# Q3 2026 Quarterly Spot-Check — QMSR/ISO 13485 Partition (#2620) ## Progress - [x] 9 sampled atoms (9/9) ## Summary | File / scope | Audited | Drift found | Severity | |---|---|---|---| | apps/compliance/data/qmsr-atoms.json (9 sampled) | 9 | 4 | critical:0, high:1, medium:2, low:1 | | **Total** | **9** | **4** | high:1, medium:2, low:1 | ## Methodology notes (read first) - **iso-13485-2016** (Tier C, paywalled): retrieved via `scripts/standards/standards-corpus get iso-13485-2016` → `/home/todd/.local/share/kelsey/standards/standards/iso-13485-2016.pdf`. Read via the `Read` tool with `pages` parameter, absolute PDF page numbers 14-16, 19, 22, 24, 26-28, 31 (matches `source_grounding.page` fields in the atoms plus adjacent pages needed for full clause text). All quotes below transcribed directly from the rendered PDF page images in this session, 2026-08-12. - **21-cfr-820-qmsr-2026** (Tier A, live source): retrieved via `scripts/standards/standards-corpus fetch 21-cfr-820-qmsr-2026`, which resolved to `https://www.ecfr.gov/api/versioner/v1/full/2026-02-04/title-21.xml?part=820`, fetched 2026-08-12T13:30Z. Full XML saved to `/tmp/claude-1000/.../scratchpad/qmsr-full.json`. Confirmed present: §820.10 (general QMS requirement, incorporates ISO 13485 by reference in 820.10(a); 820.10(c) requires Clause 7.3 and subclauses for class II/III/certain class I devices), §820.35 (Control of records). Confirmed **820.20–820.30 are `[Reserved]`** in current QMSR — corroborates the atoms' own claim that legacy §820.30 design-controls is Reserved. - **21-cfr-820-qsr** (sunset regime): §820.22, 820.25, 820.70, 820.75, 820.180 do **not** exist as sections in the current live QMSR XML (expected — they are historical/legacy pointers, not current law). Per task instructions, this is not reported as an error; I did not independently fetch the rendered public page HTML for each `url` to confirm the legacy citations are visually labeled "legacy"/"sunset" rather than presented as current law — no browser/fetch tool was invoked against the live app in this session. This is noted as an unverified sub-check, not a finding, since the underlying atom JSON (`change_delta.legacy.label` = "§X — Part 820 (legacy)") already carries the legacy label the renderer is expected to use. - All 9 atoms audited; 0 unverified rows (both sources were reachable for all 9). - Standards editions consulted: iso-13485-2016 (stored PDF), 21-cfr-820-qmsr-2026 (live eCFR fetch, version 2026-02-04). - Out-of-scope observations not flagged: atom split/merge candidates, `evidence_signals` wording, `common_gaps` prose quality — noted but not audited per scope fence. ## Findings ### REQ-ISO13485-4.1.4 — Control of Changes to QMS Processes **Verdict: clean.** - Clause refs checked: `iso-13485-2016: 4.1.4` (exists, current), `21-cfr-820-qsr: 820.70(b)` (sunset, historical pointer only), `21-cfr-820-qmsr-2026: 820.10 (incorporates ISO 13485 § 4.1.4)` (confirmed — 820.10(a) is the general blanket-incorporation mechanism for all of ISO 13485). - Source: iso-13485-2016 PDF, pp. 14-15 (absolute PDF pages), read 2026-08-12. - PDF text (verbatim, pp. 14-15): "4.1.4 The organization shall manage these quality management system processes in accordance with the requirements of this International Standard and applicable regulatory requirements. Changes to be made to these processes shall be: a) evaluated for their impact on the quality management system; b) evaluated for their impact on the medical devices produced under this quality management system; c) controlled in accordance with the requirements of this International Standard and applicable regulatory requirements." - Committed `requirement_text`: "The organization shall manage these quality management system processes in accordance with the requirements of this International Standard and applicable regulatory requirements. Changes to be made to these processes shall be: (a) evaluated for their impact on the quality management system; (b) evaluated for their impact on the medical devices produced under this quality management system; (c) controlled in accordance with the requirements of this International Standard and applicable regulatory requirements." - Exact verbatim match. No drift. --- ### REQ-ISO13485-4.2.5 — Control of Records **Verdict: clean.