The governance of artificial intelligence is delivered as an integral component of the ISO 13485 implementation project itself — whether that project is an ex novo build or an upgrade of an existing certified system. AI is not a module added on top; it is a design requirement of the system itself. If AI is present in the production environment, the quality system is engineered to govern it from the outset of the project.
Mapping: Locating the Deployment Points
During the structural analysis phase of the project, every AI deployment is located and mapped to the specific clauses that govern it. This is not a theoretical exercise; it is the operational inventory that defines the scope of the QMS.
7.1.5 — Monitoring and Measuring Resources. Identification of vision systems, predictive sensors, and classification algorithms as measuring resources. The project defines the fitness-for-purpose criteria for models that evolve, distinguishing them from static gauges.
8.4 — Externally Provided Processes. Identification of AI services, SaaS platforms, and algorithm vendors as externally provided processes. The project establishes the evaluation and re-evaluation criteria required when suppliers ship model updates without notice.
8.5.1 — Control of Production. Identification of algorithms steering maintenance schedules, line adjustments, or release decisions. The project ensures traceability of outputs to acceptance criteria and controls for silent drift.
8.3 & 7.5 — Design and Development / Documented Information. Integration of software lifecycle validation (IEC 62304) and change management for evolving models into the core design and documentation architecture.
The output of this phase is a precise map of where AI resides within the QMS, transforming an invisible exposure into a governed process.
Evidence Construction
Once mapped, the evidence architecture is built directly into the project deliverables. Each deployment receives four documented elements that become part of the official quality record:
- Defined Intended Use: Explicit statement of what the model decides and what it does not.
- Controlled Data Lineage: Traceability of inputs, training references, and version history.
- Validated Change Management: Protocols for managing model evolution and drift post-deployment.
- Documented Human Oversight: Defined roles where human intervention is required for product, patient, or release decisions.
These elements are integrated into the procedures, work instructions, and records of the system. The result is a quality system in which artificial intelligence is a controlled, auditable component, held to the same rigor as any other critical process.
Outcome
The project delivers a certified quality system where every AI deployment is mapped, evidenced, and defensible in audit across all relevant jurisdictions. The organization achieves full operational autonomy, sustaining the framework and presenting the evidence before Notified Bodies under the MDR and IVDR, Swissmedic, and the FDA.