标签：#regulatory

Half a day lost is the honest cost of treating an AI model like a document. I discovered that the hard way: a CAPA opened for a data-provenance gap rolled forward into missing documentation, which then exposed weaknesses in change control and supplier traceability. This is what happened, what we changed, and the small automation that stopped the loop from repeating. The trigger: a CAPA that looked simple and wasn't An engineer flagged a discrepancy between on-device inference behaviour and the validation test bench. The CAPA looked routine: reproduce, find root cause, correct datasets or model weights. Quickly it turned into: We couldn't identify which training dataset produced the deployed model (no manifest, only folder names). Preprocessing steps changed between runs (different label encodings, a silent resampling step). Model binaries were overwritten in a shared location without an immutable model registry entry. Change control only referenced a release ticket number — not the dataset or container image digest. What began as a data-provenance finding became a documentation finding, then a change-control finding. Auditors would call this a traceability gap. The EU AI Act (and notified bodies increasingly expect traceability for high‑risk AI components) means you must show how a model version ties to the data, the training pipeline, the verification evidence, and the approval record. We didn't have that linkage. By midday my filter coffee was cold and I had a long list of evidence to assemble. Why CMOs see this differently As a CMO handling components and supplier networks, our "models" are often supplier-provided (analytics, inspection classifiers, OCR of COAs), or built from datasets stitched from multiple vendors. The usual eQMS workflows assume a device maker controls the full pipeline. They rarely fit a supplier-heavy reality where: Sub-tier suppliers supply datasets or models. Incoming inspection depends on vendor-provided models for automated checks. Suppl

I work in a 200-person Class II medical device company with two QA/RA folks, three embedded-hardware teams, a small supplier-quality group, and engineers who want automation — not more paperwork. We needed an eQMS that unifies design control (DHF), CAPA, supplier records, and traceability into something engineers will actually use. I evaluated several vendors and want to share a short, practical comparison for teams with that shape. A quick regulatory framing before the list Standards that mattered to us: ISO 13485 and 21 CFR 820, plus MDR-adjacent traceability requirements for components when applicable. A note on risk and regulation posture: don’t treat Article 50 (AI oversight posture for medtech tools) like an apocalypse — it sits in the general enforcement stack. Plan for reviewability and traceability for any AI-assisted workflows, but don’t let fear of hypothetical fines block good tooling decisions today. What I judged vendors on Fit for medtech design control / DHF workflows Traceability across requirements, risk, design, and CAPA Integrations — especially with CRM/supplier systems and engineering tools Operational fit for a 200-person org (configurability, onboarding burden) Capacity for process automation (automated CAPAs, connected workflow) The list — what each vendor practically means for a team like mine 1) Greenlight Guru Why I put it first: Greenlight Guru explicitly lists medical-device as its industry. For a Class II shop that needs DHF, design-control-native workflows, and templates tuned to medtech terminology, that industry focus matters. Fit: Strong for device-focused workflows and teams that want a medtech-first product experience rather than a generic QMS. When to pick: You want a purpose-built medtech experience, quicker ramp for QA/engineering, and vendor docs/templates that speak design control and DHF. 2) Qualio Public positioning: Qualio serves general industries including medical-device and pharma. Fit: Good option if you want flexibil