FDA’s discussion paper on GenAI-enabled medical devices provides a useful way to think about how cybersecurity risks can contribute to the safety and effectiveness risks associated with these devices.

The paper, Considerations for the Regulation of Generative AI-Enabled Medical Devices: Discussion Paper and Request for Feedback, focuses primarily on how the characteristics of generative AI may affect the safety and effectiveness of medical devices. It considers how manufacturers might assess risk, evaluate device performance before market authorization, monitor performance after deployment, and manage changes over the device lifecycle. FDA emphasizes that the paper is intended to support discussion and stakeholder feedback rather than establish regulatory requirements.

From a medical device cybersecurity perspective, the discussion raises another important question:

How could a cybersecurity event cause, contribute to, or amplify the types of safety and effectiveness risks associated with GenAI-enabled devices?

This is an important distinction. Cybersecurity is not an additional objective separate from device safety and effectiveness. For medical devices, cybersecurity risks matter in large part because a successful attack, vulnerability, or compromise can affect the device’s ability to perform safely and effectively.

GenAI introduces new pathways through which that can happen.

From cybersecurity risk to clinical risk

Traditional medical device cybersecurity often considers scenarios such as unauthorized access, modification of software or data, loss of availability, or manipulation of device functions.

With GenAI-enabled devices, the relationship between a cybersecurity event and device behavior can be less direct.

A useful way to visualize the relationship is:

From cybersecurity threat to clinical impact A cybersecurity threat leads to manipulation or compromise of inputs, instructions, data, models, tools, or dependencies; which leads to changed GenAI behavior; which leads to a safety or effectiveness risk; which leads to potential clinical impact. Cybersecurity threat Manipulation or compromise of inputs, instructions,data, models, tools, or dependencies Changed GenAI behavior Safety or effectiveness risk Potential clinical impact

The cybersecurity event may not cause the device to stop functioning. Instead, the device may continue to operate and produce an apparently reasonable response while its behavior has been influenced by an attacker.

This distinction is particularly relevant to the risks described in FDA’s discussion paper.

GenAI creates new pathways to unsafe behavior

FDA notes that GenAI-enabled devices can accept open-ended inputs, perform multiple subtasks, produce variable outputs, and potentially change over time through modifications to models, prompts, retrieval strategies, guardrails, orchestration logic, or user interfaces. Many devices may also rely on third-party foundation models.

These characteristics are important from a cybersecurity perspective because each can introduce a pathway through which the device’s behavior could be influenced.

For example:

  • An attacker may manipulate an input to influence the model’s response.
  • Malicious content may be introduced into information retrieved by the device.
  • A compromised component may alter the information or instructions provided to the model.
  • A change to a foundation model may alter security-relevant behavior.
  • An attacker may manipulate an external tool used by an agentic system.
  • Changes to prompts, guardrails, or orchestration logic may alter how the device responds to adversarial inputs.

The resulting problem is not necessarily a conventional cybersecurity failure such as unauthorized access to a database. It may instead be a change in device behavior that creates a safety or effectiveness risk.

Prompt injection: when an input becomes a security threat

FDA’s discussion paper specifically identifies adversarial prompting and prompt injection among the testing scenarios that could be relevant to assessing whether a device maintains its intended scope and boundaries. For agentic systems, FDA also discusses resistance to prompt injection through user inputs, retrieved content, and tool outputs.

From a cybersecurity perspective, prompt injection can be understood as an attempt to compromise the integrity of the instructions or context influencing the device.

Consider a GenAI-enabled medical device designed to provide clinical decision support. Under normal conditions, the device may appropriately recognize that a particular request is outside its intended use and refuse to provide a recommendation.

An attacker could construct an input intended to alter that behavior.

If successful:

Prompt injection as a pathway to a safety impact Malicious input leads to manipulated instructions or context; which leads to altered model behavior; which leads to output outside the intended use; which leads to a potential safety impact. Malicious input Manipulated instructions / context Altered model behavior Output outside intended use Potential safety impact

The resulting unsafe output is the safety concern. The prompt injection is the cybersecurity pathway that produced it.

This distinction helps connect AI-specific attack techniques to established medical device cybersecurity risk management.

The information provided to the model is part of the risk

GenAI systems may not rely solely on the model itself. They can incorporate external information through retrieval-augmented generation, databases, documents, APIs, or other information sources.

That creates another potential cybersecurity pathway.

Suppose a GenAI-enabled device retrieves clinical information from an external knowledge source. If that source is compromised or its content is maliciously manipulated, the model may receive information that appears to be trusted.

