Kooth (Patrick Johnston)

Please find Kooth’s comments attached.

Submitted electronically to https://www.regulations.gov/

October 19, 2026

RE: Docket No. FDA-2026-N-7874; ​
Considerations for the Regulation of Generative AI-Enabled Medical Devices:
Discussion Paper and Request for Feedback

To whom it may concern,

Kooth welcomes the opportunity to comment on the FDA’s Center for Devices and
Radiological Health (CDRH) discussion paper on the regulation of generative AI-enabled
medical devices.

For 25 years, Kooth has pioneered digital mental health services, combining evidence-based
care with the reach and accessibility of digital technology to ensure that more people can
access the support they need.

Today, our services are available to over 20 million people, supporting hundreds of
thousands of users every year, the majority of whom are aged between 13 and 25. In the
US, Kooth is a core partner in California’s Children and Youth Behavioral Health Initiative
(CYBHI), where we’ve designed and launched Soluna: the nation’s first statewide, free
digital mental health service for 13–25 year olds. Co-designed with youth, Soluna removes
traditional barriers, expands access, and integrates seamlessly with existing supports to help
a generation build resilience and thrive. Soluna is now available to young people across
Michigan, New Jersey, and the UK, with state funding enabling free, universal support.

Our comments are deliberately not exhaustive. We focus on GenAI that young people use
for mental health support, and we respectfully submit the following recommendations for
CDRH's consideration:

1.​ Risk should reflect real-world use and safeguards, not labels. General-purpose
and "wellness" chatbots are widely used for mental health support, including by
young people, yet sit largely outside oversight. Intended use and directiveness
should be judged by what products actually do across realistic conversations, not by
how they are marketed. (Q1, Q2, Q5)
2.​ Young people need baseline protections. Any GenAI product that young people
foreseeably use for mental health should meet baseline safeguards. These include
age-appropriate design, clear disclosure that it is AI, and safe, proportionate routes to
human support, including crisis services. (Q1, Q5)
 3.​ Regulation should reward safeguarding, not penalize it. Demonstrated human
oversight should lower a product's risk. Tools that flag risk for review, with escalations
conducted by a trained human, should not be regulated as medical devices. (Q1, Q6)
4.​ Responsibility should be shared across the AI supply chain. Developers whose
foundation models are used for health purposes should share responsibility, including
giving advance notice of material changes and publishing safety evaluations. (Q24)
5.​ Change control should be proportionate. Model updates that pass safety testing
should be managed within a manufacturer's own quality management system.
Changes to intended use or target population should require FDA review. (Q22)
6.​ Regulatory approaches should converge internationally. As a provider operating
in both the US and the UK, Kooth welcomes deepening FDA–MHRA collaboration,
including the liaison program announced in June 2026 and joint work through IMDRF.
Consistent international standards would strengthen protection and reduce
duplicative burden for responsible, global providers. (Q22)

Together, these changes would focus regulatory attention where risk is greatest, while
enabling responsible providers to keep people safe.

Thank you for your consideration. For any questions or comments, please feel free to
contact us.

Sincerely,

Dr Patrick Johnston

Chief Operating Officer, Kooth
pjohnston@kooth.com

Dr Lynne Green

Chief Clinical Officer, Kooth
lgreen@kooth.com
Q1: Extra dimensions for the risk framework

Kooth supports the two-axis framework as a foundation. For conversational GenAI in mental
health, however, products with the same activity and the same consequence of error can
carry very different real-world risk. We recommend four modifiers that adjust a function's
position within the framework, rather than new axes.

●​ User vulnerability. Risk should increase where users are less able to evaluate
outputs, particularly children, young people, and people in acute distress. Products
that young people foreseeably use should meet baseline safeguards, including
age-appropriate design, clear disclosure that it is AI, and signposting to human crisis
support.
●​ Foreseeable use. Risk should reflect how a product is actually used, not only its
labelled intended use. General-purpose and "wellness" chatbots are widely used for
mental health support, often by young people. A product that delivers medical-like
support should not avoid scrutiny simply by avoiding medical terminology.
●​ Downstream safeguards. Risk should decrease where demonstrated safeguards are
in place: qualified human oversight, clinical governance, and reliable handoff to crisis
support. Credit should require evidence that the safeguards work in practice. As set
out in our response to Question 6, these safeguards should lower a product's risk
without themselves being treated as device functions.
●​ Time pressure and reversibility. Risk should increase in time-critical settings where
harm may be irreversible, such as a mental health crisis.

