The absence of full lifecycle risk management for AI-based medical devices in radiology

Abstract

This study represents the systematic examination of full lifecycle management for radiology artificial intelligence medical (AI) devices approved by the US Food and Drug Administration (FDA), with an in-depth analysis of post-market adverse events, recalls, and software update patterns. An analysis of 956 radiology AI medical devices approved by the FDA between September 1995 and September 2025 revealed that 429 (44.87%) of these devices had undergone software version updates. Adverse events related to software defects involved 15 products (34.88%); among these, 4 products (26.67%) underwent version updates, and for 3 products (20%), the companies initiated recalls following the occurrence of adverse events. There were a total of 124 reports (68.13%) of product recalls caused by software defects; for 38 of these reports (30.65%), corresponding to 8 products, the manufacturers corrected the defects by updating the software after implementing the recall. We make three contributions: (1) identifying that the vast majority of companies lack a closed-loop risk management system encompassing adverse events, recalls, and software updates, (2) analysing the frequency and characteristics of software updates for radiology equipment, and (3) exploring the critical role of full lifecycle management in the regulation of AI-based medical devices.

Introduction

Background: Medical device safety directly impacts patient wellbeing, relying not only on rigorous pre-market approval but also on continuous oversight throughout the entire lifecycle¹. The US Food and Drug Administration (FDA) emphasizes lifecycle management as a core regulatory principle to ensure the safety and effectiveness of medical devices throughout their operational lifespan. In April 2018, the FDA issued the Medical Device Safety Action Plan: Protecting Patients, Promoting Public Health, which highlights the implementation of full lifecycle oversight for medical devices². This action plan outlines how to continuously enhance the regulatory pathway for medical device safety across the entire lifecycle, thereby effectively safeguarding patient safety. Furthermore, the FDA’s official website provides Total Product Life Cycle information pages for each medical device category, including details on device approvals, post-market adverse events, and recalls.

With the rapid advancement of AI technologies, an increasing number of AI-based medical devices have obtained approval from the FDA and entered the market. To date, the FDA has authorized 1247 AI-based medical devices, of which 956 are AI-enabled radiological medical devices³. However, given the characteristics of AI medical device algorithms—such as rapid iteration, limited interpretability, and insufficient transparency—traditional regulatory models face substantial challenges in effectively overseeing these products^4,5. Therefore, the implementation of full lifecycle management for AI-based medical devices is of critical importance. Such an approach relies on continuous and dynamic risk monitoring, performance validation, and comprehensive assessment to ensure that these products remain safe and effective throughout their entire life cycle. Ideal life-cycle management should identify risks through adverse event monitoring, with short-term risk management actions such as recalls, and long-term risk management focusing on design and manufacturing improvements. For AI-based medical devices, these long-term measures primarily take the form of software version updates.

The FDA has issued multiple guidance documents to assist companies in establishing robust lifecycle management systems. In April 2019, it published a discussion paper titled “Proposed Regulatory Framework for Modifications to Artificial Intelligence/Machine Learning (AI/ML)-Based Software as a Medical Device (SaMD) – Discussion Paper and Request for Feedback,” outlining a comprehensive regulatory framework for AI/ML-based SaMD covering the entire product lifecycle from pre-market development to post-market performance monitoring⁶. Subsequently, in its January 2021 action plan, the FDA outlined five specific implementation pathways based on this regulatory framework to advance its adoption⁷. On 7 January 2025, the FDA further published the draft guidance Artificial Intelligence-Enabled Device Software Functions: Lifecycle Management and Marketing Submission Recommendations⁸. This document contains recommendations for the development and marketing of AI medical devices throughout their entire product lifecycle, emphasizing the critical importance of lifecycle management in ensuring the safety of AI medical devices. The FDA continues to explore and refine its regulatory approach, committed to ensuring the safety and effectiveness of AI-based medical device software functions throughout their lifecycle via a lifecycle-based regulatory methodology.

