Slingshot AI Inc. (Daniel Cahn)

Slingshot AI, Inc. submits the attached comments on Docket No. FDA-2026-N-7874, “Considerations for the Regulation of Generative AI-Enabled Medical Devices: Discussion Paper and Request for Feedback.”

FDA Generative AI Discussion Paper: Comments of Slingshot AI, Inc.
October 19, 2026
Via regulations.gov
Docket FDA-2026-N-7874. “Considerations for the Regulation of Generative AI-Enabled
Medical Devices: Discussion Paper and Request for Feedback.”
Dear Dr. Tarver and Dr. Abramson,
We appreciate the opportunity to provide comments on the discussion paper regarding generative
AI (GenAI)-enabled medical devices. In particular, we fully support the FDA’s Center for
Devices and Radiological Health’s (CDRH) ultimate goal of “enabl[ing] a nimble regulatory
approach that employs least burdensome principles and allows patients timely access to safe and
effective medical devices.”1
Slingshot AI, Inc., is a mental health AI research lab building a specialized model for
psychology. Ash is our consumer wellness app, designed for mental health, and a place for
people to talk through everyday struggles like stress, anxiety, or relationships. We train
open-weight models on behavioral health data, align them with clinician-written feedback, and
post-train them for task-specific performance on real use cases. Ash also draws on frontier
models from other developers, and every model Ash uses is held to the same policies, guardrails,
and evaluations described in Section 2. Ash is built by a team of psychologists, clinicians,
engineers, and people with lived experience. We believe that the lack of access to mental health
support is a real issue, and it is the driving mission behind our company. Nearly half of adults in
the United States have had a mental disorder at some point in their lives,2 and in any given year,
about half of adults with a mental illness receive no mental health treatment.3 For many of these
Considerations for the Regulation of Generative AI-Enabled Medical Devices: Discussion Paper and Request for
Feedback (“Discussion Paper”), at 1,
https://www.fda.gov/medical-devices/digital-health-center-excellence/considerations-regulation-generative-ai-enable
d-medical-devices-discussion-paper-and-request. We recognize that Executive Order 14434, Inaugurating the Era of
Super Intelligence (Sept. 29, 2026), directs executive agencies to use the term “Super Intelligence” (“SI”) in place of
“artificial intelligence” (“AI”). The Order defines SI by reference to the existing statutory definition of “artificial
intelligence,” 15 U.S.C. § 9401(3), so the terms cover the same technologies. For consistency with the Discussion
Paper and the questions it presents, we use the terms “AI” and “GenAI” throughout these comments.
Kessler, R. C., Angermeyer, M., Anthony, J. C., et al. (2007). Lifetime prevalence and age-of-onset distributions of
mental disorders in the World Health Organization’s World Mental Health Survey Initiative. World Psychiatry, 6(3),
168–176, at 170, https://pmc.ncbi.nlm.nih.gov/articles/PMC2174588/ (reporting that 47.4 percent of U.S. adults
surveyed in the National Comorbidity Survey Replication met criteria for at least one lifetime mental disorder under
the Diagnostic and Statistical Manual of Mental Disorders, Fourth Edition (DSM-IV)).​
Substance Abuse and Mental Health Services Administration, Key Substance Use and Mental Health Indicators in
the United States: Results from the 2024 National Survey on Drug Use and Health (July 2025) (23.4 percent of
adults, or about 61.5 million people, had any mental illness in the past year); Substance Abuse and Mental Health
Services Administration, Mental Health Treatment Among Adults and Adolescents: 2024 National Survey on Drug
Use and Health,
individuals, the realistic alternative to a tool like Ash is no support at all, rather than a visit with
a therapist or other provider. Importantly, many people are already filling that gap with
general-purpose AI. In a 2024 survey of U.S. adults, 24 percent reported having used a large
language model for their mental health, and those users often cited cost and difficulty accessing
care.4
Consumer Ash is intended for general wellness use, consistent with our comment to the Digital
Health Advisory Committee last October.5 However, some apps in this space may rise to a level
that is more consistent with treatment and diagnosis such that they are medical devices, in which
case we support the FDA’s effort to develop a more flexible, contemporary risk-aligned
regulatory framework that accounts for generative AI, among other rapidly evolving
technologies, such as agentic AI. In our opinion, the discussion paper provides just that, and
these comments address the case where a GenAI product seeks authorization as a medical
device. We also have a pending application to participate in the FDA’s Technology-Enabled
Meaningful Patient Outcomes (TEMPO) pilot for a separate product, so we are commenting as a
company that may end up operating under this framework. In addition, because these comments
address the device case, we ask CDRH to confirm that the framework described in the discussion
paper applies only to products that are medical devices and does not alter CDRH’s existing
policies for general wellness products or other software functions that are not devices.
Our comments here are not exhaustive, but are meant to provide our insights and observations
given our experience in the GenAI space. That experience comes largely from ongoing
conversations with the more than 500,000 members as of October 1, 2026, who talk to Ash, our
consumer product. These conversations often unfold over weeks or months, and they move
between everyday topics and sometimes heavier concerns. What we have learned has shaped
several of our comments below, particularly on how CDRH should treat the different kinds of
activity that can occur within a single conversation. It is also why we support the
competency-based, staged approach described in the discussion paper. We describe how we
evaluate and monitor Ash in Section 2.

