AI in medical devices · Medium · 13 min lesson

AI policy, roles, objectives and AI-specific procedures and records

ISO/IEC 42001:2023 clauses 5.2, 5.3, 6.2 and 7.5 with Annex A groups A.2 and A.3, alongside ISO 13485:2016 clauses 5.3, 5.4.1, 5.5.1 and 4.2.5

What you will learn

Write an AI policy that meets clause 5.2 and fits with the ISO 13485 quality policy.
Define AI roles, authorities and measurable objectives under clauses 5.3 and 6.2.
Build AI specific procedures and records, and tell a weak record from a compliant one.

Key takeaways

The AI policy is a controlled document: scope, framework for objectives, commitments to requirements and improvement, owner, review (clause 5.2).
Assign AI roles and authorities in writing and keep author and approver apart, especially for model release (clause 5.3).
Test every AI objective with five questions: measure, target, owner, date or frequency, data source (clause 6.2).
Extend ISO 13485 procedures for AI where possible, and add new ones for inventory, impact assessment, data and model change control.
Records must trace a release from data to approval and be retained under clauses 7.5 and 4.2.5.

Free practice question

Corvane's AI policy reads: 'We use artificial intelligence responsibly.' It has no owner, no revision history and no mention of objectives. A new customer asks to see how the company meets clause 5.2.

What is the most accurate assessment?

It is sufficient, because clause 5.2 only asks for a policy to exist.

Not quite. Clause 5.2 sets content requirements such as a framework for objectives and commitments, which this sentence lacks.

It lacks a framework for AI objectives and commitments to requirements and continual improvement, and is not a controlled document.

Correct. Clause 5.2 requires these elements and availability as documented information, so the sentence fails the clause.

It only needs to be translated into other languages.

Not quite. Language is not the gap; content and control under clause 5.2 and clause 7.5 are.

It is sufficient if the chief executive says it is.

Not quite. Clause 5.2 sets content requirements and documented availability, which a verbal statement from the chief executive cannot satisfy.

Key terms

AI policy: The top management document that sets direction, commitments and an objectives framework for AI (clause 5.2).
AI objectives: Measurable targets for responsible development and use of AI, with owner, date and evaluation (clause 6.2).
authority: The documented power to decide or approve something, such as a model release (clause 5.3).
model release: The approved step that puts a specific model version into production use.
documented information: Information that must be controlled and maintained, including procedures and records (clause 7.5).
management representative: The ISO 13485 role appointed by top management to ensure processes are established and reported (clause 5.5.2).
person responsible for regulatory compliance: The role required of device manufacturers under Article 15 of Regulation (EU) 2017/745.
separation of duties: Keeping the person who prepares a work product apart from the person who approves it.

Official sources

Go further

The full lesson has narrated slides, more scenario questions with explained answers and a simulation.

Open the Academy Watch on YouTube

Illustrative example. Educational only, not legal advice.