Current State and Limitations of Existing Literature: Current research on AI-based medical devices primarily focuses on aspects such as product approval status, post-market adverse events, product recalls, and regulatory considerations^9–13. For instance, Geeta Joshi et al.¹⁴. conducted a comprehensive analysis of 691 FDA-approved AI medical devices, examining their marketing authorization pathways, approval timelines, regulatory classifications, speciality domains, decision types, and recall histories. Similarly, Rafał Obuchowicz et al.¹⁵. reviewed advances in AI-based imaging applications, examining technological classifications, clinical practice, regulatory challenges, and future trends in radiology; Snigdha Santra et al.¹⁶. explored regulatory issues related to AI-driven combination devices, comparing regulatory strategies in the US and EU and proposing an adaptive policy framework; John C. Lin et al.¹⁷. analysed pre-market approval documentation, post-market adverse events, and recalls for all AI medical devices approved by the FDA between 1995 and July 2023. Boris Babic et al.¹⁸ studied FDA-approved AI medical devices from 2010 to 2023, identifying 943 related adverse events and concluding that current existing medical device adverse event reporting systems are inadequate for post-market safety monitoring of AI medical devices. The aforementioned studies represent isolated analyses focusing solely on aspects such as approval, adverse events, and recalls for AI-based medical devices. However, these studies have yet to examine the interrelationships from a product lifecycle perspective and lack research on software version updates, which are crucial for risk control in AI medical devices.

Research contributions: In this study, we aim to explore the full lifecycle management of FDA-approved AI medical devices, with a focus on radiology AI medical devices. We conduct a comprehensive analysis of their post-market adverse events, recalls, and software update patterns. We make three contributions: (1) identifying that the vast majority of companies lack a closed-loop risk management system encompassing adverse events, recalls, and software updates, (2) analysing the frequency and key characteristics of software updates for these devices, and (3) exploring the critical role of full lifecycle management in regulating AI medical devices and safeguarding patient safety.

Results

Software version updates

As of September 30, 2025, software version updates had been implemented for radiology AI medical devices from 94 manufacturers, covering 163 products and corresponding to 429 (44.87%) distinct product codes. Among these products, 62.57% of version updates primarily occurred within the 6-month to 2-year timeframe, as shown in Fig. 1.

Fig. 1. Statistics on software version update frequency.

This chart shows 163 products that have undergone software updates, along with the number of updates within each time interval and their total percentage. The time intervals are divided into six categories, ranging from less than 6 months to more than 4 years.

As illustrated in Fig. 2, a clear correlation is observed between cumulative update counts and version update frequency. As the number of updates increases, products tend towards the 6-month to 2-year interval. When update counts reach 5–6 or more, the proportions falling within the 6-month to 1-year and 1–2-year intervals become equal. For products with 1–2 updates, the update frequency showed greater variation and dispersion.

Fig. 2. Statistics on update frequency and number of updates.

This chart illustrates the relationship between the cumulative number of updates and the average update interval for 163 software products. Update intervals are categorized into six ranges, from less than 6 months to more than 4 years. There are 4 products with 6 or more updates, 2 products with 5 updates, 5 products with 4 updates, 8 products with 3 updates, 39 products with 2 updates, and 105 products with 1 update.

As shown in Table 1, there is a strong correlation between a product’s initial release date and the frequency of subsequent software version updates. Overall, with the exception of variations observed in 2022, products approved for market release later generally exhibited faster software version update cycles. For example, the 14 products released in 2017 or earlier had an average update interval fell within the long-term of 3–4 years. From 2018 to 2023, the update intervals for these products continued to shorten; and by 2024, 12 products had an average update interval within the short-term range of 6 months to 1 year, indicating a significant acceleration in software update iteration speed.

Table 1.

Statistics on initial release dates and initial update intervals for software versions

Year	2017 and earlier	2018	2019	2020	2021	2022	2023	2024
Number of products (units)	14	11	18	38	19	28	23	12
Average update interval (days)	1244	786	710	625	485	611	372	246

Table 2 indicates that the 163 radiology AI medical devices can be categorized into 12 classes, involving 18 product codes. Regarding software version update intervals, significant variations exist across product categories. Emission computed tomography systems exhibited the fastest update pace, with versions refreshed approximately every 270 days. In contrast, medical image analysers demonstrate the slowest update frequency, with intervals extending up to 1,231 days. Furthermore, medical imaging management and processing systems, the most numerous category, exhibit relatively prolonged update cycles, with version intervals averaging approximately 608 days.

Table 2.

