Skip to Content
← Back to services

Regulatory-by-Design Roadmap for Medical AI Development

TEF-Health Service
Consulting
Unique Identifier: 9a6ab510-c34a-4f31-9545-9a15b5471f7a

Service Description

Overview

This service helps developers of AI-based medical software anticipate regulatory and validation constraints from the earliest stages of development, with consideration of applicable frameworks such as the MDR, IEC 62304, ISO 14971, IEC 62366-1 and the EU AI Act. Rather than providing regulatory consultancy or performing a conformity assessment, Multitel identifies relevant requirements based on the risk classification of the AI-based medical software and translates those into practical considerations for the technical development of the AI system. Particular attention is given to data collection, model development, performance evaluation, traceability and the evidence that will be needed to substantiate the intended purpose. The service provides a regulatory-by-design roadmap identifying what should be considered, documented and planned throughout development to prepare the technology for subsequent validation and, ultimately, regulatory assessment.

How can the service help you?

The service is intended for SMEs, research teams and technology developers developing AI for medical applications, particularly AI-based Software as a Medical Device (SaMD), who need to understand how future regulatory and validation requirements affect technical decisions made during development.

Before the service, the customer may have an idea, an early AI concept, a prototype or an existing model, but may not yet know which requirements apply and evidence will need to be generated throughout development to support its intended purpose and performance claims. Decisions made at an early stage (particularly regarding data collection, dataset composition, model development and validation strategy) can strongly affect the ability to demonstrate the performance of the system later.

Multitel helps translate relevant regulatory, validation and technical requirements into concrete development considerations. This includes identifying what should be anticipated regarding data, performance evaluation, traceability, risk-related technical evidence, documentation and verification and validation activities.

After the service, the customer has a clearer understanding of the technical and documentation activities that should be integrated into the development process and receives a step-by-step regulatory-by-design roadmap. The roadmap identifies key next steps and the evidence that should progressively be generated to support future performance claims, technical documentation and subsequent regulatory assessment.

How will the service be delivered?

The service starts with a meeting to understand the intended medical application, current development stage, intended purpose, available or planned data, AI functionality and existing technical documentation. The service can therefore be provided from the early concept and data-planning stages through to more mature AI developments.

Multitel then performs a technical gap analysis to identify where the current development approach does not meet relevant regulatory and validation requirements. Depending on the maturity of the project, this may include reviewing the planned or existing data collection strategy, AI development process, performance evaluation strategy, traceability, risk-related technical activities and available documentation.

The findings are translated into a practical, prioritized roadmap report describing the next technical and documentation steps that should be considered during development. The roadmap is discussed with the customer and adapted to the maturity and objectives of the project.

The service is delivered online and/or on site, with no specific requirement regarding the customer’s location. The consulting work typically takes 3–6 weeks, depending on project complexity, available information and the need for additional medical or regulatory expertise. Where questions require formal regulatory interpretation, classification decisions or specialized clinical expertise, additional input from the appropriate experts may be required.

Use cases/examples

Past project example (real): From research to a class IIa software as medical device roadmap A research team developing an AI-based Software as a Medical Device (SaMD) wanted to understand what would be required from the AI and software development perspective to progress towards MDR Class IIa conformity assessment. Multitel reviewed the AI solution and its development approach in light of relevant requirements from the MDR, EU AI Act and applicable standards such as IEC 62304 and ISO 14971. The assessment focused on the technical aspects of the AI-based solution, including its intended purpose, software development and documentation, data management, model validation, performance evaluation, risk-related technical considerations and traceability. Rather than preparing the regulatory submission or addressing the complete medical-device quality management and regulatory process, Multitel identified the main gaps related to the AI and software development lifecycle and provided a practical step-by-step roadmap. Recommendations covered aspects such as software architecture, requirements and test traceability, data collection and governance, AI model development, accuracy and robustness evaluation, validation strategy and the technical evidence needed to support the intended performance claims. The result was a clear picture of what already existed, what was missing and what should be done next from an AI and software perspective to prepare the solution for future validation and Class IIa conformity assessment.

