AI GxP references for risk-based validation and quality governance.

FDA final guidance offering a risk-based framework for computer software assurance (CSA) in production and quality management systems. It describes steps to identify intended use, determine appropriate assurance activities based on risk, and generate objective evidence to meet regulatory requirements

GxP validation relevance: Provides non-binding recommendations for validating automation software used in manufacturing and quality systems; emphasises focusing assurance activities on high-risk functions and reducing unnecessary testing.

Key controls: Risk-based assurance, objective evidence, documentation of intended use, scaled testing based on impact and risk.

Scope note: this is guidance for device production and quality management system software; it is not a blanket replacement for drug GMP computerized system validation.

FDA CDER page notes increasing use of AI/ML across the drug lifecycle. It references a January 2025 draft guidance on using AI to support regulatory decision-making and outlines FDA initiatives to provide transparent frameworks for safe and effective use of AI in drug development

GxP validation relevance: Highlights FDA’s recognition of AI’s role in drug development and points sponsors to draft guidances and programs addressing AI model credibility, risk assessment, and regulatory submission expectations.

Key controls: Risk-based credibility assessment for AI models, transparency and explainability, adherence to draft guidance for AI in regulatory decision-making.

Draft guidance provides recommendations on using AI-generated data or models to support regulatory decision‑making for drugs and biological products. It outlines a risk‑based credibility assessment framework with steps such as defining the question of interest, context of use, assessing model risk, and evaluating credibility evidence

GxP validation relevance: Establishes expectations for sponsors who use AI to generate evidence supporting submissions, ensuring AI models are credible, transparent, and appropriate for regulatory decisions.

Key controls: Risk-based credibility assessment, documentation of model development and validation, defined context of use, transparency of data sources, performance metrics.

Recommendations for planned AI-enabled device modifications, the methodology for developing, validating, and implementing them, and impact assessment within a PCCP reviewed as part of a marketing submission.

The AI/ML SaMD Action Plan outlines a five-part strategy: update the regulatory framework via draft PCCP guidance, harmonise Good Machine Learning Practice principles, support transparency for AI-enabled devices, advance regulatory science methodologies including bias mitigation, and pilot real-world performance evaluation

GxP validation relevance: Provides context for FDA’s evolving regulatory approach to AI-enabled medical devices and frames future guidance and policies.

Key controls: Development of PCCP, harmonisation of GMLP, transparency initiatives, regulatory science research, real-world performance pilots.

Joint FDA, Health Canada, and MHRA principles addressing what information about a machine learning-enabled device should be communicated, to whom, why, where, when, and how. These are guiding principles, not a standalone GMP validation requirement.

This guidance clarifies the scope and application of 21 CFR Part 11. FDA explains that it will interpret Part 11 narrowly and exercise enforcement discretion while re-examining the regulation. Part 11 applies to electronic records used to satisfy predicate rule requirements, but FDA will not enforce validation, audit trail, and record retention requirements of Part 11 for some records during this re-examination Underlying predicate rules still apply

GxP validation relevance: Establishes expectations for electronic records and signatures in GxP environments, impacting validation of AI systems that generate or manage regulated records.

Key controls: Ensure compliance with predicate rules, narrow interpretation of Part 11, risk-based enforcement discretion, continued adherence to underlying GMP/GCP regulations.

FDA’s Good Machine Learning Practice (GMLP) page summarises the IMDRF final document identifying 10 guiding principles to support development of safe, effective and high‑quality AI/ML medical devices. It emphasises a risk‑based total product lifecycle approach and international harmonisation across regulators

GxP validation relevance: Provides a succinct overview of global consensus principles for AI medical devices, highlighting the importance of harmonised practices in design, development, validation and post-market monitoring.

Key controls: Ten GMLP principles including data quality, transparency, human oversight, risk management, performance monitoring, and lifecycle management.

Draft recommendations for lifecycle management and marketing submissions for AI-enabled device software functions. The draft addresses development, risk management, and evidence supporting safety and effectiveness. Do not present the draft as final guidance.

Joint HSA/MFDS principles for conducting clinical trials of machine learning-enabled medical devices. Confirm the document date and applicable national clinical-trial requirements before use.

