Automated Audit Trail & DHF Traceability Export for Clinical Models

[GBarbascumpa]

Summary / Context

As AI-driven surgical platforms and real-time computer vision models move closer to clinical deployment, medical device manufacturers face significant regulatory hurdles around continuous model updating (FDA Predetermined Change Control Plans / PCCPs), software validation (IEC 62304 / ISO 13485), and post-market risk management.

Through research with the Harvard Business School Foundry, I am exploring how developers, quality engineers, and regulatory heads can bridge the gap between open-source AI frameworks (like MONAI Core, MONAI Label, and MONAI Deploy) and stringent medical device governance.

We want to gather community feedback on how MONAI can better support regulatory auditability out of the box for real-time surgical and clinical applications.

---

Problem Statement

Currently, developers fine-tuning or deploying models (e.g., surgical tool tracking, anatomical segmentation, or real-time video inference) must manually construct compliance artifacts to satisfy regulatory authorities.

Key gaps in standard open-source workflows include:

1. PCCP & Drift Monitoring Artifacts: Lack of standardized, automated tracking for model retraining boundaries, data drift, and accuracy drops in real-time inference.
2. Design Control / DHF Traceability: Difficulty mapping MONAI Bundle transformations, network architectures, and hyperparameter configurations directly into Design History Files (DHFs) or Risk Management Files (ISO 14971).
3. Cybersecurity & Software Integrity: Ensuring model weights, pipeline dependencies, and inference outputs conform to FDA Premarket Cybersecurity guidelines and supply chain integrity (SBOMs).

---

Proposed Discussion / Feature Concepts

We would love input from developers, industry leads, and researchers building on MONAI:

1. Automated Validation & Audit Trail Exports:
   • Could MONAI Bundle or MONAI Deploy generate standardized JSON/PDF "Validation Summary Reports" detailing dataset provenance, metric evaluations, and transform pipelines for inclusion in 510(k) or PMA submissions?
2. PCCP Trigger Boundary Hooks:
   • What telemetry or performance logging hooks are you currently using to verify that a retrained model remains within its pre-approved FDA Predetermined Change Control Plan boundaries?
3. Regulatory Governance Workflows:
   • How are your teams currently handling human-in-the-loop overrides or hazard analysis validation when deploying MONAI-backed models into live OR / clinical environments?

---

Questions for the Community & Contributors

• Are you currently deploying MONAI models into clinical trials or commercial medical devices under FDA/CE-MDR oversight?
• What is your biggest friction point when translating MONAI training/inference scripts into formal Design Controls?
• Would a lightweight MONAI extension or governance plugin (focused on automated audit trail exports and drift logging) be useful to your workflow?

---

Institutional Background & Disclosure:
This discussion is opened as part of an academic and customer discovery initiative with the Harvard Business School Foundry, focusing on AI safety, cybersecurity, and regulatory governance in surgical robotics and digital health.