Analysis of product categories

Product category	Product codes involved	Total Number (units)	Average interval (days)
Medical image management and processing system	LLZ(32), QIH(26), QKB(7), OEB(1), QTZ(1)	67	608
Ultrasonic pulsed Doppler imaging system/echo imaging system	IYN(18), IYO(1)	19	457
Computed tomography x-ray system	JAK	19	734
Magnetic resonance diagnostic device	LNH	15	426
Radiological computer aided triage and notification software	QAS(12), QFM(2)	14	704
Radiological computer-assisted diagnostic software for lesions suspicious of cancer	QDQ(6), POK(4)	10	707
Medical image management and processing system	MYN	8	1231
Medical charged-particle radiation therapy system	MUJ	4	421
Emission computed tomography system.	KPS	2	270
Image-intensified fluoroscopic X-ray system.	OWB	2	1198
Medical image processing system.	QBS	2	928
Stationary X-ray system	MQB	1	287

Statistics on adverse events involving artificial intelligence medical devices in radiology

As of September 30, 2025, a total of 151 adverse events reports involving radiological AI were retrieved, corresponding to 43 different products. Analysis of these device malfunctions in adverse event reports indicates that 15 products (34.88%) associated with 40 reports may have experienced adverse events due to software defects. As shown in Table 3, for 4 products (26.67%) associated with 12 reports, manufacturers response to the identified software defects by releasing new product versions after the adverse events occurred. However, the corrective action of sofeware updates was not mentioned in the reports. The intervals between version updates for these products varied significantly, ranging from 231 days to 823 days. Notably, among the aforementioned 15 products, 3 (20%) were subject to recalls by the manufacturers following the adverse events.

Table 3.

Statistics on software version update intervals following adverse events in radiology artificial intelligence medical devices

Product number	Number of adverse events (reports)	Average interval (days)
K212441	8	235
K183593	2	823
K211597	1	306
K233657	1	231

Recall data statistics for radiology artificial intelligence medical devices

As of September 30, 2025, a total of 182 recall reports for radiology AI medical devices were retrieved. Among these, 124 reports (68.13%) were linked to software defects, with 38 reports (30.65%) involving to software version updates for 8 products. As shown in Fig. 3, there exists a significant variation in software update frequency among products with different recall counts, though no clear relationship exists between the two. The update frequency for these products primarily clusters within the 6-month to 1-year range.

Fig. 3. Statistics on defect recall and version updates for radiology artificial intelligence medical device software.

This chart illustrates the relationship between the number of recalls and the timing of corresponding software updates for eight products that received updates following a recall. The time intervals between updates are categorized into three ranges: 6 months or more, 1 year, and 3 years.

Discussion

Research into the iterative updates of software versions for radiology AI medical device products indicates that nearly half of the product codes among FDA-approved devices are interconnected, indicating software version updates. This finding suggests that manufacturers of radiology AI medical devices are not solely focused on producing diverse product types but are instead continuously enhancing product performance through version iterations. However, some manufacturers have not upgraded their product software, potentially leading to diminished competitiveness due to outdated performance. Statistical analysis of these software update frequencies reveals that version updates predominantly occur within the 6-month to 2-year timeframe, indicating that manufacturers place significant emphasis on software version updates, committing sufficient human and material resources to complete the development, testing, and release of new versions within relatively short timeframes.

There exists a correlation between the number of updates and update frequency. An increase in update frequency shortens the intervals between releases, with updates becoming more concentrated within the 6-month to 1-year and 1-year to 2-year timeframes. This may stem from continuous product refinement and optimizations, where companies develop greater maturity in the research, testing, and validation processes for new software versions. Furthermore, as updates build upon existing versions, this further accelerates the pace of version updates. Moreover, multiple updates to the same product significantly reduce potential software defects, lowering the probability of product recalls and adverse events, thereby effectively safeguarding patient safety. Simultaneously, continuous version iterations accelerate the translation of the latest research findings into clinical applications, enhancing the product’s market competitiveness.

