AAMI CR510: The Cloud Consensus Report That Led to TIR115

Bernhard Kappe

Published on: September 28th, 2021

2026 Update: The work described in this article ultimately led to the publication of AAMI TIR115:2026, Guidance for the appropriate use of public cloud computing to enable medical device functions. TIR115 supersedes AAMI CR510:2021 and provides expanded guidance for designing, deploying, and maintaining medical devices that rely on public cloud computing.

Learn more about AAMI TIR115

Orthogonal was pleased to be part of an important industry effort addressing how medical device manufacturers can safely and effectively use public cloud computing.

In 2021, the Association for the Advancement of Medical Instrumentation (AAMI) published AAMI CR510:2021, Appropriate Use of Public Cloud Computing for Quality Systems and Medical Devices.

At the time, AAMI announced the release of CR510, and we shared the key takeaways from that work below.

Cloud computing was already changing how medical device developers approached data, infrastructure, scalability, and computing costs. But for medical devices and quality systems, the benefits of cloud computing also introduced a different set of risks and challenges.

CR510 was developed to give medical device manufacturers, cloud technology providers, regulatory professionals, and other stakeholders guidance for using public cloud computing in medical devices and quality systems.

Challenges With Change

One of the central challenges identified by the working group was that cloud service providers regularly make changes to their platforms.

Those changes can happen outside a medical device manufacturer’s direct control and may occur with limited advance notice.

Traditional medical device development assumes that changes to the device and its operating environment are evaluated and controlled by the manufacturer. Public cloud computing changes that model because manufacturers may depend on infrastructure operated and changed by a third party.

CR510 helped establish an approach for thinking about that problem.

The report identified six areas stakeholders should consider when using public cloud computing in a medical device or quality system:

Identify the intended function of cloud computing.
Determine whether cloud computing is appropriate using a risk-based approach.
Understand how frequently the cloud computing resource changes and establish criteria for revalidation.
Evaluate how the cloud service provider could negatively affect the device or process.
Establish contingency plans for cloud-related adverse events.
Develop processes for detecting cloud resource changes and their potential impact.

The working group, co-chaired by Randy Horton of Orthogonal and Pat Baird of Philips, brought together industry experts to examine how public cloud computing differs from technologies traditionally used in regulated medical devices.

A key insight was that public cloud computing challenges the traditional assumption that a medical device manufacturer directly controls every part of the device and its operating environment.

Using the cloud means trading some direct control for benefits such as scalability, reliability, security capabilities, and access to continuously evolving infrastructure.

The challenge is understanding that tradeoff, incorporating it into risk management, and making appropriate architectural and design decisions.

From CR510 to TIR115

CR510 was an important first step, but the work did not stop there.

Following CR510, the AAMI Cloud Computing Working Group continued developing more detailed guidance on the appropriate use of public cloud computing in medical devices.

That effort resulted in AAMI TIR115:2026, Guidance for the appropriate use of public cloud computing to enable medical device functions.

TIR115 supersedes CR510 and provides additional guidance for designing, deploying, and maintaining medical devices that rely on public cloud computing, as well as managing relationships with cloud service providers.

The TIR develops several concepts further, including:

Managing cloud dependencies that are outside the manufacturer’s direct control
Taking a risk-based approach to whether cloud resources are appropriate for a particular device function
Distinguishing the Medical Device System (MDS) from the Medical Device Digital Environment (MDDE)
Managing the public cloud environment as a purchased service
Planning for frequent, provider-driven changes to the cloud environment
Using architecture, testing, supplier management, and postmarket monitoring to manage those changes

Get AAMI TIR115

Looking Beyond the Cloud

The challenge identified through CR510 and developed further in TIR115 is broader than cloud computing alone.

Modern medical devices increasingly operate as distributed systems and may rely on consumer computing platforms, external software systems, APIs, third-party services, and other technologies that manufacturers do not directly control.

The same fundamental questions apply: What does the medical device depend on? How much control does the manufacturer have over that dependency? What risks does it introduce? And how should those risks be managed?

TIR115 provides a more developed framework for addressing those questions in the context of public cloud computing.

Preparing for TIR115?

If your medical device already relies on public cloud infrastructure, or you are considering using it, Orthogonal can help you understand how your current approach compares with TIR115.

Our Cloud Readiness Assessment examines areas including:

Your MDS and MDDE boundary
Cloud service provider and supplier management
Cloud-related risk management
Provider-initiated change control
Architecture and testing practices
Postmarket monitoring of cloud dependencies

You receive a prioritized roadmap identifying where your current practices align with TIR115 and what may need additional attention.

Book a Cloud Readiness Conversation