FDA unveils two-axis risk model for GenAI medical devices
The gist
The FDA is rolling out a groundbreaking two-axis risk model to grade generative AI medical devices with the same rigor as human clinicians.
What to know
- The new framework demands both non-clinical benchmarking and clinical confirmation before GenAI devices hit the market.
- Regulatory scrutiny will now scale based on a device's potential for harm and its level of autonomy—not just what the AI can do, but who uses it and how.
- A public consultation is open through October 19, 2026, as the FDA seeks feedback on risk assessment, testing, and dynamic postmarket oversight for these evolving AI tools.
Clinician-Level AI Testing
The FDA is holding generative AI medical devices to a new standard by requiring both rigorous non-clinical benchmarks and real-world clinical validation, ensuring these tools perform safely for patients before approval.
The FDA is pioneering a competency-based evaluation framework for generative AI-enabled medical devices that mirrors the rigorous assessment methods used for clinicians. This approach requires manufacturers to demonstrate device proficiency through a two-pronged premarket process: non-clinical benchmarking using well-defined, published tests and datasets to establish baseline performance, followed by clinical confirmation involving real-world or simulated evaluations tailored to the device’s intended use. By focusing on the final user-facing device rather than the underlying foundation model, the FDA aims to ensure that these AI tools perform reliably and safely in practical healthcare settings before reaching patients.
Recognizing the limitations of traditional software testing for generative AI, which cannot fully replicate the diversity of clinical scenarios and patient interactions, the FDA’s competency-based model integrates both rigorous benchmark testing and clinical validation. This dual approach acknowledges that while benchmarking can measure accuracy and reliability at a fixed point, only clinical confirmation can confirm real-world efficacy and safety. This nuanced evaluation framework reflects a shift from conventional regulatory paradigms toward a more dynamic and clinically grounded assessment, ensuring generative AI devices maintain their competency as they evolve postmarket.
Risk Scales With Autonomy
Regulatory scrutiny now hinges on both the potential harm and the independence of AI devices, with oversight tailored to who uses the device and how critical its decisions are.
The FDA's proposed two-axis risk framework for generative AI-enabled medical devices innovatively balances clinical significance and autonomy to calibrate regulatory oversight. One axis assesses the severity of harm if a device’s output is incorrect, while the other gauges the degree and independence of the device’s activity, ranging from informational support to fully autonomous actions. This nuanced approach recognizes that an action-taking function does not inherently equate to the highest risk, as the potential for harm and the level of professional oversight critically influence risk classification.
Building on its established total product life cycle (TPLC) approach, the FDA’s two-axis framework ensures regulatory requirements are proportionate to both the device’s intended use and technological characteristics. It also incorporates contextual factors such as whether outputs are delivered to patients versus healthcare professionals or specialists versus generalists, acknowledging that identical outputs may carry different risk profiles depending on the user. This flexibility aims to tailor scrutiny appropriately, reflecting the complex realities of clinical environments and device deployment.
While the two-axis risk heuristic offers valuable insight into the FDA’s current thinking on device classification and enforcement discretion, it remains a non-binding guide rather than a formal regulatory mandate. The framework is designed to differentiate controls for devices that merely provide background information from those that independently influence treatment decisions, highlighting the agency’s intent to align regulatory rigor with potential harm and device autonomy. This ongoing public consultation process invites stakeholder feedback to refine risk assessment, premarket testing, and postmarket monitoring strategies.
Stakeholders Shape Oversight
The FDA’s open consultation seeks direct input on how to monitor and regulate generative AI’s unpredictable risks, signaling a shift toward flexible, risk-based postmarket surveillance.
The FDA has launched an exploratory public consultation running through October 19, 2026, inviting a broad range of stakeholders—including manufacturers, clinicians, and patients—to provide input on refining regulatory approaches for generative AI-enabled medical devices. This dialogue centers on four critical areas: risk assessment, premarket evaluation, postmarket monitoring, and other regulatory considerations unique to the non-deterministic nature of generative AI systems. Emphasizing that this process is not a binding rule or formal guidance, the FDA’s Digital Health Center of Excellence aims to gather diverse perspectives to shape future policies that address the variable, open-ended outputs these devices produce.
A particularly novel challenge highlighted in the consultation is how to effectively monitor both the generative AI model and its underlying foundation model after market entry, reflecting the complex, evolving nature of these technologies. The FDA is actively seeking feedback on balancing the depth of premarket evidence with risk-proportionate postmarket surveillance, including what data should be collected and the triggers for corrective actions. This nuanced approach acknowledges that traditional regulatory frameworks may not fully capture the dynamic risks posed by generative AI medical devices, prompting a reimagined oversight strategy tailored to their unique operational characteristics.