Retrained AI Models Can Shift Medical Device Risk Profiles Faster Than Static Risk Files Track

A regulatory professional recounts a review meeting where no one could say how a recent quiet retraining of a software medical device would have been caught by the existing risk documentation. The author argues that a risk management file is a point-in-time snapshot, while learning models change continuously, so scheduled reviews leave gaps. Changes such as subgroup performance drift, upstream labeling shifts, or inference-stack dependency updates often fall outside formal change control and generate only log entries. The piece points to standards including ISO 14971, IEC 62304, the EU AI Act, and the FDA's Predetermined Change Control Plan guidance as expecting risk to be linked to changes, ideally continuously. The author suggests triggering risk reviews from telemetry and committing in advance to a PCCP protocol that defines permissible model changes.