Article
Beyond the Cloud: Indirect Control as the New Paradigm for Medical Device Software
At the MedTech Conference 2026 in Boston, leaders from MedTech, Pharma, and the FDA discussed how agentic AI is changing regulated development, from software engineering and clinical data analysis to validation and regulatory oversight.
The conversation around agentic AI is shifting. What began largely as tools that helped people write code, analyze information, or complete routine tasks is becoming systems that can carry out multiple workflow steps with less direct intervention.
For MedTech and Pharma, that shift has significant implications. AI agents could take on more of the work involved in developing, testing, and maintaining regulated products, but the consequences of an incorrect output are not always easy to contain. The challenge is determining which activities can be automated, how to evaluate their results, and where human judgment remains essential.
These questions were at the center of a panel at The MedTech Conference 2026, moderated by Bernhard Kappe, Founder and CEO of Orthogonal. The session, Converging Paths: How MedTech and Pharma Can Accelerate Agentic AI Innovation Through Mutual Learning, featured:
Drawing on experiences in medical device engineering, digital health, clinical research, and regulation, the discussion explored what it will take to incorporate agentic AI into increasingly complex workflows.
Software development offers an early look at how agentic AI could change work across regulated industries. Initial applications focused on helping developers generate code, identify defects, and complete discrete tasks. More advanced systems can now support broader activities across the software development lifecycle, including requirements definition, risk management, testing, and troubleshooting.
This matters because writing code accounts for only part of the effort involved in developing medical device software. Engineers spend considerable time defining what a system must do, documenting design decisions, verifying functionality, investigating defects, and maintaining evidence of compliance. Automating portions of those activities could have a greater impact than accelerating code generation alone.
The panel explored troubleshooting in surgical robotics as one practical example. A surgical robot combines mechanical, electrical, and software components, making it difficult to isolate the cause of certain failures. AI can help engineers review information from multiple disciplines, including schematics, system designs, and source code, to more quickly identify likely problem areas. It may not determine the exact solution, but narrowing the investigation can save substantial engineering time.
Similar applications are emerging in clinical research, where AI can help locate relevant datasets, identify missing information, and prepare data for analysis. These examples involve different technologies and objectives, yet they illustrate a common shift: AI is beginning to handle work that previously required people to coordinate multiple tools and processes.
The opportunity extends beyond automating isolated activities. It lies in understanding how those activities fit together and determining which parts of a larger workflow can be reliably delegated to AI.
Expanding automation exposes a familiar problem: the quality of the output depends heavily on the information available to the system.
MedTech and Pharma work with information from clinical trials, connected medical devices, electronic health records, and engineering systems. These datasets differ in structure, completeness, and intended use, making them difficult to combine and interpret consistently.
Digital health technologies illustrate the challenge. Traditional clinical trials often capture measurements during scheduled patient visits, providing a limited view of what happens between appointments. Wearables and other connected technologies can collect information more frequently, offering a richer understanding of disease progression, treatment response, and patients’ daily experiences.
Yet collecting more data does not automatically make it useful. Researchers must address missing measurements, inconsistent formats, and real-world variability before the data can support reliable analysis. The panel discussed approaches that use established quality checks before introducing AI, while also applying specialized agents to identify gaps and help researchers navigate large datasets.
The same issue arises in software engineering. AI-generated outputs can be difficult to evaluate when requirements are ambiguous, source information is incomplete, or acceptance criteria are poorly defined. Greater automation does not eliminate these weaknesses. It can make them harder to detect if teams assume that an agent’s output is correct simply because it appears complete.
Access to data presents a separate challenge. Combining information across systems and organizations could reveal relationships that would otherwise remain hidden, but privacy protections, consent requirements, contractual restrictions, and the intended use of the data determine what can legitimately be shared.
For organizations adopting agentic AI, the practical question is not how much information they can collect. It is whether they have the right information, can use it appropriately, and whether it is high-quality enough to support the decisions they intend.
Even with reliable data, organizations need a way to understand how AI agents perform their work and produce results. This gets more complicated as individual tasks combine into longer processes.
One approach discussed during the panel is to separate activities that can be performed through established, deterministic functions from those requiring more open-ended AI reasoning. A workflow might use validated software to perform calculations, an agent to retrieve relevant information, and a language model to interpret findings. Each component serves a different purpose and presents different validation challenges.
That distinction matters most when AI models change. A model may improve substantially within a few months, but an organization cannot assume every update will behave the same way in an established workflow. Separating relatively stable domain knowledge and validated functions from rapidly evolving models makes it easier to evaluate changes without rebuilding the entire system.
A related challenge is making AI-driven processes precise and transparent enough. In software development, this means breaking complex activities into smaller steps with clearly defined inputs, expected outputs, and acceptance criteria. Requirements, tests, and other engineering artifacts become more useful to agents when expressed in formats both people and machines can interpret consistently.
This connects to treating more engineering artifacts as code, including requirements, design controls, and risk management information. The objective is not merely to digitize documentation. The goal is to structure that information enough to support automation, consistency checks, and traceability throughout development.
Risk management remains particularly challenging. Although structured approaches and ontologies exist, the panel identified a lack of broadly adopted, sufficiently precise representations as a barrier to more comprehensive automation.