1.​ Summary of Recommendations
In brief, our comments key on the following points:
•​ Strengths of the framework (Questions 7, 8, and 9). We support the paper’s
competency-based approach, its step-by-step path from benchmark testing to clinical

https://www.samhsa.gov/data/sites/default/files/reports/rpt56771/2024-nsduh-psr7-mhtx-adult-adol.pdf (52.1 percent
of adults with any mental illness received mental health treatment in the past year).
Stade, E. C., Tait, Z. M., Campione, S. T., Wiltsey Stirman, S., & Eichstaedt, J. C. (2026). Real-world use of large
language models for mental health in 2024. npj Digital Medicine, 9, Article 630.
https://doi.org/10.1038/s41746-026-02842-9 (reporting that 24 percent of U.S. adults in a 2024 online survey had
used a large language model for mental health, and that these users were about twice as likely as non-users to report
difficulty accessing traditional treatment, most often because of cost).
Slingshot AI, Comment Letter on Digital Health Advisory Committee; Notice of Meeting; Establishment of a
Public Docket; Request for Comments — Generative Artificial Intelligence-Enabled Digital Mental Health Medical
Devices (Oct. 17, 2025), Docket No. FDA-2025-N-2338, at
https://www.regulations.gov/comment/FDA-2025-N-2338-0016.
 confirmation to postmarket monitoring, its proposed benchmarking elements (especially
scope maintenance), and its attention to both under- and over-escalation.
•​ Device and non-device functions within a single conversation (Questions 2 and 5). A
single conversation will often mix ordinary conversation with clinical assessment or
treatment, and not every message should be subject to the same requirements. We
propose that sponsors identify the specific clinical activities that are device functions, test
the whole conversation against declared boundaries, and apply clinical benchmarking
only to those activities, consistent with FDA’s Multiple Function Device Products
guidance.
•​ Clinical evaluation (Questions 10, 11, 12, 13, 16, 18, 19, and 20). We support multiple
approaches to clinical evaluation and confirmation, ask that benchmarks be validated
against performance in real use, recommend that sponsors be able to rely on their own
benchmarks, including proprietary ones, confirmed through independent audits rather
than required outside vendors, and support accepting more premarket uncertainty in
exchange for strong postmarket monitoring.
•​ Change control (Questions 22, 23, and 24). Rather than asking a company to predict
every specific future change to its product, a Predetermined Change Control Plan (PCCP)
could describe a broad category of permitted changes, and have a flexible testing process
that changes must pass. Each update would be run through the same set of tests, with
passing scores set in advance.
•​ Benefit-risk, escalation, and comparators (Questions 1, 3, 6, 14, and 15). We ask that
functions not be placed higher on the risk grid simply because they are patient-facing
rather than used by a health care professional, and that escalation be evaluated in both
directions. Comparators should reflect the care actually available to the people a device is
intended to serve, which for mental health concerns is often no treatment at all or,
increasingly, a general-purpose AI tool or a companion chatbot built for engagement and
entertainment. We also ask CDRH to consider how easily a wrong output can be undone.

2. How We Evaluate and Monitor Ash
This section describes how we evaluate, monitor, and set limits on Ash, our consumer wellness
product. Ash is a general wellness product, and we offer these practices as context for the
comments that follow. We share them so CDRH can see the experiences that inform our
comments, and in case any of it is useful as the framework develops.
Three kinds of measurement (Questions 10, 11, and 20). We measure Ash on an ongoing basis
in three ways. First, we assess the wellness outcomes we aim to deliver, including whether Ash
users reach the goals they set, get better sleep, have better relationships, or increase their
engagement with the world. We do this through continuously gathering real-world evidence and
conducting studies that follow a sample of Ash users. Second, we continuously review what
happens in real conversations by having a large number of automated conversation analyzers
check whether Ash is behaving as expected and track shifts in how users or the model behave.
Third, a suite of offline benchmarks covers abilities, behaviors, and constraints, in both ordinary
and difficult situations. Some benchmarks score a single reply at a fixed point in a conversation
against a rubric. Others use trained judges to score whole conversations with simulated users. For
example, in one, a user describes a vivid dream in terms that would be deeply concerning if they
were describing real events, and the conversation moves between the dream and real life. We
check that Ash does not overreact to the dream, and that it responds to concerning content about
real life when it is mixed in.
Written policies (Question 5). We set out what Ash should and should not do in sensitive
situations in written policies, developed with clinical and safety experts. Each policy specifies
the context in which it applies, and lists—one behavior at a time—what Ash should and should
not do. The same policy text is the basis for the analyzers that measure Ash, the guardrails that
constrain it, and our evaluations of new models. This is close to the “declared boundaries” we
propose in Section 4, and it is why we think boundaries can be both stated and tested.
Guardrails on live conversations (Questions 6 and 20). We believe in layering our safeguards
to create additional backstops, so we do not rely on the model alone to stay within those policies.
Ash is designed to check every message a user sends with a fast guardrail system before it begins
to respond. A quick, broad check flags possible concerns, and a slower, more precise check
confirms them. When a concern is confirmed, Ash moves into safe mode: a different set of
instructions and limits that apply for the rest of the conversation. This approach is consistent with
independent research finding that concerning chatbot behavior in mental health conversations
tends to build over back-and-forth turns, and that intervening at the first point of escalation
reduces risk in later turns.6 If a user describes current thoughts of suicide, for example, they are
shown a banner with crisis resources such as the 988 Suicide & Crisis Lifeline, whatever their
subscription status, and Ash is restricted from discussing methods. The policies also guard
against the opposite error. Ash is not meant to send crisis resources in response to a figure of
speech or to a past experience that does not indicate current risk. This is the balance between
under- and over-escalation discussed in Section 7. Other limits work the same way: Ash is
currently intended for adults, users confirm their age when they sign up, and Ash is designed to
end the conversation if a user says during a conversation that they are under 18.
