Written by Dhruv Sahai, Chief Operating Officer, CARPL.ai
If you build, buy, deploy, or regulate AI in radiology, 2025 was the year the conversation stopped being philosophical and became operational. Regulators did not “discover” AI. Regulators started asking for proof that you can control it across the full product life, not just at launch.
The pattern across mature markets is consistent: AI is welcome, but only if your evidence, quality system, change control, and post deployment monitoring are real and auditable.
The big shift: from approval as an event to oversight as a lifecycle
Radiology AI is not static. Data shifts across sites. Clinical workflows vary. Models improve. Performance can drift. Regulators are increasingly acknowledging this reality, but they want predictability: clear intended use, disciplined updates, validation that matches the claim, and monitoring that catches issues early.
That theme shows up sharply in the most meaningful 2025 developments.
What changed in 2025: the highlights that actually matter
United States: The Food and Drug Administration (FDA) put change control and lifecycle evidence front and center.
In January 2025, FDA published draft guidance on AI enabled device software functions, focused on lifecycle management and the contents of marketing submissions1. The signal is clear: documentation quality, risk management, and ongoing monitoring are not accessories. They are core to the regulatory case.
In August 2025, FDA also issued guidance on predetermined change control plans for AI enabled devices2. The logic is straightforward: if you pre-specify what can change, how it will change, and how you will validate those changes, iterative improvement becomes more feasible without compromising safety and effectiveness.
Global alignment: International Medical Device Regulators Forum (IMDRF) finalized Good Machine Learning Practice principles
IMDRF published final Good Machine Learning Practice guiding principles in January 20253. This matters because it pushes the ecosystem toward shared expectations across the device lifecycle, including data management, design controls, evaluation, and ongoing monitoring.
Europe: the AI Act timeline became real for medical devices
The European Commission timeline makes the phased applicability very explicit: prohibited AI practices and AI literacy obligations applied from February 2, 2025; obligations for general purpose AI models applied from August 2, 2025; the AI Act becomes fully applicable on August 2, 2026; high risk AI systems embedded into regulated products have an extended transition to August 2, 20274.
Separately, The Medical Device Coordination Group (MDCG) guidance has started clarifying how Medical Device Regulation (MDR) and In Vitro Diagnostic Medical Devices Regulation (IVDR) obligations intersect with the AI Act, which is where manufacturers will feel the real work: technical documentation, traceability, conformity assessment, and post market surveillance all have to line up cleanly across both regimes.
What is new as we enter 2026: signals you should not ignore
FDA quality system requirements tighten in a way that will affect AI teams directly. FDA’s Quality Management System Regulation5 takes effect on February 2, 2026, aligning Part 820 more closely with ISO 13485:2016. This is not “manufacturing only.” This is a quality system expectation that pushes software and AI teams into stronger design controls, supplier controls, change management, and complaint handling discipline.
UK: The Medicines and Healthcare products Regulatory Agency (MHRA) is explicitly collecting evidence to shape a 2026 framework direction
MHRA has an active call for evidence on regulation of AI in healthcare that closes February 2, 2026. The related Commission material states that recommendations will be published by MHRA in 2026. That is a clear signal that 2026 will bring more structured expectations around AI governance in the UK context.
EU: implementation pressure is rising, even if industry keeps pushing back
Reuters reported the Commission reaffirmed the AI Act timeline, rejecting calls to pause implementation. That matters because teams planning for August 2026 cannot treat this as a theoretical date.
My opinion: compliance is becoming a product feature, especially in radiology. Most teams still treat regulatory work as paperwork that happens after the “real product” is built. That approach gets expensive in 2026. Radiology AI procurement is no longer just a clinician conversation. Security, IT, compliance, and hospital leadership want audit ready answers. If governance is weak, deployment stalls, even when the model looks great in a pilot.
CARPL sits at the point where multiple AI developers meetl hospitals and real workflows. That position forces a simple discipline: make innovation deployable. In practice, that means we spend disproportionate energy on the boring parts that regulators and hospitals increasingly care about.
1. Standardized intended use and evidence packs
A marketplace only works at scale if every product has a consistent, reviewable story: intended use, clinical validation context, labeling and instructions for use, risk controls, and a clear change management narrative that hospitals can trust.
2. Quality and security as default plumbing
We treat governance as infrastructure, not a slide. CARPL’s ISO 27001:2022 certification gives us an operating baseline for information security, which matters when you are coordinating multiple vendors and multiple sites across sensitive environments.
3. Deployment architecture built for privacy and auditability
Hospitals want clean boundaries, least privilege access, logs, and predictable data handling. Our operating model has pushed us toward privacy first deployments, strong audit trails, and practical controls that make cross site rollout less painful.
4. Metadata and workflow standardization
Radiology AI lives or dies on site variability. Standardizing metadata and making integrations repeatable is not glamorous, but it is exactly the kind of operational maturity regulators and hospital buyers reward in 2026.
None of this is loud marketing. It is simply what you end up building when you want AI tools to survive real procurement, real audits, and real post deployment scrutiny.
Closing thought: 2026 rewards the boring teams
The teams that win in radiology AI in 2026 will not only be the teams with great models. They will be the teams who can answer hard questions with calm evidence, disciplined change control, and a quality system that actually runs.
2025 clarified the direction. 2026 will reward execution.
References
1. Center for Devices and Radiological Health. , May 2025. “Predetermined Change Control Plan for Artificial Intelligence-Enabled.” FDA. https://www.fda.gov/regulatory-information/search-fda-guidance-documents/marketing-submission-recommendations-predetermined-change-control-plan-artificial-intelligence.
2. Center for Devices and Radiological Health. 2025. “Artificial Intelligence-Enabled Device Software Functions: Lifecycle Management and Marketing Submission Recommendations.” FDA. https://www.fda.gov/regulatory-information/search-fda-guidance-documents/artificial-intelligence-enabled-device-software-functions-lifecycle-management-and-marketing.
3. International Medical Device Regulators Forum. 2025. “IMDRF AIML WG GMLP N88 Final.” International Medical Device Regulators Forum. https://www.imdrf.org/sites/default/files/2025-02/IMDRF_AIML%20WG_GMLP_N88%20Final.pdf.
4. European Union. 2026. “AI Act | Shaping Europe's digital future.” Shaping Europe's digital future. https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai.
5. US FDA. 2025. “Quality Management System Regulation: Final Rule Amending the Quality System Regulation – Frequently Asked Questions.” FDA. https://www.fda.gov/medical-devices/quality-system-qs-regulationmedical-device-current-good-manufacturing-practices-cgmp/quality-management-system-regulation-final-rule-amending-quality-system-regulation-frequently-asked?utm_source=chatgpt.com.
