National foreword

This Published Document is the UK implementation of CEN ISO/TS 24971‑2:2026. It is identical to ISO/TS 24971‑2:2026.

The UK participation in its preparation was entrusted to Technical Committee CH/210/4, Risk analysis for Medical Devices.

A list of organizations represented on this committee can be obtained on request to its committee manager.

Contractual and legal considerations

This publication has been prepared in good faith, however no representation, warranty, assurance or undertaking (express or implied) is or will be made, and no responsibility or liability is or will be accepted by BSI in relation to the adequacy, accuracy, completeness or reasonableness of this publication. All and any such responsibility and liability is expressly disclaimed to the full extent permitted by the law.

This publication is provided as is, and is to be used at the recipient’s own risk.

The recipient is advised to consider seeking professional guidance with respect to its use of this publication.

This publication is not intended to constitute a contract. Users are responsible for its correct application.

This publication is not to be regarded as a British Standard.

Compliance with a Published Document cannot confer immunity from legal obligations.

This Published Document was published under the authority of the Standards Policy and Strategy Committee on 30 June 2026.

This Technical Specification (CEN/TS) was approved by CEN on 22 June 2026 for provisional application.

The period of validity of this CEN/TS is limited initially to three years. After two years the members of CEN and CENELEC will be requested to submit their comments, particularly on the question whether the CEN/TS can be converted into a European Standard.

CEN and CENELEC members are required to announce the existence of this CEN/TS in the same way as for an EN and to make the CEN/TS available promptly at national level in an appropriate form. It is permissible to keep conflicting national standards in force (in parallel to the CEN/TS) until the final decision about the possible conversion of the CEN/TS into an EN is reached.

CEN and CENELEC members are the national standards bodies and national electrotechnical committees of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czechia, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic of North Macedonia, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye and United Kingdom.

European foreword

This document (CEN ISO/TS 24971‑2:2026) has been prepared by Technical Committee ISO/TC 210 "Quality management and corresponding general aspects for products with a health purpose including medical devices" in collaboration with Technical Committee CEN-CENELEC/ JTC 3 “Quality management and corresponding general aspects for medical devices” the secretariat of which is held by NEN.

Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. CEN-CENELEC shall not be held responsible for identifying any or all such patent rights.

Any feedback and questions on this document should be directed to the users’ national standards body/national committee. A complete listing of these bodies can be found on the CEN and CENELEC websites.

According to the CEN-CENELEC Internal Regulations, the national standards organizations of the following countries are bound to announce this Technical Specification: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic of North Macedonia, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye and the United Kingdom.

Endorsement notice

The text of ISO/TS 24971‑2:2026 has been approved by CEN-CENELEC as CEN ISO/TS 24971‑2:2026 without any modification.

Foreword

ISO (the International Organization for Standardization) is a worldwide federation of national standards bodies (ISO member bodies). The work of preparing International Standards is normally carried out through ISO technical committees. Each member body interested in a subject for which a technical committee has been established has the right to be represented on that committee. International organizations, governmental and non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.

The procedures used to develop this document and those intended for its further maintenance are described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types of ISO documents should be noted. This document was drafted in accordance with the editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).

ISO draws attention to the possibility that the implementation of this document may involve the use of (a) patent(s). ISO takes no position concerning the evidence, validity or applicability of any claimed patent rights in respect thereof. As of the date of publication of this document, ISO had not received notice of (a) patent(s) which may be required to implement this document. However, implementers are cautioned that this may not represent the latest information, which may be obtained from the patent database available at www.iso.org/patents. ISO shall not be held responsible for identifying any or all such patent rights.

Any trade name used in this document is information given for the convenience of users and does not constitute an endorsement.

For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions related to conformity assessment, as well as information about ISO’s adherence to the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT), see www.iso.org/iso/foreword.html.

This document was prepared by Technical Committee ISO/TC 210, Quality management and corresponding general aspects for products with a health purpose including medical devices, in collaboration with Technical Committee IEC/TC 62, Medical equipment, software, and systems, Subcommittee SC 62A, Common aspects of medical equipment, software, and systems, and with the European Committee for Standardization (CEN) Technical Committee CEN/CLC/JTC 3, Quality management and corresponding general aspects for medical devices, in accordance with the Agreement on technical cooperation between ISO and CEN (Vienna Agreement).

A list of all parts in the ISO 24971 series can be found on the ISO website.

Any feedback or questions on this document should be directed to the user’s national standards body. A complete listing of these bodies can be found at www.iso.org/members.html.

Introduction

Artificial intelligence (AI) is rapidly advancing and offers transformative potential for the healthcare sector. These advantages can be related to improved benefits for the patient, increased efficiency in clinical workflows and more effective management of healthcare overall. However, the implementation of new technologies such as AI can also present new risks and can, for example, jeopardize patient safety, affect privacy and security, influence user actions, undermine trust in healthcare or adversely affect the management of healthcare.

