AI in medical devices · Medium · 13 min lesson
Integrating AI governance into the QMS: ISO 13485 and ISO/IEC 42001 mapping
ISO 13485:2016 clauses 4 to 8 and ISO/IEC 42001:2023 clauses 4 to 10 and Annex A, with EU AI Act Article 17
What you will learn
- Compare ISO 13485 and ISO/IEC 42001 in purpose and structure and map their main clauses.
- Identify what ISO/IEC 42001 requires that a sound ISO 13485 system does not already cover.
- Design one integrated system with a mapping matrix and statement of applicability, linked to AI Act Article 17.
Key takeaways
- ISO 13485 and ISO/IEC 42001 have different purposes and structures; integration needs a written mapping matrix, not memory.
- Policy, roles, documents, audit, management review and corrective action overlap strongly, so extend existing procedures.
- Context and interested parties, the AI system impact assessment, AI objectives and the statement of applicability are the usual gaps.
- Keep one risk process: add AI risk sources to the device risk file and link the impact assessment to it.
- Article 17(3) of the AI Act lets the quality system aspects sit in the device QMS; ISO/IEC 42001 gives no presumption of conformity.
Free practice question
The managing director of Corvane Health says: 'We hold an ISO 13485 certificate, so our AI management system under ISO/IEC 42001 is done.' RhythmLens uses a machine learning model, and no AI impact assessment or statement of applicability exists.
What is the best reply?
Agree, because both standards are management system standards and the certificates are interchangeable.
Not quite. Certificates are specific to a standard, and ISO 13485 does not contain clauses 6.1.3 or 6.1.4 of ISO/IEC 42001.
Disagree: overlap is large, but a gap analysis is needed for the impact assessment, statement of applicability and other ISO/IEC 42001 items.
Correct. Clauses 6.1.3, 6.1.4 and 6.2 of ISO/IEC 42001 have no comparable requirement in ISO 13485, so a gap analysis is needed.
Disagree, and tell the team to discard the ISO 13485 system and start again.
Not quite. The overlap in clauses 5.5.1, 4.2.4 and 8.2.4 means the existing system can be extended rather than discarded.
Agree, provided the AI team writes a new policy this week.
Not quite. A policy under clause 5.2 is only one requirement, and the impact assessment under clause 6.1.4 would still be missing.
Key terms
- AI management system (AIMS): The management system that an organisation sets up to govern its AI, as described in ISO/IEC 42001.
- mapping matrix: A table that links each requirement of each standard to the procedure, record and owner that satisfy it.
- statement of applicability: The document that lists each Annex A control, states whether it applies, and justifies any exclusion (clause 6.1.3).
- AI system impact assessment: An assessment of the consequences of an AI system for individuals, groups and society (clauses 6.1.4 and 8.4).
- Annex A: The set of 38 AI controls in nine groups in ISO/IEC 42001, with guidance in Annex B.
- gap analysis: A comparison of requirements with existing practice that sorts each item into covered, partly covered or not covered.
- Article 17: The article of Regulation (EU) 2024/1689 that sets quality management system aspects for providers of high-risk AI systems.
- harmonised standard: A European standard whose use gives a presumption of conformity with a regulation; ISO/IEC 42001 is not one under the AI Act.
Official sources
- ISO/IEC 42001:2023 Information technology - Artificial intelligence - Management system
- ISO 13485:2016 Medical devices - Quality management systems - Requirements for regulatory purposes
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), Official Journal
- Article 17: Quality management system, AI Act explorer
Go further
The full lesson has narrated slides, more scenario questions with explained answers and a simulation.
Open the AcademyWatch on YouTubeIllustrative example. Educational only, not legal advice.