** - Clause refs checked: `iso-13485-2016: 4.2.5` (exists, current), `21-cfr-820-qsr: 820.180` (sunset, historical pointer), `21-cfr-820-qmsr-2026: 820.35; 820.10 (incorporates ISO 13485 § 4.2.5)` — confirmed §820.35 "Control of records" exists in current QMSR and explicitly states it supplements "Clause 4.2.5 in ISO 13485 (incorporated by reference)." - Source: iso-13485-2016 PDF, p. 16 (absolute PDF page), read 2026-08-12; 21-cfr-820-qmsr-2026 via `standards-corpus fetch`, 2026-08-12T13:30Z. - PDF text (verbatim, p. 16, §4.2.5 first sentence): "Records shall be maintained to provide evidence of conformity to requirements and of the effective operation of the quality management system." - eCFR text (verbatim, §820.35): "In addition to the requirements of Clause 4.2.5 in ISO 13485 (incorporated by reference, see § 820.7), Control of Records, the manufacturer must include the following information in certain records:" - Committed `requirement_text`: "Records shall be maintained to provide evidence of conformity to requirements and of the effective operation of the quality management system." - Exact verbatim match to the ISO clause's top-line obligation. No drift. --- ### REQ-ISO13485-6.2 — Human Resources / Training **Verdict: finding.** - **Drift type:** non-standard-terminology (omitted qualifier) - **Severity:** low - **Standard clause / source:** ISO 13485:2016 §6.2 (Human resources) - **Source quote (verbatim from PDF, p. 19):** > Personnel performing work affecting product quality shall be competent on the basis of appropriate education, training, skills and experience. - **Committed text (verbatim, atom `requirement_text`):** > Personnel performing work affecting product quality shall be competent on the basis of education, training, skills, and experience. - **Location:** `apps/compliance/data/qmsr-atoms.json`, atom `REQ-ISO13485-6.2`, field `requirement_text`. - **PDF page:** p. 19 (absolute PDF page). - **Recommended revision:** > Personnel performing work affecting product quality shall be competent on the basis of appropriate education, training, skills, and experience. - **Notes:** The word "appropriate" is a normative qualifier in the standard — competence must be established on education/training/skills/experience that is appropriate to the specific role, not merely present. Dropping it slightly loosens the stated obligation. Low severity because the atom's own `atomic_constraints` field (out of audit scope but visible) correctly captures the role-specific-competence requirement elsewhere, so downstream scanner logic is not affected — only the top-line `requirement_text` string drifts. --- ### REQ-ISO13485-7.3.3 — Design and Development Inputs **Verdict: clean.** - Clause refs checked: `iso-13485-2016: 7.3.3` (exists, current), `iso-14971-2019: 5.4` (out of scope — not iso-13485/QMSR family, not re-verified here), `21-cfr-820-qsr: 820.30(c)` (sunset, historical pointer), `21-cfr-820-qmsr-2026: 820.10 (incorporates ISO 13485 § 7.3.3)` (confirmed via 820.10(a)/(c) general incorporation mechanism). - Source: iso-13485-2016 PDF, p. 22 (absolute PDF page), read 2026-08-12. - PDF text (verbatim, p. 22): "Inputs relating to product requirements shall be determined and records maintained (see 4.2.5). These inputs shall include: a) functional, performance, usability and safety requirements, according to the intended use; b) applicable regulatory requirements and standards; c) applicable output(s) of risk management; d) as appropriate, information derived from previous similar designs; e) other requirements essential for design and development of the product and processes. These inputs shall be reviewed for adequacy and approved." - Committed `requirement_text`: "Inputs relating to product requirements shall be determined and records maintained. These inputs shall include functional, performance, usability and safety requirements, according to the intended use." - This is a condensed excerpt (first sentence + item (a) only, of a-e), not a full reproduction, but it does not misstate obligation level, invert scope, or add invented specificity — it is a faithful partial quote of the clause's opening obligation and first input category. No drift flagged; the fuller item list (b-e) is separately captured in `atomic_constraints` (out of scope). --- ### REQ-ISO13485-7.3.8 — Design Transfer **Verdict: finding.