--- title: "AI SaMD Playbook · Regulating AI/ML Medical Devices" description: "Working reference for AI/ML SaMD regulation: FDA PCCP, EU AI Act, MHRA, Health Canada, PMDA, TGA, NMPA · for RA, QA, security and product teams." lang: en json-ld: | [ { "@context": "https://schema.org", "@graph": [ { "@type": "WebSite", "@id": "https://ai-samd.com/#website", "url": "https://ai-samd.com/", "name": "AI SaMD Playbook", "description": "Working reference for regulating AI/ML Software as a Medical Device: FDA, EU AI Act, MHRA, Health Canada and NMPA guidance, model risks, and cybersecurity for RA/QA teams.", "inLanguage": "en" }, { "@type": "Organization", "name": "Blue Goat Cyber", "url": "https://bluegoatcyber.com" } ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "AI SaMD Playbook · Regulating AI/ML Software as a Medical Device", "description": "A working reference for regulating AI/ML Software as a Medical Device · FDA PCCP, EU AI Act, MHRA, Health Canada, PMDA, TGA, and NMPA guidance, model risks, and cybersecurity considerations for RA/QA teams.", "author": { "@type": "Organization", "name": "Blue Goat Cyber" }, "publisher": { "@type": "Organization", "name": "Blue Goat Cyber", "url": "https://bluegoatcyber.com" }, "mainEntityOfPage": "https://ai-samd.lovable.app/" }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Which AI-specific risks must our ISO 14971 file address?", "acceptedAnswer": { "@type": "Answer", "text": "At minimum: dataset bias and subgroup performance gaps, distributional shift after deployment, automation bias from the clinician, adversarial or out-of-distribution inputs, and silent failure modes where the model returns a confident but wrong output. Each should map to a hazardous situation, a sequence of events, and a verifiable mitigation · not just a generic 'human in the loop' statement." } }, { "@type": "Question", "name": "How do we handle performance drift in the risk file?", "acceptedAnswer": { "@type": "Answer", "text": "Treat drift as a foreseeable misuse / lifecycle hazard. Define the monitored metrics (e.g. AUROC, calibration, subgroup deltas), the thresholds that trigger investigation, and the response · retraining inside a PCCP, a field safety notice, or temporary disablement. Reviewers increasingly expect drift thresholds to be quantitative, not narrative." } }, { "@type": "Question", "name": "Do we need to document foundation-model or third-party model risk?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. If any component is a third-party or foundation model, you own the risk of opaque training data, undisclosed updates, and license changes. Document the supplier control, the locked version under test, and what happens if the upstream provider deprecates or silently retrains it." } }, { "@type": "Question", "name": "When do we need a PCCP vs. a new 510(k) / Letter to File?", "acceptedAnswer": { "@type": "Answer", "text": "A PCCP is for changes you can specify in advance: the modification (e.g. periodic retraining on new sites), the protocol (data, methods, acceptance criteria), and the impact assessment. Anything you cannot bound up-front · new intended use, new patient population, new output type · is a new submission. A Letter to File still applies for changes outside the PCCP that don't affect safety or effectiveness." } }, { "@type": "Question", "name": "What does 'locked' vs. 'adaptive' mean in practice?", "acceptedAnswer": { "@type": "Answer", "text": "A locked algorithm produces the same output for the same input across the cleared lifecycle; any change is a controlled release. An adaptive algorithm updates in the field · and is only acceptable to FDA today inside a PCCP that pre-authorizes exactly how it may change. Continuously self-learning systems with no envelope are not currently clearable in the US." } }, { "@type": "Question", "name": "Who owns model governance internally?", "acceptedAnswer": { "@type": "Answer", "text": "RA/QA owns the regulatory envelope and change-control gate, ML owns model performance and drift monitoring, security owns the integrity of the training and inference pipeline, and clinical/medical affairs owns the intended-use boundary. The dossier should show a single Responsible Person and a documented escalation path between these functions." } }, { "@type": "Question", "name": "How is an AI SaMD threat model different from a classical SaMD one?", "acceptedAnswer": { "@type": "Answer", "text": "You inherit the standard STRIDE / SBOM / vulnerability-management expectations from the FDA 2023 premarket cyber guidance, plus AI-specific threats: model inversion, membership inference, training-data poisoning, prompt injection (for LLM-backed devices), and adversarial perturbations. The threat model should explicitly enumerate which of these apply and which are out of scope, with rationale." } }, { "@type": "Question", "name": "What about the model weights and training data themselves?", "acceptedAnswer": { "@type": "Answer", "text": "Treat weights as a controlled software artifact: integrity-checked, signed where feasible, and inventoried in your SBOM (or AI-BOM). Training and validation datasets need provenance, access controls, and a documented chain of custody · especially if PHI was used. Loss of integrity of either weights or data is a cybersecurity event under the 2023 guidance." } }, { "@type": "Question", "name": "Do we need post-market monitoring for AI-specific attacks?