The PATIENT AI Act Discussion Draft: Five Provisions AI Device Makers Should Read

On October 29, 2026, Senator Bill Cassidy, M.D., Chairman of the Senate Health, Education, Labor and Pensions (HELP) Committee, released a discussion draft of the PATIENT AI Act, short for the Protecting Americans Through Intelligent, Ethical, and Transparent Artificial Intelligence in Health Care Act. It is not an introduced bill. It is a 45-page draft the Committee has put out for stakeholder feedback, with comments due December 1, 2026.

‍

For teams building AI-enabled devices, the FDA and CMS titles matter most. They would change how software is reviewed, how it can be updated during review, and how it gets paid for. Below are the five provisions we think AI device makers should read closely, and where the text needs work.

What the draft contains

The draft has four titles.

‍

• Title I, general activities. HIPAA privacy and security guidance for AI, a public meeting on AI liability, a transparency report, HHS internal AI use, workforce training and research datasets.
• Title II, FDA. A voluntary component-level review for devices that combine software and other components (new FD&C section 515D), a risk-based review track for software-based devices (515E), changes to software during premarket review (amending 515C), accredited third-party review of low to moderate risk software (515F), a postmarket surveillance pilot and a rule of construction on liability.
• Title III, ONC. Technical assistance within HHS on implementing AI, certification of clinical research technology, voluntary ONC certification of AI applications that are health IT and not devices, and a clarification that using AI does not by itself turn an excluded software function into a device.
• Title IV, CMS. A coverage evaluation framework for AI-based services, a dedicated coverage pathway, proposed payment methods, faster HCPCS Level II coding decisions and a 5-year CMS Innovation Center model.

The draft defines a "software-based device" as a device whose intended medical purpose is achieved primarily through one or more software functions. That is close to, but not the same as, the IMDRF Software as a Medical Device concept or FDA's "device software function," so expect questions about how it treats software in a medical device and hardware with embedded AI.

‍

Five provisions AI device makers should read

1. PCCPs for changes made during review (Sec. 202(b))

‍

This is the most practical change for AI developers. Today, a predetermined change control plan (PCCP) under section 515C covers changes made after a device is authorized. The draft adds a second kind of plan. A 510k submitter or PMA applicant whose device includes a software function could submit a PCCP describing changes it may make while the submission is under review.

‍

A change consistent with a plan FDA has accepted would not, solely because of that change, require a new submission, withdrawal and resubmission, or "the recommencement of the applicable review period." The applicant would still submit the information FDA needs to show the change "does not materially alter the safety or effectiveness of the device."

‍

AI teams often improve a model during a long review, and a meaningful change can mean starting over. Two gaps stand out. It does not cover De Novo requests under section 513(f)(2), where many novel AI devices go. And it does not say how a review-period plan relates to the post-authorization PCCP the device may also carry.

‍

2. A risk-based review track for software (Sec. 202(a), new 515E)

‍

FDA would set up a risk-based approach to premarket review of software-based devices across 510k, De Novo and PMA, with the level of review matched to the device's risk. A device counts as low to moderate risk if FDA determines that it presents low to moderate risk and that general controls, or general and special controls, are sufficient for reasonable assurance of safety and effectiveness. For those devices, FDA applies the least burdensome means of evaluation and takes into account the software function, the intended use and its risk.

‍

Much of this restates the least burdensome principle that already runs through the device provisions of the FD&C Act, so its effect depends on the guidance FDA would issue within 180 days of enactment. The drafting also needs a fix. Subsection (c) says a software-based device that does not meet the low to moderate risk criteria "shall not be eligible for review under this section," which sits oddly next to subsection (a) covering all software-based devices. The text should make clear that higher-risk software keeps its existing review route.

‍

3. Accredited third-party review of software (Sec. 203, new 515F)

‍

FDA would publish qualifications for certification bodies within 180 days and certify at least 3 within 180 days after that guidance is final. Bodies must be independent of device manufacturers and may not design, manufacture, promote or sell devices. An accredited body could review a low to moderate risk software-based device and make a recommendation to FDA on clearance or approval under 510k, De Novo or PMA.

‍

FDA would then have 30 days to accept the determination or decide that more review is needed, would rely on the third-party review "to the maximum extent practicable," and would explain any additional review in writing. Accreditation lasts 3 years, with periodic onsite visits.