Release in stages (Questions 11, 19, and 22). Each model update is first tested against offline
benchmarks, including simulated conversations. It is then released to a small group of users who
have opted in to early versions, which we call a canary release, for a period that depends on how
significant the change is. We watch canary conversations closely with the analyzers across a
large number of signals, and may bring in expert human review of a sample. If, for example, we
see an increase in factual errors, we can act quickly, including by rolling the release back. The
graduated deployment pathway we suggest in Section 5 is modeled on this.
From real use back to benchmarks and guardrails (Questions 10 and 19). Our benchmarks
cover the situations we already know to test, and real use shows us the ones we missed. People
regularly use Ash in ways we did not plan for. For example, some users talk to Ash about
everyday nutrition, and seeing that in real conversations is what led us to build benchmarks for it.
Weilnhammer, V., Hou, K. Y. C., Luettgau, L., Summerfield, C., Dolan, R., & Nour, M. M. (2026). A clinically
validated framework for auditing AI chatbot behavior in mental health interactions. Nature Medicine,
https://doi.org/10.1038/s41591-026-04577-2 (finding, across 810 simulated multi-turn conversations with nine
chatbots, that concerning behavior accumulated over turns and could be reduced by intervening at early escalation
points).
When a new concern appears, we write or revise a policy, build and test an analyzer for it, and
deploy and monitor a guardrail, which can happen within hours. Benchmarks also become less
informative the longer we optimize against them, so we treat building new ones as continuing
work.
What this has taught us. In our experience, safety in this domain is a moving target. The risks
are long-tailed and often new, and no fixed set of tests stays sufficient. That is why the comments
below favor staged release, postmarket monitoring, and sponsor-built benchmarks (Section 5),
and a change control plan that lets a sponsor ship tested fixes quickly (Section 6).

3. Strengths of the Framework (Questions 7, 8, and 9)
First, we support the move toward competency-based evaluation. A conversational product can
receive an almost unlimited range of inputs, and no sponsor can test every one of them. Under
the paper’s approach, CDRH would instead test whether the product can do the specific things its
intended use requires. For a mental health product, that might mean recognizing when a user
describes thoughts of self-harm or declining to answer a question about adjusting a medication
dose if that is out of scope of its intended use. The sponsor would then confirm that the product
performs the same way in real or clinically representative use. We think that is a more realistic
way to evaluate these products than trying to test every possible input.
Second, we support the list of skills the paper would test for on pages 12 and 13. The list
separates what a product needs to be good at (for example, clinical knowledge and clear
communication) from what it needs to do safely (for example, recognizing an emergency and
escalating it). We are also supportive of what the paper calls “scope maintenance.” As we
understand it, this means that a product should know what it was built to do, and it should
recognize when a request falls outside of that.7 For example, a device built to treat depression
should not answer medical questions far outside its intended use. Instead, it should say that this is
not something it can help with and suggest that the person speak with a doctor. In response to
Question 9, we want to highlight that, in mental health conversations, risk may emerge gradually
over the course of an interaction rather than from any single response. For example, individual
responses may appear benign when viewed in isolation but, over the course of a multi-turn
interaction, may collectively reinforce a distorted belief. We therefore recommend that CDRH
make clear that evaluations should assess not only individual responses, but also risks that
emerge cumulatively across an interaction. In our view, this can be addressed within the existing
framework, particularly S.1, E.4, and the long-conversation testing contemplated in R.1 without
creating a separate element.
Third, we support the paper’s staged approach. As we read it, a product would first be tested
against benchmarks outside of clinical use, then its performance would be confirmed with real
users, and then it would be monitored after it reaches the market. The amount of evidence
required at each step would depend on the product’s risk. We agree with that sequence, and we
agree that evidence gathered after a device is in use can and should inform CDRH’s view of that
device, particularly given the ever-evolving nature of generative technologies.
Discussion Paper at 12-13, 24 (describing element S.2, “Scope maintenance and boundary adherence”).
Finally, we believe the two-axis framework on pages 5 and 6 makes sense as a way to think
about risk, with the caveats we describe below. We note that the paper contemplates moderating
a function’s presumptive risk according to its location on the consequences axis (p. 7). Our main
request, discussed in the next section, is that CDRH clarify how the framework applies to the
ordinary conversational content (non-device function) that may surround device functions.

4. Device and Non-Device Functions in One Conversation (Questions 2 and 5)
A GenAI product used for treatment will perform some functions that are device functions and
many that are not. The discussion paper recognizes that products may have “other functions”
(p. 4 & n.10). It asks that risk be assessed “across realistic conversational trajectories, not only at
the level of individual functions” (p. 8). We agree.
Whether an individual message is part of a device function depends on the context of the
conversation. On its own, a suggestion to take a walk is a general wellness conversation. On the
other hand, if a suggestion to take a walk is part of a behavioral activation protocol for diagnosed
major depressive disorder that schedules daily 30-minute walks, then that same suggestion may
be part of a treatment plan that would be a device function. Reviewing and classifying individual
messages misses that context. However, reviewing and classifying the entire conversation as a
device function poses a separate but important problem: it could require clinical validation of
greetings, small talk, and open conversation that produce no clinical output to validate.