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. Your post-market surveillance plan should cover anomalous input patterns (possible adversarial probing), unexpected output distributions, and known-vulnerability disclosures against any upstream model or framework. Coordinate with your vulnerability disclosure program so AI-specific findings have a triage path." } }, { "@type": "Question", "name": "What is the minimum AI-specific artifact set for a submission?", "acceptedAnswer": { "@type": "Answer", "text": "A model card (intended use, training/validation data, performance by subgroup, limitations), a data sheet for each dataset, a PCCP if the model will update post-market, a GMLP-aligned lifecycle description, an AI-aware threat model and SBOM/AI-BOM, and a post-market performance monitoring plan. For EU, add the AI Act technical documentation crosswalk to your MDR technical file." } }, { "@type": "Question", "name": "How detailed does the model card need to be?", "acceptedAnswer": { "@type": "Answer", "text": "Detailed enough that an independent reviewer can reproduce the headline performance claims and understand where the model should not be used. That means quantitative metrics with confidence intervals, subgroup breakdowns, the exact frozen test set, the inference hardware envelope, and explicit out-of-scope populations and inputs." } }, { "@type": "Question", "name": "How do we keep the dossier audit-ready between submissions?", "acceptedAnswer": { "@type": "Answer", "text": "Version the model card, PCCP execution log, drift-monitoring reports, and retraining records under your QMS · not in an ML team wiki. Each PCCP-permitted update should produce a traceable record (data snapshot, training run ID, validation report, release approval) that can be pulled in an inspection without reconstruction." } } ] } ] --- [AI SaMD Playbook ](/) Sections[Crosswalk](/#crosswalk)Tools Search Ctrl K[Talk to us →](https://go.bluegoatcyber.com/meetings/blue-goat-cyber/discovery-session) AI SaMD Playbook · Living reference, updated monthly # The field guide for shipping AI-enabled medical software. AI SaMD Playbook is a working reference for RA/QA, product, and security teams turning machine-learning models into cleared Software as a Medical Device · covering the new FDA, EU AI Act, MHRA, Health Canada, and NMPA expectations, the risk vectors auditors are now asking about, and the artifacts (PCCP, model cards, crosswalks) you need on file. - Built for RA/QA, ML, and security leads - Covers FDA · EU AI Act · MHRA · HC · NMPA - Why now PCCP + GMLP are reshaping submissions - Output Audit-ready submission artifacts [Explore the concerns →](#concerns)[Read the brief](#crosswalk) Sponsored by [Blue Goat Cyber](https://bluegoatcyber.com/) · 250+ FDA submissions, zero rejections. ## The AI SaMD lifecycle map Global obligations across the ML development pipeline Data Train Validate Deploy Monitor FDAUSA EU AI ActEU MHRAUK Health CanadaCA PMDAJP TGAAU NMPACN Primary obligation Supporting control Hover any node for the compliance question it raises. Hover a node · the compliance question it raises appears here AI/ML-enabled devices authorized by FDA 1,350+ FDA list · 2026 update [Source · FDA list ↗](https://www.fda.gov/medical-devices/software-medical-device-samd/artificial-intelligence-and-machine-learning-aiml-enabled-medical-devices) PCCP final guidance Dec 2024 FDA · final guidance [Source · FDA guidance ↗](https://www.fda.gov/regulatory-information/search-fda-guidance-documents/predetermined-change-control-plans-machine-learning-enabled-medical-devices) EU AI Act high-risk obligations Aug 2026 Annex III medical AI [Source · Art. 113 (EU) 2024/1689 ↗](https://artificialintelligenceact.eu/article/113/) Of devices with no model card ≈ 70% transparency gap [Source · Nature Med. 2025 audit ↗](https://www.nature.com/articles/s41591-024-03203-3) The landscape ## Four shifts redrawing the _SaMD_ map. AI didn't just add a feature to medical software. It rewrote the assumptions underneath every premarket submission, every post-market report, and every cybersecurity threat model. FDA · 2024 ### Predetermined Change Control Plans PCCPs let manufacturers pre-authorize specified model updates without a new submission. The catch: the modification protocol must be airtight, and drift outside it is an unauthorized change. Final guidance · reissued Aug 2025 [Source · FDA PCCP guidance ↗](https://www.fda.gov/regulatory-information/search-fda-guidance-documents/predetermined-change-control-plans-machine-learning-enabled-medical-devices) FDA · IMDRF ### Good Machine Learning Practice Ten guiding principles for the lifecycle of ML-enabled devices: representative data, performance monitoring, human-in-the-loop, transparency. Increasingly cited in deficiency letters. GMLP · 10 principles [Source · FDA / Health Canada / MHRA GMLP ↗](https://www.fda.gov/medical-devices/software-medical-device-samd/good-machine-learning-practice-medical-device-development-guiding-principles) EU · AI Act × MDR ### The double-classification trap An AI SaMD that is Class IIa under MDR is almost always high-risk under the AI Act. Two conformity assessments, two technical files, two sets of post-market obligations · but one device. Enforcement · August 2026 [Source · MDCG 2025-6 (MDR/IVDR × AIA) ↗](https://health.ec.europa.eu/document/download/b78a17d7-e3cd-4943-851d-e02a2f22bbb4_en?filename=mdcg_2025-6_en.pdf) Cross-cutting ### Transparency, bias & explainability Regulators increasingly expect model cards, intended-use populations, subgroup performance, and a clear story for how clinicians should weigh the output. Black boxes are getting harder to ship. Health Canada · MHRA · TGA aligned [Source · GMLP transparency principles ↗](https://www.fda.gov/medical-devices/software-medical-device-samd/transparency-machine-learning-enabled-medical-devices-guiding-principles) The guidance shelf ## The _documents_ shaping AI in SaMD. A curated reading list of the regulations, guidances, and frameworks that an AI/ML SaMD program is expected to know · with the canonical link to each. Search guidance documents Sort Newest Oldest Title A–Z By body All bodiesFDAEUMHRAHealth CanadaIMDRFWHONIST Showing 16 of 16 [ EU Ongoing Framework ### MDCG Guidance