New ISO Guidance for AI-Powered Medical Devices: ISO/TS 24671-2:2026 Has Arrived

Artificial intelligence is transforming healthcare at a rapid pace, but with innovation comes the responsibility to manage risk just as rigorously. The publication of **ISO/TS 24971-2:2026, “Medical devices — Guidance on the application of ISO 14971 — Part 2: Machine learning in artificial intelligence,” marks a significant milestone for the medical device industry.

This new technical specification builds on the well-established ISO 14971 risk management framework, offering practical guidance for applying it to machine learning-enabled medical devices (MLMDs).

What the Guidance Covers

The specification walks manufacturers through the unique risk landscape that ML introduces across the product lifecycle, including:

• AI/ML-specific risk identification, hazards tied to feature extraction, model training, and algorithm behavior that fall outside traditional risk categories.
• Data-related risks and bias, training and test data quality, unwanted bias, and model performance issues, with dedicated guidance on evaluating bias.
• Cybersecurity considerations, information security risks introduced by ML systems, including exposure to adversarial manipulation.
• Lifecycle management, model drift, continuous learning, retraining, updates, and rollback procedures across deployment and post-market monitoring.
• Human oversight and transparency, addressing the “black box” problem, explainability, usability, and risk controls that keep human oversight central to safe deployment.

One Important Scope Note

Worth flagging for anyone diving into this standard: ISO/TS 24971-2:2026 explicitly does not apply to MLMDs built on large language models or generative AI. It’s scoped to traditional/classical machine learning applications. Manufacturers working with LLM-based or generative AI medical device functionality will need to look elsewhere (or wait for future guidance) to cover those risk profiles.

Why This Matters Now

As regulators worldwide sharpen their focus on AI in healthcare, manufacturers need to demonstrate more than just innovative capability, they need to show safety, effectiveness, transparency, and continuous control over AI-driven functionality throughout the product’s life.

Remember, ISO/TS 24971-2:2026 doesn’t replace ISO 14971; it complements it, giving organizations developing ML-enabled medical devices a practical framework to strengthen risk management processes and support regulatory alignment.

What Manufacturers Should Do Now

For companies developing AI-driven software, diagnostic solutions, digital health platforms, or connected medical devices, now is the time to revisit:

• AI risk management processes
• Software lifecycle documentation
• Data governance and validation strategies
• Post-market monitoring plans
• Alignment with the EU AI Act, MDR, and IVDR

Organizations that get ahead of this guidance now will be better positioned as regulatory scrutiny of AI-enabled medical technology continues to intensify.