We recognize that this line is not always easy to draw, particularly in psychotherapy, where
asking someone about their thoughts can itself be part of treatment. We believe that difficulty is a
reason for a framework in which the sponsor defines its clinical activities and shows their
boundaries, so that CDRH can review both. This also addresses the second part of Question 5,
which asks how intended use should be characterized when a device’s behavior emerges over the
course of a conversation (p. 10). In our view, intended use should be defined by the clinical
activities the sponsor intends the device to perform, together with the boundaries placed around
those activities, rather than by the particular direction an individual conversation may take.
The direction of a conversation is set largely by the user. If the direction of the conversation
defined intended use, a device’s regulatory status could change from one conversation to the
next. No sponsor could then state its intended use in a submission, design benchmarks around it,
or keep it constant across updates. The paper’s own approach depends on a stable intended use. It
expects sponsors to “define the scope of testing based on the device’s intended use and risk
profile” (p. 13). Under element S.2, it also lists, as a scenario to test, conversations in which
“individual turns appear in-scope but the cumulative interaction drifts out of scope,” and it treats
outputs beyond the device’s intended use as a failure to test for under element S.2 (p. 24). That
test works only if intended use is defined in advance and each conversation is measured against
it.
This does not make the direction of a conversation (or its trajectory) irrelevant. We agree that
how a conversation can unfold should shape risk assessment and testing (p. 8). But trajectory
belongs in the evaluation of whether a device stays within its intended use, not in the definition
of that use. Defining intended use this way also responds to a risk the paper itself identifies,
“uncertainty in the bounds of a device’s intended use” (p. 2). The same approach resolves the
psychotherapy example we noted above. A question about someone’s thoughts is part of a device
function when it serves a declared activity, such as a structured assessment. It is ordinary
conversation when it does not. Finally, if real-world monitoring shows that a device regularly
performs a clinical activity it has not declared, the sponsor should be expected either to correct
that behavior or to declare the activity and support it with evidence.
We think CDRH should therefore consider a more flexible framework that could, for example,
do the following:
1.​ Declare the clinical activities. The sponsor could list each clinical activity the product
performs (for example, assessing a condition or building a treatment plan). Conversation
outside these activities is an “other function.”
2.​ Declare the boundaries. The sponsor would also state rules that apply across the whole
conversation (for example, no use with minors when the product is intended only for
adults, recognizing and escalating a credible safety risk wherever it arises in the
conversation, no discouraging the user from seeking care, and no clinical activity outside
of its intended use).
3.​ Test the boundaries over whole conversations. The sponsor could then use simulated
users in long conversations, including user types that push against boundaries and steer
conversations toward out-of-scope clinical concerns. The behavior of those simulated
users should be checked against real conversations, so that the testing reflects how people
actually behave in nuanced clinical contexts. Recent peer-reviewed work shows this can
be done. In one study, licensed physicians rated only about 1 percent of simulated
exchanges from mental health conversations as clearly artificial.8 At the same time, how
data are simulated is critical: research suggests that relative to simulated users based on
frontier models, simulated users based on purpose-built models more closely match the
distribution of real users.9 The sponsor would then report how often the boundaries hold
(measured against acceptance criteria set in advance and weighted by the severity of a
failure), and an independent auditor could verify that testing.
4.​ Limit clinical benchmarking to the declared activities. The rest of the conversation is
then evaluated for adherence to boundaries. Because boundary testing covers the whole
conversation, we believe this approach is consistent with the paper’s statement that
benchmarking should be “of sufficient clinical and functional scope to evaluate the
device for its intended use” (p. 14).
This approach builds on ideas that other commenters have put forward. Dr. Richard Pescatore
proposed what he calls a “conversational envelope.”10 Under his approach, the sponsor would list
Weilnhammer et al., supra note 6 (reporting that licensed physicians rated about 1 percent of the simulated
exchanges as clearly artificial).
Zhu, Z., Tieleman, O., Stamatis, C. A., Smyth, L., Hull, T. D., Cahn, D. R., Chen, J., & Malgaroli, M. (2025).
DIAL: Direct iterative adversarial learning for realistic multi-turn dialogue simulation. arXiv:2512.20773,
https://arxiv.org/abs/2512.20773 (describing methods for making simulated users more realistic).
Comment of Richard Pescatore, DO, FDA-2026-N-7874-0006,
https://www.regulations.gov/comment/FDA-2026-N-7874-0006.
the things a device should not do in a conversation. The sponsor would then test those limits with
simulated users who present difficult clinical challenges (e.g., diminishing their symptoms,
pushing back on being referred for help, or continuing to press for advice). Where our
perspective differs is that we would treat only the sponsor’s declared clinical activities as device
functions, so that clinical benchmarking is focused on those activities.
Some commenters have urged that a conversational product’s intended use be judged by where a
conversation can end up, and not only by where it starts.11 We share the underlying concern that a
product should not drift into clinical territory without appropriate oversight. However, we do not
believe the right answer is to treat the entire conversation as a device function. The rule against
undeclared clinical activity, along with testing across entire conversations, is intended to
demonstrate that the product does not drift.