A strong correlation also exists between a product’s initial market release date and the subsequent frequency of software version updates. Overall, products approved for market entry later tend to exhibit relatively faster software update cycles. This may stem from the relative maturity of AI technology within the field of radiology AI medical devices, reducing the complexity of software version upgrades. Concurrently, given the substantial number of existing radiology AI medical devices on the market, new products must offer enhanced functionality to capture market share. Sustained software updates and continuous performance improvements are thus essential to maintain competitive edge. Among the twelve product categories examined, medical image management and processing system exhibited the highest number of software updates. This likely stems from their critical role in managing, processing, and analysing medical images within clinical radiology departments. Ultrasonic pulsed doppler imaging system/echo imaging system and Computed tomography x-ray system followed by substantial update volumes, reflecting these as two primary application domains for AI in radiology where relevant enterprises have accumulated extensive research expertise. However, analysis of software version update frequency indicates that despite the high number of updates for these three product categories, the update cycles are relatively long. This may be attributable to the complex system functionality of these products, where version upgrades necessitate comprehensive consideration of multiple factors. Consequently, extended periods for research, development, design, and validation lead to relatively infrequent version updates.

Among 151 adverse event reports for radiology AI medical devices (corresponding to 43 products), adverse events in 15 products (34.88%) may have been caused by software defects. As the core component of AI medical devices, software vulnerabilities pose significant threats to safety and reliability, potentially leading to misdiagnosis or missed diagnoses that compromise patient safety¹⁹. According to 21 CFR Part 803, corrective actions must be taken for products that have caused or may cause death or serious injury to avoid unreasonable risks of substantial harm to public health. An analysis of these 40 adverse event reports revealed that only 12 reports, corresponding to 4 products, prompted the companies to update the software versions of their products following the adverse events. The swiftest manufacturer released a new software version within 231 days, while the slowest completed the product version update after 823 days. Although 10 adverse event reports for four products mentioned that manufacturers should create software change requests or implement software version updates to correct existing defects, no actual action was taken to update the versions. Only three products were subject to voluntary recalls by manufacturers after the adverse events.

Analysis of recall reports for radiology artificial intelligence medical devices reveals that recalls attributable to software defects predominate^20,21. According to 21 CFR 820.100, corrective or preventive action procedures must include investigations into nonconformities related to products, processes, and quality systems. Therefore, after implementing recalls and receiving returned products, companies should not consider the recall action concluded. Instead, they must conduct comprehensive, systematic analyses of exposed software issues to trace the root causes of defects. Among recall reports attributed to software defects, 47.58% mentioned that companies planned or were about to release new versions to correct existing software flaws. However, some reports failed to disclose any corrective actions taken by the companies, leaving regulatory authorities and the public uncertain whether appropriate measures had been implemented—a lack of transparency in information. Further analysis of 124 recall reports reveals that 38 reports (30.65%) corresponded to 8 products for which companies released new versions after implementing voluntary recalls. Software updates for these products primarily occurred within 6 months to 1 year. By proactively updating software versions, these companies can reduce the likelihood of future recalls. Simultaneously, this approach provides invaluable reference for developing other types of radiology AI medical devices and managing software version updates, helping prevent recalls or adverse events caused by similar software defects. This not only safeguards patient safety but also reduces the human and financial resources required for product recalls.

Previous research findings indicate that the vast majority of companies have not established effective closed-loop risk management systems. They fail to create effective linkages between adverse events, product recalls, and software updates, leaving these three elements isolated and disconnected. This gap not only hinders the effective identification of product defects but also impedes the containment of risk propagation. Companies should establish and refine comprehensive product lifecycle management systems to achieve closed-loop management encompassing adverse events, recalls, and software updates, as illustrated in Fig. 4. Post-market adverse events serve as risk sentinels. Upon detecting such events, in-depth analysis identifies product risk points. If attributed to software defects, short-term recall measures can contain risk propagation. However, ultimately, software updates must eliminate product defects at their source to reduce adverse events and recalls^22,23. Post-market surveillance and continuous risk management not only drive iterative product upgrades and significantly enhance product safety performance but also substantially reduce the incidence of adverse events and recalls, effectively safeguarding patient safety. Closed-loop systems require not only proactive implementation by companies but also a shift in regulatory focus toward the full product lifecycle, with particularly emphasis on post-market surveillance and management of AI medical devices. This includes, for example, requiring companies to develop post-market surveillance plans and submit regular surveillance reports. Continuous monitoring and evaluation of real-world data are essential to ensuring the ongoing safety and effectiveness of such products.