This final rule amends the device CGMP requirements in 21 CFR part 820 by incorporating ISO 13485:2016 and aligning it with FDA-specific provisions. It adds definitions and clarifications to avoid inconsistencies, harmonizes U.S. quality management system requirements with international standards, and reduces duplicative regulatory burdens. The rule emphasises global harmonization, risk-based QMS, and improved patient access. It becomes effective February 2 2026

GxP validation relevance: Provides legally binding requirements for medical device manufacturers’ quality management systems, forming the foundation for validating AI-enabled devices and ensuring their manufacture complies with international standards.

Key controls: Risk-based quality management system incorporating ISO 13485, control of records and complaint files, design and development documentation, harmonization with international standards.

FDA technical amendments revise references and language in device regulations to conform with the QMSR final rule. Use the current eCFR text for requirements applicable to a specific activity.

This guidance clarifies the FDA’s compliance policy for low‑risk general wellness products that promote a healthy lifestyle. It notes that Section 3060 of the 21st Century Cures Act excludes software intended solely for maintaining or encouraging a healthy lifestyle from the device definition and states that CDRH does not intend to examine or enforce device regulations for such low‑risk products. General wellness products must be intended only for general wellness use and present a low risk to users; examples include exercise equipment, audio/video programs, and wellness apps. The guidance lists types of acceptable claims (weight management, fitness, relaxation, mental acuity, self‑esteem, sleep management, sexual function)

GxP validation relevance: Helps developers of AI‑enabled wellness applications determine whether their products qualify for enforcement discretion, reducing unnecessary validation burdens and focusing GxP efforts on higher‑risk medical devices.

Key controls: Defines criteria for exclusion from device regulation; clarifies enforcement discretion for general wellness products; emphasises that such products do not need premarket authorization or QMSR compliance if they meet the criteria.

This guidance clarifies the types of clinical decision support (CDS) software functions that are not regulated as medical devices. To be considered non‑device CDS, a software function must meet four criteria: it cannot acquire, process, or analyze medical images or signals; it is intended to display, analyze, or print medical information; it supports or provides recommendations to a health care professional about prevention, diagnosis or treatment; and it provides sufficient information for the professional to independently review the basis for recommendations. If any criterion is not met, the software is considered a device. The guidance provides examples of non‑device CDS and device CDS functions

GxP validation relevance: Informs developers of AI/ML‑enabled clinical decision support tools about regulatory scope and classification, helping them determine whether their software falls under device regulation and requires formal validation.

Key controls: Ensure that CDS software avoids processing medical images or IVD signals, provides transparent rationale to clinicians, and allows independent review; if regulated as a device, follow QMSR and premarket requirements.

FDA’s TEMPO for Digital Health Devices Pilot is linked to the CMS Innovation Center ACCESS model. It is a specific device pilot program, not a general authorization for AI-enabled GxP systems.

This FAQ page explains that the FDA’s final rule issued January 31 2024 incorporates ISO 13485:2016 into 21 CFR part 820 and renames the regulation to the Quality Management System Regulation (QMSR). It clarifies that the QMSR aligns U.S. device QMS requirements with international standards, promotes consistency, and provides safe, effective, high‑quality devices. The QMSR became effective February 2 2026, replacing the Quality System Regulation. The FAQ notes that FDA is updating inspection processes, training staff, and engaging stakeholders. It highlights that under the QMSR, FDA may review management review, quality audits, and supplier audit reports that were previously exempt, and that a new inspection program replaces the Quality System Inspection Technique

GxP validation relevance: Provides additional guidance to device manufacturers on implementing the QMSR, preparing for inspections, and understanding new requirements, which is crucial for validating AI‑enabled devices under the updated quality management framework.

Key controls: Highlights adoption of ISO 13485, clarifies QMSR implementation and inspection processes, emphasises management review and audit record availability, encourages comparative analysis of existing records to meet QMSR requirements.

Recommendations for cybersecurity design, labeling, and premarket submission evidence for medical devices with cybersecurity risk. Supersedes the June 2025 guidance. This is device guidance; determine its relevance to a pharmaceutical manufacturing system before applying it.

This final FDA guidance clarifies that chimeric antigen receptor (CAR) T cell products are human gene therapy products where T cell specificity is genetically modified to recognize a desired antigen. It provides CAR T‑specific recommendations on chemistry, manufacturing and control (CMC), pharmacology/toxicology and clinical study design. The guidance also covers analytical comparability studies and notes that many recommendations apply to other genetically modified lymphocyte products such as CAR NK cells and T cell receptor‑modified T cells Sponsors are encouraged to communicate with CBER’s Office of Tissues and Advanced Therapies (OTAT) to discuss product‑specific considerations before submitting an IND

GxP validation relevance: Although not specific to AI, this guidance outlines regulatory expectations for development of genetically modified cell therapies like CAR T products. It highlights critical quality and clinical considerations that may interact with computational tools and data analysis in product design, manufacturing, and trial management, ensuring such tools align with GxP and regulatory standards.

