Governance Layer

5. Governance Layer

5.1 Management & Audit Log

What this module is, in one paragraph. The Management & Audit Log is the executive launchpad for the QMS — the single screen that aggregates findings from CAPA, Risk, Training, Document Control, AI Findings, Vigilance, and EUDAMED into one inbox; hosts the ISO 13485:2016 15-clause coverage matrix (which Wrapper module satisfies each clause, with status); tracks internal audit cycles (§8.2.3); hosts management review records (§5.6); tracks NB communications (every email / letter / certificate exchange per response-deadline); surfaces the AI Act conformity matrix (Articles 9-15, 17, 72) split into two scopes (Wrapper-own AI obligations and customer-AI obligations); and renders the Regulatory Health Score gauge per device per regulator. ISO 13485 §5.6 (Management Review) requires top management to review the QMS at planned intervals to ensure its continuing suitability, adequacy, and effectiveness; §8.2.3 (Internal Audit) requires planned audits; §8.2.4 (Monitoring and Measurement of Processes) requires evidence of process performance. FDA 21 CFR 820.20 (Management Responsibility) and §820.22 (Quality Audit) impose the equivalent. MDR Annex IX §2.2 specifies that the NB audits all of these. EU AI Act Art. 14 + Art. 17 require organisational and management oversight of AI systems.

Regulatory pathway summary. Supports ISO 13485:2016 §5.6 (management review) + §8.2.3 (internal audit) + §8.2.4 (monitoring); FDA 21 CFR 820.20 (management responsibility) + §820.22 (quality audit); MDR Annex IX §2.2 (NB audit of management procedures); MDSAP Chapter 1 (Management); EU AI Act Art. 14 (Human Oversight) + Art. 17 (QMS for AI); ISO 14971:2019 §4.4 (risk-management review); ISO 13485 §4.1.6 (validation of QMS software).

Regulatory Specificity

Table 1 — Which regulation applies in which case

Table 2 — Regulatory problem solved

Table 3 — Conformity-assessment pathway impact

Why these regulations are non-negotiable. "Management review not documented" is the most common ISO 13485 §5.6 audit finding. Without §8.2.3 internal-audit evidence, the QMS fails stage-2 audit. Without §4.1.6 eQMS validation evidence, the use of any software (including Wrapper itself) in the QMS is unsupported — a fundamental NB finding. Under MDR Annex IX §2.2, the NB audits all management procedures including their software implementation.

Who uses this module and when. QMS Manager daily. Executive sponsor weekly. PRRC monthly for §5.6 management review session. NB / MDSAP auditor at every audit. FDA inspector at every inspection (especially §820.20 management responsibility).

5.2 AI Governance Log

What this module is, in one paragraph. The AI Governance Log is the operational evidence engine for every AI system used by Wrapper and by Wrapper’s customers — covering both Wrapper’s own seven AI workflows (FormSuggestion, ImpactMapper, SmartImpactMapper, Search, RiskDiscussion, TrainingDiscussion, TrainingImpact) and customer-embedded AI systems (e.g. customer diagnostic AI models). The EU AI Act (Regulation 2024/1689) classifies medical-device AI as High-Risk under Annex III, point 5 when it is itself a medical device or a safety component thereof; high-risk obligations include Art. 9 (Risk Management System), Art. 10 (Data Governance), Art. 11 (Technical Documentation, with Annex IV structure), Art. 12 (Logging / Traceability), Art. 13 (Transparency), Art. 14 (Human Oversight), Art. 15 (Accuracy, Robustness, Cybersecurity), Art. 17 (Quality Management System), Art. 50 (Transparency obligations including watermarking), Art. 72 (Post-Market Monitoring). FDA SaMD + Clinical Decision Support + GMLP + PCCP guidance layer the FDA framework. IEC 42001:2023 is the new AI management-system standard. IEC 81001-5-1 + IEC 62304 govern software lifecycle. The AI Governance Log carries 13 tabs covering each obligation: AI Systems Registry, Dataset Governance, Model Lifecycle / Frozen Model Registry, V&V Log, Inference Traceability Log, Human Oversight Log, Monitoring / Drift Log, Change Control + PCCP, AI Cybersecurity, AI Suppliers, AI Audit Trail, AI Incidents, AI Regulatory Evidence — plus a 14th "AI Transparency Register" for Art. 50 + Art. 13 disclosure events. Each evidence row carries multiple regulatory mappings (EU AI Act / FDA SaMD / MDR Annex II) so a single row presents in five regulator lenses without duplication.

