On 22 December 2025, FDA added AAMI CR515:2025 to its Recognized Consensus Standards database under recognition number 13-153. AAMI TIR45:2023 was added on 26 May 2025 (13-143). FDA's QMSR page also lists AAMI TIR102:2019 as a resource.
AAMI documents are not all of the same type, and the type affects how far a document carries in a submission. This article lists the AAMI standards, technical information reports (TIRs) and consensus reports (CRs) most relevant to medical device software, AI and cybersecurity, with their FDA recognition numbers.
What AAMI is
The Association for the Advancement of Medical Instrumentation (AAMI) is a nonprofit founded in 1967, with more than 15,000 members in over 70 countries (AAMI). It develops national and international consensus standards through its standards programme.
AAMI publishes three types of document that matter here:
Standards: voluntary consensus standards.
Technical information reports (TIRs): technical guidance documents, not standards.
Consensus reports (CRs): concise, practical guidance on narrowly focused topics. According to AAMI's CR procedures, a CR is developed in 13 to 16 weeks and reviewed every 12 to 24 months, when it may be reaffirmed, revised, transitioned to a TIR or standard, or withdrawn.
In our view, the document type is the first thing to check. A TIR or CR remains guidance-level material, even when FDA recognises it.
What FDA recognition means
FDA's database lists the standards for which FDA will accept a Declaration of Conformity in a premarket submission. Recognition does not make a document mandatory. "Complete" in the database is the label for the extent of recognition; it says nothing about whether a submission is complete.
The list
| Designation | Title | Type | FDA recognition no. |
|---|---|---|---|
| ANSI/AAMI/IEC 62304:2006/A1:2016 | Medical device software – Software life cycle processes [Including Amendment 1 (2016)] | Standard | 13-79 |
| ANSI/AAMI/ISO 14971:2019 | Medical devices – Application of risk management to medical devices | Standard | 5-125 |
| ANSI/AAMI SW96:2023 | Standard for medical device security – Security risk management for device manufacturers | Standard | 13-131 |
| AAMI TIR57:2016 | Principles for medical device security – Risk management | TIR | 13-83 |
| AAMI TIR97:2019 | Principles for medical device security – Postmarket risk management for device manufacturers | TIR | 13-112 |
| AAMI TIR45:2023 | Guidance on the use of AGILE practices in the development of medical device software | TIR | 13-143 |
| AAMI CR34971:2022 | Guidance on the Application of ISO 14971 to Artificial Intelligence and Machine Learning | CR | 13-124 |
| AAMI CR515:2025 | Cybersecurity Consideration Unique to Machine-Learning Enabled Medical Devices | CR | 13-153 |
| ANSI/AAMI SW91:2018 | Classification of defects in health software | Standard | 13-105 |
Source: FDA Recognized Consensus Standards database. ANSI/AAMI/ISO 14971:2019 shares recognition number 5-125 with ISO 14971 Third Edition 2019-12.
1. ANSI/AAMI/IEC 62304:2006/A1:2016
The US adoption of IEC 62304, covering software life cycle processes for medical device software. When you cite it, use the exact recognised designation, including Amendment 1, rather than the shorthand "IEC 62304".
2. ANSI/AAMI/ISO 14971:2019
The US adoption of ISO 14971 on risk management for medical devices. The security and AI documents below build on it; they do not replace it.
3. ANSI/AAMI SW96:2023
A standard on security risk management for device manufacturers. It is the only document in the security group that is a standard rather than a TIR.
4. AAMI TIR57:2016
A TIR setting out principles for medical device security risk management.
5. AAMI TIR97:2019
A TIR on postmarket security risk management for device manufacturers, relevant once a connected device is on the market.
6. AAMI TIR45:2023
A TIR on using agile practices in medical device software development. It explains how agile methods can fit with the software life cycle; it does not replace IEC 62304.
7. AAMI CR34971:2022
A CR on applying ISO 14971 to artificial intelligence and machine learning.
8. AAMI CR515:2025
A CR on cybersecurity considerations unique to machine learning-enabled medical devices. It is the most recent addition to FDA's recognised list in this group.
9. ANSI/AAMI SW91:2018
A standard for classifying defects in health software.
Our article on AI/ML standards for medical devices covers the wider AI standards landscape.
TIR102 and the QMSR
FDA's QMSR page lists AAMI TIR102:2019, "U.S. FDA 21 CFR mapping to the applicable regulatory requirement references in ISO 13485:2016 Quality Management Systems", as a resource. It is a mapping aid between the US regulations and ISO 13485, not a software or security document, and not a substitute for the regulation itself.
The EU position
No AAMI document gives a presumption of conformity under the MDR. MDCG 2019-16 Rev.1, the MDCG guidance on cybersecurity for medical devices, is not legally binding. Its Annex III lists, for information only, standards such as EN ISO 14971, EN 62304 and IEC/TR 80001-2-2, and states that standards give a presumption of conformity only when they are harmonised and published in the Official Journal.
In our view, FDA recognition and EU harmonisation are separate questions. A standards list for a dual-market device should record both, per document.
A hypothetical example
Hypothetical example: a company developing cloud-connected, machine learning-based SaMD is preparing a US submission. It works in sprints.
Its standards list for the US includes:
ANSI/AAMI/IEC 62304 and ANSI/AAMI/ISO 14971 as the core life cycle and risk management standards;
SW96, supported by TIR57 and TIR97, for security risk management;
TIR45, because of its agile development process;
CR34971 and CR515, because the device uses machine learning.
For each, it records the exact version and FDA recognition number. For the EU, it works from MDCG 2019-16 Rev.1 and the harmonised EN ISO 14971, not from the AAMI versions. Our article on SaMD technical documentation explains where this evidence sits in the file.
Conclusion
AAMI documents are useful, but they are not all equal. Check the document type first, then the FDA recognition status, then whether anything equivalent is harmonised in the EU. In our view, the core set for connected SaMD is IEC 62304, ISO 14971 and the AAMI security documents SW96, TIR57 and TIR97, with the agile and AI documents added where they match the product.
Recognition numbers and versions change, so check each entry in FDA's database before a submission. Our article on medical device regulatory strategy for the EU and US covers dual-market planning.
If you need help building a standards list for your software, our software lifecycle management team can help, or contact MedQAIR.
Frequently asked questions
Is a TIR a standard?
No. A technical information report is a guidance-level document. FDA may still recognise a TIR, as it has done for TIR57, TIR97 and TIR45.
Is a recognised AAMI document mandatory?
No. FDA recognition means FDA will accept a Declaration of Conformity to that document in a submission. Using it remains voluntary.
Can I use AAMI documents for CE marking?
They can inform your technical approach, but they give no presumption of conformity under the MDR. Only harmonised standards published in the Official Journal do.
Which AAMI documents cover AI?
CR34971:2022, on applying ISO 14971 to AI and machine learning, and CR515:2025, on cybersecurity considerations unique to machine learning-enabled devices. Both are FDA-recognised consensus reports.
