FDA GenAI Rules: Too Slow or Just Right?

Everyone says the FDA is moving too slow on AI. They’re wrong. 🧠

Moving fast on a broken framework would be worse than moving carefully on the right one.

This week, the FDA’s Digital Health Center of Excellence released a discussion paper on regulating generative AI-enabled medical devices, opened under docket FDA-2026-N-7874, with public comments due October 19, 2026. According to Edge RCM, which broke down the development for physicians, this is the agency’s first real attempt at a framework built specifically for GenAI devices, rather than stretching existing software and AI/ML rules to cover them.

That distinction matters more than most people realize.

The old FDA frameworks assumed three things:
– Inputs are bounded
– Outputs are fixed
– The underlying algorithm is stable

GenAI devices break all three. Inputs are open-ended. Outputs are open-ended. Models change constantly, often with bias drift and performance degradation nobody tracks.

So the FDA designed something new.

The paper proposes a two-axis risk framework that weighs how independently a device functions alongside how severe the harm would be if it gets it wrong. It also introduces a competency-based premarket evaluation model, borrowed from how we assess human clinicians, not legacy software pathways.

The paper goes further than most critics have acknowledged. It directly addresses hallucinations, how to monitor a model that keeps learning after deployment, and who is accountable when a manufacturer builds on top of someone else’s foundation model.

That last one is the real bomb in the room.

Almost every clinical AI product being sold right now is built on top of OpenAI, Anthropic, or Google infrastructure. The device maker has limited visibility into the training data, the architecture, or how the model was evaluated. When something goes wrong with a patient, does liability land on the device company or the foundation model vendor? Nobody has answered that. The FDA is now at least asking the question out loud.

🔎 The counterpoint is fair: this is not a proposed rule, not draft guidance, not a binding requirement. It is a 30-page discussion paper requesting feedback. Nothing changes in any practice tomorrow.

But here is the problem with the critics who want faster action: speed without the right framework produces rubber stamps, not safety. We have already cleared over 950 AI devices. Most lack any postmarket monitoring requirement. We do not need more approvals on a broken chassis.

What we actually need is a framework that can handle a model that rewrites itself after deployment. That is genuinely new regulatory science. The FDA calling that out explicitly, naming agentic AI and foundation model accountability as open questions, is not weakness. It is intellectual honesty the sector has been avoiding for years.

The real accountability question is not whether the FDA is moving fast enough.

It is whether the companies rushing products to market have answers to the questions this paper is asking. Most of them do not.

👉 Follow Jonathan Govette, CEO of Oatmeal Health, for daily healthcare insights on LinkedIn. Deeper dives in The Oatmeal Bite on Substack: https://news.oatmealhealth.com