Overview
ISO/TS 24971-2:2026 provides important guidance for managing risks unique to artificial intelligence (AI) and machine learning (ML) in medical devices, referred to as ML-enabled medical devices (MLMD). Developed by the International Organization for Standardization (ISO), this technical specification is meant to be used alongside ISO 14971 (the internationally recognized standard for risk management in medical devices) and ISO/TR 24971. It specifically addresses how manufacturers can integrate the risk management process of ISO 14971 into the MLMD lifecycle. Notably, this document does not apply to MLMD employing large language models (LLMs) or generative AI.
As AI and ML technologies rapidly change the healthcare landscape, ISO/TS 24971-2:2026 serves as a practical tool for developers, manufacturers, and regulators seeking to ensure patient safety, clinical effectiveness, and regulatory compliance of ML-enabled medical devices.
Key Topics
ISO/TS 24971-2:2026 covers several critical topics relevant to the safe and effective integration of ML in medical devices:
- Risk Management Integration: Aligns MLMD development with the ISO 14971 risk management process, covering hazard identification, risk evaluation, risk control, and residual risk assessment.
- Management Responsibilities: Emphasizes the need for informed leadership, the allocation of qualified personnel, and defined risk acceptability criteria within organizations developing MLMD.
- Competency and Team Composition: Stresses the necessity of multidisciplinary teams with expertise in ML practices, data management, clinical workflow, IT security, usability engineering, and regulatory compliance.
- Risk Analysis and Planning:
- Identification of unique ML-related hazards, such as algorithmic bias, overfitting, explainability challenges, and issues with training and test data.
- Special risk control considerations, such as the safe handling of updates, retraining, and adaptation of models (including continuous learning).
- Performance monitoring and proactive post-market surveillance to detect issues that may arise from evolving datasets or model drift.
- Bias and Explainability: Addresses unwanted bias in ML models and the importance of transparency and explainability to foster trust and to facilitate informed clinical decision-making.
- Usability and Human Oversight: Considers user experience, error prevention, and the need for human oversight mechanisms to mitigate risks associated with automation.
Applications
ISO/TS 24971-2:2026 is essential for any organization developing, implementing, or reviewing ML-enabled medical devices, including:
- Medical Device Manufacturers: Supports the integration of robust risk management across all phases of MLMD development, from concept through post-market activities.
- Regulatory Affairs and Quality Professionals: Provides a framework for documenting and demonstrating compliance with international safety expectations for MLMD.
- Healthcare Providers and Users: Informs procurement and operational decisions regarding the safe deployment and ongoing use of MLMD within clinical workflows.
- Technical and Data Science Teams: Guides the design, validation, and retraining strategies for ML models used in medical devices, emphasizing the importance of data quality, performance monitoring, and effective risk controls.
By systematically addressing machine learning-specific risks, organizations can improve device safety, meet regulatory demands, and enhance trust among clinicians and patients.
Related Standards
To comprehensively manage risks for AI and ML in medical devices, ISO/TS 24971-2:2026 should be used alongside these key standards and technical reports:
- ISO 14971:2019 - Medical devices – Application of risk management to medical devices
The foundational standard for medical device risk management.
- ISO/TR 24971 - Medical devices – Guidance on the application of ISO 14971
Offers practical guidance for implementing ISO 14971 processes.
- IEC 80001-1 - Application of risk management for IT networks incorporating medical devices
- IEC/TR 80002-1 - Guidance on the application of ISO 14971 to medical device software
- ISO/IEC 22989 - Foundational AI concepts and terminology
- ISO/IEC 23894 - Risk management for AI systems
In summary, ISO/TS 24971-2:2026 is an essential resource for the effective risk management of machine learning-enabled medical devices, supporting the safe and responsible integration of advanced AI technologies into healthcare.