Together, these modifiers place the same underlying model at different points in the
framework depending on context. A general-purpose chatbot used by a distressed young
person with no human oversight carries far higher risk than a youth mental health service
built on the same model with clinically governed safeguards. This directs regulatory attention
to where risk is greatest.

Q2: Directiveness as a spectrum

Kooth supports treating directiveness as a continuum. Furthermore, directiveness should be
assessed on the outputs a product actually produces in realistic use, not on how it is
described or marketed. A product that delivers medical-like guidance should not avoid
scrutiny simply by avoiding medical terminology.

We suggest the following output characteristics as risk modifiers:

●​ Raise risk: imperative instructions; specific clinical actions; personalization inferring
a clinical diagnosis; a single directed path with no alternatives; and emotionally
persuasive or dependency-forming language. Dependency-forming language can
steer a vulnerable user as strongly as an explicit instruction.
●​ Lower risk: offering a range of options; general psychoeducation, especially when
drawn from a clinically reviewed library; users choosing their own next step; and
ready access to human support.
Functions that are non-directive, draw on reviewed content, leave the next step to the user,
and provide access to human support have a risk profile more consistent with supportive
information than with a device function. Conversely, where a general-purpose product
routinely produces higher-risk outputs on health topics, those outputs should inform how its
intended use is assessed. We encourage CDRH to publish worked examples near this
boundary, applied equally to purpose-built tools and to general-purpose chatbots used for
mental health support. This would give all developers predictability, encourage design
toward these safeguards, and create a level playing field.

Q5: Multi-turn conversations drifting from information to direction

Risk should be assessed across realistic conversations, including long exchanges, users in
distress, young users, and deliberate attempts to push a system beyond its scope.

Where behavior emerges over a conversation, intended use is best characterized by the
scope a product is designed to stay within, and by evidence that it does. Products that
demonstrably stay within defined limits, and hand off to human support when a conversation
becomes directive or high-risk, should be assessed against that narrower use.

Any GenAI product that young people foreseeably use for mental health should maintain
baseline safeguards throughout a conversation: age-appropriate design, ongoing disclosure
that it is AI, crisis referrals, and design that avoids fostering dependence.

Q6: Under-escalation vs over-escalation

We encourage CDRH to clarify that care escalation functions do not include AI that flags
potential risk for review by a trained human, where a human makes every escalation
decision beyond referrals, and the tool neither diagnoses nor gives users clinical advice.
Treating such safeguarding tools as devices would discourage the providers doing most to
keep young people safe, while general-purpose chatbots often provide little escalation at all.

How to weigh under- against over-escalation depends heavily on what an escalation
triggers. Flagging a conversation for human review costs little; an automatic emergency
referral costs a great deal. We encourage CDRH to recognize graduated escalation
pathways, such as referrals/signposting, then human review, then emergency services.
These let a system escalate early at low cost, which narrows the trade-off itself.

Within each tier, manufacturers could set a minimum detection rate for the highest-risk
cases, then minimize over-escalation subject to that floor. Acceptable trade-offs should be
set in advance through clinical governance for each deployment context, not tuned by
developers alone. For young people, over-escalation is a real harm, not a safe default: it
erodes trust and discourages future disclosure.
Q22: Scaling the evidence needed for model changes

Kooth supports using the premarket competency-based assessment as a baseline for
re-evaluating modifications. The key distinction is between changes to how a model
performs and changes to what a product is for.

Model-level changes could be managed within a manufacturer's quality management
system. These include new foundation model versions, adjustments to prompts or
guardrails, updates to the curated content the system draws on, and retraining of
task-specific models. The condition is that the device is re-benchmarked and continues to
meet predefined criteria. These changes are well suited to a PCCP. Changes to intended
use or target population, or new action-directing functions, should require FDA review.

We encourage CDRH to build on Predetermined Change Control Plans for Machine
Learning-Enabled Medical Devices: Guiding Principles (FDA, Health Canada and MHRA,
2023), so that manufacturers can validate an update once rather than separately for each
market.

Q24: Changes to third-party foundation models

Foundation model developers can change or retire models with little notice. Manufacturers
remain responsible for the safety of their devices, but can only meet that responsibility if they
know when and how the underlying model changes.

Manufacturers can detect and respond to such changes by pinning to specific model
versions, monitoring model behavior continuously in production, and automatically
re-running their safety benchmarks whenever the underlying model changes. Changes that
pass predefined criteria could be managed under a PCCP, as set out in our response to
Question 22.

We encourage CDRH to set expectations, through guidance or recognized standards, for
foundation model developers whose models are used in health contexts. These should
include advance notice of material changes, a defined period of access to fixed model
versions, and published safety evaluations, including how the model behaves with young
people and on mental health topics.