FDA Draft Guidance Targets AI‑Enabled Medical Device Safety and Governance
What Happened — The U.S. Food and Drug Administration released a non‑binding draft guidance (2025) that obliges manufacturers of AI‑enabled medical devices to treat model drift, bias, and data‑poisoning as regulated risks. The guidance calls for predefined change‑control plans, continuous monitoring, testing, and auditability, and stresses transparent governance and staff education.
Why It Matters for Compliance & Audit Readiness
- SOC 2 / continuous‑compliance programs must now capture AI‑model lifecycle controls (change‑control, monitoring, testing) as part of the CC6 – Change Management and CC7 – System Operations criteria.
- Evidence of ongoing model validation and bias mitigation becomes audit evidence; without it, organizations risk non‑conformance to the “Security” and “Availability” principles.
- Verisq’s Control‑Mapping capability can automatically map these new AI‑specific controls to existing SOC 2 criteria and collect continuous evidence for auditors.
Who Is Affected – Healthcare providers, medical‑device manufacturers, health‑tech SaaS vendors, and any organization that deploys AI/ML models as regulated medical devices.
Recommended Actions
- Update your change‑control policy to include AI‑model versioning, drift detection, and bias testing.
- Implement continuous monitoring pipelines that log model inputs/outputs, performance metrics, and remediation actions.
- Document governance processes (approval workflows, staff training) and retain evidence in a tamper‑proof repository for audit readiness.
Source: DataBreachToday – How FDA's Draft Guidance Shapes AI Medical Device Safety
Technical Notes
- The guidance does not prescribe a specific technical solution but requires “predetermined change‑control plans” and “auditability” for AI models.
- Risks highlighted: model drift, algorithmic bias, data poisoning, and the need for transparent, repeatable outputs.
- No CVEs are cited; the focus is on governance and risk‑management processes.