Outcome: a focused technical and regulatory-by-design roadmap helping the team structure the further development and validation of its AI-based SaMD while identifying the AI-related evidence that would need to be generated for the future technical documentation.

Keywords: Device classification intended purpose SaMD EU MDR EU AI Act IEC 62304 ISO 14971 IEC 62366 software documentation risk management usability clinical evaluation
Offerings: Technological Solutions & Documentation Conformity & Compliance (certification, audit, corrective and preventive action, documentation, gap & risk analysis, etc.)
Provider Logo

Provider & Contact

Provider Organisation Multitel (MULTITEL)
Provider Country Belgium
Organisation Website https://www.multitel.be/
Ask about this service

Pricing is available to registered users. SMEs receive significant state-aid reductions (GBER) — or, depending on the call, free services during the funded project. Sign in or register to see the price for your organisation.

Operational Details

Service Inputs Requests introduced by the SMEs
Service Outputs A structured gap assessment; A step-by-step documentation roadmap targeting Class IIa; Recommendations on technical aspects including accuracy, robustness, validation, and end-to-end traceability.
Dependencies & Restrictions MDR AI Act
Certification Support
  • AI Act
  • MDR 2017/745
Service Standards
  • IEC 62304
  • IEC 62366-1
  • ISO 14971

Related services

  • Access to Compound Collection

    Karolinska Institutet (KI)

    The Unit: Chemical Biology Consortium Sweden (https://www.scilifelab.se/units/cbcs/) The infrastructure is part of Science for Life Laboratory (SciLifeLab) which is an academic collaboration between Swedish universities (including Karolinska Institutet) and a national research infrastructure with a focus on life science. Chemical Biology Consortium Sweden (CBCS) is a national research infrastructure offering an extensive portfolio of services - from computational and organic chemistry to phenotypic small molecule screens in cells and model organisms, cell painting and functional precision medicine. The mission of CBCS is to provide a state-of-the-art platform and expertise for the generation of high-quality bioactive chemical tools (small organic molecules) for applications within life science research in general and with the ultimate goal to explore complex biology. Our units comprise compound handling labs (hosting the SciLifeLab Compound Collection of ca 350,000 molecules), screening labs (microtiter format liquid handling robotics and a wide range of plate readers), and chemistry labs (equipment and instrumentation for organic chemistry synthesis and analysis). The service: Access to compound collection https://www.cbcs.se/the-compound-collection The Scilifelab Compound Collection is managed by the Compound Center at CBCS KI, and is based on donations of high-quality sets from the pharmaceutical industry (Biovitrum, Karobio, Orexo/Biolipox, KDev) and has been developed and expanded with compounds from various commercial compound vendors. The compounds can be readily available in assay-ready plates through acoustic nano-litre scale liquid dispensing or in 96-tube racks; compounds are stored at 10mM concentration in DMSO solution at - 20 °C under humidity control. We provide: o Management, storage, and processing of solids and liquids. o Compound delivery and interface with key customers. o Performance of instruments and automation that support these operations. o Analytical techniques used for quality assurance. o Sample informatics, including registration and compound quality data.

    View service →
  • AI Evaluation

    Vlaamse Instelling Voor Technologisch Onderzoek N.V. (VITO)

    Evaluation of medical AI using real-world Data and Synthetic Data to create a strong technical AI evaluation report. Method: evaluation of medical AI products, taking into account the differences between subpopulations, sources of bias, metric selection, uncertainty intervals, among others. Keywords: AI performance evaluation, test report

    View service →
  • AI Evaluation Training

    Vlaamse Instelling Voor Technologisch Onderzoek N.V. (VITO)

    Specialized training on how to thoroughly evaluate the performance of Medical AI models and create test reports for notified bodies. Medthod: Organisation of in-person and online training for Medical AI companies to enable them to create strong technical AI evaluation reports. Keywords: AI performance evaluation, test report, course

    View service →
  • AI Monitoring

    Vlaamse Instelling Voor Technologisch Onderzoek N.V. (VITO)

