Question
Requirements and references
- GSPR 1, 4, 17.2
- Annex II, 5(b); 6.1(a), (b)
- EN ISO 14971
Documents reviewed by BSI
R-TF-013-002 Risk management record.pdf
Question: Risk mitigation implementation and verification evidence
Compliance to GSPRs 1 and 4 and effective implementation of corrective action 1 are not fully demonstrated because evidence that all identified mitigations have been implemented and verified is not clearly observed.
For example, the risk R-DAG "The medical device outputs a wrong result" is observed to have been mitigated by the following control measures:
- Information about device outputs are detailed in the IFU.
- The medical device returns metadata about the output that helps supervising it, such as explainability media and other metrics.
- The device returns an interpretative distribution representation of possible ICD categories, not just one single condition.
- AI models undergo retraining using expanded dataset of images.
However, corresponding requirements and verification evidence could not be found under the "Mitigation or Control Requirement(s)" and "Verification of implementation of risk control measures" columns when cross-referenced with the requirement and test descriptions in QMS-legit-health-plus-version-1-1-0-0-product-verification-and-validation-software-R-TF-012-034-Soft.pdf. None of the requirements or tests identified clearly address explainability, interpretive distributions or retraining of AI models. None of the tests appear to verify information about device outputs in the IFU.
It is unclear if other risks are similarly impacted.
Please clarify and provide updated documentation if necessary._