** - **Drift type:** omitted-conditional / conflation (drops one of two required assurances) - **Severity:** medium - **Standard clause / source:** ISO 13485:2016 §7.3.8 (Design and development transfer) - **Source quote (verbatim from PDF, p. 24):** > The organization shall document procedures for transfer of design and development outputs to manufacturing. These procedures shall ensure that design and development outputs are verified as suitable for manufacturing before becoming final production specifications and that production capability can meet product requirements. > Results and conclusions of the transfer shall be recorded (see 4.2.5). - **Committed text (verbatim, atom `requirement_text`):** > Design transfer activities shall ensure design outputs are verified as suitable for manufacturing before becoming final production specifications. - **Location:** `apps/compliance/data/qmsr-atoms.json`, atom `REQ-ISO13485-7.3.8`, field `requirement_text`. - **PDF page:** p. 24 (absolute PDF page). - **Recommended revision:** > Design transfer activities shall ensure design outputs are verified as suitable for manufacturing before becoming final production specifications, and that production capability can meet product requirements. - **Notes:** The clause states TWO required assurances that transfer procedures must ensure: (1) outputs verified suitable for manufacturing, and (2) production capability can meet product requirements. The committed `requirement_text` states only (1), omitting the production-capability assurance entirely from the top-line obligation statement. The atom's own `atomic_constraints` field does separately capture a related idea ("Design transfer must demonstrate that production methods are capable of consistently producing devices that meet design output specifications") so the concept is not entirely absent from the atom, but the primary `requirement_text` string — the one most likely surfaced to a reader as "the requirement" — presents only half the clause's obligation. --- ### REQ-ISO13485-7.5.2 — Cleanliness of Product **Verdict: clean.** - Clause refs checked: `iso-13485-2016: 7.5.2` (exists, current), `21-cfr-820-qsr: 820.70(e)` (sunset, historical pointer), `21-cfr-820-qmsr-2026: 820.10 (incorporates ISO 13485 §7.5.2)` (confirmed general incorporation). - Source: iso-13485-2016 PDF, p. 26 (absolute PDF page), read 2026-08-12. - PDF text (verbatim, p. 26): "The organization shall document requirements for cleanliness of product or contamination control of product if: a) product is cleaned by the organization prior to sterilization or its use; b) product is supplied non-sterile and is to be subjected to a cleaning process prior to sterilization or its use; c) product cannot be cleaned prior to sterilization or its use, and its cleanliness is of significance in use; d) product is supplied to be used non-sterile, and its cleanliness is of significance in use; e) process agents are to be removed from product during manufacture. If product is cleaned in accordance with a) or b) above, the requirements contained in 6.4.1 do not apply prior to the cleaning process." - Committed `requirement_text`: exact match, full verbatim reproduction of the above (all five conditions plus the 6.4.1 carve-out). - No drift. Full verbatim match confirmed. --- ### REQ-ISO13485-7.5.7 — Particular Requirements for Validation of Processes for Sterilization and Sterile Barrier Systems **Verdict: clean.** - Clause refs checked: `iso-13485-2016: 7.5.7` (exists, current), `21-cfr-820-qsr: 820.75` (sunset, historical pointer), `21-cfr-820-qmsr-2026: 820.10 (incorporates ISO 13485 §7.5.7)` (confirmed general incorporation). - Source: iso-13485-2016 PDF, pp. 27-28 (absolute PDF pages, clause spans the page break), read 2026-08-12. - PDF text (verbatim, pp. 27-28): "The organization shall document procedures (see 4.2.4) for the validation of processes for sterilization and sterile barrier systems. Processes for sterilization and sterile barrier systems shall be validated prior to implementation and following product or process changes, as appropriate. Records of the results and, conclusion of validation and necessary actions from the validation shall be maintained (see 4.2.4 and 4.2.5). NOTE Further information can be found in ISO 11607-1 and ISO 11607-2." - Committed `requirement_text`: exact verbatim match to the full clause text above, including the NOTE. - No drift. Full verbatim match confirmed across the page break. --- ### REQ-ISO13485-8.2.4 — Internal Audit **Verdict: finding.