Post-market surveillance is essential for ensuring that AI-enabled medical devices remain safe, effective, and compliant after launch. DataArt recently hosted a webinar to explore how manufacturers can monitor real-world performance, respond to drift, and navigate MDR, IVDR, and EU AI Act requirements. The panel of experts included:
- Sara Jarowska, Senior Manager of Quality and Regulatory Affairs, DataArt
- Andrei Sorokin, AI Expert and Solutions Architect, DataArt
- Varvara Bogdanova, Innovations Manager, DataArt
Our experts discussed regulatory expectations, technical monitoring approaches, and implementing post-market surveillance in practice. In this article, we summarize the main insights from the discussion.
What Changes After Launch
Varvara Bogdanova: Once such an AI-enabled medical device is on the market, what changes from a regulatory and quality perspective?
Sara Jarowska: The key shift is from proving performance once to proving it continuously. Pre-market evidence is a snapshot from a controlled setting. After launch, manufacturers need active post-market surveillance based on real-world data, predefined indicators, and thresholds. For AI-enabled devices, ongoing monitoring of performance and potential drift becomes part of maintaining compliance throughout the product lifecycle.
How EU Regulations Fit Together
V. B.: When we talk about AI-enabled medical devices in Europe and post-market monitoring, we have both the MDR and the European AI Act. How do these two frameworks come together in practice?
S. J.: The AI Act does not replace MDR or IVDR. It adds another layer on top of the existing medical device framework. For medical devices, the starting point remains intended use, classification, and whether notified body involvement is required. In practice, many expectations around monitoring, traceability, and lifecycle control already existed under MDR and IVDR, even if the AI Act now states some of them more explicitly.
What Really Changed in 2026
V. B.: August 2026 marked an important point in the evolution of the European AI regulatory framework. What has really changed for manufacturers of AI-enabled medical devices, particularly when it comes to post-market monitoring?
S. J.: A common misconception is that everything starts in August 2026. In reality, most relevant post-market obligations were already in place under MDR and IVDR. Manufacturers already had to define indicators, thresholds, and trend reporting methods, and account for how software behaves in the field. The AI Act makes some expectations more explicit and may affect product design or specifications, but it does not change the fact that continuous monitoring was already necessary in practice.
What Manufacturers Should Monitor
V. B.: What should manufacturers actually be monitoring once an AI-enabled medical device is on the market? And how do they know when something has changed enough to require action?
Andrei Sorokin: Technically, monitoring starts with the data pipeline. Incoming data should still match the formats and assumptions defined in the documentation. Once clinical outcomes are available, manufacturers can track metrics such as sensitivity, specificity, and positive and negative predictive values, including performance across different patient groups or use settings. The challenge is that clinical ground truth may arrive late, so earlier signals often come from clinician overrides, anomaly detection, and changes in input data distributions. Data drift is relatively easy to detect; concept drift is harder and usually needs more specialized tooling.
S. J.: From the regulatory side, manufacturers need to monitor what they have already declared: intended use, labeled claims, specifications, values and factors from the predetermined change control plan, and identified risks. If accuracy is part of the labeling, it must be tracked. If risk management identified failure modes, those must also be monitored in the field. The monitoring plan should reflect the product documentation and the risk profile of the device.
How to Respond to Drift
V. B.: Once a potential issue or change is detected, what happens next? What are the exact steps manufacturers should take?
A. S.: In healthcare, drift is a trigger for investigation, not for automatic retraining. A signal may reflect a technical change in the environment, such as a new scanner, and in some cases recalibration is enough. In others, retraining may be needed. But before any update is deployed, the manufacturer must validate that the update solves the problem without introducing new risks. Depending on the type of change, additional evidence and notified body involvement may also be required.
S. J.: From the regulatory perspective, response depends heavily on preparation. If thresholds, change categories, and significance criteria were defined upfront, the event can be assessed more efficiently. The manufacturer needs to evaluate patient safety impact, whether limits were exceeded, and whether vigilance or CAPA processes are triggered. The change is then classified and processed accordingly. The exact regulatory path may differ, but controlled development and validation are always required before release.
Tools, Systems, and Evidence
V. B.: If we want to build this monitoring system today, which parts can be covered with ready-made solutions and where might additional tailoring be needed?
A. S.: Basic monitoring capabilities are available in major cloud platforms. Tools such as SageMaker or Vertex AI can help detect changes in input distributions and, in some cases, feature attribution. Concept drift is still harder to handle and often requires custom logic or specialized tools. Even then, these outputs should be treated as signals for investigation, not as standalone deployment decisions.
S. J.: From a compliance perspective, having a tool is not enough. Manufacturers need to prove that alerts are reviewed, records are retained, and outputs support PMS and QMS requirements. That means audit trails, traceability to model versions and thresholds, and often tool validation. Monitoring infrastructure is part of regulatory evidence generation, not just a technical add-on.
