IEC published PAS 63621 this year, and the title says data management, not security. Read it anyway. Six of the seven cybersecurity threats the FDA named for AI-enabled devices in its January 2025 draft attack the data and the pipeline that produce the model, so a standard about how you handle that data is a cybersecurity standard whether it calls itself one or not.
The scope is the whole data lifecycle for an AI-enabled medical device: how data is sourced, labeled, stored, governed, and protected, with traceability from a finding back to the dataset it came from. It asks manufacturers to establish provenance, maintain integrity and confidentiality, control access, and protect data against tampering and loss across the term, not once at design time.
The first is Data of Unknown Provenance, which the document abbreviates DOUP. It is data whose source, date of creation, or validity cannot be confirmed. If you cannot say where a training record came from, you cannot rule out that someone put it there on purpose, which is the definition of a poisoning risk. Naming DOUP gives a reviewer a clean question to ask, and gives you a clean answer to prepare.
The second is integrity insurance, the set of measures that keep data accurate, consistent, and unaltered end to end. That covers data quality, access control, and the documentation that proves the record was not modified between collection and training. It is the same evidence a cybersecurity reviewer wants when they ask how you know the model was trained on what you say it was.
The practical shift is that your data pipeline is now in scope for evidence, not just your deployed model. You have to be able to show where the training and evaluation data came from, that it was not altered, and who could touch it. Most quality systems already produce pieces of this, but they were never assembled into a story a reviewer could follow from a model output back to a governed dataset.
PAS 63621 is a publicly available specification, which is a fast-track document, not a full international standard yet. That is a feature right now. It gives you a concrete structure to point at while the binding standards catch up, and it maps cleanly onto the FDA threat list. If I were building an AI-enabled device this year, I would use it as the spine for the data half of the cybersecurity file and let the rest of the standards slot onto it.
Start with one device. We build the twin from documentation your quality system already produces, run AI discovery remotely, and show you the graph: the handful to fix, and the evidence for everything else.