** - **Drift type:** scope-narrowing - **Severity:** high - **Standard clause / source:** ISO 13485:2016 §8.2.4 (Internal audit) - **Source quote (verbatim from PDF, p. 31):** > The organization shall conduct internal audits at planned intervals to determine whether the quality management system: a) conforms to planned and documented arrangements, requirements of this International Standard, quality management system requirements established by the organization, and applicable regulatory requirements; b) is effectively implemented and maintained. - **Committed text (verbatim, atom `requirement_text`):** > Internal audits shall be conducted at planned intervals to determine whether the QMS conforms to planned arrangements and is effectively maintained. - **Location:** `apps/compliance/data/qmsr-atoms.json`, atom `REQ-ISO13485-8.2.4`, field `requirement_text`. - **PDF page:** p. 31 (absolute PDF page). - **Recommended revision:** > Internal audits shall be conducted at planned intervals to determine whether the QMS conforms to planned and documented arrangements, the requirements of ISO 13485, the organization's own QMS requirements, and applicable regulatory requirements, and is effectively implemented and maintained. - **Notes:** Clause 8.2.4(a) names FOUR distinct conformance targets internal audits must check against: (i) planned and documented arrangements, (ii) the requirements of ISO 13485 itself, (iii) the organization's own established QMS requirements, and (iv) applicable regulatory requirements. The committed text collapses this to a single target — "planned arrangements" — dropping conformance-to-the-standard and conformance-to-regulatory-requirements entirely from the top-line obligation. It also drops "implemented" from 8.2.4(b), leaving only "effectively maintained." This is scope-narrowing on a clause that is directly customer-facing (a company reading only this string could reasonably believe internal audits need only check against internal plans, not against the ISO 13485 standard or applicable regulations) — flagged high per the severity taxonomy ("scope broadening or narrowing... on a clause that drives scanner findings on customer docs"). --- ### REQ-QMSR-820.30j — Design History File (DHF) **Verdict: finding.** - **Drift type:** omitted-conditional (missing required content category) - **Severity:** medium - **Standard clause / source:** ISO 13485:2016 §7.3.10 (Design and development files), reached via QMSR §820.10(c) — confirmed 820.10(c) requires "Design and Development, Clause 7.3 and its Subclauses in ISO 13485" for class II/III and listed class I devices; confirmed §820.30 (legacy DHF section) is `[Reserved]` in current QMSR text. - **Source quote (verbatim from PDF, p. 24, §7.3.10):** > The organization shall maintain a design and development file for each medical device type or medical device family. This file shall include or reference records generated to demonstrate conformity to the requirements for design and development and records for design and development changes. - **Committed text (verbatim, atom `requirement_text`):** > A Design History File (DHF) must be established and maintained for each type of device. The DHF must contain or reference the records necessary to demonstrate that the design was developed in accordance with the approved design plan and applicable regulatory requirements. - **Location:** `apps/compliance/data/qmsr-atoms.json`, atom `REQ-QMSR-820.30j`, field `requirement_text`. - **PDF page:** p. 24 (absolute PDF page). - **Recommended revision:** > A Design History File (Design and Development File under ISO 13485 §7.3.10) must be established and maintained for each medical device type or family. The file must contain or reference the records necessary to demonstrate conformity to the design and development requirements and must include records of design and development changes. - **Notes:** Two things worth separating here. (1) The current ISO 13485 §7.3.10 text explicitly requires the file to include or reference "records for design and development changes" — a distinct, named content category. The committed `requirement_text` omits this entirely (it is captured separately in the atom's own `atomic_constraints`, out of audit scope, but not in the primary requirement statement). (2) The committed text's "in accordance with the approved design plan" phrasing is verbatim from the **sunset** §820.30(j) text (`change_delta.legacy.text` in the same atom), not from the current §7.3.10 text, which does not use "approved design plan" language. This phrase is defensible on the merits — the atom's own `whats_changed` field cites the FDA preamble (Response to Comment 31, 89 FR 7507–7508) characterizing §7.3.10 as encompassing "the design and development plan," so it is not an invented obligation — but the top-line `requirement_text` presents legacy terminology as if it were the current clause's own wording, while silently dropping a content category the current clause explicitly names. Flagged medium: not obligation-inverting, but a real omission from a clause whose current text is one sentence long and thus disproportionately affected by dropping one of its two clauses. ## Count 9 audited, 5 clean, 4 findings, 0 unverified