    Semi-automated performance monitoring of the Medical AI deployed in the clinical practice, following PMS regulation. Making the distinction between deployments where good model performance can be guaranteed and where not. Consultancy services on automated model performance monitoring in the clinical practice, in compliance with Medical Device Regulation (MDR). Keywords: AI performance evaluation, performance monitoring, PMS, PMCF

    View service →
  • AI Privacy Risk Testing and Compliance Support

    RISE Research Institutes Of Sweden

    Your AI models might be leaking personal data or trade secrets. GDPR and the AI Act expect you to check this — not hope for the best. We deliver reproducible and defensible testing, so your decisions — and your audits — rest on evidence instead of assumptions. Organisations that build or deploy AI models must meet strict privacy and cybersecurity obligations under GDPR, the EU AI Act, and sector‑specific rules. Models can unintentionally memorise and leak personal data through attacks such as membership inference, data reconstruction, and data extraction — creating real compliance and reputational risks. GDPR requires organisations to prevent downstream exposure of personal data and to honour the Right to be Forgotten, which in practice demands testing whether individual training data still leaves detectable traces inside a model. Beyond privacy, AI models may also reveal proprietary or confidential business information, turning leakage into an IP and cybersecurity risk, not just a data‑protection issue. The EU AI Act reinforces this by requiring testing under foreseeable misuse, including privacy‑relevant attacks. LeakPro provides structured, empirical stress‑testing of AI models to measure privacy and IP leakage, validate privacy‑enhancing technologies, and generate audit‑ready evidence for DPIAs, GDPR, and AI Act compliance. This service maps to the following articles within AI-act: • Article 9 Risk management system — Continuous lifecycle risk management to keep your AI compliant and under control. • Article 10 Data and Data Governance — Validate that your training data meets state-of-the-art privacy and security standards. • Article 15 Accuracy, robustness and cybersecurity — Proactively detect and mitigate confidentiality attacks before they become real risks. The audit reports constitute evidence that feeds into the technical documentation (Article 11 — Technical documentation, Annex IV). How can the service help you? • Detect leakage of personal data, sensitive attributes, or proprietary information. • Check data traceability to support GDPR Right‑to‑be‑Forgotten obligations. • Validate and tune synthetic data, federated learning, and differential privacy. • Provide quantitative leakage‑risk indicators for audits, DPIAs, and procurement. • Advise on privacy‑resilient AI design already at investment and planning. How the service will be delivered Logistics • Delivered via RISE secure environments or customer infrastructure. • Supports models across text, tabular, image, time‑series and graph modalities. • Option for iterative collaboration during model development or one‑off audits. Delivery period Engagements are planned in phases depending on the scope, starting with a general assessment (qualitative), followed by attack simulation (quantitative) and reporting. Duration • Short engagement: 3–6 weeks • Complex model audits or PET optimization: 2–4 months Customer requirement • Provide intended use-case, regulatory context, and risk appetite • Documentation of model development and system environment. • Optional: Access to model artefacts and training data for technical study. Deliveries • Tailored attack suite configuration • Execution of privacy and IP leakage attacks • PET tuning recommendations • Compliance‑aligned summary (reporting evidence for GDPR, AI Act, etc) Output • Technical leakage‑risk metrics • Training data traceability assessment (Right‑to‑be‑Forgotten) • Harm‑oriented explanation for DPIAs • Recommendations for mitigation and governance

    View service →
  • AI readiness level and Machine learning feasibility investigation

    RISE Research Institutes Of Sweden

    Method description: Investigate Data to be usable in an AI context. The service is customized according to the SME's needs. Method reference: To be refined depending on the type of task, and in dialog with the customer. The Center for Applied AI at RISE carries out cutting-edge research in AI, connects expertise and applications within RISE, and explores a wide range of innovative applications with industry and the public sector. Applied AI Centre at RISE helps companies and government agencies to see more potential in the technology, use it more wisely and develop it faster. Keywords: Trustworthy AI, Federated learning, Data Science, AI, Deep Learning, Natural language processing, Computer Vision, Machine learning.

    View service →