Key controls: Provides detailed CMC and manufacturing control recommendations, pharmacology/toxicology requirements, clinical study design considerations, analytical comparability studies, and encourages early engagement with regulators to address product‑specific issues

This final FDA guidance provides recommendations to sponsors developing human gene therapy products incorporating genome editing. It advises on the information that should be included in an Investigational New Drug (IND) application to assess the safety and quality of investigational genome editing products, including product design, manufacturing and testing, nonclinical safety assessment and clinical trial design The guidance aims to help sponsors address potential off‑target effects and ensure that genome editing therapies meet regulatory standards.

GxP validation relevance: Relevant because CRISPR and other genome‑editing therapies rely on complex design, manufacturing and data‑analysis processes. Understanding regulatory expectations ensures that digital tools and AI‑driven workflows used in genome editing research, manufacturing and clinical development comply with GxP quality and traceability requirements.

Key controls: Recommends comprehensive documentation of genome editing product design and manufacturing processes, testing protocols, nonclinical safety studies and clinical trial design; emphasises risk management for off‑target effects and encourages early communication with FDA

FDA guidance on CMC flexibilities in developing human cellular and gene therapy products for a biologics license application. Flexibility must be considered in the specific product and development context; it is not a blanket waiver of validation requirements.

Draft recommendations for using next-generation sequencing to assess safety issues associated with genome editing in human gene therapy products. Determine the relevance to the product, editing approach, and development stage.

Draft recommendations for developing individualized therapies for specific genetic conditions with a known biological cause using a plausible mechanism framework. This is a specialized development framework, not a general GMP standard.

Draft guidance on expedited programs for regenerative medicine therapies for serious conditions. A separate February 2019 final guidance also exists; consult the issuer’s current index and the applicable version.

Draft recommendations for capturing postapproval safety and efficacy data for cell and gene therapy products. Relevant to product lifecycle evidence and postapproval planning, rather than manufacturing system qualification alone.

Draft recommendations on clinical trial designs for cellular and gene therapy products in small populations. Statistical and clinical expertise is needed to apply the guidance to a specific development program.

FDA answers common questions on development of cellular and gene therapy products across regulatory review, CMC, pharmacology/toxicology, clinical, and clinical pharmacology. The final guidance supersedes the earlier draft status used in this index.

Draft recommendations for risk-based cell safety testing to support INDs or BLAs for allogeneic cell-based products. Consider cell expansion, reagents, and the number of individuals exposed to the product.

Draft recommendations addressing the use and control of human- and animal-derived materials in manufacturing cell and gene therapy and tissue-engineered products. Use the issuing source and the specific product/material context.

Draft guidance on a science- and risk-based potency assurance strategy using process design, process controls, materials, in-process tests, and potency lot release assays. This item remains a draft.

FDA describes CMC flexibility and lifecycle considerations for cell and gene therapies. Apply the stated flexibilities within the product’s development context and applicable regulatory framework; the page is not a replacement for source requirements.

FDA announcement of the initial approvals of Casgevy and Lyfgenia for sickle cell disease. Useful as product-development context; it is not validation guidance or an approval of other products.

Annex 11 applies to all computerised systems used in GMP activities. It requires validated systems commensurate with risk, lifecycle documentation, supplier qualification, and roles and responsibilities of personnel. Risk management must be applied throughout the lifecycle, and documentation should cover specification, design, testing, and maintenance

GxP validation relevance: Provides EU expectations for validation, operation, and monitoring of computerised systems in GMP; forms basis for inspections and risk-based validation across the lifecycle.

Key controls: Risk management, validation and qualification, supplier management, change control, security and data integrity measures, periodic review.

This final reflection paper discusses regulatory considerations for using AI/ML throughout the medicinal product lifecycle. It stresses risk‑based approaches, minimising bias, ensuring trustworthy AI, and identifying when AI falls within EMA remit. Sponsors should ensure data sets, algorithms and processing pipelines are fit for purpose, align with legal, ethical and technical standards, and engage early with regulators for high‑risk AI. Sections cover data quality, training/validation/test separation, model development, performance assessment, interpretability, governance, data integrity and protection, and risk classification

GxP validation relevance: Provides comprehensive guidance on AI use across drug discovery, clinical development, manufacturing and post‑authorisation, establishing expectations for trustworthy AI and early regulatory dialogue.