This builds on FDA’s Multiple Function Device Products guidance, under which other functions
“are not the subject of FDA’s review simply because they are part of a multiple function device
product.”12 Unlike existing digital therapeutics, a GenAI product often cannot fully separate its
functions architecturally because a single model produces both types of conversation. Testing by
declared activity thus provides a logical separation, and the boundary testing supports the safety
analysis the guidance calls for when functions cannot be fully separated. We recognize that,
under the guidance, FDA may still assess the impact of other functions on the device function
under review, and we would expect sponsors to address that impact in their submissions.
For the same reason, we ask CDRH to confirm that the two-axis framework applies to device
functions, and that ordinary conversation outside the definition of a device is not placed on the
grid at all. Placing it even in the lowest-risk corner would suggest that it needs to be
benchmarked. We would also welcome examples showing how CDRH would apply this
approach to a product that moves fluidly between device and non-device function within a single
conversation, including in the draft guidance on generative AI-enabled conversational devices
for mental disorders that CDRH has listed on its fiscal year 2027 guidance agenda. Relatedly, on
Question 2, we agree that directiveness should depend on the substance and context of an output,
not solely on particular words (p. 7). In mental health conversations, many directly worded
suggestions, such as trying a breathing exercise or taking a short walk, carry little consequence if
they turn out to be unhelpful. Where such suggestions are part of a device function, we ask
CDRH to confirm that they fall low on the consequences axis even when phrased directly. Where
they come up in ordinary conversation, they should stay off the grid entirely, as we propose
above.

5. Clinical Evaluation (Questions 10, 11, 12, 13, 16, 18, 19, and 20)
Clinical confirmation (Question 11). We support the paper’s view that clinical confirmation
need not require a prospective clinical study in every case. The methods described on page 15,
including retrospective evaluation on real inputs, shadow deployment, standardized patient
See, e.g., Comment of the American College of Allergy, Asthma & Immunology, FDA-2026-N-7874-0118,
https://www.regulations.gov/comment/FDA-2026-N-7874-0118; Comment of Ravi R. Pankhaniya, MD,
FDA-2026-N-7874-0045, https://www.regulations.gov/comment/FDA-2026-N-7874-0045.
FDA, Multiple Function Device Products: Policy and Considerations (July 29, 2020), at 5,
https://www.fda.gov/media/112671/download.
interactions, clinician adjudication, and prospective studies, are workable. We use versions of
some of these ourselves. Laboratory testing alone may not reveal how a conversational product
behaves in real use. Simulated users can behave quite differently from real people, and making
them realistic takes deliberate work.13 The key safeguard, in our view, is to check simulated users
against real conversations before relying on them, as we propose in Section 4. We would
encourage CDRH to give weight to evidence from real-world deployment. A systematic review
of 519 studies evaluating large language models in health care found that only 5 percent used
real patient care data.14 In one of our own studies, we audited 20,000 real conversations with Ash,
and clinicians reviewed the conversations our system flagged for potential risk, along with
another random subsample of 600 conversations to catch potential false negatives.15 Several
standard safety benchmarks were no longer very useful because nearly every model scored close
to perfectly on them. The real conversations showed how challenging it can be to capture the
nuances of clinical risk with a benchmark. People often talked about risk indirectly, and some
used coded language for self-harm that the benchmarks were not designed to catch. Independent
research highlights the same concern. One study found that three widely used chatbots responded
in line with expert clinicians’ risk ratings at the extremes of suicide risk, but did not
meaningfully distinguish among intermediate risk levels, where clinical judgment is particularly
important.16 This is why the “anticipated distribution of real-world inputs” that Question 11 asks
about (p. 18) matters so much for conversational devices. Where CDRH believes a prospective
study is necessary, we would welcome guidance on which functions would require one.
Graduated real-world deployment (Question 11). We would also encourage CDRH to
consider a pathway in which a product is first made available to a limited number of real users.
The sponsor would monitor it and set clear criteria in advance for pausing or rolling it back. The
product would then be made available to more users as its performance justifies. The level of
oversight could depend on the product’s risk. For example, it might include clinician review of a
sample of conversations, automated monitoring for safety events, or both. The first randomized
trial of a generative AI mental health chatbot used a form of this oversight, with researchers
monitoring the chatbot’s responses during the study.17 This mirrors the paper’s own description of
how clinicians are trained, through supervised practice “with progressively greater
Zhu et al., supra note 9.
Bedi, S., et al. (2025). Testing and evaluation of health care applications of large language models: A systematic
review. JAMA, 333(4), 319-328 (finding that 5 percent of 519 included studies evaluated models using real patient
care data).
Stamatis, C. A., Meyerhoff, J., Zhang, R., Tieleman, O., Malgaroli, M., & Hull, T. D. (2026). Beyond simulations:
What 20,000 real conversations reveal about mental health AI safety. arXiv:2601.17003,
https://arxiv.org/abs/2601.17003.
McBain, R. K., et al. (2025). Evaluation of alignment between large language models and expert clinicians in
suicide risk assessment. Psychiatric Services, https://pmc.ncbi.nlm.nih.gov/articles/PMC12856735/ (finding that
three widely used chatbots aligned with expert clinicians on very-high-risk and very-low-risk suicide-related
questions but did not meaningfully distinguish intermediate risk levels).