Documents (MDR/IVDR) ](https://health.ec.europa.eu/medical-devices-sector/new-regulations/guidance-mdcg-endorsed-documents-and-other-guidance_en) [Medical Device Coordination Group guidance · including](https://health.ec.europa.eu/medical-devices-sector/new-regulations/guidance-mdcg-endorsed-documents-and-other-guidance_en) [MDCG 2019-11](/glossary#mdcg-2019-11) on qualification & classification of software, the MDCG-endorsed cybersecurity guidance, and MDR/AI Act interplay. Open document ↗ [ MHRA Ongoing Framework ### Software and AI as a Medical Device Change Programme The UK's iterative reform programme · eleven workstreams covering qualification, premarket, post-market, cybersecurity, and AI-specific transparency. Targeted guidance lands on a rolling basis. Open document ↗ ](https://www.gov.uk/government/publications/software-and-ai-as-a-medical-device-change-programme)[ FDA 2026 Final ### Cybersecurity in Medical Devices · QMS & Premarket Submissions ](https://www.fda.gov/regulatory-information/search-fda-guidance-documents/cybersecurity-medical-devices-quality-system-considerations-and-content-premarket-submissions) [Final guidance reissued 3 Feb 2026, superseding the June 2025 version. The reference document for](https://www.fda.gov/regulatory-information/search-fda-guidance-documents/cybersecurity-medical-devices-quality-system-considerations-and-content-premarket-submissions) [SBOM](/glossary#sbom), threat modelling, vulnerability management and post-market cyber for any AI-enabled device. Open document ↗ [ MHRA 2026 In force ### AI Airlock · Phase 2 Cohort + £3.6M Expansion Phase 2 (announced Oct 2025) adds seven technologies spanning ambient clinical scribes, cancer diagnostics, eye-disease detection and obesity treatment. April 2026 funding extends the programme through 2028. Open document ↗ ](https://www.gov.uk/government/news/mhra-expands-ai-airlock-programme-with-a-36-million-funding-boost-over-three-years)[ HC 2026 Final ### Pre-market Guidance for ML-Enabled Medical Devices ](https://www.canada.ca/en/health-canada/services/drugs-health-products/medical-devices/application-information/guidance-documents/pre-market-guidance-machine-learning-enabled-medical-devices.html) [](https://www.canada.ca/en/health-canada/services/drugs-health-products/medical-devices/application-information/guidance-documents/pre-market-guidance-machine-learning-enabled-medical-devices.html)[Health Canada](/glossary#health-canada)'s risk-based premarket framework · data quality, validation, transparency, predetermined-change handling, and post-market monitoring for ML-enabled [SaMD](/glossary#samd). Open document ↗ [ FDA 2025 Draft ### AI-Enabled Device Software Functions: Lifecycle Management Draft guidance (Jan 2025) outlining premarket and lifecycle expectations for AI-enabled device software functions, including transparency, performance monitoring, and labelling. Open document ↗ ](https://www.fda.gov/regulatory-information/search-fda-guidance-documents/artificial-intelligence-enabled-device-software-functions-lifecycle-management-and-marketing)[ EU 2025 Framework ### MDCG 2025-6 · MDR/IVDR × AI Act Interplay ](https://health.ec.europa.eu/document/download/b78a17d7-e3cd-4943-851d-e02a2f22bbb4_en?filename=mdcg_2025-6_en.pdf) [June 2025 joint MDCG + AI Board guidance on how MDR/IVDR conformity assessment lines up with](https://health.ec.europa.eu/document/download/b78a17d7-e3cd-4943-851d-e02a2f22bbb4_en?filename=mdcg_2025-6_en.pdf) [AI Act](/glossary#ai-act) high-risk obligations · the canonical reference for a single dual-conformity file. Open document ↗ [ MHRA 2025 Framework ### AI Airlock · Pilot Programme Report ](https://www.gov.uk/government/publications/ai-airlock-sandbox-pilot-programme-report) [Published Oct 2025, the 77-page synthesis of the Apr 2024 – Mar 2025 pilot cohort. Not formal guidance, but the clearest signal of how](https://www.gov.uk/government/publications/ai-airlock-sandbox-pilot-programme-report) [MHRA](/glossary#mhra) is reasoning about [AIaMD](/glossary#aiamd) evidence, monitoring and change control. Open document ↗ [ FDA 2024 Final ### Predetermined Change Control Plans for ML-Enabled Devices Final guidance on how manufacturers can pre-authorize specified model modifications without a new submission. Defines the Description of Modifications, Modification Protocol, and Impact Assessment. Open document ↗ ](https://www.fda.gov/regulatory-information/search-fda-guidance-documents/predetermined-change-control-plans-machine-learning-enabled-medical-devices)[ EU 2024 In force ### Regulation (EU) 2024/1689 · The AI Act ](https://eur-lex.europa.eu/eli/reg/2024/1689/oj) [Classifies medical AI as high-risk under](https://eur-lex.europa.eu/eli/reg/2024/1689/oj) [Article 6](/glossary#article-6) + Annex I. High-risk obligations apply Aug 2026; GPAI obligations from Aug 2025. Layers on top of MDR/IVDR conformity assessment. Open document ↗ [ MHRA 2024 In force ### AI Airlock · Regulatory Sandbox ](https://www.gov.uk/government/publications/ai-airlock-the-regulatory-sandbox-for-aiamd) [A live sandbox pairing manufacturers, approved bodies, and the NHS with the](https://www.gov.uk/government/publications/ai-airlock-the-regulatory-sandbox-for-aiamd) [MHRA](/glossary#mhra) to test how novel AI medical devices can be safely regulated before launch. Open document ↗ [ IMDRF 2024 Draft ### Good Machine Learning Practice · Guiding Principles (N73) ](https://www.imdrf.org/sites/default/files/2024-06/Good%20machine%20learning%20practice%20for%20medical%20device%20development%20-%20Guiding%20Principles%20DRAFT%20for%20Consultation.pdf) [Draft 2024 expansion of the ten](https://www.imdrf.org/sites/default/files/2024-06/Good%20machine%20learning%20practice%20for%20medical%20device%20development%20-%20Guiding%20Principles%20DRAFT%20for%20Consultation.pdf) [GMLP](/glossary#gmlp) principles, prepared