AI in medical devices · Medium · 13 min lesson
Data governance: sourcing, representativeness, labelling and data quality for AI devices
EU AI Act Article 10 (Regulation (EU) 2024/1689), GMLP principles 3 to 5, ISO/IEC 5259-2:2024, ISO 13485:2016 clauses 4.2.5 and 7.3
What you will learn
- Plan and document data sourcing so every dataset has an origin, purpose, legal basis, version and owner.
- Show that data are representative of the intended patient population and use setting, and examine bias before training.
- Control labelling and data quality with a reference standard, annotator instructions, agreement measures and quality checks.
Key takeaways
- Every dataset needs a register entry: origin, purpose, permission, acquisition, version and owner (Article 10(2)(b); clause 4.2.5).
- Representativeness is judged against a written intended population and setting; gaps become actions or a narrower claim (Article 10(3), (4)).
- Labels need a defined reference standard, written instructions, agreement measures and traceable adjudication (Article 10(2)(c); GMLP 5).
- Choose data quality measures and thresholds before inspecting the data (ISO/IEC 5259-2).
- Examine bias by subgroup and record the finding and decision, even when no action is needed (Article 10(2)(f), (g)).
Free practice question
Nerelo's register entry DS-021 for an ECG archive reads: 'Source: partner hospitals. Size: 22,000 recordings. Labels: expert.' No agreement number, collection period, device or labelling method is given.
What is the main weakness of this entry?
The origin, purpose, permission and preparation of the data cannot be shown, so the dataset cannot support evidence.
Correct. Article 10(2)(b) and (c) expect collection origin and preparation steps to be known and recorded for the dataset.
The dataset is too small for any device.
Not quite. Size is not the issue in the entry; Article 10(2)(b) concerns recorded origin and permission, not a fixed number.
The word expert should be capitalised.
Not quite. Style is irrelevant; the gap against Article 10(2)(c) is the missing labelling method and records.
Partner hospitals should not be used as sources.
Not quite. Hospitals are a normal source; the problem is that Article 10(2)(b) origin evidence is missing.
Key terms
- data governance: Practices for design choices, collection, preparation, suitability, bias and gaps of the data used for AI (Article 10(2)).
- provenance: The documented origin, history and permitted use of a dataset.
- representativeness: The degree to which data reflect the intended population and setting of use (Article 10(3), (4)).
- reference standard: The agreed method or panel that decides the true label.
- inter-annotator agreement: A measure of how consistently annotators assign the same label.
- adjudication: Resolving annotator disagreement by a defined third reader, keeping the original labels.
- data gap: Part of the intended population or setting that the dataset does not cover.
- data quality measure: A defined, measurable characteristic of data such as completeness or accuracy (ISO/IEC 5259-2).
Official sources
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), Official Journal
- Good Machine Learning Practice for Medical Device Development: Guiding Principles (Health Canada, with FDA and MHRA)
- ISO/IEC 5259-2:2024 Artificial intelligence - Data quality for analytics and machine learning - Part 2: Data quality measures
- ISO 13485:2016 Medical devices - Quality management systems - Requirements for regulatory purposes
Go further
The full lesson has narrated slides, more scenario questions with explained answers and a simulation.
Open the AcademyWatch on YouTubeIllustrative example. Educational only, not legal advice.