should manufacturers prepare?

Begin with intended-use definition, classification, risk assessment, benchmarking, clinical confirmation, foundation-model assessment, human oversight, change control, and postmarked monitoring.

13. How can Maven Regulatory Solutions help?

Maven Regulatory Solutions can support FDA GenAI regulatory strategy, medical-device classification, AI/ML regulatory assessment, risk assessment, premarket evidence planning, benchmarking strategy, clinical evidence planning, PCCP strategy, postmarked monitoring, regulatory gap assessments, and global digital-health regulatory strategy.

Conclusion

Generative AI is creating a new generation of medical-device technologies, but its variable outputs, evolving models, third-party dependencies, and increasing autonomy create regulatory questions that may not be fully addressed by conventional approaches.

FDA's 18 August 2026 discussion paper represents an important step toward exploring a regulatory framework specifically suited to GenAI-enabled medical devices.

The proposed concepts include a two-axis risk framework, competency-based premarket evaluation, non-clinical device benchmarking, clinical confirmation, risk-proportionate postmarked monitoring, foundation-model considerations, and agentic AI oversight.

For manufacturers, the immediate takeaway is not that these proposals are already mandatory. Instead, the paper provides an important indication of the regulatory questions FDA is currently examining.

Companies developing GenAI-enabled medical devices should therefore proactively assess intended use, risk, device competency, clinical evidence, model dependencies, human oversight, change control, and real-world performance.

Early regulatory planning can help manufacturers identify evidence gaps, improve submission readiness, strengthen lifecycle controls, and prepare for the evolving FDA regulatory landscape surrounding GenAI-enabled medical devices.

Why Choose Maven Regulatory Solutions?

Maven Regulatory Solutions supports medical-device and digital-health companies with FDA regulatory strategy, GenAI/AI-enabled device assessment, product classification, risk-based regulatory planning, premarket submission strategy, AI/ML evidence planning, benchmarking strategy, clinical evaluation planning, PCCP assessment, postmarked monitoring, regulatory gap assessments, and global digital-health market access.

Our technology-focused regulatory approach helps organizations translate emerging FDA developments into practical, risk-based, and lifecycle-oriented regulatory strategies for innovative AI-enabled medical devices.