1300 North 17th Street ▪ Suite 900

Arlington, Virginia 22209

Tel: 703.841.3200

Fax: 703.841.3392

www.medicalimaging.org

September 22, 2022

Ms. Reva Schwartz, et al

National Institute of Standards and Technology

ATTN: Information Technology Laboratory

100 Bureau Drive

Gaithersburg, MD 20899

Re: NIST AI Risk Management Framework, Version 2

Dear Ms. Schwartz:

As the leading trade association representing the manufacturers of medical imaging equipment, 

radiopharmaceuticals, contrast media, and focused ultrasound therapeutic devices, the Medical 

Imaging & Technology Alliance (MITA) applauds the National Institute of Standards and 

Technology (NIST) in its continued work to enable development and adoption of artificial 

intelligence and machine learning technologies. We thank NIST for considering many of our 

prior AI Risk Management Framework comments and urge that same careful consideration for 

the comments below.

We understand that this framework intends to describe “a process for managing AI risks across a 

wide spectrum of types, applications, and maturity – regardless of sector”. However, the 

document today does not do enough to accommodate the discrepancies between sectors which 

would enable successful use. For instance, the healthcare sector uses a very specific definition 

for the term “harm” as provided in the HHS document “Guidance for Industry: Q9 Quality Risk 

Management1”. Harm is defined as “damage to health, including the damage that can occur 

from loss of product quality or availability” (emphasis added). This definition and usage is 

substantially different than the definitions and usage of “harm” throughout the framework. 

Unless a new word or term is used, and the discrepancy rectified, the framework will be difficult 

for MITA members to use. 

The framework also makes no mention of industries, such as medical device manufacturing,

which already have established risk management procedures to ensure quality (i.e., ISO 

14971:2019 Medical devices — Application of risk management to medical devices). At a 

minimum, the framework should make explicit reference to regulated industries like medical 

device manufacturing and state unequivocally that this framework should be considered a 

supplement to those existing mechanisms. It should also explain that, since the framework is 

meant to be broad, it may not be a necessary tool for organizations who have mature risk 

management processes in place. 

1 https://www.fda.gov/media/71543/download
2

Thank you for your attention to these comments. We look forward to continued engagement with 

NIST in pursuit of AI excellence. If you have any questions, please contact Zack Hornberger, 

Director of Cybersecurity & Informatics, at ____________ or by phone at ____________.

Sincerely, 

Patrick Hope

Executive Director, MITA

MITA is the collective voice of manufacturers of medical imaging equipment, 

radiopharmaceuticals, contrast media, and focused ultrasound therapeutic devices. It represents 

companies whose sales comprise more than 90 percent of the global market for medical imaging 

innovations. These products include: magnetic resonance imaging (MRI), medical X-Ray 

equipment, computed tomography (CT) scanners, ultrasound, nuclear imaging, 

radiopharmaceuticals, and imaging information systems. MITA Member company technologies 

are an important part of our nation’s healthcare infrastructure and are essential for the 

screening, diagnosis, staging, managing and effectively treating patients with cancer, heart 

disease, neurological degeneration, and numerous other medical conditions.