Verification is the product, and now the FDA says so

On 19 October, the FDA closed comments on a 30-page paper⁴ that could decide how generative and agentic AI reaches patients in the US. The agency has already authorized over 1,600³ AI-enabled medical devices. What it has not had is a clear way to test software that talks, reasons and takes actions. Its answer, floated on 18 August¹, is the one I have been arguing for in production: verification is the product. Now it may become the rulebook.

What is the FDA proposing for generative AI medical devices?

The paper is a discussion draft, not guidance, but its shape is clear. It sorts risk on two axes. One is activity: does the device just inform, direct an action, or take the action itself? The other is consequence: how bad is it if the output is wrong? A wrong over-the-counter suggestion and a wrong insulin dose sit in very different places.

Then it proposes "competency assessment", loosely modeled on how doctors are trained and licensed. First, non-clinical benchmarking against prespecified pass marks, scored by independent adjudicators, covering safety, clinical skill and performance across patient groups, plus a separate element for agentic systems. Second, clinical confirmation, from retrospective review through shadow deployment to, in some cases, a prospective study. Third, monitoring after launch, scaled to risk.

The test is the device you ship, not the model you bought

One line in the paper matters more than the rest: the evaluation target is the final, user-facing device as deployed, not the foundation model standing alone².

That ends a common sales pitch. "We are built on the best model" is not evidence. The prompts, the retrieval, the tools the agent can call, the guardrails and the handoff to a human are the device. In agentic systems the model is rarely the part that breaks; the glue around it is. The FDA is now saying it will test the glue.

For agents, the paper adds a specific check: compliance with human-oversight checkpoints before irreversible or high-consequence actions². That is the same discipline I argued for in AI code: output that looks right is cheap, and proof that it is right is the work.

Bangladesh ran this exam years ago

Here is the flip. Long before this paper, Bangladesh was a proving ground for exactly this kind of test. Researchers took 23,954⁵ chest X-rays from tuberculosis screening clinics run by icddr,b in Dhaka and scored five commercial AI readers against a bacteriological test, not against a radiologist's opinion. All five outperformed experienced radiologists. All five could cut the follow-on lab tests needed by half⁵ while keeping sensitivity above 90%.

The products did not perform identically, and that was the point. A benchmark on local patients, with a hard reference standard, is what lets a program choose a tool and set its threshold on evidence instead of a sales deck. That is competency assessment: pass marks set in advance, real inputs, an outside referee. A country that cannot afford to waste a lab test learned to verify first. The US is now writing that habit into regulation.

Monitoring is the new launch day

The most interesting question in the paper is Question 18². The FDA asks whether it should accept more uncertainty before launch in exchange for stronger monitoring after it. It lists the tools: re-running benchmarks against the original pass marks, clinicians reviewing samples of real inputs and outputs, and watching for performance drift. It even asks whether a supervisory AI agent could do part of that watching.

This is where most teams underbuild. They budget for the launch and treat monitoring as a dashboard someone checks when there is a complaint. But a generative system changes when its vendor updates the model, when users change how they ask, and when the clinic changes its workflow. If you cannot re-run your test next month, you do not have a test.

My MPH capstone taught me a version of this in health communication: fixing the measurement up front made a campaign's reach about 3x larger. The same rule applies to AI. Decide what you will measure before you ship, or you will spend the year arguing about anecdotes.

What I would build before the rules arrive

You do not need to wait for final guidance. Every item below is useful even if you never file with the FDA. My free AI use-case risk triage helps place a use case on the activity and consequence axes first.

• Place it on the grid. Write down whether your system informs, directs or acts, and how bad a wrong answer is. That sets how much proof you need.
• Build your own exam. Collect a few hundred real cases from your own users, set pass marks in advance, and have someone independent score them.
• Run in shadow first. Let the system work on live cases with its output hidden from care, and compare it with what clinicians actually did.
• Gate the irreversible. Any action that changes a dose, a booking or a payment waits for a human checkpoint.
• Re-test on every model update. Treat a vendor's new model version like a new device and re-run the exam before it goes live.

I made the broader case in Verification is the real product. The FDA paper is the new development: the regulator now describes the same stack, benchmark, confirmation and monitoring, as the price of entry.

The short version

• The FDA closed comments on 19 October 2026 on a discussion paper about regulating generative and agentic AI devices.
• It proposes competency assessment: benchmarks with pass marks, clinical confirmation, and monitoring scaled to risk.
• The test target is the deployed device, not the foundation model, so prompts, tools and guardrails are what get judged.
• Bangladesh already showed the method, testing five AI X-ray readers on 23,954 images against a lab reference.
• Monitoring is the new launch: re-run your exam on every model update, or you do not have one.

If the FDA asked you tomorrow to re-run the test that proves your AI works, could you?

Md Shafaat Ali Choyon (MPH, CHES®, MBA, MCIM) is a growth, marketing and public-health strategist who builds and runs AI in production, with 17 years across telecom, fintech, e-commerce, consumer tech and healthcare in the US and Bangladesh. See the essays or the portfolio.