Key controls: Risk-based assessment, bias mitigation, data governance, transparency and explainability, performance monitoring, early interaction with regulators.

The European Commission’s non‑binding guidelines provide an overview of AI practices prohibited under the AI Act. They explain that certain AI practices—such as harmful manipulation and deception, exploitation of vulnerabilities, social scoring, individual criminal risk assessment, untargeted scraping of facial data, emotion recognition in workplaces and education, biometric categorisation to infer protected characteristics, and real‑time biometric identification in public spaces—are unacceptable. The guidelines offer legal explanations and practical examples to help stakeholders understand and comply with these prohibitions, and stress that the Court of Justice of the EU provides authoritative interpretations

GxP validation relevance: Helps developers of AI‑enabled medical and GxP systems avoid incorporating prohibited practices (e.g., social scoring, real‑time remote biometric identification), ensuring that AI applications respect fundamental rights and avoid non‑compliant features.

Key controls: Highlights the AI Act’s banned practices and emphasises the need for early risk assessments and ethical reviews to ensure that AI systems do not exploit vulnerabilities or engage in manipulation or social scoring.

These non‑binding guidelines explain the practical application of the AI Act’s definition of an ‘AI system’. They assist providers and stakeholders in determining whether a software product qualifies as an AI system by clarifying that AI systems are machine‑based systems with varying degrees of autonomy that infer outputs from inputs. The guidelines are designed to evolve over time and support early implementation of the AI Act; they accompany the guidelines on prohibited AI practices and highlight that, as of February 2 2025, the AI system definition, AI literacy and certain prohibitions have begun to apply

GxP validation relevance: Supports GxP software developers in determining whether their digital products fall under the AI Act, thereby guiding the appropriate regulatory pathway and documentation for AI‑enabled medical devices and digital health technologies.

Key controls: Encourages documentation of system autonomy, adaptiveness, training methods and outputs to justify classification; underpins risk categorisation (prohibited, high‑risk, or limited risk) and informs compliance with AI Act obligations.

Amends Regulation (EU) 2021/2226 on medical devices for which instructions for use may be provided electronically. This is eIFU regulation; it is not an AI validation standard.

Health Canada pre-market guidance for machine learning-enabled medical devices covers risk management, data, development and training, testing and evaluation, clinical validation, transparency, and post-market monitoring. Its scope is medical devices.

Joint principles on predetermined change control plans for machine learning-enabled medical devices. These principles are distinct from the FDA’s August 2025 final PCCP submission guidance.

Joint FDA, Health Canada, and MHRA principles addressing what information about a machine learning-enabled device should be communicated, to whom, why, where, when, and how. These are guiding principles, not a standalone GMP validation requirement.

Health Canada’s notice describes its approach to digital health technologies, including software and integrated hardware/software systems. Treat it as program context and confirm current applicable device guidance.

MHRA’s AI Airlock supports regulatory exploration for AI-enabled medical devices. Phase 3 applications opened in October 2026. Participation is not equivalent to market authorization or validation of a product.

MHRA roadmap for the Software and AI as a Medical Device Change Programme. It describes policy development and planned work; distinguish roadmap commitments from effective legal obligations.

ISO AI management-system standard. Public publisher catalog information checked; the licensed full text and organization-specific applicability were not reviewed.

ISO guidance on AI risk management. Public publisher catalog information checked; the licensed full text was not reviewed. This does not replace applicable GxP requirements.

NIST’s AI Risk Management Framework is a voluntary tool to assist organisations in designing, developing and deploying trustworthy AI systems. It helps manage risks to individuals, organisations and society, emphasises trustworthiness considerations, and was developed through a consensus-driven process with public input

GxP validation relevance: Provides a general framework for identifying and managing AI risks, informing governance and validation strategies in regulated industries.

Key controls: Core functions of “Map, Measure, Manage, Govern”; profiles for generative AI and critical infrastructure; stakeholder engagement.

TGA guidance on artificial intelligence and medical-device software regulation. Establish device status, intended purpose, and applicable evidence needs before selecting assurance activities.

TGA evidence requirements for software using AI. Use in conjunction with applicable device classification, conformity assessment, technical documentation, and lifecycle controls.