Heinz, M. V., Mackin, D. M., Trudeau, B. M., et al. (2025). Randomized trial of a generative AI chatbot for
mental health treatment. NEJM AI, 2(4), https://doi.org/10.1056/AIoa2400802 (randomized trial of 210 adults in
which researchers monitored the chatbot’s responses during the study).
independence” (p. 11). Because the product interacts with real users, this pathway does not fit
precisely within shadow deployment, but it can generate evidence that shadow deployment
cannot. Where this occurs before marketing authorization, we would expect it to be conducted
under the investigational requirements the paper notes may apply, with criteria for pausing and
expanding agreed with CDRH in advance. We would also welcome clarification on when this
kind of deployment could proceed as a nonsignificant risk study under the abbreviated
requirements of 21 CFR 812.2(b).
Benchmark validity (Question 10). We believe the best evidence that a benchmark is
meaningful is showing that scores on it track separately measured performance of the same
product in real use. For example, a sponsor whose product estimates symptom severity from
conversations could compare those estimates to the scores that the same users report on a
validated questionnaire, using data held out from the model’s development. We would encourage
CDRH to accept that kind of evidence of validity, including for benchmarks that sponsors
develop themselves. Question 10’s concern about independence and “optimization to the test”
can be addressed with test data held out from development, acceptance criteria set before testing,
and independent audit, as we describe below. Building proprietary benchmarks is one of the main
ways AI developers innovate, and the paper itself notes that publicly available benchmarks can
suffer from data contamination, saturation, and limited real-world representativeness (p. 12). We
ask CDRH to confirm that sponsor-developed benchmarks need not be made public and can
remain confidential in a sponsor’s submission.
Combining simulated and real results (Question 12). We use simulated users to screen new
models before they are released to our users. Our simulated user model is continuously trained
from de-identified Ash conversations, and we have published about the methods we use to train
our simulator models.18 We found that issue rates in simulated conversations correlated with real
issue rates across 14 chatbot configurations (r = 0.82).19 As we upgrade our simulator
infrastructure, we replay past model changes in simulation to ensure our simulators continuously
improve their ability to predict real-world outcomes. Furthermore, we use simulation to identify
any unexpected changes in a new model’s behavior compared to the previous model. As
described above, we use canary releases in addition to simulated results to measure model
performance before general release, and we use statistical methods to assess how much the
results vary by chance. We suggest that sponsors demonstrate that simulated results align with
real-world results to ensure the applicability of their simulations, and we recommend the use of
canary releases as part of model change procedures.
Independent auditing by third parties (Question 16). We support a role for independent
auditing. However, we would caution against a structure in which a small number of outside
bodies become gatekeepers that every company must pay before its product can reach patients.
Question 16 asks what safeguards would prevent third-party participation “from limiting
competition or preventing innovation” (p. 19). We believe the most important safeguard is choice
among multiple qualified auditors. The Accreditation Scheme for Conformity Assessment
(ASCA) program the paper describes (p. 17) is a good starting point, since it relies on multiple
See, e.g., Zhu et al., supra note 9.
Zhu et al., supra note 9, at tbl. 3 (reporting r = 0.818 between simulated and real issue rates across 14 chatbot
configurations).
accredited organizations rather than a single body. FDA’s own 510(k) Third Party Review
Program offers a model. Participation is voluntary, sponsors can choose among FDA-recognized
review organizations, and FDA makes the final decision.20 We recommend that CDRH follow
that approach here. Rather than requiring sponsors to test against an outside vendor’s
benchmarks, CDRH could allow a sponsor to prespecify its own benchmarks and have a
qualified, independent auditor confirm that the test data were held out from development, that
acceptance criteria were set before testing, and that scoring was sound. CDRH could also
recognize multiple accredited auditors, publish their criteria, and ensure that fees scale with
company size. Question 16 also asks about appropriate qualifications and independence criteria.
We suggest drawing on the standards the paper identifies for expert adjudicators, including
structural independence from the sponsor and qualifications appropriate to the relevant clinical
domain (p. 14). However, certain third-party arrangements may raise practical concerns in this
context. For example, maintaining a sequestered bank of real mental health conversations could
require highly sensitive personal disclosures to be held outside the sponsor’s privacy controls.
Sharing those conversations with a third party would generally require users’ consent, and some
state laws require separate consent before consumer health data is shared. Holding the
conversations outside the sponsor would also expose some of the most sensitive disclosures
people make to added risk of a breach.
Postmarket monitoring (Questions 18, 19, and 20). We support accepting more premarket
uncertainty for conversational devices in exchange for strong postmarket monitoring. No
premarket test can cover the full range of what people will say to a conversational product, and
real use produces evidence that premarket testing cannot. We believe this tradeoff is appropriate
where the sponsor commits in advance to the kinds of monitoring the paper describes, namely
periodic re-benchmarking, clinician review of samples of real conversations, and monitoring for
performance degradation (pp. 19-20), with the scope and frequency of each scaled to the device’s
risk, along with clear triggers for re-testing and the ability to roll back a change. Monitoring
results could be maintained in the sponsor’s quality system and made available to FDA, with
event-based reporting continuing under existing medical device reporting and correction and
removal requirements. Question 18 asks where this approach may not be appropriate (p. 21). The
balance between premarket evidence and postmarket monitoring may depend in part on how
readily an error can be detected and its consequences addressed. Postmarket monitoring may
provide a more meaningful safeguard where errors can be identified quickly and any resulting
harm can be mitigated or reversed, but may be less protective where an error could have
immediate or irreversible consequences. This is one reason we ask CDRH to consider
reversibility as part of the framework (Section 7).
