| ISO 14971:2019 |
§ 7.1 |
Post-production information — systematic collection and review of field performance data |
⚠ Not formally established |
🟡 Moderate |
| FDA 2025 AI Guidance (Draft) |
§ 5.1 |
AI/ML model documentation — intended use, model architecture, and training approach |
✓ Documented |
🟢 Met |
| FDA 2025 AI Guidance (Draft) |
§ 5.3 |
Demographic subgroup performance data — age, sex, race, and geography |
✓ Documented |
🟢 Met |
| FDA 2025 AI Guidance (Draft) |
§ 5.4 |
Training data transparency — dataset composition, provenance, and bias examination |
✓ Documented |
🟢 Met |
| FDA 2025 AI Guidance (Draft) |
§ 7.1 |
Independent third-party verification or validation evidence |
✗ None |
🔴 Critical |
| FDA PCCP Final Guidance |
§ 4.1 |
Predetermined Change Control Plan — documented and FDA-aligned |
✗ No PCCP |
🔴 Critical |
| FDA PCCP Final Guidance |
§ 4.2 |
Defined drift thresholds with documented clinical justification |
✗ Not defined |
🔴 Critical |
| FDA PCCP Final Guidance |
§ 4.3 |
Revalidation trigger — conditions requiring full revalidation after model change |
✗ Not defined |
🔴 Critical |
| NIST AI RMF |
GOVERN 1.1 |
AI risk governance policy — organizational accountability for AI risk |
✓ Established |
🟢 Met |
| NIST AI RMF |
MAP 5.1 |
AI system risk identification — documented hazards and failure modes |
✓ Documented |
🟢 Met |
| NIST AI RMF |
MEASURE 2.5 |
Bias testing — subgroup performance evaluation and documentation |
✓ Completed |
🟢 Met |
| NIST AI RMF |
MANAGE 4.1 |
Post-deployment monitoring — ongoing performance oversight program |
✗ Not established |
🔴 Critical |
| ISO 42001:2023 |
Clause 6.1 |
AI risk assessment — systematic identification and treatment of AI-specific risks |
✓ Completed |
🟢 Met |
| ISO 42001:2023 |
Clause 8.4 |
AI system performance evaluation — documented testing against objectives |
✓ Documented |
🟢 Met |
| IEC 62304:2006 |
§ 8.1 |
SOUP identification — third-party AI components documented as Software of Unknown Provenance |
✗ Not documented as SOUP |
🔴 Critical |
| IEC 62304:2006 |
§ 8.1.2 |
SOUP anomaly list — known anomalies and version pinning documented |
✗ Not established |
🔴 Critical |
| ISO 14971:2019 |
§ 4.4 |
Hazard identification — AI-specific failure modes including hallucination and drift |
✓ Identified |
🟢 Met |
| EU AI Act |
Article 9 |
Risk management system — documented AI lifecycle risk management |
✓ Established |
🟢 Met |
| EU AI Act |
Article 10 |
Data governance — training data bias examination for health outcomes |
✓ Documented |
🟢 Met |
| EU AI Act |
Article 14 |
Human oversight — defined mechanisms for human review and override of AI outputs |
✓ Defined |
🟢 Met |
| CMS Requirements |
Non-Discrimination |
Equal AI performance across all patient demographic groups — documented parity |
✓ Documented |
🟢 Met |