Summary
The EU AI Act data requirements place specific expectations on how manufacturers manage the data used to develop, validate and monitor AI/ML-enabled medical devices. In his article, Leon Doorn examines Article 10 on data and data governance, explaining how AI Act data governance connects with wider obligations for high-risk AI systems under the AI Act, MDR and IVDR.
Article 10 cannot be considered in isolation. Data-related obligations also affect the provider’s quality management system, technical documentation, risk management, human oversight and post-market monitoring. Manufacturers need to understand which requirements apply to their devices and how evidence is captured across these processes.
A key concern is whether manufacturers can demonstrate that their datasets are suitable for the intended purpose. During conformity assessment, a Notified Body may request access to data used in AI/ML development and testing. Leon discusses how ISO/IEC 5259-2 can support AI data quality assessment through measures covering accuracy, completeness, consistency, currentness and representativeness. The article also explains why manufacturers need to understand the availability, origin and suitability of their AI training and testing data.
The discussion of AI bias detection considers how bias can enter at different stages of development: data acquisition, labelling, augmentation, cleaning, transformation, model selection and tuning. Differences in imaging equipment, clinical protocols, healthcare settings, geography and patient characteristics can all affect dataset representativeness. Manufacturers need to identify relevant sources of bias, assess their potential effects and document the controls used to address them. Independent clinical test datasets should then be used to assess overall performance and relevant subgroups in the intended use environment.
Leon then turns to data lifecycle governance. Drawing on ISO/IEC 5259-1 and ISO/IEC 5259-3, he describes the role of a data quality plan covering specification, acquisition, storage, preparation, provisioning and decommissioning. These activities should be reflected in existing quality management processes, including supplier management, software development, verification and validation, and change management. This connects with MedQAIR’s Management Systems and EU AI Act compliance support.
The article also addresses AI post-market monitoring. Manufacturers need to collect information showing whether device accuracy remains appropriate over time and across relevant groups. Changes in clinical practice, technology, acquisition protocols or disease prevalence can make existing datasets less representative. Monitoring for data drift and reviewing whether training and test data remain suitable are therefore important. Transparency matters too: users need information about performance characteristics and known limitations, including differences in performance across subgroups. MedQAIR’s Post-Market Follow-Up service is relevant to these ongoing activities.
Leon’s central point is that data management must be built into the full development and lifecycle processes for AI/ML-enabled medical devices. Manufacturers should assess the data they already hold, identify gaps and ensure their quality management system captures the data quality requirements, risks, controls and testing needed to support compliance.
Read the full LinkedIn article, Data Requirements Under the EU AI Act, for a closer look at data governance for AI/ML-enabled medical devices.
