AI in medical devices · Expert · 13 min lesson
Building the AI technical file: model card, data sheet and traceability matrix
Regulation (EU) 2024/1689 Articles 10, 11 and 13 and Annex IV items 1 to 4 and 6, ISO 13485:2016 clause 7.3.10, ISO 14971 clauses 7.2 and 7.3, GMLP principles 3, 4 and 9
What you will learn
- Write a data sheet that meets Annex IV item 2(d) and supports the data governance practices of Article 10.
- Write a model card with metrics, group results and limits, and identify the released model precisely enough to reproduce it.
- Build a traceability matrix from claims to requirements, risk controls and signed evidence, and use it to find gaps.
Key takeaways
- A data sheet records provenance, selection, labelling, cleaning and splits, with counts that reconcile (Annex IV 2(d); Article 10(2)).
- A model card reports intended use, metrics, group results and limits, and feeds the instructions (Annex IV 3 and 4; Article 13(3)(b)).
- Identify the released model by weights hash, code commit, data snapshot, configuration and seed.
- The traceability matrix links claim, requirement, risk control and signed evidence; blanks and orphans show gaps (ISO 13485 7.3.10; ISO 14971 7.2, 7.3).
- Split by patient, lock the test set and record the method (GMLP principles 3 and 4); one controlled set serves the EU and the FDA.
Free practice question
Norvale's data scientist describes the training data in the file as 'ECG recordings from partner clinics, cleaned'. The notified body asks how many patients, which sites, how labels were made and what was removed.
What does Annex IV item 2(d) expect?
A datasheet describing provenance, scope, selection, labelling procedures and cleaning methods, with counts.
Correct. Annex IV item 2(d) requires datasheets covering provenance, scope, how data was selected, labelling and cleaning.
Only the name of the cloud storage folder.
Not quite. A folder name gives no provenance or labelling detail, which Annex IV item 2(d) expects.
A promise to prepare the data description after certification.
Not quite. Article 11 paragraph 1 requires the documentation before placing on the market.
Nothing, since cleaned data is self-explanatory.
Not quite. Article 10 paragraph 2 requires documented preparation, labelling and cleaning practices, so nothing is self-explanatory.
Key terms
- data sheet: A structured record of a dataset covering provenance, selection, labelling, cleaning and splits (Annex IV item 2(d)).
- model card: A short controlled document reporting a model's intended use, metrics, group results and limitations.
- traceability matrix: A table linking each claim or requirement to its risk control and the verification record that proves it.
- data leakage: Information from test data reaching training, for example the same patient on both sides, which inflates results.
- orphan: A test or requirement in the matrix that traces to nothing, showing missing linkage.
- data governance: Documented practices for design, collection, preparation, bias examination and gap handling of datasets (AI Act Article 10(2)).
- model identity: The set of identifiers, such as weights hash, code commit and data snapshot, that lets a released model be reproduced.
- GMLP: Ten guiding principles for good machine learning practice in medical device development, issued by regulators in 2021.
Official sources
- Regulation (EU) 2024/1689, Annex IV: Technical documentation referred to in Article 11(1)
- Regulation (EU) 2024/1689, Article 10: Data and data governance
- Regulation (EU) 2024/1689, Article 13: Transparency and provision of information to deployers
- Mitchell et al., Model Cards for Model Reporting (arXiv 1810.03993)
- Gebru et al., Datasheets for Datasets (arXiv 1803.09010)
Go further
The full lesson has narrated slides, more scenario questions with explained answers and a simulation.
Open the AcademyWatch on YouTubeIllustrative example. Educational only, not legal advice.