Traceability

When a patient comes to harm after an AI-supported decision, someone will ask what the tool showed, which version was running and who acted on it. The traceability principle asks you to document and monitor the tool from development to daily use, so that those questions can be answered Lekadir et al. (2025).

Traceability recommendations¶

T1: Run a risk management process throughout the lifecycle¶

Research +, deployable ++. Start a risk management file in design and keep it current: estimate each risk’s likelihood and severity, decide on mitigations and check that they work. Risks named in the paper include misuse after too little training, use outside the target population and incorrect input data. For medical devices, ISO 14971 ISO (2019) sets out the process.

→ See: Risk management planning

T2: Provide documentation¶

Research ++, deployable ++. Write for each audience: an information leaflet for patients and clinicians, technical documentation for developers and regulators, a publication following a reporting guideline such as TRIPOD+AI Collins et al. (2024), and the risk management file. Model cards Mitchell et al. (2019) and datasheets Gebru et al. (2021) are common templates.

→ See: Documentation, Reporting and transparency

T3: Check the quality of inputs and outputs¶

Research +, deployable ++. Check automatically for missing, out-of-range or wrongly formatted inputs and for implausible outputs, and show users how certain the tool is about each result.

→ See: Quality control

T4: Audit and update on a schedule¶

Research +, deployable ++. Decide which data you will re-evaluate on and how often. Audits look for drift (changes in the data or in what the outcome means), new biases and falling performance. Under EU law, an update may need a new conformity assessment unless you described it in advance in the technical documentation.

→ See: Monitoring and auditing

T5: Log usage¶

Research +, deployable ++. Record, with privacy safeguards, which data the tool used, what it predicted, what the clinician decided and any problems. The EU AI Act European Parliament and Council (2024) requires automatic logging for high-risk systems, with logs kept for at least six months.

→ See: Logging and traceability

T6: Set up governance¶

Research +, deployable ++. Assign roles for risk management, audits, maintenance and supervision, and agree how responsibility for errors is shared between clinicians, hospital and manufacturer, including support for patients harmed by an AI error.

→ See: Governance and accountability