The resulting sequence could be:

A compromised knowledge source as a pathway to clinical harm A compromised information source leads to manipulated retrieved content; which the GenAI system incorporates; which leads to incorrect or unsafe output; which leads to potential clinical harm. Compromised information source Manipulated retrieved content GenAI incorporates the information Incorrect or unsafe output Potential clinical harm

The model itself may not have been compromised.

From a safety and effectiveness perspective, the concern is the resulting behavior of the device. From a cybersecurity perspective, the concern includes the integrity and trustworthiness of the information entering the device’s decision process.

This makes the trust boundary of the GenAI-enabled device broader than the model itself.

Agentic AI increases the consequences of manipulation

The relationship becomes even more significant when GenAI systems can take actions.

FDA describes agentic AI systems as systems that can autonomously plan and execute multi-step tasks, use external tools, or take actions across a sequence of steps. The paper notes that some agentic systems could potentially meet the definition of a medical device when their actions result in control of another medical device.

For an informational GenAI system, a successful attack might produce an incorrect response.

For an agentic system, the same type of manipulation could potentially influence what the system does.

For example:

Manipulation of an agentic system leading to an unintended action Manipulated input or context leads the agent to develop an unintended plan; an authorized tool is invoked; the action is executed; and the clinical workflow or device behavior is affected. Manipulated input or context Agent develops an unintended plan Authorized tool is invoked Action is executed Clinical workflow or device behavior is affected

This creates an important cybersecurity consideration: the security risk is not limited to preventing unauthorized users from accessing a tool.

The system may already be authorized to use the tool.

The cybersecurity question becomes whether an attacker can influence an authorized AI system into using that capability in an unsafe or unintended way.

FDA’s discussion paper recognizes the increased risk associated with autonomous multi-step action, tool use, and reduced opportunity for human review. It also identifies tool use, recognition of erroneous tool outputs, human-oversight checkpoints, and resistance to prompt injection as areas relevant to agentic AI competency.

These same characteristics provide natural points for cybersecurity risk analysis.

Foundation models introduce another cybersecurity pathway

Many GenAI-enabled devices may depend on foundation models developed by third parties. FDA notes that these models can influence refusal behavior, content policies, output formatting, version control, and safety-critical behaviors that are integral to the safety and effectiveness of the device.

This creates a familiar medical device cybersecurity challenge: dependency on components outside the manufacturer’s direct control.

The cybersecurity concern is not simply whether a third-party model contains a vulnerability.

A change to the model could alter behavior that is relevant to the device’s security or safety.

For example:

A third-party foundation-model change altering safety behavior A third-party model change leads to changed instruction following or refusal behavior; which leads to a changed device response to an adversarial input; which leads to altered safety behavior. Third-party model change Changed instruction following or refusal behavior Changed device response to an adversarial input Altered safety behavior

FDA specifically recognizes that changes to an underlying third-party foundation model may occur independently of the medical device manufacturer and asks how manufacturers could detect, evaluate, and respond to such changes while maintaining reasonable assurance of safety and effectiveness.

For cybersecurity, this reinforces the importance of understanding the security implications of changes to third-party AI components — not just traditional software components.

Cybersecurity can affect robustness and generalizability

FDA’s discussion paper considers whether safety and clinical proficiency remain consistent across foreseeable variation in inputs, runtime conditions, and conversational contexts. It specifically includes resistance to adversarial inputs targeting safety-critical behaviors within its discussion of robustness.

This creates an interesting intersection between AI evaluation and cybersecurity testing.

A device may perform appropriately when exposed to expected inputs, yet behave differently when an attacker deliberately constructs an input designed to exploit the model.

Consequently, cybersecurity testing can provide an important perspective on questions such as:

  • Does the device maintain safety-critical behavior when inputs are manipulated?
  • Does it maintain its intended boundaries when instructions are deliberately conflicting?
  • Does it continue to escalate appropriately when an attacker attempts to suppress escalation?
  • Does it maintain appropriate behavior when retrieved information is manipulated?
  • Does it remain within its intended scope during extended adversarial conversations?

In this context, security testing is not testing something separate from device performance. It is testing whether safety and effectiveness remain intact under security-relevant conditions.

Changes over the lifecycle can change cybersecurity risk

One of the notable characteristics of GenAI-enabled devices is that their behavior may change over time.

FDA discusses changes resulting from software updates, algorithm revisions, retraining, changes in intended functionality, continuous adaptation, and updates to third-party foundation models. The paper recognizes that these changes may affect the safety and effectiveness of the device and considers approaches such as re-benchmarking and predetermined change control plans.

Cybersecurity introduces another dimension to this lifecycle consideration.

