Risk Management for AI/ML Medical Devices: Applying ISO 14971 and ISO/TS 24971-2:2026

Risk management for AI/ML-enabled medical devices introduces considerations that are not always adequately addressed through conventional software risk analysis alone. The behavior of an ML-enabled function can be influenced by the data used to develop and evaluate the model, characteristics of the intended population, input variability, model performance, foreseeable use, and changes that occur throughout the product lifecycle. These factors need to be considered within the established ISO 14971 risk management process. ISO/TS 24971-2:2026 provides specific guidance for applying ISO 14971 to medical devices that use machine learning. For design and quality teams, this means understanding how ML-specific considerations affect hazard identification, risk estimation and evaluation, selection of risk controls, verification of those controls, residual risk, and the continued review of risk after the device is released.

This webinar focuses on putting that framework into practice. Meredith L. Crabtree will examine Product Hazard Analysis and the use of FMEA and Fault Tree Analysis for ML-related risks, including risks associated with data, model behavior, incorrect or unexpected outputs, and performance variability. The session will also address how identified risks are translated into design and risk-control requirements and traced through verification and supporting evidence. The discussion then follows the risk file across the Total Product Life Cycle, including algorithm and model changes, postmarket performance, cybersecurity considerations, and anticipated modifications under PCCPs. It will conclude by connecting these activities with design and development under QMSR and the risk-management evidence relevant to FDA marketing submissions.

| WHY YOU SHOULD ATTEND

Apply the New ML-Specific Risk Guidance

Understand how ISO/TS 24971-2:2026 supplements ISO 14971 for machine-learning-enabled medical devices and where ML introduces additional considerations into hazard identification, risk estimation, control, and residual risk evaluation.

Connect Risk Analysis to the Device Lifecycle

See how Product Hazard Analysis, FMEA, FTA, design controls, verification evidence, algorithm changes, postmarket information, cybersecurity, and regulatory expectations connect rather than operating as separate risk activities.

| AREAS COVERED

1. ISO 14971 Risk Management for ML-Enabled Devices

• What ISO/TS 24971-2:2026 adds to the ISO 14971 framework
• Where ML creates different risk considerations from conventional device software
• ML model, algorithm, data and performance considerations across the TPLC

2. ML Hazard Identification and Risk Analysis

• Product Hazard Analysis for ML-enabled device functions
• Data, model behavior, incorrect outputs, performance variability and foreseeable use
• Applying FMEA and Fault Tree Analysis to ML-related failure and hazard scenarios
• Risk estimation when ML performance can vary across populations, inputs and operating conditions

3. Risk Controls, Verification and Traceability

• Translating ML risks into design and risk-control requirements
• Model performance and acceptance criteria as part of risk control
• Verification of controls and evaluation of residual risk
• Traceability from hazard analysis through design, testing and risk-management evidence

4. Managing ML Risk Across the Product Lifecycle

• TPLC and postmarket performance monitoring
• Algorithm/model changes and reassessment of existing risks
• PCCPs and anticipated AI/ML modifications
• Cybersecurity considerations that can affect safety and ML performance

5. Connecting the Risk File to QMSR and FDA Expectations

• Risk management within design and development under QMSR
• Where AI/ML risk evidence supports FDA marketing submissions
• Maintaining the risk-management story as the product changes

6. Questions and Discussion

| WHO SHOULD ATTEND

This webinar is intended for professionals involved in the design, development, quality, risk management, validation, regulatory oversight, and lifecycle management of AI/ML-enabled medical devices, including:

• Software Design Quality Engineers
• Design Quality Engineers
• AI/ML and Software Engineers
• Risk Management Professionals
• Quality Assurance Professionals
• Regulatory Affairs Professionals
• Software Validation and V&V Professionals
• Systems and Product Development Engineers
• Cybersecurity and Product Security Professionals
• Engineering and Quality Management

Course Director: Meredith L. Crabtree

Meredith L. Crabtree is a quality and regulatory professional with extensive experience supporting medical device and life sciences organizations in quality systems, regulatory compliance, risk management, validation, and emerging technology applications. Her work includes helping organizations address the practical quality and compliance implications of AI-enabled systems, product lifecycle activities, supplier and process controls, postmarket activities, validation, and evolving regulatory expectations. Her training focuses on translating regulatory and quality requirements into practical decisions that technical and quality teams can apply within their existing systems and processes.