by the [IMDRF](/glossary#imdrf) AI/ML Working Group. Feeds back into FDA, [MHRA](/glossary#mhra), and HC alignment. Open document ↗ [ WHO 2024 Framework ### Ethics & Governance of AI for Health · LMM Guidance WHO guidance on the ethics and governance of large multi-modal models in health, covering oversight, transparency, bias, and accountability across the lifecycle. Open document ↗ ](https://www.who.int/publications/i/item/9789240084759)[ NIST 2023 Framework ### AI Risk Management Framework (AI RMF 1.0) Voluntary framework increasingly cited by US regulators and procurers · Govern, Map, Measure, Manage. Adopted as the spine of many manufacturer AI risk programs. Open document ↗ ](https://www.nist.gov/itl/ai-risk-management-framework)[ IMDRF 2022 Final ### ML-Enabled Medical Devices: Key Terms & Definitions (N67) The harmonised vocabulary regulators now reference · model, training data, locked vs. adaptive, deployment environment. The starting point for any cross-jurisdictional submission. Open document ↗ ](https://www.imdrf.org/documents/machine-learning-enabled-medical-devices-key-terms-and-definitions)[ FDA 2021 Framework ### Good Machine Learning Practice · 10 Guiding Principles ](https://www.fda.gov/medical-devices/software-medical-device-samd/good-machine-learning-practice-medical-device-development-guiding-principles) [Co-authored with](https://www.fda.gov/medical-devices/software-medical-device-samd/good-machine-learning-practice-medical-device-development-guiding-principles) [Health Canada](/glossary#health-canada) and the [MHRA](/glossary#mhra). The de facto checklist regulators read submissions against: representative data, human-in-the-loop, lifecycle monitoring. Open document ↗ The Compliance Clock ## When the obligations _bite_. A live, dated read on the FDA, EU AI Act, MHRA and APAC milestones that change what an AI/ML SaMD program must do. All bodiesFDAEU AI ActMHRAPMDATGAHC **HEADS UP** · The EU's proposed Digital Omnibus on AI (in trilogue) would push high-risk dates from 2 Aug 2026 to 2 Dec 2027 . Treat EU 2026/2027 entries as proposed, not settled. 2023 HC In force ### Health Canada pre-market guidance for ML-enabled devices Health Canada finalises lifecycle expectations for machine-learning enabled medical devices, aligning with IMDRF GMLP and FDA action plan. [Read more +](/regulators/health-canada)/ Sources · Health Canada SaMD guidance MAY 2024 MHRA In force ### AI Airlock sandbox launched MHRA opens its regulatory sandbox for AI as a Medical Device, pairing manufacturers with approved bodies and the NHS to stress-test novel AI devices pre-market. [Read more +](/regulators/mhra)/ Sources · MHRA Press · AI Airlock DEC 2024 FDA In force ### FDA PCCP final guidance + AI/ML lifecycle draft Predetermined Change Control Plans become the expected vehicle for bounded post-market model updates; the lifecycle draft is now cited in reviews. [Read more +](/regulators/fda)/ Sources · FDA · PCCP final guidance FEB 2025 EU In force ### EU AI Act Art. 5 prohibitions + Art. 4 AI literacy Prohibited practices apply across the Union and providers / deployers must ensure AI-literacy for staff operating AI systems. [Read more +](/regulators/eu-ai-act)/ Sources · EU AI Act consolidated text AUG 2025 EU In force ### GPAI obligations (Chapter V) for foundation models General-purpose AI providers face transparency, copyright, and systemic-risk obligations that propagate downstream into medical-device integrations. [Read more +](/regulators/eu-ai-act) FEB 2026 FDA In force ### FDA cybersecurity premarket guidance reissue Refreshed premarket cybersecurity expectations including SBOM, AI-aware threat modelling, and post-market coordinated vulnerability disclosure. [Read more +](/regulators/fda)/ Sources · FDA · Cybersecurity guidance FEB 2026 TGA In force ### TGA refreshed AI regulation page + evidence positions TGA publishes its updated approach to AI in medical devices, with explicit positions on evidence packages and Australian-population data. [Read more +](/regulators/tga) APR 2026 MHRA In force ### AI Airlock Phase 2 + £3.6M multi-year funding Second cohort runs under multi-year funding, locking in the Airlock as a permanent route for novel AI devices through 2028. [Read more +](/regulators/mhra) 2 AUG 2026 EU Proposed push ### EU AI Act high-risk application date Primary date for high-risk AI systems (Arts. 9–14, 72) to be fully compliant. EU's Digital Omnibus on AI proposes pushing this to 2 Dec 2027 — treat as pending. [Read more +](/regulators/eu-ai-act)/ Sources · EU Digital Omnibus (trilogue) 2026 PMDA Imminent ### PMDA IDATEN + Confirmation of Change Plans for AI Japan's IDATEN scheme and Confirmation of Change Plans are explicitly extended to AI-based devices, with Japan-specific evidence expectations. [Read more +](/regulators/pmda) 2026 FDA Imminent ### FDA AI/ML lifecycle guidance expected to finalise Final lifecycle guidance is expected to formalise GMLP-aligned expectations across the total product life cycle for AI-enabled devices. [Read more +](/regulators/fda) 2 AUG 2027 EU Horizon ### EU AI Act Annex I extended transition closes Dual conformity (MDR + AI Act) required with no further grandfathering for legacy Annex I devices that integrate AI components. [Read more +](/regulators/eu-ai-act) 2027+ TGA Horizon ### TGA software rules reform consolidation Australia's software-as-medical-device rules consolidate, with AI-aware criteria for clinical decision support and adaptive systems. [Read more +](/regulators/tga) Live countdown 93 DAYS until EU AI Act high-risk application date EU readiness index Fragmented FDA transition period Active MHRA guidance Settled [Open the regulator crosswalk](/crosswalk) Reference date · May 2026 · refreshed monthly. Click any milestone for the regulator detail page. The compliance clock ## When the _obligations_ bite. A dated read on the FDA, EU AI Act and MHRA milestones that change what an AI/ML SaMD program has to do, and by when. Heads up - The EU's proposed Digital Omnibus on AI (in trilogue) would push the high-risk application date from 2 Aug 2026 to 2 Dec 2027 , with knock-on effects for the Annex I extension. Treat the EU 2026/2027 entries below as the regulation as enacted, not as a settled timetable. All bodiesFDAEU AI ActMHRA Showing 12 of 12 Expand all + 1. May 2024 MHRA In force ### AI Airlock sandbox launched MHRA opens its regulatory sandbox for AI as a Medical Device, pairing manufacturers with approved bodies and the NHS to stress-test novel AI devices pre-market. Read more + Sources: [MHRA press release ↗](https://www.gov.uk/government/news/mhra-launches-ai-airlock-to-address-challenges-for-regulating-medical-devices-that-use-artificial-intelligence)[AI Airlock collection ↗](https://www.gov.uk/government/collections/ai-airlock-the-regulatory-sandbox-for-aiamd) 2. Aug 2024 EU In force ### EU AI Act enters into force Regulation (EU) 2024/1689 enters into force. Most obligations apply on a staged timetable; the clock starts here for medical AI manufacturers. Read more + Sources: [Regulation (EU) 2024/1689 ↗](https://eur-lex.europa.eu/eli/reg/2024/1689/oj)[Commission announcement ↗](https://commission.europa.eu/news-and-media/news/ai-act-enters-force-2024-08-01_en) 3. Dec 2024 FDA In force ### PCCP final guidance issued On 3 Dec 2024 FDA publishes the final Marketing Submission Recommendations for a Predetermined Change Control Plan for AI-Enabled Device Software Functions, letting manufacturers pre-authorise specified model modifications without a new submission. Read more + Sources: [Federal Register notice ↗](https://www.federalregister.gov/documents/2024/12/04/2024-28361/marketing-submission-recommendations-for-a-predetermined-change-control-plan-for-artificial)[FDA guidance page ↗](https://www.fda.gov/regulatory-information/search-fda-guidance-documents/predetermined-change-control-plans-machine-learning-enabled-medical-devices) 4. Jan 2025 FDA Draft ### AI-Enabled Device Software Functions: draft guidance On 7 Jan 2025 FDA publishes draft lifecycle-management guidance for AI-enabled device software functions (docket FDA-2024-D-4488), signalling expectations on transparency, monitoring and labelling that reviewers are already citing in submissions ahead of finalisation. Read more + Sources: [Federal Register notice ↗](https://www.federalregister.gov/documents/2025/01/07/2024-31543/artificial-intelligence-enabled-device-software-functions-lifecycle-management-and-marketing)[Draft guidance PDF ↗](https://www.hhs.gov/guidance/sites/default/files/hhs-guidance-documents/FDA/guidance-ai-enabled-device-software-functions.pdf)[FDA guidance page ↗](https://www.fda.gov/regulatory-information/search-fda-guidance-documents/artificial-intelligence-enabled-device-software-functions-lifecycle-management-and-marketing) 5. Feb 2025 EU Applies ### AI Act, Chapters I + II apply Prohibited AI practices (Art. 5) and AI literacy obligations (Art. 4) become applicable. Affects any deployer or provider operating in the EU, including medical AI vendors. Read more + Sources: [Article 5 (prohibited) ↗](https://artificialintelligenceact.eu/article/5/)[Article 4 (AI literacy) ↗](https://artificialintelligenceact.eu/article/4/)[Regulation (EU) 2024/1689 ↗](https://eur-lex.europa.eu/eli/reg/2024/1689/oj) 6. Aug 2025 EU Applies ### AI Act GPAI obligations apply General-Purpose AI model rules (Chapter V), governance bodies and penalties become applicable. Foundation-model providers used inside SaMD now in scope. Read more + Sources: [GPAI Chapter V ↗](https://artificialintelligenceact.eu/chapter/5/)[Commission GPAI guidelines ↗](https://digital-strategy.ec.europa.eu/en/library/guidelines-scope-obligations-providers-general-purpose-ai-models-under-ai-act)[GPAI Code of Practice ↗](https://digital-strategy.ec.europa.eu/en/policies/ai-code-practice) 7. Oct 2025 MHRA In force ### AI Airlock pilot report + Phase 2 cohort MHRA publishes the 77-page AI Airlock pilot programme report (Apr 2024 – Mar 2025) and announces a Phase 2 cohort of seven AI technologies, signalling how the agency expects evidence, monitoring and change control to evolve for AIaMD. Read more + Sources: [Pilot programme report ↗](https://www.gov.uk/government/publications/ai-airlock-sandbox-pilot-programme-report)[Phase 2 cohort ↗](https://www.gov.uk/government/publications/ai-airlock-phase-2-cohort) 8. 2025–26 MHRA Expected ### Software & AI Change Programme: targeted guidance lands MHRA continues releasing workstream outputs (qualification, premarket, post-market, cybersecurity, AI-specific transparency) on a rolling basis under the SaMD/AIaMD Change Programme. Read more + Sources: [Change Programme (GOV.UK) ↗](https://www.gov.uk/government/publications/software-and-ai-as-a-medical-device-change-programme)[Roadmap document ↗](https://www.gov.uk/government/publications/software-and-ai-as-a-medical-device-change-programme/software-and-ai-as-a-medical-device-change-programme-roadmap) 9. Feb 2026 FDA In force ### Cybersecurity premarket guidance reissued FDA reissues the final Cybersecurity in Medical Devices guidance (3 Feb 2026), superseding the June 2025 version. Now the controlling document for SBOM/AIBOM, threat modelling, vulnerability management and post-market cyber for any AI-enabled device submission. Read more + Sources: [Feb 2026 final guidance (PDF) ↗](https://www.fda.gov/media/119933/download)[FDA guidance page ↗](https://www.fda.gov/regulatory-information/search-fda-guidance-documents/cybersecurity-medical-devices-quality-system-considerations-and-content-premarket-submissions) 10. Apr 2026 MHRA In force ### AI Airlock secures £3.6M multi-year funding MHRA confirms £3.6M over three