Risk Management for AI/ML Medical Devices: Applying ISO 14971 and ISO/TS 24971-2:2026

Risk management for AI/ML-enabled medical devices introduces considerations that are not always adequately addressed through conventional software risk analysis alone. The behavior of an ML-enabled function can be influenced by the data used to develop and evaluate the model, characteristics of the intended population, input variability, model performance, foreseeable use, and changes that occur throughout the product lifecycle. These factors need to be considered within the established ISO 14971 risk management process. ISO/TS 24971-2:2026 provides specific guidance for applying ISO 14971 to medical devices that use machine learning. For design and quality teams, this means understanding how ML-specific considerations affect hazard identification, risk estimation and evaluation, selection of risk controls, verification of those controls, residual risk, and the continued review of risk after the device is released.

This webinar focuses on putting that framework into practice. Meredith L. Crabtree will examine Product Hazard Analysis and the use of FMEA and Fault Tree Analysis for ML-related risks, including risks associated with data, model behavior, incorrect or unexpected outputs, and performance variability. The session will also address how identified risks are translated into design and risk-control requirements and traced through verification and supporting evidence. The discussion then follows the risk file across the Total Product Life Cycle, including algorithm and model changes, postmarket performance, cybersecurity considerations, and anticipated modifications under PCCPs. It will conclude by connecting these activities with design and development under QMSR and the risk-management evidence relevant to FDA marketing submissions.