Regulatory pathway summary. Supports EU AI Act Reg. 2024/1689 Art. 9 (RMS), Art. 10 (Data Governance), Art. 11 (Technical Documentation), Art. 12 (Logging), Art. 13 (Transparency), Art. 14 (Human Oversight), Art. 15 (Accuracy/Robustness/Cybersecurity), Art. 17 (QMS), Art. 26 (Deployer obligations), Art. 50 (Transparency obligations), Art. 72 (Post-Market Monitoring), Annex IV (Technical Documentation structure); FDA SaMD (2017) + Clinical Decision Support (2022) + Good Machine Learning Practice (2021) + Predetermined Change Control Plan (2024); IEC 42001:2023 (AI management systems); IEC 62304:2006+A1:2015 (software lifecycle); IEC 81001-5-1:2021 (health-software cybersecurity); ISO/IEC 23894:2023 (AI risk management); ISO 13485:2016 §4.1.6 + §7.3; FDA 21 CFR Part 11 for HITL log integrity.

Regulatory Specificity

Table 1 — Which regulation applies in which case

Table 2 — Regulatory problem solved

Table 3 — Conformity-assessment pathway impact

Why these regulations are non-negotiable. EU AI Act Art. 43 requires AI conformity assessment before placing high-risk AI on the market after 2 August 2026; without Annex IV documentation, the device is unmarketable. FDA SaMD evidence is required at premarket review; without PCCP, every iterative AI update triggers a full new submission cycle. FDA AI/ML Action Plan requires post-market drift monitoring evidence; absence opens a Form-483 observation.

Who uses this module and when. AI/ML Lead daily. PRRC for high-risk AI. Information Security Officer for AI Cybersecurity. FDA reviewer at premarket and post-market. NB Auditor at AI-aware surveillance.

5.3 Supplier Log

What this module is, in one paragraph. MDR Annex II §5 + MDR Annex IX §4 (NB supplier-audit expectation) + FDA 21 CFR 820.50 → QMSR Supplier Purchasing Controls + ISO 13485:2016 §7.4 (Purchasing) require the manufacturer to evaluate and select suppliers based on their ability to supply product in accordance with the manufacturer’s requirements, define quality requirements, monitor performance, take action when requirements are not met, and maintain records. The manufacturer is legally responsible for the regulatory compliance of every supplier whose component, software, or service touches the device. Wrapper’s Supplier Log carries the Master Registry (per-supplier metadata, criticality, regulatory status, performance score, audit dates), the qualification workflow (8 critical-supplier forms SUP-FRM-001..008 covering Initial Questionnaire, Quality-System Assessment, On-Site Audit Checklist, Quality Agreement, Material Specifications, Risk Assessment, Business-Continuity Verification, Regulatory Compliance Check; plus 3 routine-supplier forms SUP-FRM-101..103), the performance and monitoring dashboard, the receiving QC sub-log, the switching and dual-sourcing logic with an alternate-qualification scorecard (6 weighted criteria), the business continuity matrix (Component → Primary / Alt 1 / Alt 2 / switchover time / stock buffer), and the regulatory compliance tracking per supplier across six regulatory lenses (ISO 13485 certificate validity, FDA Establishment Registration, MDR certification, RoHS, REACH, Conflict Minerals = Dodd-Frank §1502 / CMRT). Five AI agents — QualiBot (new-supplier-request sentinel), AuditBot (audit-due scheduled scan), MonitorBot (NCMR rate threshold), RenewBot (Quality-Agreement expiry), SwitchBot (performance-decline triage) — automate routine oversight, with all actions flowing through the AI Findings inbox for human approval.

Regulatory pathway summary. Supports MDR Annex II §5 (suppliers in the technical documentation) + MDR Annex IX §4 (NB supplier-audit expectation); FDA 21 CFR 820.50 Supplier Purchasing Controls (→ QMSR equivalent post 2 Feb 2026); ISO 13485:2016 §7.4 (Purchasing) including §7.4.1 + §7.4.2 + §7.4.3; MDSAP Chapter 6 (Purchasing); EU REACH Regulation (EC) 1907/2006; EU RoHS Directive 2011/65/EU; US Dodd-Frank §1502 conflict-minerals (CMRT).

