Skip to content
The pace of AI implementation into new products and settings is increasing rapidly. While machine learning has been used to supplement and drive technology behind medical software, such as radiology planning software, for a few years now, the use of AI in high-risk scenarios has flourished recently. We are seeing the emergence of many new systems, such as ambient scribes for clinicians and other clinical decision-making tools, and this has been met with a new AI-focused standard from the international standards committee, ISO 42001, which was created to provide AI Management best practice principles.
Management system standards, such as ISO 9001 or ISO 13485, are powerful tools used by organisations to help meet their regulatory requirements. For companies producing AI-driven products or services, the need to manage an AI system means that implementing a best-practice framework such as ISO 42001 could be appealing. As it turns out, there may be other upsides to effectively handling AI management through ISO 42001, as it can be very helpful in meeting other regulatory or statutory needs.
Medical Device Regulations
Under the requirements of regulations such as EU MDR, medical devices must have complete and comprehensive technical documentation, which includes key information about the device.
Within this, particularly for Software Medical Devices (SaMD), there is a need to create a detailed system architecture, outlining how the device operates, along with testing plans and results. By implementing ISO 42001 in conjunction with your other management systems, it is much easier to have a structured approach to documenting your system and its key features. Relatedly, AI risk management from ISO 42001 feeds directly into your existing medical device risk management systems, reviewing the system from an AI-risk perspective not only ensures that all safety and clinical handles have been addressed, but also may bring additional stakeholders into the risk review process, whose expertise may help with other areas of risk analysis.
EU AI Act
As of August 2027, the EU AI Act will be fully in force for medical devices requiring a Notified Body – in fact, EU AI Act compliance will need to be confirmed by your Notified Body. This means there will be another mandatory regulatory framework which must be met by AI-medical device manufacturers to ensure their algorithms and products are safe and low risk to their users and beyond.
To meet the requirements of the EU AI Act, organisations should be setting up a system of processes to document and review AI from creation (including training and refining) to release – expect your Notified Body to be asking about this in the audit before August 2027. Creating an AI management system in line with ISO 42001 can streamline this process, setting you up for success by creating documented procedures for AI implementation, review and risk management.
If this applies to you, you should already be addressing the AI Literacy requirements of the EU AI Act – fortunately, we have a free course to address exactly this requirement.
CEN and Standardisation
The European Committee for Standardisation (CEN) is a body which works with groups of industry experts to determine which international standards should become recommended for use by organisations within the EU. They currently have a project to review AI-related standards and will be making recommendations to regulators and manufacturers about which standards should be harmonised against European regulations.
On the current working docket, they refer to an unnamed standard for AI management systems, and it has been widely speculated that this is likely to be ISO 42001. Going forward, this means that there is a good chance the standard will end up in the harmonisation process against EU regulations, such as the EU AI Act or even MDR and IVDR. If you’re planning to sell high-risk AI into Europe, there’s a reasonable chance that compliance with ISO 42001 will become part of your market entry requirements in the coming years.
UK, US and Canada - the 10 Good Machine Learning Principles
Collectively, a joint body representing the UK, USA and Canada has created a list of 10 principles which should form the basis for good machine learning and AI design. The principles fall generally into three broad areas: having the right people, sourcing and using the right data, and monitoring the product during development and beyond release.
AI Medical Devices in the UK, US and Canadian markets should be applying these principles in their company already.
These principles are all addressed within ISO 42001, which sets out the management system steps needed to control and maintain an AI system effectively. For example, ISO 42001 clause 9 is about measuring and monitoring of products, through documented reviews, audits and management review. Or in clause 7, there are clearly set out requirements for both competence and awareness, ensuring that your organisation has the right expertise with the right level of training to ensure that decisions made about your AI are done in a way that is technically and ethically sound.
What if I don't make a Medical Device?
Even outside of the medical device and clinical space, there is still unease among the public, healthcare professionals and commissioners about the rise of unchecked AI and the legitimacy of claims of its safety and effectiveness. Demonstrating compliance with ISO 42001 is a great way to demonstrate to both customers and potential partners that your organisation is running an effective AI management system and helps to assure interested parties that your products are being made with the necessary level of diligence and rigour.
We’re the experts that have your back.
Speak to a Member of our Expert Team about how you can adopt ISO 42001 into your business
