AAMI CR515:2025—Cybersecurity in ML Medical Devices

While medical devices are designed to heal, monitor, or save lives, they could instead become a tool for harm if compromised. The healthcare sector is now a prime target for cybercriminals, with threats like ransomware, data breaches, and system failures growing ever more sophisticated. Every breach is more than just a technical failure; it is a breakdown of trust—putting not only patient care at risk, but the very integrity of the healthcare system itself. As these medical devices become smarter and more integrated, robust cybersecurity becomes the lifeline that separates safety from catastrophe. AAMI CR515:2025—Cybersecurity considerations unique to machine learning – enabled medical devices provides guidance on managing cybersecurity risks that are specific to medical devices incorporating machine learning.

The Rise of AI and Machine Learning in Medical Devices

With the advent of artificial intelligence (AI) and machine learning (ML), medical devices have entered an entirely new realm of sophistication and capability. By analyzing data for faster, more accurate clinical insights, AI and ML hold the promise of revolutionizing healthcare.

AI and ML devices can help doctors diagnose diseases with unprecedented accuracy, predict patient outcomes, and even suggest personalized treatment plans. The global AI in healthcare market is experiencing explosive growth, projected to rise from roughly $36 billion in 2025 to over $500 billion by 2033, highlighting the massive shift toward AI-driven technologies.

Addressing Cybersecurity Risks in AI-Driven Medical Devices

The rapid technological advancement of AI-driven medical devices, however, brings with it a host of new cybersecurity challenges. Devices that once operated autonomously are now connected to vast network and are collecting, processing, and transmitting patient data in real-time. As such, there is now an increase for potential exposure to cyber threats—particularly when these devices are designed to “learn” from vast amounts of data and adapt their behavior over time. AAMI CR515:2025 addresses these unique cybersecurity threats that arise during the development and deployment of machine learning-enabled medical device software.

What Is AAMI CR515:2025?

AAMI CR515:2025 is a consensus report that addresses the unique cybersecurity threats associated with developing and deploying machine learning–enabled medical device software (MLMD). This includes potential cybersecurity threats that can arise from or during data collection, product design, product deployment, product use, and maintenance.

While MLMD software, like any software-based technology, is susceptible to traditional cybersecurity threats and vulnerabilities, AAMI CR515:2025 focuses only on those threats that are unique to ML–based technologies or that may differently challenge such technologies.

AAMI CR515:2025 is intended to supplement the information on security risk management of medical devices provided in AAMI SW96.

You can learn more about AAMI SW96 in our blog post: ANSI/AAMI SW96:2023—Medical Device Security.

Why Cybersecurity Matters for Medical Devices

From infusion pumps and ventilators to diagnostic machines and implantable devices, medical devices are now part of a broader network of interconnected technologies. Whether it is through Wi-Fi, Bluetooth, or even 5G, devices now communicate with each other and with centralized data systems. While this creates remarkable efficiencies, it also opens the door to cyber threats. These cybersecurity threats could allow hackers to interfere with device operations, alter dosages, or manipulate settings, creating catastrophic consequences for patient safety.

Given these risks, the importance of cybersecurity for medical devices cannot be overstated. AAMI CR515:2025 provides considerations to mitigate these risks, assuring medical devices are secure throughout their lifecycle.

Where to Buy AAMI CR515:2025

By adhering to AAMI CR515:2025, manufacturers and software developers can help mitigate the risks of cyberattacks and assure that technology continues to serve its intended purpose: saving lives and improving patient care.

AAMI CR515:2025—Cybersecurity considerations unique to machine learning – enabled medical devices is available on the ANSI Webstore.