Fig. 4. Closed-loop and open-loop lifecycle management.

This chart illustrates the differences between closed-loop and open-loop lifecycle management of radiology AI medical devices. In a closed-loop system, adverse events, recalls, and software updates are interconnected. Risk management measures for adverse events caused by software defects should involve either a recall or a software update; conversely, the risk management measure for a recall should be a software update. Timely software updates reduce the risk of adverse events and recalls. In an open-loop system, these elements exist in isolation from one another.

The rapid iteration of AI medical device algorithms, coupled with challenges in interpretability and transparency, presents novel challenges to traditional medical device regulatory frameworks. When significant changes occur in AI medical devices—such as software version updates—manufacturers must submit new 510(k) applications or PMA supplemental submissions and obtain FDA approval prior to market release^24,25. Current regulatory approaches demand substantial human and material resources for comprehensive safety and efficacy reviews. Moreover, lengthy approval cycles hinder the emergence of new AI medical devices and impede the pace of software version updates.

To address this issue, the FDA issued the Digital Health Innovation Action Plan in 2017²⁶ and launched the Software Pre-Certification Programme²⁷. In April 2019, the FDA published a discussion paper entitled Proposed Modified Regulatory Framework for Artificial Intelligence/Machine Learning (AI/ML)-Based Software as a Medical Device (SaMD): Discussion Paper and Request for Feedback, proposing a regulatory framework based on the principle of PCCP⁶. In October 2023, the Guidance on Planned Change Control Plans for Machine Learning-Supported Medical Devices was issued, refining regulatory requirements²⁸. In December 2024, the first draft of Recommendations for Market Submissions of Planned Change Control Plans for AI-Driven Device Software Functionality was published, revised in August 2025 to provide more targeted solutions for pre-market submissions of PCCPs for relevant products. The PCCP scheme enables manufacturers to modify products within the scope of their premarket application without requiring repeated submissions to the FDA for each major update, thereby achieving more efficient and streamlined regulation of AI-enabled medical devices without compromising the safety and effectiveness of medical device software products. As of 30 September 2025, the FDA had approved only 12 PCCP applications for radiological AI medical devices from 11 manufacturers. Nine of these products are for medical imaging management and processing, while three are for ultrasound imaging. The limited number of PCCP-approved products may stem from the FDA’s requirement that companies submit detailed plans outlining the scope and implementation pathways for anticipated software functional changes, alongside comprehensive assessments of their impact on the entire device. This necessitates establishing a full-cycle software change management framework, possessing advanced technical planning and validation capabilities, and providing robust evidence demonstrating the controllability and compliance with future changes at the time of application. However, many companies find it difficult to meet these requirements and choose not to submit a PCCP application when their product is launched. Instead, they submit new marketing applications to the FDA only when software version updates are required^29,30.

As the field where artificial intelligence technology is most maturely applied within medical devices and boasts the largest number of marketed products, radiology AI medical devices should proactively embrace the PCCP. This approach not only reduces manufacturers’ R&D costs, shortens product approval cycles, and accelerates product iteration to deliver enhanced functionality, but also ensures products remain safe and effective through continuous software updates. It further encourages manufacturers to establish and refine comprehensive lifecycle quality management systems, thereby driving the industry toward sustained, high-quality development.

Methods

Data source

Data is based on the publicly available list of AI medical devices on the FDA website (accessed 30 September 2025), filtering all radiology artificial intelligence medical devices approved by the FDA between September 1995 and September 2025. Using the product number as the search criterion and setting the timeframe from the product approval date to 30 September 2025, queries of the FDA Recalls of Medical Devices and MAUDE (Manufacturer and User Facility Device Experience) Database yielded recall reports and adverse event reports for radiology AI medical devices.

Software update identification

By clicking the “Submission Number” for radiology devices within the AI medical device list, one may navigate to the product’s market approval details page. Selecting and clicking “Summary” then provides the FDA decision summary for that product. Taking 510(k) pathway approvals as an example, by reviewing and synthesising sections such as “Trade name” “Predicate Device” “Device description” “Intended Use” “Summary of Technological Characteristics” “Key Feature Comparison” and “Performance Data”, one can clearly ascertain the relationship between the current version and the predicate device version. For instance, explicit statements indicating this version constitutes an update or functional enhancement over the previous version may be interpreted as a software version update.

