Data is the backbone of Artificial Intelligence (AI) applications, including Medical Device Software (MDS) AI models which rely on sensitive health data. Assuring security of this sensitive health data is a key requirement for MDS AI models and there should be a structured way to manage the risk caused by data security compromises. Implementing a security risk management standard/framework is an effective way to develop a solid baseline for managing security risks, measuring the effectiveness of security controls and meeting compliance requirements. In this paper, nine risk management standards/frameworks in data/information security, AI, Medical Devices (MDs) and AI-enabled MDs domains are evaluated to identify their gaps and implementation challenges when applying them to assure data security of MDS AI models. The results show that currently there is no specific standard/framework that specifically addresses data security risk management of MDS AI models, and that existing standards/frameworks have several gaps such as complexity of the implementation process; lack of detailed threat and vulnerability catalogues; lack of a proper method for risk calculation/estimation; and lack of risk controls and control implementation details. These gaps necessitate the need for the development of a new data security risk management framework for MDS AI models.

Digital transformation fundamentally changes established practices in public and private sector. Hence, it represents an opportunity to improve the value creation processes (e.g., “industry 4.0”) and to rethink how to address customers' needs such as “data-driven business models” and “Mobility-as-a-Service”. Dependable, collaborative and autonomous systems are playing a central role in this transformation process. Furthermore, the emergence of data-driven approaches combined with autonomous systems will lead to new business models and market dynamics. Innovative approaches to reorganise the value creation ecosystem, to enable distributed engineering of dependable systems and to answer urgent questions such as liability will be required. Consequently, digital transformation requires a comprehensive multi-stakeholder approach which properly balances technology, ecosystem and business innovation. Targets of this paper are (a) to introduce digital transformation and the role of / opportunities provided by autonomous systems, (b) to introduce Digital Depednability Identities (DDI) - a technology for dependability engineering of collaborative, autonomous CPS, and (c) to propose an appropriate agile approach for innovation management based on business model innovation and co-entrepreneurship.

Abstract The future will encompass heavily interconnected, distributed, heterogeneous and intelligent systems which are bound to have a significant economic and social impact. Cyber physical systems (CPS) such as autonomous cars, smart electric grid, implanted medical devices and smart manufacturing are some practical examples of these intelligent systems. However, due to the open and cooperative nature of CPS, assuring their dependability is a challenge. The DEIS project addresses this important and unsolved challenge by developing the concept of a digital dependability identity (DDI). A DDI contains all the information that uniquely describes the dependability characteristics of a CPS or CPS component. DDIs are synthesised at development time and are the basis for the (semi)automated integration of components into systems during development, as well as for the fully automated dynamic integration of systems into systems of systems in the field.

Abstract Today, the growth of medical devices and mobile medical applications is increasing enormously, thanks to the efficiency and enhancement of new technology. When it comes to mobile medical apps, developers need to understand what is required when a mobile application fulfils the definition of a medical device. Such applications have to be developed in compliance with medical device regulations. This can be a challenge for mobile medical application developers, as medical device software is normally developed in a manner that will also ensure the production of regulatory documentation that is essential to market such devices. In this paper, we identify the need for a mobile medical application development framework, the key criteria for such a framework, and describe how the results were collected through performing a Medical Device Software Development workshop. Furthermore, we describe how MDevSPICE together with an agile software development approach can be tailored to support a mobile medical applications development framework. We detail one of the key criteria for mobile medical application development framework—traceability.

Software systems are becoming increasingly complex. Within safety critical domains such as medical device software, this increasing complexity is placing growing demands on manufacturers who must ensure their software not only meets functional requirements but is also safe and reliable. However, the Food and Drugs Administration who regulate medical device software in the United States report a significant increase in recalls between years 2003 and 2012 and have cited software difficulties as one of the frequent causes of recalls. Furthermore a recent analysis of traceability documentation submitted to the Administration has revealed that the traceability data was incomplete, incorrect, and conflicting in many cases. This is problematic as traceability plays an important role in the development of safe and reliable software. In this paper we present the validation, through industry trial, of a traceability assessment and implementation framework which we have developed to assist medical device organizations implement traceability in an efficient and regulatory compliant manner. Our findings show that implementation of the framework within two organizations improved their traceability process and that both organizations found the framework to be both useful and usable.

Abstract Most existing software systems that lack explicit traceability links between artefacts, or if implemented, are often not leveraged to take advantage of the information it can provide to a development or validation team. Within the medical device domain, as in other safety critical domains, regulation normally requires such systems that are certified before entering service. This involves submission of a safety case (a reasoned argument that the system is acceptably safe) to the regulator. A safety case should include evidence that the organisation has established effective software development processes. At the heart of such processes, they must incorporate traceability. However, numerous barriers such as a lack of awareness of traceability and a lack of guidance as to how to implement traceability hamper its effective implementation. In this paper, we address the lack of guidance on traceability implementation by presenting our experience of developing and trialling a traceability assessment model in two medical device organisations. We show that the assessment model was successful in identifying strengths and weaknesses in both organisations' implementation of traceability. Through experience of trialling the model, we propose an idea to improve it by automation, using the Open Services for Lifecycle Collaboration initiative. Copyright © 2015 John Wiley & Sons, Ltd.