scope:

This document provides guidance for applying an ISO 14971 risk management process when evaluating medical technology utilizing machine learning (ML). It is intended to apply to ML-enabled medical devices² throughout all phases of the product lifecycle.

This document is intended to be used in conjunction with ISO 14971. It does not modify the ISO 14971 risk management process-rather it provides information and guidance to inform the application of ISO 14971 to ML medical technology. A risk management process is further detailed in Annex A.

This document addresses the same types of risk that are addressed in ISO 14971 but focuses on risks that are elevated with or unique to ML medical devices. Because artificial intelligence (AI) and ML are software-driven, the unique or elevated risks are those around data management, feature extraction, algorithm training, evaluation, and cyber and information security. This document also provides examples and suggests strategies for eliminating or mitigating the associated risk.

Annex B of this standard provides additional clarification and examples of hazards, hazardous situations, and harms, as well as possible risk control strategies in a series of tables that correspond with ISO 14971: 2019, Tables C.1, C.2, and C.3.

² Also referred to as ML medical devices in this document.