The safety and effectiveness of AI in medical devices was explored in an AAMI-BSI document^[16^], which identified three ways in which AI-based medical devices differed from “traditional” (non-AI) medical devices:

Training. These medical devices can process large amounts of data and learn from these data to improve their results. Thus, they can have positive effects on patient health within the scope of the intended use of the medical device.
Level of autonomy. These medical devices can generate different treatment options, select the best option based on a trained model and execute the selected option (see for example IEC/TR 60601‑4‑1^[8^]). These steps can be performed with reduced or even without direct user action. Therefore, human oversight is critical for their safe application.
Explainability. These medical devices often rely on complex algorithms and large datasets to generate output. However, the inherent opacity of these algorithms makes it challenging to interpret how specific conclusions or recommendations are derived. This aspect is sometimes referred to as the “black-box problem”. This can make it difficult for clinicians, other healthcare personnel and individuals without specialist knowledge to understand the rationale for the output.

Many different AI-based technologies and algorithms exist today, which are differentiated by data topology and model architecture, including decision trees, genetic algorithms and deep learning-based technologies such as generative AI and neural networks. ISO/IEC 22989^[4^] and ISO/IEC 23894^[6^] provide general guidance on AI concepts, terminology and risk management, but they do not specifically address the application of AI to medical devices. It is noted that “risk” is defined in these documents as the effect of uncertainties on objectives (see also ISO 31000^[3^]). This definition is useful for organizational or business risk management. The term “risk” used in the healthcare sector is different and is defined in ISO 14971:2019 as the combination of the probability of occurrence of harm and the severity of that harm.

This document focuses on machine learning (ML) techniques and is restricted to ML-enabled medical devices (MLMD). Machine learning is considered a subset of AI that involves an ML model and an ML algorithm. See Figure 1. The ML model and the ML algorithm are the results of the concept development for a new MLMD, together with acceptance criteria for the eventual MLMD. It is noted that the supporting infrastructure (computing framework, hardware, network and other IT components) can be an important aspect in concept development. The MLMD acceptance criteria are different from the criteria for risk acceptability. It is important to establish the MLMD acceptance criteria at the start, as part of concept development, and not at the end of the MLMD development. Otherwise, the results of MLMD testing could influence the decisions when establishing those criteria.

After concept development, the ML model is trained by using an ML algorithm enabling it to learn patterns from training data without being explicitly programmed. Next, the trained ML model is applied to test data to verify its performance. The training data and the test data are different (disjoint) sets. They can be actual patient data or synthetic data, i.e. data created to simulate a patient for training or testing purposes. The tested ML model can then be applied to new patient data in a clinical setting. More information on MLMD can be found in IMDRF documents N67^[21^] and N88^[23^] and in guidance documents^[17^][18^] from FDA, Health Canada and MHRA.

It is recognized that the ML model can require retraining after a period of use to redefine its parameters and to ensure its continued performance. This can be achieved by planned retraining with collected patient data or on a continuous basis with each new patient data. The latter is referred to as “continuous learning” throughout this document and sometimes as “adaptive” in other documents.

All medical devices come with inherent risks. Manufacturers are required to demonstrate that their medical devices do not pose unacceptable risks, and that the benefits of the intended use outweigh the overall residual risk. ISO 14971 details how manufacturers can identify, assess and control risks to protect the patients, the users and other persons as well as property (for example objects, data, other equipment) and the environment. This includes risks related to data and systems security and cybersecurity. Guidance on the application of ISO 14971 is provided in document ISO/TR 24971^[2^]. Additionally, IEC 80001‑1^[11^] and IEC/TR 80002‑1^[12^] address software internal to a medical device that can support AI or ML.

This document was developed to provide specific guidance on the application of ISO 14971 to MLMD. It does not provide a new risk management process, nor does it expand the requirements of ISO 14971. This document addresses risks related to machine learning and topics such as data management, feature extraction, unwanted bias, information security, training the ML model by an ML algorithm, evaluation and testing of the trained ML model. See Annex A for an explanation of bias. The report AAMI TIR34971^[14^] provided valuable input for this document.

1 Scope

This document provides guidance on risks specific to artificial intelligence (AI) and machine learning (ML) and how to apply the risk management process of ISO 14971 to ML-enabled medical devices (MLMD). This document is intended to be used in conjunction with ISO 14971 and ISO/TR 24971^[2^].

This document does not apply to MLMD employing large language models (LLM) or generative AI.

2 Normative references

3 Terms and definitions

4 General requirements for risk management system

4.1 Risk management process

4.2 Management responsibilities

4.3 Competence of personnel

4.4 Risk management plan

4.5 Risk management file

5 Risk analysis

5.1 Risk analysis process

5.2 Intended use and reasonably foreseeable misuse

5.3 Identification of characteristics related to safety

5.4 Identification of hazards and hazardous situations

5.5 Risk estimation

6 Risk evaluation

7 Risk control

7.1 Risk control option analysis

7.2 Implementation of risk control measures

7.3 Residual risk evaluation and subsequent steps

8 Evaluation of overall residual risk

8.1 General considerations for MLMD

8.2 Disclosure of significant residual risks

9 Risk management review

10 Production and post-production activities

10.1 General

10.2 Information collection

10.3 Information review

10.4 Actions

Bibliography

AI Medical Device Data & Risk Management Solution Pack