Adverse event classification

Review sections such as “Medical Device Problem Code” “Additional Manufacturer Narrative” and “Event or Problem Description” within the adverse event reports. Characterise device failures in radiology AI medical device reports were classified according to IMDRF terminology, categorising them as software defects, component damage, battery issues, misuse, or insufficient information. Concurrently, verification of these classifications was conducted by considering the specific characteristics and risks associated with medical device software, as published by IMDRF. The manufacturer’s supplementary remarks within the report were examined determine whether the company intended to implement corrective measures in response to the reported product adverse events.

Recall analysis

Based on the causes determined by the FDA and those reported by manufacturers in medical device recall reports, recall reasons can be categorised into types such as software defects, manufacturing defects, device design defects, and non-compliance with standards. Furthermore, the action plans disclosed by manufacturers in the reports reveal whether the company intends to implement corresponding follow-up corrective measures after executing the product recall.

Exclusion criteria and potential bias explanation

Regarding the exclusion of irrelevant recall or adverse event reports: ① Product model mismatch. The product version model referenced in the recall report does not belong to an FDA-approved version of radiology AI medical devices, meaning the involved version does not utilise artificial intelligence; even if its software contains defects, these are not attributable to AI technology. Alternatively, the recalled version is the current product’s latest iteration, precluding the calculation of time intervals due to the absence of a newer version. ② Timeline inconsistency. The next consecutive version of the product has been released, yet the recall date or adverse event date occurs after the new version’s release date with no subsequent version available. In such cases, the product’s technical iteration is largely complete, and any issues should be addressed through new versions; hence exclusion applies. ③ No version update. If no version update exists for the product number referenced in the recall report or adverse event report, the update interval cannot be calculated. Potential bias explanation: Due to incomplete data in AI medical device adverse event reports—such as missing event timestamps preventing update frequency calculation or lack of critical information like manufacturer investigation narratives—misclassification or omissions may occur. Detailed exclusion criteria and dual-review procedures were therefore implemented to minimise the impact of data limitations on study conclusions.

Study design

This research examines the intrinsic relationship between software updates, adverse event occurrence, and product recalls in radiology artificial intelligence medical devices. Software version updates were identified through the Decision Summary on the FDA’s Product Approval Details page. Software defect-related adverse event reports and recall reports were obtained by searching the Recalls of Medical Devices and MAUDE databases using product numbers. The relationship between software updates, adverse events, and recalls was established based on software version update frequency, revealing the current status and issues in the full lifecycle risk management of radiology AI medical devices.

Regarding the calculation of software update frequency

① Calculation of software update frequency. Subtract the approval date of the second version from that of the first to obtain the update frequency for that software version. For products with multiple consecutive version updates, calculate the average interval time. ② Update frequency for recalled products. Calculate the interval between the company’s recall initiation date and the release date of the next new version for the recalled product’s highest version. ③ Update frequency for products associated with adverse events. Calculate the interval between the adverse event occurrence date and the release date of the next new version for that product.

Author contributions

All authors contributed extensively to the work presented in this paper. J.L. wrote the main paper. Z.C.G. and Y.G. conducted data analysis, prepared tables and figures, and drafted relevant portions. R.X., Y.X.D., and W.J.S. collected relevant data and performed basic processing. W.L. reviewed and edited manuscripts, provided guidance on the writing process. All authors critically reviewed the manuscript for intellectual content and approved the final version of the manuscript.

Data availability

All raw data used for the manuscript is available on the FDA website, as follows: the list of approved radiology AI medical devices is sourced from the FDA’s Centre for Digital Health Excellence website(accessed September https://www.fda.gov/medical-devices/software-medical-device-samd/ Artificial-intelligence-enabled-medical-devices 2025); adverse event reports were sourced from the FDA’s MAUDE database (accessed September https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/ cfMAUDE/search.CFM 2025); and recall reports were sourced from the FDA’s Medical Device Recall Database (accessed September https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfRES/res.cfm 2025). All extracted data elements are available from the corresponding author upon reasonable request and approval.

Code availability

Not applicable.

Competing interests

The authors declare no competing interests.

Comping interests

The authors declare no competing interests.