Medical Devices

Where device cybersecurity
meets AI governance.

AI-enabled and connected medical devices carry two burdens at once: FDA §524B premarket cybersecurity and responsible-AI oversight. We prepare you for both, from IEC 62304 and ISO 14971 through §524B and SBOM, plus the PCCP that lets your model keep improving after clearance.

Talk to us about your device Get the §524B readiness checklist
The two burdens

Two regulatory worlds,
one device.

A connected or AI-enabled device has to answer to cybersecurity regulators and to the emerging responsible-AI regimes at the same time. Most vendors solve one and get caught by the other. We build both into the same program, so the evidence lines up instead of fighting itself.

01

Device cybersecurity

§524B · IEC 62304 · ISO 14971 · SBOM
  • §524B premarket cybersecurity documentation
  • Software bill of materials (SBOM) and dependency risk
  • IEC 62304 software lifecycle
  • ISO 14971 risk management
  • Coordinated vulnerability handling and postmarket updates
02

AI governance

ISO 42001 · PCCP · NIST AI RMF · EU AI Act
  • ISO 42001 AI management system
  • PCCP: predetermined change control for AI/ML models
  • Model monitoring and drift detection
  • Human oversight of AI-driven output
  • EU AI Act and NIST AI RMF where they apply
The §524B package

Your premarket cybersecurity documentation set, as one coordinated package.

The cybersecurity evidence FDA expects with a §524B submission is a coordinated set of documents that has to fit together. We scope the controls, structure the documentation, and bring in the right regulatory partner to produce it, so it arrives as one package built to hold up under review.

§524B PCCP IEC 62304 ISO 14971 ISO 42001 SBOM AAMI TIR57

Threat model and security risk assessment. Secure-by-design architecture and controls. Software bill of materials with dependency risk. Vulnerability management and coordinated disclosure plan. Postmarket cybersecurity and update strategy. The PCCP that defines which model changes are pre-authorized, so your AI/ML can keep improving after clearance without a new submission.

We handle the readiness: we specify the controls and coordinate the documentation with our regulatory partner. Predicate selection, substantial equivalence, and the 510(k) submission and filing route through that regulatory-affairs network. The organizational certifications underneath, SOC 2, ISO 27001, ISO 42001, and HIPAA, we deliver in-house.

How the evidence gets built

One control, traced end to end.

Frameworks are abstract until you can see a single requirement turn into the artifact a reviewer actually reads. Here is one, the way it runs through the program.

The control
A clinician must approve any AI-generated recommendation before it affects care, and the device records that approval in a tamper-evident log.
Where it is required
§524B secure design and audit logging, ISO 14971 risk control for erroneous output, ISO 42001 human-oversight control, and the PCCP clause that says a model update may not remove this approval gate.
The evidence it produces
The audit-log schema and its access controls, the risk-control traceability entry, the PCCP protocol section that fences the gate, and the IEC 62304 verification test proving the gate cannot be bypassed. Four artifacts, one control, and a reviewer can follow the line without asking a question.
Who it is for

Built for the devices
that carry both burdens.

AI/ML software as a medical device

SaMD where the model itself is the product, and where it needs to keep learning after clearance.

Connected diagnostics and instruments

Devices that talk to networks, phones, or the cloud, and inherit §524B the moment they connect.

Digital-health devices

Monitoring and therapeutic devices blending firmware, apps, and AI into one regulated system.

Tell us about your device. We will tell you what §524B and your AI oversight actually require.



or work through the §524B readiness checklist