Regulatory Specificity

Table 1 — Which regulation applies in which case

Table 2 — Regulatory problem solved

Table 3 — Conformity-assessment pathway impact

Why these regulations are non-negotiable. MDR Annex II §5 requires supplier evidence in the TF; without it, NB Annex II review fails. FDA 21 CFR 820.50 is a top-three Form-483 citation in CGMP inspections. ISO 13485 §7.4 is one of the most-cited stage-2 audit findings. REACH + RoHS non-conformity is enforced at EU member-state level — a non-conforming component triggers product recall.

Who uses this module and when. Purchasing Agent daily. QA Engineer per critical supplier. QMS Manager dashboard view. NB Auditor at supplier-evidence audit. FDA Inspector at §820.50 inspection focus.

5.4 Cybersecurity Log

What this module is, in one paragraph. Cybersecurity is now a premarket gate at FDA and a top-three NB audit focus for medical-device SMEs. FDA Cybersecurity in Medical Devices (final guidance September 2023) + Secure Product Development Framework (SPDF) specify eight elements that must accompany every premarket submission: Security Risk Management, Security Architecture, Cybersecurity Testing, Cybersecurity Management Plan, Vulnerability Communication Plan, Software Bill of Materials, Penetration Testing, Labeling. EU MDR Annex I §17 + MDCG 2019-16 require medical-device cybersecurity controls. IEC 81001-5-1:2021 specifies the health-software cybersecurity lifecycle. IEC 62304 §5 + §6 integrate security into the software lifecycle. ISO 27001:2022 demands an Information Security Management System with 93 Annex A controls. SOC-2 Trust Services Criteria demand evidence per CC1–CC9 plus Availability / Confidentiality / Processing Integrity / Privacy. NIST CSF 2.0 provides the dashboard lens (Govern / Identify / Protect / Detect / Respond / Recover). NIS2 Directive (EU) imposes incident-response obligations on essential entities. CycloneDX + SPDX specify SBOM formats. Wrapper’s Cybersecurity Log carries 17 tabs covering every regulator’s expectation: Dashboard, ISMS Document Register, ISMS Risk Register (ISO 27005, distinct from ISO 14971 device risk), Threat Model (STRIDE/PASTA), SBOM Registry, Vulnerability Tracker (CVE feeds, dependency-check, KEV, EPSS), Pentest Results, Security Incident Log (with explicit Vigilance-boundary decision-tree), Access Control Review (quarterly per SOC-2 CC6), Encryption Inventory, Backup / Recovery Testing, Cyber CAPA (linked to CAPA module), Security Training (linked to Training module), Vendor / Third-Party Cyber Risk (linked to Supplier module), SOC-2 Evidence Locker (one row per CC# × period × evidence artefact), FDA Cybersecurity Submission Package generator (the 8 SPDF elements per device per submission), EU MDR §17 Cyber Evidence (per device per MDCG 2019-16 element).

Regulatory pathway summary. Supports ISO 27001:2022 Annex A (93 controls organised 5.x Organisational / 6.x People / 7.x Physical / 8.x Technological) + ISO 27005 (information-security risk); SOC-2 Trust Services Criteria 2017 (with 2022 points of focus) CC1-CC9 + Availability + Confidentiality + Processing Integrity + Privacy; FDA Cybersecurity in Medical Devices (final guidance September 2023) + SPDF; EU MDR Annex I §17 + MDCG 2019-16; IEC 81001-5-1:2021; IEC 62304:2006+A1:2015 §5 + §6; NIST CSF 2.0; CycloneDX 1.5 / SPDX 2.3 SBOM standards; NIS2 Directive (EU) 2022/2555.

Regulatory Specificity

Table 1 — Which regulation applies in which case

Table 2 — Regulatory problem solved

Table 3 — Conformity-assessment pathway impact

Why these regulations are non-negotiable. FDA Cybersecurity in Medical Devices (Sept 2023 final) is enforced at premarket — without the 8 SPDF elements, the submission is rejected. ISO 27001 Annex A 5.x–8.x coverage is required for ISMS certification. SOC-2 Type-2 attestation requires per-CC# evidence with sample-period coverage. MDR Annex I §17 is part of every CE marking — non-conformity blocks CE.

Who uses this module and when. Information Security Officer daily. CISO weekly. SOC-2 auditor at attestation. NB Auditor at MDR §17 review. FDA reviewer at premarket and post-market.