years to expand the AI Airlock, locking in the sandbox as a standing component of UK AIaMD regulation through 2028. Read more + Sources: [MHRA funding announcement ↗](https://www.gov.uk/government/news/mhra-expands-ai-airlock-programme-with-a-36-million-funding-boost-over-three-years) 11. Aug 2026 EU Applies ### AI Act high-risk obligations apply Full high-risk regime applies to AI systems classified under Article 6 + Annex III. Most medical AI is high-risk via the MDR/IVDR conformity-assessment route under Annex I, risk management, data governance, transparency, human oversight and post-market monitoring become enforceable. Read more + Sources: [Article 113 (entry into application) ↗](https://artificialintelligenceact.eu/article/113/)[Articles 9–14 (high-risk obligations) ↗](https://artificialintelligenceact.eu/chapter/3/)[MDCG 2025-6 (MDR/IVDR × AIA) ↗](https://health.ec.europa.eu/document/download/b78a17d7-e3cd-4943-851d-e02a2f22bbb4_en?filename=mdcg_2025-6_en.pdf) 12. Aug 2027 EU Applies ### AI Act Annex I high-risk extension applies Extended transition period closes for high-risk AI embedded in products covered by Annex I sectoral law (medical devices, IVDs, machinery). Full conformity assessment under both MDR/IVDR and the AI Act required. Read more + Sources: [Article 113(c) extended transition ↗](https://artificialintelligenceact.eu/article/113/)[Annex I (Union harmonisation law) ↗](https://artificialintelligenceact.eu/annex/1/)[MDCG 2025-6 guidance ↗](https://health.ec.europa.eu/document/download/b78a17d7-e3cd-4943-851d-e02a2f22bbb4_en?filename=mdcg_2025-6_en.pdf) The concerns matrix ## The _risks_ regulators are watching. Eight AI-specific risk vectors that are reshaping how SaMD is reviewed, monitored, and · when it goes wrong · recalled. Severity reflects how often we see them in 2024–2025 deficiency letters. Severity AllCriticalHighWatch Threat type All threatsDataModelAdversarialLLM-specificLifecycle Showing 8 of 8 # Risk vector Mechanism Patient & program impact Type Severity 01 Model & data drift Real-world inputs diverge from training distribution; performance silently degrades. Missed pathology, biased subgroup outcomes, unreported AE pattern shift. Model Critical 02 Data poisoning Adversarial samples in training, fine-tuning or federated updates corrupt the model. Targeted misclassification; integrity loss across the install base. Data Critical 04 LLM hallucination & prompt injection Generative SaMD invents references, mis-summarises notes, follows hidden instructions. Patient safety + liability; unauthorised data exfiltration via tool calls. LLM-specific Critical 03 Adversarial inputs Imperceptible perturbations to images, signals or prompts force wrong outputs. Clinical decision support gives confidently wrong recommendations. Adversarial High 05 Opacity & explainability Clinicians cannot interrogate why the model said what it said. Automation bias, deficient informed consent, regulator pushback. Model High 06 Third-party foundation models OEM ships a device on top of a model it does not control or fully document. SBOM gaps, supply-chain CVEs, version pinning impossible to attest. LLM-specific High 07 Lifecycle & post-market monitoring Continuous learning outside an authorised PCCP, no rollback path. Unauthorised modification; mandatory recall risk. Lifecycle High 08 Privacy of training & inference data PHI memorised by the model; inference logs leak across tenants. HIPAA / GDPR exposure; reputational and statutory penalties. Data Watch Key concerns · expandable ## Five questions every _AI/SaMD_ file must answer. A working primer on the recurring themes in 2024–2025 deficiency letters. Tap any row to expand the regulator's expectation and the watchpoints we look for in a submission review. ### 01 Bias & equity Subgroup performance is a regulatory question, not just a fairness one. Training data that under-represents skin tones, ages, sexes or device vendors produces silent disparities in sensitivity and specificity. FDA, [MHRA](/glossary#mhra) and [Health Canada](/glossary#health-canada) now expect performance to be reported by clinically relevant subgroups, with mitigation plans where gaps are found. What we look for - Stratified test-set metrics (sex, age, race/ethnicity, device, site) - Documented data-collection rationale and known representational gaps - Bias re-evaluation tied to each model update [Source · FDA, GMLP guiding principles ↗](https://www.fda.gov/medical-devices/software-medical-device-samd/good-machine-learning-practice-medical-device-development-guiding-principles) ### 02 Transparency Clinicians and patients must be able to interrogate what the model is doing. ### 03 Clinical validation Analytical accuracy is not clinical performance. ### 04 Cybersecurity AI models inherit every classical threat, and bring new ones. ### 05 Post-market monitoring The submission is the start of the obligation, not the end. The case files ## When AI in (and around) _medicine_ failed. Seven sourced incidents · from regulated SaMD failures to the consumer-chatbot tragedies that are now driving how the FDA, EU and MHRA rewrite the rules. Content note Several entries describe suicide, self-harm and patient deaths in clinical detail. Sourced to court filings, peer-reviewed journals and primary reporting. If you are in crisis, please contact your local emergency services or [findahelpline.com](https://findahelpline.com). All casesSaMDClinical AI / CDSConsumer chatbot Showing 8 of 8 Case 00 · 2023 Peer-reviewed critique ### GE HealthCare · Critical Care Suite (K223491) SaMD USA · FDA An on-device AI triage algorithm for pneumothorax detection on chest X-ray · cleared via [510(k)](/glossary#510k) and a worked example of how the FDA expects AI lifecycle controls to look in a real submission. Read the file +[Source: FDA K223491 decision summary (PDF) ↗](https://www.accessdata.fda.gov/cdrh_docs/pdf22/K223491.pdf) Case 01 · 2025 Litigation ### Raine v. OpenAI Consumer chatbot California, USA Wrongful-death suit alleging ChatGPT coached a 16-year-old toward suicide over months of conversation. Read the file +[Source: NYT coverage ↗](https://www.nytimes.com/2025/08/26/technology/chatgpt-openai-suicide.html) Case 02 · 2024 Litigation ### Garcia v. Character.AI Consumer chatbot Florida, USA First major US wrongful-death suit against an AI companion app: 14-year-old Sewell Setzer III died by suicide after months of attachment to a Character.AI persona. Read the file +[Source: Reuters ↗](https://www.reuters.com/legal/character-ai-must-face-suicide-lawsuit-us-judge-rules-2025-05-21/) Case 03 · 2023 Regulatory action ### Belgian 'Eliza' case Consumer chatbot Belgium An adult Belgian man died by suicide after six weeks of conversation with 'Eliza', a chatbot built on the Chai app's GPT-J–based model. Read the file +[Source: Brussels Times ↗](https://www.brusselstimes.com/430098/belgian-man-commits-suicide-following-exchanges-with-chatgpt) Case 04 · 2023 Withdrawn ### NEDA 'Tessa' chatbot Consumer chatbot USA The US National Eating Disorders Association pulled its Tessa chatbot days after launch when it began dispensing weight-loss advice to users with eating disorders. Read the file +[Source: NPR ↗](https://www.npr.org/sections/health-shots/2023/06/08/1180838096/an-eating-disorders-chatbot-offered-dieting-advice-raising-fears-about-ai-in-hea) Case 05 · 2018–2022 Regulatory action ### Babylon Health symptom-checker SaMD United Kingdom [MHRA](/glossary#mhra)\-regulated triage app repeatedly criticised for missing serious presentations including heart attack and sepsis in safety researcher tests. Read the file +[Source: BMJ investigation ↗](https://www.bmj.com/content/368/bmj.m815) Case 06 · 2018 Peer-reviewed critique ### IBM Watson for Oncology Clinical AI / CDS USA / global Internal IBM documents revealed Watson recommended 'unsafe and incorrect' cancer treatments, including a regimen contraindicated by the patient's bleeding. Read the file +[Source: STAT News ↗](https://www.statnews.com/2018/07/25/ibm-watson-recommended-unsafe-incorrect-treatments/) Case 07 · 2021 Peer-reviewed critique ### Epic Sepsis Model Clinical AI / CDS USA External validation of Epic's widely-deployed sepsis prediction model found it missed 67% of sepsis cases and generated alert fatigue at scale. Read the file +[Source: JAMA Intern Med ↗](https://jamanetwork.com/journals/jamainternalmedicine/fullarticle/2781307) The crosswalk · preview ## One _device_. Seven regulators. One read. A condensed view of how the major regulators are positioning on AI in SaMD. Use it to scope your global submission strategy before the divergence multiplies your timeline. [ FDA ](/regulators/fda) [ United States · FDA Leading ](/regulators/fda) [](/regulators/fda)[PCCP](/glossary#pccp) final guidance, AI/ML Action Plan, draft guidance on AI-enabled device software functions. → [ EU ](/regulators/eu-ai-act) [ European Union · AI Act + MDR Statutory ](/regulators/eu-ai-act) [](/regulators/eu-ai-act)[AI Act](/glossary#ai-act) classifies medical AI as high-risk; full obligations apply Aug 2026 alongside [MDR](/glossary#mdr). → [ MHRA United Kingdom · MHRA Advanced Software & AI as a Medical Device Change Programme, AI Airlock sandbox underway. → ](/regulators/mhra) [ HC Canada · Health Canada Advanced Pre-market guidance for ML-enabled medical devices; aligned with FDA/MHRA principles. → ](/regulators/health-canada) [ PMDA Japan · PMDA Developing IDATEN + Confirmation of Change Plans expanded to AI/program medical devices (Sept 2025). → ](/regulators/pmda) [ TGA Australia · TGA Developing Reformed software rules + AI evidence guidance; AI regulation page refreshed Feb 2026. → ](/regulators/tga) [ NMPA China · NMPA Emerging Technical review guidelines for AI medical devices; algorithm filing required. → ](/regulators/nmpa) Risk-class crosswalk ## The same _risk_, seven names. IMDRF SaMD tiers down the side, every regulator's local class across the top. Each cell is the one obligation that bites at that tier in that jurisdiction. All tiersTier ITier IITier IIITier IV IMDRF SaMD tier FDA United States EU EU AI Act + MDR MHRA United Kingdom HC Canada PMDA Japan TGA Australia NMPA China Tier I Inform Inform clinical management · non-serious condition e.g. Wellness coach prompting hydration Class I / often exempt 510(k)-exempt likely; QSR + cybersecurity still apply MDR Class I · AI Act high-risk if Annex I route Self-declared CE under MDR; AI Act may still pull in if rule applies UK Class I Self-declared; SaIAMD Workstream 02 on intended purpose Class I Establishment licence only; MDEL Class I · General Self-notification; no PMD Act premarket review Class I ARTG inclusion; conformity assessment evidence Class I Record-filing with provincial NMPA bureau Tier II Drive Inform clinical management · serious condition e.g. Triage suggestion in primary care Class II · 510(k) / De Novo 510(k) or De Novo; PCCP recommended for any retraining MDR Class IIa · AI Act high-risk Notified Body conformity + AI Act Annex IV technical file UK Class IIa Approved Body review; SaIAMD WS 02 + WS 09 (cyber-secure AI) Class II Medical Device Licence; ML-enabled pre-market guidance applies Class II · Controlled Third-party certification or PMDA review depending on generic class Class IIa Conformity assessment; AI evidence guidance for software Class II Provincial NMPA review + algorithm filing + Chinese clinical data Tier III Diagnose Drive clinical management · serious condition e.g. AI-CADx flagging suspicious lesions Class II/III · De Novo or PMA Clinical validation expected; AI/ML lifecycle draft cited in reviews MDR Class IIb · AI Act high-risk Notified Body + AI Act Arts. 9–14 + Art. 72 post-market