Cybersecurity and AI for medical devices.
Designing a connected device that is secure from the architecture up, and checking that an AI function behaves as intended on data that looks like the field.
You are probably in one of these situations.
Medical device cybersecurity is first a patient safety matter. It is built into the architecture and the software lifecycle, not into a standalone document.
- Your device is connected and no threat analysis has been formalised.
- Hospital customers send you security questionnaires.
- Your product includes an AI function whose performance must be demonstrated.
What I actually do.
Architecture and threats
Threats modelled, architecture reviewed, defence in depth.
Lifecycle
IEC 81001-5-1 activities built into your software process.
SBOM and vulnerabilities
Components inventoried, vulnerabilities tracked, updates planned.
Customer questionnaires
MDS2 answers aligned with the actual architecture.
AI validation
Independent test data, criteria set before testing, drift monitored.
Deliverables
| Ref. | Deliverable |
|---|---|
| D1 | Threat model and architecture review |
| D2 | Lifecycle security plan |
| D3 | SBOM and vulnerability management procedure |
| D4 | MDS2 answers |
| D5 | AI function validation plan and report |
Standards
| IEC 81001-5-1 | Security activities in the health software lifecycle |
|---|---|
| IEC TR 60601-4-5 | Technical security specifications for devices |
| IEC 62304 | Medical device software lifecycle |
| ISO 14971 | Risk management |
| MDS2 | Manufacturer disclosure statement for healthcare providers |
| ISO/IEC 23894 | Artificial intelligence risk management |
Frequently asked questions
Do you run penetration tests?
No. I specify them and interpret the results; a qualified provider runs them.
How do you validate an AI function?
On data independent from training, with criteria set before testing, then by monitoring drift.
A project to move forward? Let's talk.
Three lines are enough: the topic, the stage, the deadline. Reply within two business days.
Use the contact form →Please do not send confidential documentation before a non-disclosure agreement has been signed.