Singapore MOH/HSA guidance on safe development, deployment, and use of AI in healthcare. The official page links the AIHGle 2.0 document, roles infographic, and deployers’ toolkit. Distinguish healthcare guidance from pharmaceutical GMP requirements.

TGA’s AI medical-device software guidance discusses synthetic data within AI training and validation. Synthetic data need justification in the context of the device, performance evidence, and representativeness.

Article summarises the ISPE GAMP Guide on Artificial Intelligence released in 2025. The guide builds on GAMP 5 principles and provides a risk-based framework for evaluating, implementing and maintaining AI systems across pharmaceutical life cycles, including manufacturing, distribution and medical devices. It emphasises lifecycle management, data integrity, and ongoing performance monitoring and addresses various AI technologies from rule-based to generative AI, aiming to harmonise regulatory expectations while recognising local nuances

GxP validation relevance: Offers industry insights into the application of GAMP principles to AI, reinforcing risk-based validation, data governance, and lifecycle control within pharmaceutical operations.

Key controls: Risk-based lifecycle management, data integrity controls, performance monitoring, adaptation of GAMP categories to AI technologies.

Consultation on Chapter 4, Annex 11, and proposed Annex 22. The consultation texts are drafts and are distinct from the operative GMP texts listed in EudraLex Volume 4.

Publisher catalog for risk management of medical devices. Consider AI/ML-specific hazards and limitations alongside the applicable device risk-management framework; licensed full text was not reviewed.

Publisher listing for Application of ISO 14971 to machine learning in artificial intelligence — Guide. Catalog metadata verified; obtain the licensed full text and confirm applicability.

IMDRF/AIML WG/N88 FINAL:2025 sets out good machine learning practice principles for medical-device development. Use as harmonization guidance; determine national regulatory applicability.

The updated ICH Q9(R1) guideline provides principles and tools for quality risk management to improve product availability and protect patients. It clarifies the formality of risk management, risk-based decision-making, and subjectivity in assessments and emphasises integration of risk management throughout pharmaceutical quality systems

GxP validation relevance: Applies to pharmaceutical quality management systems, informing risk-based validation of AI and software systems by emphasising systematic identification, analysis, and control of risks.

Key controls: Risk assessment, risk control, risk review, and communication; alignment with GMP/ICH guidelines.

This working group paper provides a high-level overview of regulatory considerations and emerging good practices for AI in health. It outlines key considerations for developers, regulators, manufacturers and practitioners to facilitate safe use of AI, emphasising risk‑benefit assessments, evaluation and monitoring of AI performance, and continuous assessment across the lifecycle. It does not serve as a regulatory framework but lists best practices to support safe AI in health

GxP validation relevance: Offers global perspective on regulatory challenges for AI in healthcare, informing early-stage development and policy discussions.

Key controls: Risk-benefit assessment, performance evaluation and monitoring, stakeholder engagement, ethical considerations.

This guidance provides recommendations for computerised systems across GxP domains and assists inspectors and regulated users. It emphasises lifecycle management, planning, user requirements, testing, validation strategies, change management, system security, audit trails, electronic signatures, personnel training, and inspection considerations. It supports innovation while ensuring compliance

GxP validation relevance: Offers comprehensive global guidance for validation and inspection of computerised systems in GxP environments, forming the basis for regulatory inspections and industry practices.

Key controls: Lifecycle approach, user requirements specification, supplier management, testing and validation, change control, security and audit trail, training.

This ISPE article summarises updates in the GAMP 5 second edition. It discusses patient-centric, risk-based approaches, modern IT practices, and emphasises critical thinking over prescriptive compliance. It covers new technologies such as AI/ML, blockchain and cloud computing, updates categories for cloud and SaaS, and emphasises agile and risk-based methodologies, continuous improvement, and updated appendices for SaaS validation and classification of systems

GxP validation relevance: Provides practitioners with updated best practices for validating modern computerised systems, including AI and cloud technologies, aligning with regulatory expectations and CSA concepts.

Key controls: Risk-based lifecycle, critical thinking, scalable validation for SaaS and cloud, agile development, continuous improvement.

PMDA’s English-language resource for its subcommittee on software as a medical device utilizing AI and machine learning. Distinguish scientific advice and reports from binding Japanese regulatory requirements.