More advanced agentic workflows will depend on addressing such gaps.
Organizations need to define what an agent is expected to do, how to verify successful execution, and what evidence to retain when a result requires further investigation.
As agentic workflows become more capable, the traditional concept of keeping a human in the loop becomes less straightforward.
When AI assists with a single task, a person can review the output before taking action. That model becomes harder to maintain when a system performs multiple interconnected activities, particularly when some steps are routine, and others involve significant judgment.
The panel explored how oversight can match the risks of a particular activity. A risk-based approach to evaluating AI in drug development considers both the AI model’s influence on a decision and the potential consequences if that decision is incorrect.
This distinction matters because not every AI-generated result requires the same level of scrutiny. An established, validated function may warrant a different review process from an AI-generated interpretation that could affect a safety-related decision.
The discussion also examined how organizations might make this distinction more visible. If an AI-supported workflow can identify which outputs came from validated functions based on documented evidence and which involved less predictable reasoning, reviewers can focus their attention where it matters most.
That does not remove responsibility from the organization using AI. Manufacturers remain accountable for their products and the quality of the work supporting them, whether an employee, an external contractor, or an AI system performed the activity.
The challenge is to design oversight that remains meaningful as automation expands. Instead of reviewing every action the same way, teams need to understand which decisions carry the greatest consequences and establish controls appropriate to those risks.
Much of today’s discussion around agentic AI focuses on improving development productivity, but connected medical devices and digital health technologies create opportunities throughout the product lifecycle.
For example, surgical robotic systems generate operational data that can provide insights into equipment performance, maintenance needs, and how clinicians interact with the technology. Analyzing that information can help engineering and service teams identify potential problems, improve system reliability, and refine future designs.
In pharma, digital health technologies are expanding the types of information available during clinical research. Over time, some of these capabilities could extend beyond clinical trials to support real-world evidence generation and a better understanding of treatments after approval.
Electronic health records offer another potential source of longitudinal information, allowing researchers and clinicians to examine patient experiences beyond the relatively narrow observation periods of traditional studies.
Agentic AI could help process these larger datasets, identify unusual patterns, and support ongoing monitoring. However, using AI for these purposes requires careful consideration of data quality, privacy, and how researchers will validate the resulting insights. This matters as AI-enabled technologies evolve after deployment and organizations need to ensure they keep performing as intended.
The broader opportunity is to establish stronger connections between development, clinical evidence, and real-world performance. Information collected during product use may help identify improvements that can inform future engineering and research decisions, creating a more continuous learning process across the lifecycle.
Despite their technical similarities, MedTech and Pharma operate under different regulatory frameworks.
For an AI-enabled medical device, the AI may be part of the regulated product itself. In drug development, AI may instead support research, clinical trials, or other activities while the drug remains the regulated product. These differences affect how regulators evaluate evidence and which expectations apply.
The discussion highlighted the longstanding collaboration between FDA’s device and drug centers on digital health and AI policy. Although the requirements cannot always be applied identically, the two areas share enough common challenges to benefit from coordinated approaches.
The same applies to industry. MedTech brings experience in software-intensive products, system verification, design controls, and product lifecycle management. Pharma brings experience in clinical research, complex datasets, and digital health technologies used to generate evidence. Each has developed methods that could help the other address the practical challenges of AI adoption.
One particularly useful area for shared learning is the relationship between automation and evidence. Whether AI supports software development, clinical data analysis, or regulatory decision-making, organizations need to show that the resulting work fits its intended purpose.
Looking ahead, the panel considered how agentic AI might evolve beyond today’s applications. One possibility is that agents will move from identifying problems and recommending next steps to carrying out more complete workflows.
For example, a system that currently detects a missing data point might eventually investigate the issue, take appropriate corrective action, and prepare the result for review. In engineering, agents could take on more of the work between defining requirements, developing a solution, and producing the evidence needed to evaluate it.
These possibilities are not yet equivalent to fully autonomous regulated development. Many activities still require substantial human expertise, and the right level of automation will vary by use case.
What is changing is how much and how complex the work AI can potentially perform. As those capabilities advance, teams will need to reconsider how they organize their processes rather than simply add AI tools to existing ways of working.
The discussion during this panel and across the entire MedTech Conference made clear that MedTech and Pharma have much to learn from each other as they address this transition. Their regulatory differences will remain, but the underlying engineering questions around data, workflow design, validation, and accountability increasingly overlap.
For MedTech organizations, the next step is to identify where agentic AI can take on meaningful portions of development work and ensure that the surrounding processes can support it. That requires more than a capable AI model. It requires engineering practices that make the work precise, verifiable, and manageable as technology continues to change.
At Orthogonal, this approach informs our medical device software development, particularly by making requirements, testing, risk management, and design controls more structured and traceable. These foundations will become increasingly important as AI agents take on a larger role in the software development lifecycle.
Related Posts
Article
Beyond the Cloud: Indirect Control as the New Paradigm for Medical Device Software
Article
AAMI Publishes TIR115: New Guidance for Using Public Cloud Computing in Medical Devices
Article
Your Next AI Algorithm May Not Be the Hard Part
Article
How MedTech Teams Must Evolve for the Agentic AI Era