‍

More review capacity could shorten timelines. The text has four issues worth raising in comments. It does not say how 515F relates to the existing section 523 510k Third Party Review Program. It switches between "certify" and "accredit," and between "certification bodies" and "third-party review organizations." It asks for a recommendation on "safety and efficacy," a drug standard, rather than the device standards of substantial equivalence or reasonable assurance of safety and effectiveness. And it does not say what happens if FDA misses the 30-day window.

‍

4. Liability, where the text and the summary differ (Sec. 205)

‍

The text of Sec. 205 says nothing in the FDA title alters or affects any liability under federal or state law, including product liability, medical malpractice "or the application of section 521" of the FD&C Act, the device preemption provision. The Committee's section-by-section summary describes Sec. 205 differently, as reiterating "existing federal preemption of state product liability laws for medical devices to apply to integrated and software-based devices."

‍

Those are two different statements, and the difference matters for AI software. Courts have applied section 521 preemption mainly to PMA devices, and most AI software reaches the market through 510k. Device makers and their counsel should read the text, not the summary, and the Committee should align the two. Separately, Sec. 102 would have HHS arrange, through a nonprofit, a public meeting on how liability is apportioned among providers, facilities, insurers, developers and manufacturers. Manufacturers have a reason to take part.

‍

5. A Medicare pathway tied to third-party review (Title IV)

‍

Title IV is the largest commercial change in the draft. Within 18 months, CMS would publish a framework for evaluating coverage requests for AI-based services. It would consider clinical validity and utility, performance across patient subgroups, human oversight, ongoing performance monitoring and material changes. CMS could not find that a service lacks clinical utility solely because no physician interprets the output, and could not base a coverage or payment decision solely on FDA authorization, 515F review or a billing code. CMS would also propose payment methods that account for software, compute, validation, cybersecurity and monitoring costs, and would decide HCPCS Level II coding requests within 180 days of a complete request.

‍

The access question is in the details. The dedicated coverage pathway in Sec. 402 is limited to AI applications reviewed by a 515F certified entity. The 5-year Innovation Center model in Sec. 405 covers applications that perform a clinical function autonomously and applications reviewed by a 515F entity. A non-autonomous product that FDA reviewed itself would fit neither. Developers choosing between FDA review and a third party, if this passes, would need to weigh that.

‍

Also in the draft

• Integrated devices (515D). A voluntary review in which FDA evaluates each component of a device, such as sensors, AI software functions and outputs, then the device as a whole, and relies on prior component reviews "to the maximum extent practicable." It supplements 510k, De Novo or PMA review rather than replacing it.
• Postmarket pilot (Sec. 204). A voluntary FDA pilot within 1 year on real-world data, automated postmarket data collection and CMS coordination on paying for surveillance.
• Non-device AI (Sec. 303). Voluntary ONC certification for AI health IT that is not a device. That certification is not FDA review, and customers may need help telling the two apart.

What this means for developers

Do not plan around it yet. This is a discussion draft. Nothing here changes current requirements, and the text will change before any bill is introduced. Today's PCCP, 510k, De Novo and PMA rules still apply.

‍

Comment on what affects your products. The Committee is asking for feedback now. Teams with De Novo devices, products that update often, or plans that depend on Medicare coverage have specific, practical points to make on Secs. 202, 203 and Title IV.

‍

Keep building your PCCP under current law. A review-period plan would add to, not replace, the post-authorization PCCP. A well-built plan under FDA's final guidance is useful either way.

‍

Build coverage evidence early. The CMS framework names clinical utility, subgroup performance, human oversight and ongoing monitoring. Those are worth planning into your validation and postmarket programs now, whatever happens to the bill.

‍

Caveats

The draft's deadlines run from enactment, so even if a version passes, the new tracks would take time to stand up. It has no bill number or cosponsors. The 515F pathway and the CMS pathway tied to it depend on each other, so a change to one would likely change the other.

‍

The bigger picture

Congress changed the device software rules with the 21st Century Cures Act in 2016 and FDORA in 2022, which created section 515C and the PCCP. This draft builds on both, and pairs FDA review changes with a Medicare coverage and payment path for AI. Read with our PCCP guide and our post on how to create an FDA PCCP in five steps, it shows where Congress may take the PCCP next. The full discussion draft is in our document library, and the Committee's press release has the details on comments.

‍

How Cosm Can Help

Cosm works with AI device teams on regulatory strategy across 510k, De Novo and PMA, including PCCPs, Pre-Submissions and the evidence plans that support both FDA review and coverage. If you want to assess how the draft could affect your pathway or prepare comments before December 1, talk to Cosm.