Practical Challenges in Monitoring
V. B.: What are the biggest practical and regulatory challenges manufacturers face when implementing post-market monitoring?
A. S.: One major practical challenge is delayed ground truth. Teams may see early signals but still lack confirmed clinical outcomes. Another is root-cause analysis, especially when access to site-level data is limited. Manufacturers often need to work with indirect signals to determine whether the issue lies in the pipeline, the environment, or the model. Integrating different monitoring components into a coherent architecture is also a challenge.
S. J.: On the regulatory side, awareness is still a major issue. Many companies underestimate how much of this is already expected under MDR and IVDR. Another challenge is waiting too long because guidance is still evolving. A third is automating compliance evidence: logs, traceability records, and monitoring outputs should come directly from the system rather than being reconstructed later for audits.
Monitoring as a Strategic Asset
V. B.: Is post-market monitoring only about managing risk and meeting regulatory requirements, or can it create additional value?
S. J.: It can create real strategic value. Real-world data is difficult and expensive to obtain in healthcare, so if manufacturers capture it through monitoring, it can support future product improvements, refinement of the change control plan, and stronger internal expertise.
A. S.: A strong post-market surveillance system can also help with product positioning. It may show where a device performs best, where its intended use could be refined, and how override data from the field can support targeted performance improvement.
Off-Label Use and Risk Management
Audience question: How should off-label use be accounted for in post-market monitoring?
S. J.: For the European market, the starting point is the risk management file. Manufacturers need to assess whether the off-label use falls within a reasonably foreseeable use scenario. If it does, it should be reflected in monitoring and post-market follow-up. If it does not, it may not need the same level of monitoring, but field data should still confirm that the original assumptions remain valid.
Acting Before a Threshold Is Crossed
Audience question: Do manufacturers always need to wait until a threshold is crossed before taking action?
S. J.: No. A threshold is not the only valid trigger. A recurring pattern, trend, or correlation with another factor may already justify investigation or additional controls. Monitoring data should be interpreted in context, especially if signals are concentrated in a particular population, geography, or time period.
Monitoring Without Access to Site Data
Audience question: How can manufacturers obtain monitoring insights if they cannot access in-site clinical data or user feedback? How can this be reconciled with data protection requirements?
A. S.: One option is to bring monitoring to the data. In a hybrid architecture, monitoring components can run within the hospital environment and process data locally. That can still support detection of drift and other changes while limiting data transfer. Even indirect or privacy-preserving signals may be enough to identify where further investigation is needed.
S. J.: This still requires proper legal and data protection controls. Data-sharing arrangements depend on what information is collected, and measures such as anonymization or pseudonymization may be needed. Using sensitive health data for product improvement requires careful assessment under GDPR, regardless of where processing occurs.
How to Limit Downtime
Audience question: Are there good practices manufacturers can use to limit downtime?
A. S.: A practical approach is to do as much technical preparation as possible in parallel with the regulatory process. Teams may prepare or retrain an updated model in the background while gathering the evidence needed for release. The updated model should not be deployed until that evidence is complete.
S. J.: From the regulatory side, downtime is reduced by preparation before launch. If the manufacturer has already defined the change control plan, thresholds, and change classification logic, it can respond faster. Continuous monitoring also helps teams act early, before a performance issue becomes critical.
Research-Only AI and the EU AI Act
Audience question: If a medical product has AI functionality used only in a research lab and not with real patients or in a hospital, does the EU AI Act still apply?
S. J.: Yes, but usually in a more limited way. The AI Act applies broadly, while additional obligations apply to high-risk systems. If the AI is part of a medical device requiring notified body involvement, the high-risk requirements may apply. If not, some general obligations, such as transparency-related requirements, may still remain relevant.
How Companies Are Preparing Outside the EU
Audience question: When balancing readiness and cost, are companies outside the EU proactively preparing for stricter EU requirements, or waiting for similar rules in their own region?
A. S.: The biggest cost is often building post-market surveillance capability in the first place. Once that exists, maintaining it is usually less expensive and disruptive.
S. J.: Much depends on a company’s market strategy. Some organizations prepare early by following requirements or guidance from other regions before similar rules apply locally. That can be useful if it helps solve immediate product and compliance challenges.
Conclusion
For AI-enabled medical devices, post-market monitoring is not a secondary activity after launch. It is part of how safety, performance, and compliance are maintained over time. Manufacturers need technical monitoring capabilities, but also predefined thresholds, change control logic, risk-based decision-making, and traceability across the lifecycle.
Companies that treat post-market surveillance as a strategic capability, not just a regulatory obligation, will be better positioned to keep products on the market, respond to issues faster, and use real-world evidence to improve future generations of their technology.
For more insights on post-market monitoring for AI-enabled medical devices, watch the full webinar here:
Contact us if you need support designing compliant post-market surveillance, monitoring, and change-control processes for AI-based medical software.
