FDA Proposes 'Competency Assessment' Framework to Regulate Generative AI in Medical Devices

The U.S. Food and Drug Administration (FDA) has introduced a novel approach to regulating generative artificial intelligence in medical devices, proposing a "competency assessment" model that evaluates AI systems more like human clinicians than traditional software. For decades, medical software has been tested against rigid, predictable specifications, ensuring that a specific input always yields a specific, pre-programmed output. Generative AI shatters that paradigm by introducing open-ended reasoning, variable responses, and continuous adaptation. Recognizing that old regulatory tools cannot safely govern these dynamic systems, the FDA's new discussion paper outlines a framework designed to test an AI's underlying clinical judgment and reliability across a wide range of unpredictable scenarios, fundamentally altering how medical technology will be cleared for hospital and patient use.[1][3]

Released on August 18, 2026, by the FDA's Digital Health Center of Excellence, the discussion paper marks the agency's first formal effort to establish a regulatory framework specifically tailored to the unique capabilities and risks of generative AI. The initiative aligns with broader federal priorities to harness artificial intelligence to accelerate the delivery of innovative medical products to market while maintaining rigorous safety standards. Acting FDA Commissioner Kyle Diamantas emphasized that the United States must lead in shaping how this technology is developed and deployed responsibly. The agency has opened a public docket to gather feedback from device manufacturers, clinicians, researchers, and patient advocates through October 19, 2026, before moving to formalize the guidelines into binding regulatory policy.[1][3][4]

Historically, the FDA has evaluated software as a medical device (SaMD) by establishing a tightly bounded performance envelope and verifying that the system consistently stays within those pre-authorized limits. This deterministic approach works well for traditional algorithms, such as those designed to calculate a specific medication dose or flag a defined anomaly in an X-ray. However, generative AI systems—which can accept open-ended natural language requests, perform multiple complex subtasks simultaneously, and produce variable, synthesized outputs in response to similar inputs—defy this traditional testing model. Because their core value proposition lies in handling novel inputs with novel outputs, forcing them into a rigid testing framework would either stifle their utility or fail to capture their true operational risks in a clinical setting.[3][6]

To address this non-deterministic behavior, the FDA's proposed competency-based premarket evaluation consists of two main components: non-clinical device benchmarking and clinical confirmation. Benchmarking would assess the device's baseline clinical knowledge, analytic capabilities, communication quality, and safety behavior against standardized, rigorous metrics. Once a baseline is established, clinical confirmation would evaluate the system's performance in simulated or real-world clinical environments, ensuring it can handle the nuance and unpredictability of actual patient care. This dual-layered approach is explicitly inspired by how human physicians are trained, credentialed, and evaluated by medical boards, shifting the regulatory focus from predicting every possible software output to verifying that the system possesses the necessary competence to perform its intended clinical role safely.[3][5]

Evaluating an AI system for its judgment, adaptability, and clinical reasoning, rather than its strict adherence to a fixed technical specification, represents a fundamental shift in the FDA's regulatory philosophy. As regulatory analysts at Lexim AI noted, the approach is much closer to how a licensing board evaluates a newly graduated doctor than how an inspector verifies a pacemaker meets its cleared engineering specifications. This "nimble regulatory approach" aims to employ the least burdensome principles necessary to ensure safety, avoiding the trap of forcing generative AI devices into the Predetermined Change Control Plan (PCCP) framework that was built for a completely different, more predictable generation of machine learning systems.[6]

Beyond premarket testing, the framework introduces a two-axis risk assessment schema designed to calibrate regulatory expectations based on the specific use case of the AI tool. The horizontal axis measures the system's functional autonomy, ranging from non-directive informational outputs—such as summarizing a patient's medical history for a doctor to review—to fully autonomous action-taking, where the AI might independently adjust a therapy. The vertical axis evaluates the potential clinical consequences if the AI's output is incorrect or hallucinates, scaling from limited inconvenience to severe patient harm. By mapping devices on this grid, the FDA aims to stratify oversight intensity, applying the most rigorous controls to systems that operate autonomously in high-stakes medical scenarios.[1][3]

Under this risk-stratified model, patient-facing generative AI functions may face significantly heightened regulatory controls compared to tools designed exclusively for back-office or physician use. The FDA noted in its discussion paper that because patients generally lack the deep domain expertise of trained clinicians, they are far less equipped to recognize AI hallucinations, subtle medical errors, or confidently challenge an algorithmic recommendation. This lack of a human "expert in the loop" amplifies downstream safety risks, meaning that a generative AI symptom checker or virtual health assistant deployed directly to consumers will likely need to clear a much higher evidentiary bar for competency and safety than a similar tool designed to assist a radiologist.[3]

Postmarket monitoring forms another critical pillar of the proposal, acknowledging the reality that generative AI models can experience performance degradation, behavioral shifts, or "data drift" when their underlying foundation models are updated by third-party developers. Because these systems are not static, the FDA is exploring continuous oversight mechanisms that extend far beyond initial market clearance. This ongoing scrutiny could include mandatory periodic retesting against clinical benchmarks, routine clinician review of real-world AI outputs, and required reassessments triggered by significant software updates. The goal is to ensure that an AI device remains just as competent and safe six months after deployment as it was on the day it received FDA authorization.[1][5]

The agency is also considering a voluntary "Foundation Model Device Master File" program to address the complex supply chain of modern AI development. Many medical AI tools are built on top of massive, general-purpose foundation models developed by tech giants who may not want to assume the liability of becoming regulated medical device manufacturers. Under this proposed program, foundation model developers could confidentially submit detailed information about their training data, system architecture, and safety guardrails directly to the FDA. Medical device manufacturers building specialized applications on top of those models could then reference the master file in their own regulatory submissions, streamlining the approval process while protecting the intellectual property of the foundation model creators.[3]

Healthcare marketing and strategy firms are already advising device manufacturers and hospital systems to prepare for the operational realities of this regulatory shift. Because the framework emphasizes ongoing competency demonstration rather than a single, static approval event, companies will need to fundamentally alter how they communicate with both providers and patients. Marketers and product teams will need to develop dynamic patient engagement strategies that transparently explain how AI devices maintain their qualifications, why their clinical parameters might change following a software update, and what guardrails are in place to catch errors. Building and maintaining this trust will become a continuous operational requirement in the generative AI era.[2]

The FDA has positioned this regulatory initiative as a core component of its broader Innovation and Global Leadership strategic pillar. By establishing these guidelines early and soliciting broad public input, the agency hopes to create a flexible, science-based framework that balances the rapid pace of AI innovation with the non-negotiable demand for rigorous patient safety. Furthermore, as healthcare systems worldwide grapple with the integration of generative AI, the FDA's competency-based model could serve as a foundational blueprint for international regulators, setting a global standard for how to safely harness the transformative potential of artificial intelligence in modern medicine.[1][4]