IVD software, and any AI that interprets data or produces a result, is chosen, installed and managed under a governed process. Commercial IVD software has ARTG inclusion; software developed in-house, AI for diagnostic purposes included, is treated as an in-house IVD meeting NPAAC, TGA and good-practice requirements; selection, rollout and use sit inside the clinical governance and risk framework with privacy, cybersecurity and data integrity risks managed; a privacy impact assessment confirms compliance with Australian privacy law and protects patient data, including when third parties process it; acceptance testing and commissioning prove performance for the intended use, users and clinical setting; AI performance is evaluated before clinical use and watched over time against defined expectations; and where an AI system was trained on non-Australian data its performance is checked on data that reflects the local patient population, with limitations written down and risks reduced.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.