A change that appears primarily related to model performance can also change the device’s security behavior.

For example, changing:

  • the foundation model,
  • system prompts,
  • guardrails,
  • retrieval mechanisms,
  • orchestration logic, or
  • external tools

may change how the device responds to adversarial inputs.

Therefore, a change can potentially alter both the functional risk and the cybersecurity pathway to that risk.

This makes cybersecurity impact assessment an important part of understanding whether a GenAI change could affect the device’s safety or effectiveness.

Postmarket monitoring has a cybersecurity dimension

FDA recognizes that premarket evaluation may not fully capture the behavior of GenAI-enabled devices once deployed. The discussion paper therefore considers postmarket approaches including periodic benchmarking, clinician review, and monitoring for performance degradation or drift.

Cybersecurity events can be relevant to this same postmarket picture.

A security compromise may not initially appear as a traditional security incident. It could manifest as:

  • unexpected changes in model behavior,
  • increased rates of unsafe responses,
  • unusual interaction patterns,
  • unexpected tool use,
  • changes in refusal or escalation behavior,
  • abnormal retrieval behavior, or
  • performance changes following a third-party model update.

Consequently, monitoring the safety and effectiveness of a GenAI-enabled device may also provide an opportunity to identify behavior that warrants cybersecurity investigation.

Conversely, cybersecurity monitoring can help explain unexpected changes in device behavior.

The two disciplines therefore become complementary:

Performance monitoring asks: Is the device continuing to behave as intended?

Cybersecurity monitoring asks: Could a security event explain a change in that behavior?

Looking at GenAI cybersecurity through the safety lens

The FDA discussion paper provides a useful set of concepts for thinking about GenAI-enabled device risk. Its possible two-axis approach considers the degree and independence of device activity and the consequences of relying on an incorrect output. FDA also asks whether other factors, such as reversibility, downstream safeguards, time pressure, and traceability, should inform risk assessment.

These concepts can also help frame cybersecurity risk.

Manufacturers can bring them into the device’s threat model — assessing, for each GenAI-specific pathway, how a cybersecurity compromise could move the device outside its intended behavior and what the resulting clinical impact could be.

The key question is not simply:

Can the GenAI-enabled device be attacked?

For medical devices, that question is incomplete.

A more useful question is:

If the GenAI-enabled device is successfully attacked or manipulated, how could that affect the safety or effectiveness of the device?

The answer depends on what the device does and how it is used.

An attack that changes the wording of a low-consequence informational response may have very different implications from one that causes a system to suppress an emergency escalation, generate an incorrect clinical recommendation, or initiate an action in a clinical workflow.

This is consistent with the broader principle of medical device cybersecurity: the significance of a cybersecurity risk depends on its potential impact on the device and, ultimately, on patients and users.

Bringing the cybersecurity and GenAI risk perspectives together

GenAI changes the ways in which cybersecurity risks can translate into device behavior.

The relevant attack surface may extend beyond conventional software components to include:

The GenAI-enabled device attack surface as a chain A processing chain running through inputs, prompts, retrieved information, the model, guardrails, orchestration, tools, outputs, and downstream actions. A compromise anywhere along the chain can influence device behavior. Inputs Prompts Retrieved information Model Guardrails Orchestration Tools Outputs Downstream actions

A compromise anywhere along this chain could potentially influence the behavior of the device.

That does not make cybersecurity a separate risk category from safety and effectiveness. Instead, cybersecurity provides one pathway through which the safety and effectiveness risks associated with GenAI can arise.

For manufacturers, this perspective can help connect GenAI risk assessment with existing medical device cybersecurity practices.

The objective is ultimately the same:

maintain the safety and effectiveness of the medical device throughout its total product lifecycle.

FDA’s February 2026 Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions guidance provides FDA’s current recommendations for cybersecurity device design, labeling, and premarket submission documentation for devices with cybersecurity risk, with the stated aim of helping ensure that marketed medical devices are sufficiently resilient to cybersecurity threats.

For GenAI-enabled devices, applying that cybersecurity perspective means looking beyond whether the underlying technology can be compromised and asking the more consequential question:

How could cybersecurity risk change what the GenAI-enabled device does — and what could that mean for safety and effectiveness?

That is where cybersecurity and the emerging FDA discussion around GenAI-enabled medical devices intersect.

FDA is accepting public comment on the discussion paper through October 19, 2026, under docket FDA-2026-N-7874.

Sources: FDA, “Considerations for the Regulation of Generative AI-Enabled Medical Devices: Discussion Paper and Request for Feedback”; FDA, “Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions” (issued February 3, 2026).