The technical information report outlines how manufacturers can manage cybersecurity, patient safety, and regulatory risks as medical devices increasingly rely on cloud-based technology.
The Association for the Advancement of Medical Instrumentation (AAMI) has published AAMI TIR115:2026, which provides guidance for the appropriate use of public cloud computing to enable medical device functions. The technical information report (TIR) is meant to help manufacturers, cloud service providers, regulatory professionals, and regulators keep cloud-enabled devices safe, effective, and compliant.
TIR115 supersedes AAMI CR510:2021, a consensus report recognized by the US Food and Drug Administration (FDA).
Cloud computing has become a key platform for digital health, according to an announcement from AAMI. It supports remote care, mobile medical apps, and data-intensive diagnostics and patient monitoring. But public cloud environments change frequently, at different rates, and often outside a manufacturer’s direct control. The document’s authors call this “a paradigm shift for safety and compliance.” A disconnect among users, devices, and the cloud they use can cause problems with interoperability, cybersecurity, and regulatory compliance.
Alternatives such as building a private cloud can be costly for manufacturers, particularly without clear regulatory guidance.
From Consensus Report to TIR
AAMI first addressed the issue in 2021 with CR510, which offered six practical recommendations. They ranged from identifying the intended function of cloud computing to detecting cloud resource updates and resulting adverse events. The AAMI Standards Board then approved development of a TIR to provide deeper conceptual and practical guidance.
“Writing a standard takes way too long for this type of emerging technology,” says Pat Baird, senior regulatory specialist at Philips, according to an AAMI announcement. Baird, who co-chaired both the CR510 task group and the TIR115 working group, also compared a consensus report to a temporary solution while more comprehensive guidance was developed.
The AAMI Cloud Computing Working Group developed TIR115. Its members include major device manufacturers, academic researchers, technology companies, and representatives of the FDA’s Center for Devices and Radiological Health. Federal participation does not constitute government endorsement.
Randy Horton, chief solutions officer at Orthogonal and working group co-chair, summarized the core challenge. “The key insight we arrived at was that public cloud computing has challenged the traditional notion of control in a validated state—that I as a medical device manufacturer control every aspect of this device or system,” he says in the announcement.
What TIR115 Recommends
The TIR explains how to design, deploy, and maintain medical devices in a cloud environment and how to build effective relationships with cloud service providers. Among its core principles, the public cloud environment should be managed as a purchased service rather than as a component of the device. Devices should also be architected, when feasible, to limit the effect of cloud changes on performance and safety.
The TIR stresses that risk depends on how a function’s outputs are used. A wearable defibrillator’s ability to detect life-threatening heart rhythms in real time should not depend on a cloud connection because a lost connection could seriously harm the patient. The same device’s analysis of historical cardiac data, however, could rely on cloud resources.
Horton made a similar point during the TIR’s development, according to the AAMI announcement. Manufacturers may hand over “some set of low-level functions” to a cloud services provider, he noted, but they should not hand over the core function.
The TIR also offers a framework for deciding which cloud components belong to the regulated device. Manufacturers classify every computing component as part of either the medical device system or the medical device digital environment. The medical device system includes the components identified in the regulatory submission as part of the device. The digital environment is the general-purpose computing the device depends on that is not regulated as part of it. A component cannot be “neither” or “both.”
“We’re working on this kind of model of, where do you draw the line between which part of that layer—not just who’s responsible for it, but which part of it is actually part of the regulated device?” Horton says.
Supplier Oversight and Postlaunch Testing
Because a cloud service provider generally cannot be audited the way a supplier of physical parts can, the TIR guides manufacturers through a supplier risk assessment. The assessment covers the provider’s track record, change management, and service level agreements. It connects that approach to supplier requirements in ISO 13485 and FDA regulations.
After launch, the TIR recommends a staging environment that mirrors production and periodic full regression testing. The testing is meant to catch cumulative cloud changes that may go unnoticed one at a time.
Baird says manufacturers have traditionally bought software that performs a given function and tested it before it went into a product. With the cloud, however, software can change even after it is implemented and tested. “And that is often out of a manufacturer’s control,” he says in the AAMI announcement.
Horton says the goal is not to keep devices out of the cloud. “The bottom line is that with the cloud, your medical device is living in a wonderful, but more chaotic world,” he says. “And that’s OK, so long as you understand and explicitly acknowledge this change, gather the necessary knowledge, incorporate that into your risk analysis, and then make thoughtful design decisions.”
AAMI TIR115:2026 is available now and is included in AAMI’s All Standards eSubscription package.