We would welcome more concrete guidance from CDRH on how much premarket evidence such
a program could replace, and for which types of devices. On cadence and triggers (Question 19),
reassessment could be tied to defined events, such as a model update or the emergence of a new
risk pattern in real-world use. The scope and depth of that reassessment could then be
proportionate to the significance of the change or new risk, consistent with the staged-release
approach described in Section 2. Our automated conversation analyzers (Section 2) also illustrate
FDA, 510(k) Third Party Review Program,
https://www.fda.gov/medical-devices/premarket-submissions-selecting-and-preparing-correct-submission/510k-third
-party-review-program.
one form of the machine-based supervisory agents discussed in Question 20 (p. 21). Such tools
could support ongoing monitoring, but they should themselves be validated for their intended
purpose and periodically checked against clinician review. Research in mental health illustrates
both the potential value of these tools and the importance of continued human oversight. In one
study, an automated judge showed greater agreement with individual clinicians than clinicians
showed with one another, while models also tended to evaluate their own outputs more leniently
than outputs generated by other models.21

6. Change Control (Questions 22, 23, and 24)
We appreciate CDRH’s recognition that generative AI products will change over time, and we
think it’s possible to use PCCPs for these devices. However, a plan that requires a company to
list each specific future change in advance is often infeasible for products that are updated
continuously. We recommend that CDRH clarify in guidance that, for these products, a PCCP’s
description of modifications can define a category of changes by its boundaries, meaning
prespecified performance thresholds and validation methods, rather than by an exhaustive list of
individual changes. Locking a conversational model in place also carries risk. No premarket
testing can anticipate every way people will use these products, and a locked model cannot be
quickly corrected when a new risk appears in real use. Allowing tested, monitored updates lets
patients benefit from those fixes, while the plan’s testing requirements guard against new harms.
In practice, the description of modifications could cover a category of changes, such as updates
to the underlying model, so long as the product keeps the same intended use and the same
declared clinical activities and continues to meet defined performance bounds set at the
acceptance criteria that FDA authorized. The updates would then be run through the same set of
tests. For example, the tests might measure how reliably the product escalates crisis situations
and how often it stays within its intended use. Changes that fall within the category and meet the
passing scores could be made without a new submission. Changes that fall outside it, such as a
change to the product’s intended use or to its declared clinical activities, would require one.
Some changes may not need a PCCP at all. Question 22 asks whether certain categories of
change could be managed within a sponsor’s quality management system (p. 21). We believe
changes that only add or tighten safeguards, such as a new guardrail or analyzer for a newly
identified risk, are good candidates, so long as they are tested before release and the device
continues to meet its passing scores.
Changes to outside models (Question 24). Ash draws on frontier models from other developers
for use cases auxiliary to the core conversational model, such as those related to our memory
retrieval system and our text-to-speech models used for voice conversations. We use fixed
versions of the models we reach through a developer’s API and require agreements with our
vendors that models remain available to us for sufficient time after deprecation for us to identify
a suitable alternative. In practice, frontier models have advanced so rapidly that very few of our
auxiliary models remain the same from one quarter to the next. We treat a move to a new version
like any other model update: it goes through the same offline benchmarks and canary release,
and must meet the same passing scores, before it reaches general use. Furthermore, we
Weilnhammer et al., supra note 6 (finding that an automated judge’s ratings agreed with an individual clinician’s
ratings more closely than two clinicians’ ratings agreed with each other, and that models rated their own outputs
more leniently than other models did).
continuously monitor live conversations against an established baseline and keep tested fallbacks
in place so we can move traffic to another model to mitigate the risk of an unexpected change
from a developer API we rely on.

7. Benefit-Risk, Escalation, and Comparators (Questions 1, 3, 6, 14, and 15)
Patient-facing functions (Question 3). We do not believe a function should be moved higher on
the consequences axis simply because it is patient-facing rather than used by a health care
professional. For many people who come to a tool like ours, the realistic alternative is an internet
search, a long wait, or no support at all, all of which can be associated with worsening outcomes
and thus risk. Our own research supports this. In one study, people who faced barriers to
accessing care found Ash more helpful and used it more, as did people who felt shame or stigma
about seeking mental health support.22 A blanket presumption would penalize the tools best
placed to close that gap, and it would build in the “medical parentalism” the paper itself cautions
against (p. 8). Instead, we recommend that CDRH credit safeguards it can verify, such as
escalation that holds up across an entire conversation and testing of whether users understand the
product’s outputs. On the “when” in Question 3, we recognize that a patient-facing function may
warrant a higher position where the user cannot reasonably evaluate the output and the
consequence of relying on it is severe. In those cases, verified safeguards should be able to offset
the presumption.
Escalation in both directions (Question 6). Over-refusal and over-escalation carry their own
risk. If authorized devices decline reasonable requests or escalate by reflex, people may turn
instead to general-purpose AI tools or AI companion apps that are not designed for mental health
and are not subject to this framework. In one survey of U.S. adults with an ongoing mental health
condition who had used a large language model, nearly half had used one for psychological
support,23 and researchers have found that general-purpose models can respond inappropriately to
serious symptoms, including by encouraging delusional thinking.24 Our own research, described
below, found that when a purpose-built AI wellbeing tool was withdrawn from the market, many
of its users turned to general-purpose AI. We agree with the paper that both under- and
over-escalation matter. We recommend that sponsors state and justify their intended balance
between the two, report each separately and by severity, and measure both against how often
trained clinicians disagree on the same cases. Over-escalation is a real harm. It can lead to
unnecessary emergency visits, add to a person’s anxiety, erode the trust that brings people back
when they need help, and suppress future disclosure of important symptoms. A reflexive referral
Stamatis, C. A., Wolfe, E. C., Malgaroli, M., & Hull, T. D. (2026). Talking to a human as an attitudinal barrier: A
mixed methods evaluation of stigma, access, and the appeal of AI mental health support. arXiv:2604.09575,
https://arxiv.org/abs/2604.09575.
