scope:

This document provides guidance for applying an ISO 14971 risk management process when evaluating medical technology utilizing machine learning (ML). It is intended to apply to ML-enabled medical devices² throughout all phases of the product lifecycle.

This document is intended to be used in conjunction with ISO 14971. It does not modify the ISO 14971 risk management process-rather it provides information and guidance to inform the application of ISO 14971 to ML medical technology. A risk management process is further detailed in Annex A.

This document addresses the same types of risk that are addressed in ISO 14971 but focuses on risks that are elevated with or unique to ML medical devices. Because artificial intelligence (AI) and ML are software-driven, the unique or elevated risks are those around data management, feature extraction, algorithm training, evaluation, bias, health inequity, safety, and cyber and information security. This document also provides examples and suggests strategies for eliminating or mitigating the associated risk.

Annex B provides additional clarification and examples of hazards, hazardous situations, and harms, as well as possible risk control strategies in a series of tables that correspond with ISO 14971: 2019, Table C.1, Table C.2, and Table C.3.

² Also referred to as ML medical devices in this document.

² Documents that are referred to solely in an informative manner are listed in the Bibliography.