--- title: "AI/ML Medical Device Cyber Walkthrough - PCCP, SPDF, MDR &…" description: "Interactive walkthrough for AI/ML medical devices: identify cyber risks and pick the right FDA SPDF/PCCP, EU MDR (MDCG 2019-16 Rev.2), and EU CRA sections for…" lang: en json-ld: | [ { "@context": "https://schema.org", "@graph": [ { "@type": "WebSite", "@id": "https://medtechcybertips.com/#website", "url": "https://medtechcybertips.com/", "name": "MedTech Cyber Tips", "description": "The ultimate organized guide to medical device cybersecurity.", "inLanguage": "en-US", "publisher": { "@id": "https://medtechcybertips.com/#org" }, "potentialAction": { "@type": "SearchAction", "target": "https://medtechcybertips.com/topics?q={search_term_string}", "query-input": "required name=search_term_string" } }, { "@type": "Organization", "@id": "https://medtechcybertips.com/#org", "name": "MedTech Cyber Tips", "url": "https://medtechcybertips.com/", "logo": "https://medtechcybertips.com/icon-512.png", "sponsor": { "@type": "Organization", "name": "Blue Goat Cyber", "url": "https://bluegoatcyber.com", "sameAs": [ "https://home.bluegoatcyber.com/", "https://codebluechart.com/", "https://why.bluegoatcyber.com/", "https://spdf.bluegoatcyber.com/", "https://threatmodel.bluegoatcyber.com/", "https://pentesting.bluegoatcyber.com/", "https://premarket.bluegoatcyber.com/", "https://fdaresponse.bluegoatcyber.com/", "https://postmarket.bluegoatcyber.com/", "https://goatwatch.bluegoatcyber.com/" ] } } ] }, { "@context": "https://schema.org", "@type": "HowTo", "name": "AI/ML medical device cybersecurity walkthrough", "description": "Guided walkthrough that helps MedTech teams identify AI/ML cyber risks and select the right PCCP/SPDF, EU MDR, and EU CRA artifacts for their submission and postmarket program.", "datePublished": "2026-07-10", "dateModified": "2026-07-10", "url": "https://medtechcybertips.com/aiml-walkthrough", "step": [ { "@type": "HowToStep", "name": "Identify device modality" }, { "@type": "HowToStep", "name": "Classify learning behavior (locked, PCCP, continuous)" }, { "@type": "HowToStep", "name": "Map data flow (on-device, cloud, federated)" }, { "@type": "HowToStep", "name": "Select target jurisdictions (FDA, EU MDR, EU CRA)" }, { "@type": "HowToStep", "name": "Prioritize AI/ML cyber risks" }, { "@type": "HowToStep", "name": "Generate tailored SPDF / PCCP / MDR / CRA artifact list" } ] } ] --- [Skip to main content](#main) [ MedTech Cyber Tips The Ultimate Guide ](/) [Home](/)[Find Your Path](/journey)[All Topics](/topics)Reference[About](/about) Search ⌘K Guided walkthrough · 2026 edition # AI/ML medical device cyber walkthrough Answer five short questions and get a tailored list of AI/ML cyber risks and the exact PCCP / SPDF sections (FDA Feb 3, 2026 guidance), MDR / MDCG mappings, and EU CRA obligations to include in your technical file. Last updated Jul 10, 2026· 1mo ago ~2 minutes · no login Step 1 of 5 ## What's the device modality? Modality drives the highest-signal adversarial threats and the evaluation evidence you'll need. Medical imaging (CT/MR/US/X-ray) CNN/vision transformer on DICOM Signals / physiological (ECG, EEG, PPG) Time-series classifier or anomaly detector Clinical NLP / LLM assistant Text summarization, coding, or clinical decision support Genomics / omics Variant calling, risk scoring Wearable / at-home monitor On-device inference, intermittent connectivity Robotics / surgical / closed-loop Real-time control with safety envelope Step 2 of 5 ## How does the model change after clearance? This determines whether you need a PCCP and how tight the change-control envelope has to be. Locked model (no post-market changes) Frozen weights; standard 510(k)/PMA path PCCP-managed adaptive Pre-specified modifications & protocol under Section 524B / Feb 3 2026 guidance Continuously / online learning in field Highest scrutiny - requires very tight change controls Step 3 of 5 ## Where does inference happen? Data-flow topology decides which cloud, transport, and cryptographic controls you must document. On-device inference only Model artifact ships with device Cloud inference / SaMD API Data leaves device to model service Federated / split learning Weights or gradients travel; data stays local Step 4 of 5 ## Which jurisdictions do you ship into? Pick every regime you'll be reviewed under - obligations stack and CRA has separate reporting. United States (FDA) Section 524B FD&C + Feb 3 2026 guidance European Union (MDR) MDR Annex I §17.2 + MDCG 2019-16 Rev.2 EU CRA-in-scope accessories / companion apps Regulation (EU) 2024/2847 - reporting from Sept 11 2026 Select all that apply. Step 5 of 5 ## Which risks are you already worried about? Optional - we always compute a baseline. Selecting risks here raises their priority in the output. Adversarial inputs Crafted perturbations (imperceptible noise, prompt jailbreaks, out-of-distribution triggers) cause misclassification or unsafe action. Training-data / supply-chain poisoning Malicious contribution to training, fine-tuning, or upstream dataset (labels, backdoors, dependency confusion via ML libraries). Model / weight extraction Query-based or physical readback of proprietary weights, feature representations, or training data. Silent performance drift Population shift, sensor firmware change, or PCCP modification degrades sensitivity/specificity without triggering an alarm. PHI / PII leakage Membership inference, log leakage, or over-collection through inference pipeline exposes protected health information. Prompt injection / tool abuse (LLM only) Untrusted clinical text overrides system prompt, extracts tools, or exfiltrates PHI to attacker-controlled endpoints. Select all that apply. Complete steps 1–4 to see recommendations. Reset MedTech Cyber Tips The organized, end-to-end guide to medical device cybersecurity, from concept through postmarket. Part of the Blue Goat Cyber family. Topics - [Overview](/topics/home) - [Why It Matters](/topics/why) - [SPDF](/topics/spdf) - [Threat Modeling](/topics/threatmodel) - [Pentesting](/topics/pentesting) Reference - [Glossary](/glossary) - [FDA vs MDR](/compare) - [Resources](/resources) - [Updates](/updates) - [RSS feed](/rss.xml) © 2026 medtechcybertips.com. An educational resource sponsored by Blue Goat Cyber. Not legal or regulatory advice.