Rousmaniere, T., et al. (2026). Large language models as mental health resources: Patterns of use in the United
States. Practice Innovations, 11(2), 139-155, https://doi.org/10.1037/pri0000292 (reporting that 48.7 percent of
surveyed U.S. adults with an ongoing mental health condition who had used a large language model in the past year
had used one for psychological support).
Moore, J., Grabb, D., Agnew, W., Klyman, K., Chancellor, S., Ong, D. C., & Haber, N. (2025). Expressing stigma
and inappropriate responses prevents LLMs from safely replacing mental health providers. In Proceedings of the
2025 ACM Conference on Fairness, Accountability, and Transparency (pp. 599–627).
https://doi.org/10.1145/3715275.3732039.
to 988 is not always the right response when there is no sign of current risk, particularly when
the services a person is referred to are not accessible to them or they have reported a negative
prior experience with such services. At the same time, missed risk is the failure that matters
most. In our study of 20,000 real conversations with Ash described above, every suicide-risk
case that clinicians confirmed received crisis resources.25
Comparators (Questions 14 and 15). We recommend that sponsors report how much clinicians
disagree with one another on the same task. Utah’s AI regulatory sandbox offers a useful
example. In a pilot in which physicians reviewed an AI system’s decisions on routine
prescription renewals, the physicians agreed with the system’s renewal recommendations 91
percent of the time, and where the first physician wanted more information, a second physician
usually disagreed.26 Much of the gap between the AI and the physician was the same kind of
disagreement physicians have with each other. The same pattern appears in mental health
research, where clinicians rating the same conversations agreed with one another less closely
than an automated judge agreed with an individual clinician.27 We believe this kind of
comparison, against the judgment of clinicians in practice, is the most useful.
We also support considering “no intervention” as an appropriate comparator in some cases
(p. 18). We recommend that CDRH allow comparison to what users would otherwise do, where a
sponsor can support that comparison with data, and that CDRH develop a method for doing so.
One way to support that comparison is with data on what the intended users actually do when the
device is not available, such as the market-withdrawal study described below. Randomized trials
in this area already use a no-treatment comparator. The first randomized trial of a generative AI
mental health chatbot compared it with a waitlist control.28 In behavioral health, the alternative is
often no care at all. We have also studied what people did after a purpose-built AI wellbeing tool
was withdrawn from the market. Many turned to general-purpose AI, or to no support at all.29
Others may turn to AI companion and role-play apps, which are built for entertainment and
engagement rather than mental health support. To be clear, we are not suggesting a deliberately
weak baseline. The comparator should reflect the care that is actually available to the people the
device is intended to serve, and should account for both the benefits and the risks of offering
scalable support where gaps in access are known.
Reversibility (Question 1). Finally, we would encourage CDRH to consider reversibility,
meaning how easily the effect of a wrong output can be undone before it causes harm, as part of
Stamatis et al., Beyond simulations, supra note 15.
Utah Office of Artificial Intelligence Policy, Doctronic Regulatory Mitigation Agreement,
https://ai.utah.gov/agreements/doctronic/; Deep dive: Doctronic’s AI prescription refill pilot program in Utah, Fierce
Healthcare (Aug. 10, 2026),
https://www.fiercehealthcare.com/ai-and-machine-learning/deep-dive-doctronics-ai-prescription-refill-pilot-program
-utah.
Weilnhammer et al., supra note 6.
Heinz et al., supra note 17.
Stamatis, C. A., Kruzan, K. P., Hsu, J., Ungless, M., & Hull, T. D. (2026). Generic AI or nothing: Support-seeking
patterns after market withdrawal of a purpose-built AI wellbeing tool. PsyArXiv,
https://osf.io/preprints/psyarxiv/et8ma.
its risk assessment. Consistent with the paper’s statement that measurement functions may
“migrate higher on the consequences axis” (p. 8), we suggest that reversibility move a function
lower on that axis when errors can be readily detected and undone, rather than serving as a new
axis. A breathing exercise that does not help is very different from telling someone that chest
pain is not urgent. In our experience, most conversational output can be readily reversed. We
recognize that the exceptions, such as missing suicide risk, reinforcing a delusion, or
encouraging someone to stop a medication, are the cases CDRH cares about most, and that small
errors can build over months of use. Our proposals on escalation and postmarket monitoring are
designed to catch those cases and reverse them.

8. Conclusion
We appreciate CDRH’s thoughtful work on this discussion paper and the opportunity to share our
perspective. We would welcome the opportunity to meet with CDRH staff to discuss these
comments or to participate in any pilot programs as CDRH continues to develop this framework,
including its planned draft guidance on generative AI-enabled conversational devices for mental
disorders.​

Respectfully, on behalf of Slingshot AI,

Daniel Cahn
______________________________
Daniel Cahn​
CEO and Co-Founder​
Slingshot AI, Inc.

Neil Parikh
______________________________
Neil Parikh​
President and Co-Founder​
Slingshot AI, Inc.
Please direct any questions regarding these comments to Josh Hsu, General Counsel.