The HSA digital health page summarises regulatory guidelines for software medical devices, including AI. It notes that digital health consultations have become common and references the 2020 Regulatory Guidelines for Software Medical Devices, covering cybersecurity, data integrity and lifecycle management. It highlights the AI in Healthcare Guidelines (AIHGle 2.0) updates, clarifying responsibilities for developers, deployers and users, and emphasising transparency, risk assessment and mitigation

GxP validation relevance: Provides context for Singapore’s regulatory framework for AI and software medical devices, pointing to detailed guidelines and international collaborations (e.g., with Korea’s MFDS).

Key controls: Cybersecurity and data integrity controls, lifecycle management, clarity of roles, transparency and risk mitigation guidance.

MSIT announcement on the AI Basic Act and its Enforcement Decree entering into force. The announcement is policy context; confirm current Korean legal text and specialist interpretation for specific obligations.

MFDS notice for revised digital medical-product classification and designation regulations. The official Korean source is linked; detailed translation, current applicability, and the earlier secondary summary have not been verified.

A presentation by South Korea’s MFDS summarises the Digital Medical Products Act (DMPA) and its subordinate regulations for AI‑ and software‑based devices. Six subordinate regulations are highlighted: (1) classification and designation of digital medical products; (2) approval, certification and notification processes that introduce software usability evaluation, Predetermined Change Control Plans (PCCP), exemptions for certain clinical decision support systems and enhanced AI‑specific labelling and evaluation frameworks for digital health technologies combined with pharmaceuticals; (3) Good Manufacturing Practice requirements based on ISO 13485 and IEC 62304 that incorporate AI‑specific controls; (4) regulations for protocol approval and conduct of clinical trials, enabling simplified data‑driven and decentralised trials; (5) a cybersecurity regulation covering the AI/software lifecycle aligned with IMDRF guidelines; and (6) special provisions establishing certification criteria for excellent governance systems and a conditional ‘use first, evaluate later’ regulatory sandbox The presentation notes that overlapping requirements between the DMPA and the Korean AI Act are deemed fulfilled when compliance with the DMPA is demonstrated

GxP validation relevance: Informs AI‑enabled medical device developers about South Korea’s comprehensive regulatory framework, covering classification, approval, PCCPs, QMS, clinical trials, cybersecurity and sandbox provisions, which are critical for AI validation and post‑market controls.

Key controls: Requires risk‑based classification and designation of digital medical products; mandates software usability evaluations and PCCPs; introduces AI‑specific labelling and transparency; requires QMS compliant with ISO 13485/IEC 62304; simplifies clinical trial protocols and allows use of real‑world evidence; mandates cybersecurity controls across the lifecycle; offers conditional approval pathways via a regulatory sandbox.

The AI Act establishes a uniform legal framework for AI systems across the EU, promoting trustworthy AI that respects health, safety, fundamental rights, and environment while preventing market fragmentation. It sets obligations for providers and users and classifies high‑risk AI systems, including medical devices, requiring risk management, human oversight, and conformity assessment

GxP validation relevance: Defines legal obligations and risk classifications for AI systems in the EU; high-risk AI systems like medical devices must meet strict requirements, impacting design, validation, post-market monitoring, and transparency.

Key controls: Risk management system, human oversight, quality management, data governance, documentation, monitoring and reporting obligations.

The concept paper outlines the need to revise Annex 11 due to new digital technologies. It proposes including data integrity guidance for data in motion and at rest, digital transformation, cloud services, and clarifying scope and definitions. It emphasises risk-based qualification of commercial-off-the-shelf software, agile development processes, and updated classification of critical data and systems

GxP validation relevance: Signals regulatory intent to modernise Annex 11, highlighting areas where AI and digital transformation will require new guidance.

Key controls: Incorporation of data integrity, cloud service requirements, agile development acceptance, risk-based qualification and classification of critical systems.

The article previews Edition 2 of IEC 62304, expected in 2026. It notes that the update simplifies safety classifications, expands scope to all health software, and introduces AI/ML development lifecycle requirements. It emphasises harm considerations (including property and environmental damage), alignment with ISO 14971 and ISO 13485, and dedicated AI process planning and validation steps. The revised standard will affect classification decisions, documentation effort and development practices for AI‑enabled devices

GxP validation relevance: Provides early insight into upcoming changes to the medical device software lifecycle standard, which will introduce explicit AI lifecycle requirements and broaden scope to general health software.

Key controls: Simplified safety classes, alignment with risk management (ISO 14971), AI process planning and validation, cybersecurity considerations.