February 2026 Newsletter – Practical Approaches for Risk Management and V&V
The Big Picture for Risk Management
Risk management has been on my mind recently with the switch by FDA this month to QMSR and its emphasis on risk-based decision making. Over the years I’ve seen many companies put a lot of energy into the details of risk assessment (“Should this risk probability be rated P3 or P4?”) but comparatively little energy into integrating risk management throughout their quality system. So I created a simple diagram to illustrate how risk assessments and the Risk Management File need to be regularly updated with feedback from many activities across the company–from product testing to manufacturing to customer complaints to post-market surveillance.
Why Do We Need Formal Risk Assessment?
Sometimes the problems in risk management are very basic: I’ve often been asked the question, “Why do we even need to do a formal risk assessment?” Given that performing a risk assessment and compiling the formal documentation are so time consuming, it’s not surprising that some employees think this way (especially if they’ve never worked on a medical device before). The simple answer is that we have to do it for regulatory compliance. But I’ve put together some better reasons in this post, from a practical perspective on risk management.
𝐖𝐡𝐞𝐧 𝐬𝐡𝐨𝐮𝐥𝐝 𝐕&𝐕 𝐫𝐞𝐚𝐥𝐥𝐲 𝐬𝐭𝐚𝐫𝐭 𝐢𝐧 𝐦𝐞𝐝𝐢𝐜𝐚𝐥 𝐝𝐞𝐯𝐢𝐜𝐞 𝐝𝐞𝐯𝐞𝐥𝐨𝐩𝐦𝐞𝐧𝐭?
V&V is traditionally viewed as the final phase of medical device development, but successful teams begin preparing for it from the start. While formal, documented Verification & Validation occurs at the end to demonstrate compliance, effective development integrates testing throughout. This includes developing test methods, building tools, and evaluating prototypes early and often. Waiting until design completion to think about testing leads to delays and rework. Strong teams treat V&V preparation as a continuous process, not a last-minute scramble.
Full episode
Thoughts on AI
New AI tools promise to ease the burden of V&V testing and the associated documentation. These are typically AI features added to existing requirements management, test management, or eQMS software tools. They allow the product team, for example, to automatically generate a set of test cases from a set of software requirements or to do predictive traceability from higher level requirements to lower level requirements. I expect we’ll see rapid introduction this year of new AI tools specifically for medical device development and I’m excited about any developments that will cut down on the burden of compliance documentation.
Meanwhile, it’s good to keep in mind the limitations of AI technology and how it’s implemented. This top ten list from Testlio, a software testing company, is a good reminder that regardless of how sophisticated the technology, good products still depend on good software testing. Enjoy!
The AI Testing Fails That Made Headlines in 2025
“If 2025 proved anything, it is that AI fails not because it is mysterious, but because it is untested. Most of this year’s headline-grabbing blunders were entirely preventable with a little more rigor and a lot more humility.”
Upcoming Events
International MedTech Safety Conference (IMSC26) – Boston – June 2-5, 2026
The conference focuses on how safety decisions are actually made: at the intersection of risk management, regulation, engineering, clinical use, and organizational culture. This is an excellent opportunity to learn about best practices for medical device risk management from experts around the world. For people who are unable to travel to Boston, the conference is available online as well.
I’ll be presenting “A Dynamic Approach for Risk Management of Software-Intensive Medical Devices” – practical ways to make rigorous risk management work together with fast-moving, software-intensive development projects
https://www.medsafety.net/programoverview