AI Life Cycle Management for Medical Devices

As AI-enabled medical products continue to evolve, organizations face new challenges related to model performance, data quality and ongoing evaluation. In this Q&A, Christian Hoffmann, principal engineer at UL Solutions, shares perspectives on AI life cycle management, model drift, post-market monitoring and emerging expectations for AI-enabled medical products.

Traditional software systems are generally specified and validated against predefined requirements and are expected to produce similar results when presented with similar inputs. AI-enabled functions, whose behavior is learned from data, add a strongly data-dependent element: the quality and representativeness of the data, as well as statistical evidence of performance, become crucial elements in demonstrating that a system is fit for its intended purpose. How an AI system performs over time can be influenced by changes in clinical practice, data sources, technology or changes to the AI model itself.

Life cycle management therefore needs to maintain evidence that the system continues to meet its intended purpose, safety requirements and performance claims under its current conditions of use.

The AI life cycle includes many of the phases familiar from traditional software development such as design, development, verification, validation, deployment, operation and maintenance. But AI systems also introduce additional data-centric activities such as data collection, annotation, preparation, model training and statistically appropriate evaluation. Across the life cycle stages, organizations need to consider how data quality, model behavior and acceptable performance are defined, assessed and documented. Datasets, models and the associated evidence become important life cycle artifacts that require management alongside more traditional engineering artifacts such as requirements, source code and test reports. After release, the operating environment may change, and the AI system may be modified through model updates or, in some cases, adaptive learning mechanisms, making ongoing evaluation an important part of the AI life cycle.

Initial validation is typically performed using appropriately selected and independent datasets and predefined evaluation methods to demonstrate that an AI system is fit for its intended use. Post-market evaluation extends this by incorporating data and feedback gathered during real-world use and by monitoring whether changes in the operational domain affect system behavior. For example, new generations of imaging equipment, shifts in patient populations or changes in clinical workflows may influence the data encountered by the system and therefore its performance. As a result, organizations may need to monitor relevant statistical performance indicators, input data characteristics, user feedback, complaints and incidents to determine whether the assumptions made during development and initial validation continue to hold. Compared with traditional software validation, greater emphasis is placed on data, statistical evidence and real-world performance under current conditions of use throughout the product life cycle.

Model updates should be managed through a structured change process that includes versioning, impact assessment, and appropriate documentation and traceability. For AI systems, changes may affect not only software components but also data, annotations, training procedures or the model itself, making traceability across life cycle artifacts particularly important. Unlike traditional software changes, the impact of a model update cannot generally be determined through source code review alone, as humans generally cannot infer the resulting behavior directly from the parameters of a complex model. Instead, statistical evaluation becomes crucial for demonstrating that the updated system continues to meet its requirements. Retraining activities accordingly require carefully managed data, appropriately qualified annotators where annotation is required, and suitable requirements, performance metrics and evaluation methods. Concepts such as predetermined change control plans can provide a means for specifying guardrails upfront, making it easier to introduce certain model changes later while maintaining appropriate oversight and control.

Drift is used as an umbrella term to describe situations where the assumptions underlying an AI system become less representative of real-world conditions over time. One common form is data drift, where the characteristics of the input data encountered during operation increasingly differ from those during development and validation, such as when new generations of imaging equipment are introduced or patient populations change. Another common form is concept drift, where the underlying relationships between inputs and the intended outputs change, such as in response to evolving clinical practices.

These forms of drift can affect system performance even when neither the model itself nor the surrounding software has been modified at all. Organizations therefore may monitor relevant statistical characteristics of input data and system performance, together with user feedback, complaints and other post-market information. Changes in these indicators do not necessarily mean that a system is no longer performing acceptably, but they can signal the need for further investigation and evaluation. Effective drift management requires ongoing analysis of real-world data and appropriate processes for assessing and responding to identified changes.

Post-market monitoring provides organizations with insight into how an AI system performs under real-world conditions throughout its operational life. In addition to traditional post-market activities such as the analysis of complaints, incidents and user feedback, AI systems may require monitoring of relevant statistical performance indicators and characteristics of the input data to identify changes that could affect system behavior. This information helps organizations assess whether the assumptions made during development continue to hold within the intended operational domain and can contribute to the generation of real-world evidence that supports ongoing evaluation of requirements, risk controls and the underlying safety or performance arguments.

The results of post-market monitoring can support a range of activities, including further investigation, risk management updates, model improvements or retraining efforts. For AI-enabled medical products, real-world data and the resulting real-world evidence increasingly complement pre-market evaluation by providing insight into system performance under actual conditions of use. In this way, post-market monitoring becomes an important feedback mechanism that helps organizations support ongoing compliance of AI-enabled medical products.

Standards, guidance documents and regulatory approaches for AI-enabled medical products are evolving alongside the technology itself and increasingly address AI-specific governance and life cycle topics. While they continue to emphasize safety, performance and effectiveness, they also increasingly focus on how topics like data management, human oversight, cybersecurity, ongoing performance evaluation and risk management are applied to AI-enabled systems.

A notable trend in emerging standards and guidance is the growing attention to organizational capabilities in addition to product-specific controls. AI management system approaches reflect the need for robust processes, clear responsibilities and appropriate personnel qualifications for developing, evaluating, monitoring and maintaining AI systems. This is particularly relevant because AI performance depends not only on software implementation, but also on data, models, operational context and the organization’s ability to manage change over time. The precise obligations and terminology differ by jurisdiction and product, but organizational AI management systems generally build on existing quality management systems.

Organizations should consider the full life cycle of an AI-enabled medical product from the earliest stages of planning and development rather than focusing solely on model performance for solving the clinical use case. This includes defining the intended use and operational domain and establishing data management strategies and processes to demonstrate the origin, quality, representativeness and suitability of data throughout the life cycle. Datasets, annotations, reference standards and statistical evidence should be treated as managed engineering artifacts from the outset rather than temporary inputs to model development. Decisions made during prototyping can have long-lasting consequences, particularly if data lineage or model history cannot be reconstructed during the transition from a prototype to a medical product.

It is also important to plan early for how the system will be monitored, maintained and potentially updated after deployment. This may include not only structured change mechanisms but also, for some AI systems, predefined approaches for future model improvements or controlled adaptive behavior, where applicable. In addition to technical considerations, organizations should have the necessary competencies, responsibilities and governance processes in place, including AI-system-specific expertise in areas such as data management, annotation, testing and governance. Addressing these topics early can support later validation and ongoing life cycle management.