BS EN ISO 14971 is the cornerstone of risk management for medical devices, guiding us through the process of identifying and controlling risks. Whether your device is a physical product or a software-based solution, this standard is crucial. For AI and machine learning systems, risk management becomes even more complex due to their inherent unpredictability and reliance on data. This standard helps us stay ahead of potential hazards and ensures patient safety, which is critical for regulatory approval under frameworks like the FDA and MDR.

In this lesson, learners will be introduced to the essential terms and concepts used in ISO 14971, the international standard for risk management of medical devices. We will explore critical definitions such as risk, hazard, harm, hazardous situation, and residual risk, helping learners understand their significance in the context of medical device safety.

Competence of personnel is crucial in the risk management process, particularly in AI and SaMD development. ISO 34971:2023 emphasizes the importance of having team members with the right qualifications, skills, and experience to identify, assess, and mitigate risks effectively. Personnel involved in risk management should have expertise in both the clinical aspects of the device and the technical elements, such as AI algorithms and software systems.

Understanding and meeting regulatory requirements is critical for bringing AI-based medical devices to market. For instance, compliance with the EU Medical Device Regulation (MDR) and FDA 510(k) pathways ensures that your product meets safety and performance standards. Regulatory bodies require robust documentation, including clinical evidence, risk management files, and technical reports to ensure patient safety and product efficacy.​

In AI-driven systems, it's important to show how your software functions within clinical workflows and to demonstrate that it continuously meets safety standards, especially as machine learning models evolve over time.

​

Understand the Risk Management Process Framework

A Risk Management Plan is the foundation of the entire risk management process outlined in ISO 14971. It provides a structured approach to identifying, assessing, and controlling risks throughout the lifecycle of a medical device, including AI-based systems. The plan must be created early in the development process and updated as new risks emerge.

​

Risk Analysis: Systematically identifying hazards and estimating the risks associated with them.

Risk Evaluation: Assessing the identified risks to determine their acceptability.

Risk Control: Implementing measures to reduce or eliminate unacceptable risks.

Residual Risk Evaluation: Evaluating the risks that remain after control measures have been applied.

In the context of AI and machine learning-based medical devices, risk management is an ongoing process that is crucial for ensuring safety and compliance. According to AAMI/BSI TR 34971, regular risk management reviews are required to assess new risks introduced through system updates, changes in performance, or environmental factors. This review ensures that identified risks are properly mitigated, and residual risks are evaluated in light of current performance and regulations."​

Once an AI-based medical device has gone through development, testing, and regulatory approval, the focus shifts to production and post-production activities. These activities are critical for ensuring that the device remains safe and effective throughout its lifecycle. Key aspects include continuous monitoring, handling complaints, and retraining the AI model based on real-world performance.