AI in medical devices · Expert · 13 min lesson

Capstone part 2: findings, risk-based conclusions and an improvement plan

ISO 19011 clauses 6.4.8 and 6.4.9, ISO 13485 clauses 7.3.9 and 8.5.2, MDR Annex I section 17, AI Act timeline under Regulation (EU) 2026/1744

What you will learn

Write findings in four parts and grade them by harm, reach, control and recurrence, giving a reason for each grade.
Group findings by root cause and state conclusions limited to the sample, separating present duties from scheduled ones.
Build a prioritised improvement plan with causes, owners, dates, deliverables and effectiveness checks, sequenced by risk and by the regulatory clock.

Key takeaways

A finding has four parts: requirement, evidence with document and line, a statement of what is not met, and a grade (ISO 19011 clause 6.4.8).
Grade by harm, reach, control and recurrence, and write the reason; a record slip and a test set gap are not the same grade.
Group findings by root cause, and conclude only on the sample, by area, keeping MDR duties apart from the AI Act line to 2 August 2028.
Corrective action addresses the cause and, under ISO 13485 clause 8.5.2, needs an owner, date, deliverable and an effectiveness review.
Sequence actions by risk first: hold risky releases, rebuild the evidence, fix the system, then follow the regulatory clock.

Free practice question

A draft finding in the NoduLens report reads: 'F-06. The change process is not good. Improve it.' The reviewer has the change record CCR-077 and the procedure number in front of her.

What is the best way to repair this finding?

Add the word seriously before not good.

Not quite. An adverb adds no verifiable fact, while ISO 19011 clause 6.4.8 builds findings on evidence checked against criteria.

Cite clause 7.3.9, name CCR-077 line 8 and state that no assessment preceded release, then grade it.

Correct. The requirement, evidence, statement and grade are the four parts that make a finding answerable under ISO 13485 clause 7.3.9.

Delete the finding, as it is too vague to use.

Not quite. The gap is real and evidenced, so deleting it would breach the evidence based approach in ISO 19011 clause 4.

Add a list of consultants who could redesign the process.

Not quite. Naming consultants is advice and does not state the requirement that is not met under ISO 13485 clause 7.3.9.

Key terms

finding: A statement of conformity or nonconformity with an audit criterion, based on evidence (ISO 19011 clause 3.10, 6.4.8).
root cause: The underlying reason a nonconformity arose, which a corrective action must remove (ISO 13485 clause 8.5.2).
correction: Action to fix a detected nonconformity in the instance found, without removing its cause.
corrective action: Action to eliminate the cause of a nonconformity so that it does not recur (ISO 13485 clause 8.5.2).
effectiveness check: A later, measurable test that the corrective action removed the cause (ISO 13485 clause 8.5.2 f).
readiness line: A dated entry that tracks preparation for a duty that applies later, such as AI Act duties for Annex I products from 2 August 2028.

Official sources

Go further

The full lesson has narrated slides, more scenario questions with explained answers and a simulation.

Open the Academy Watch on YouTube

Illustrative example. Educational only, not legal advice.