AI plan UK Class IIb Approved Body design-dossier or type review; AI Airlock candidate Class III Clinical evidence + ML pre-market guidance + post-market plan Class III · Highly Controlled PMDA review; IDATEN / Confirmation of Change Plans for AI changes Class IIb TGA conformity assessment; AI-specific evidence expected Class II/III CMDE technical review; Chinese-population validation; locked model Tier IV Treat or diagnose critical Diagnose / treat · critical condition e.g. Autonomous AI dosing or critical-care diagnosis Class III · PMA Full PMA + rigorous clinical; PCCP mandatory for any model update MDR Class III · AI Act high-risk Annex IX conformity + AI Act + FRIA (Art. 27) for public deployers UK Class III Approved Body design-dossier; Innovative Devices Pathway encouraged Class IV Highest scrutiny; clinical investigation + full ML evidence package Class IV · Highly Controlled Full PMDA review + locked-model expectations + post-market obligations Class III / AIMD TGA conformity assessment; clinical investigation typical Class III NMPA national review; CMDE AI guideline; Chinese trial data required Classifications are indicative · local rules and intended-use specifics control · for a personalised classification run the [risk wizard](/risk-wizard). Implementation ## Six _moves_ to ship AI SaMD without losing a quarter. 1. 01 Define the model's intended use first Population, modality, decision class. Everything else · PCCP, GMLP, post-market · flows from this. 2. 02 Author a real PCCP, not a placeholder Specify which parameters can change, the protocol that governs changes, and the impact assessment template. 3. 03 Threat-model the model itself Treat the model as an attack surface: poisoning, evasion, extraction, prompt injection, supply chain. 4. 04 Ship a model card with every release Datasets, subgroup performance, known failure modes. Regulators read these. So do plaintiffs. 5. 05 Wire post-market monitoring before launch Drift detectors, performance dashboards, AE triage, and a documented rollback path on day one. 6. 06 Map FDA → EU AI Act once, reuse forever One control set; two technical files. Save the quarter you'd otherwise spend rewriting. § FAQ · for RA/QA readers ## The questions auditors are already asking . Short, plain-English answers to the AI-specific concerns we see surface in deficiency letters, notified-body Q&A, and pre-submission meetings. Use them as a self-check against your own technical file. Risk vectors ### AI-specific failure modes 01 What reviewers want to see anticipated in your hazard analysis · beyond the usual SaMD risks. ### Which AI-specific risks must our ISO 14971 file address? ### How do we handle performance drift in the risk file? ### Do we need to document foundation-model or third-party model risk? Model governance ### Lifecycle, change control, PCCP 02 How to keep a learning system inside its cleared envelope without filing a new submission for every retrain. ### When do we need a PCCP vs. a new 510(k) / Letter to File? ### What does 'locked' vs. 'adaptive' mean in practice? ### Who owns model governance internally? Cybersecurity ### AI-aware threat modelling 03 Where the FDA 2023 cybersecurity guidance and AI/ML expectations intersect · and what auditors now ask. ### How is an AI SaMD threat model different from a classical SaMD one? ### What about the model weights and training data themselves? ### Do we need post-market monitoring for AI-specific attacks? Audit artifacts ### What belongs in the dossier 04 The documents reviewers and notified bodies are now explicitly asking for in AI/ML submissions. ### What is the minimum AI-specific artifact set for a submission? ### How detailed does the model card need to be? ### How do we keep the dossier audit-ready between submissions? Informational only · not legal or regulatory advice. Always reconcile against the current text of FDA, EU AI Act, MHRA, Health Canada, and NMPA guidance for your specific intended use. Sponsor ## Built and sponsored by _Blue Goat Cyber_. The cybersecurity team behind 250+ FDA submissions with zero rejections . Penetration testing, threat modeling, SBOM, and AI/ML model security for medical device manufacturers · from first 510(k) to global rollout. [Visit Blue Goat Cyber ↗](https://bluegoatcyber.com/)[Re-read the concerns](#concerns) Why this guide exists Every week, another regulator publishes another draft on AI in SaMD. Manufacturers don't need another PDF · they need one place to see the shape of the field, the risks that matter, and the playbook that keeps a submission moving. Independent · Vendor-neutral · Updated quarterly Subscribe to the brief ## New guidance · in your inbox · before it's on LinkedIn. One email per fortnight. The week's regulatory moves on AI in medical devices, distilled · FDA, EU AI Act, MHRA, Health Canada, NMPA. No fluff, no recycled press releases. Work email Subscribe → Joining the waitlist · no sponsor pitches, ever Talk to Blue Goat Cyber ## Bring your _AI SaMD_ to the team that has shipped 250+. Book a working session and we'll come back with a tailored read on the regulatory and cybersecurity work in front of you. No sales pitch · a 30-minute discovery call. - PCCP-ready threat models for AI/ML devices - FDA → EU AI Act control mapping - SBOM, model card and post-market monitoring playbooks Replies within one business day · NDA on request Discovery session · 30 min ### Pick a time that works. Live calendar · video link sent on confirmation. Bring your device concept, target regulator(s), and any open questions. [Book a discovery session](https://go.bluegoatcyber.com/meetings/blue-goat-cyber/discovery-session) Opens go.bluegoatcyber.com in a new tab © 2026 AI SaMD Playbook · Sponsored by Blue Goat Cyber [Crosswalk](/crosswalk)[Colophon](/colophon) Editorial reference only. Not legal or regulatory advice.