Foundation Layer

2. Foundation Layer — The Chassis

2.1 Quality Event System (QES)

What this module is, in one paragraph. A Quality Event is any signal that might indicate a problem with the product, the process, or the QMS — a customer complaint, a service-engineer observation, an internal-audit finding draft, a near-miss from production, a chat message in support. ISO 13485:2016 §8.2.1 (Feedback) and FDA 21 CFR 820.198 (Complaint Files) require that every such signal be captured and triaged and a documented rationale explain why each one did or did not escalate to CAPA (§8.5.2). The classic SME failure mode is that signals live in email inboxes and chat logs and never reach the QMS — an audit finding waiting to happen. The QES forces every signal into a structured event with a six-state lifecycle (Triaged → Under Investigation → Root Cause Analysis → Corrective Action → Verification → Effectiveness Review), an event-chain linking the originating signal to all downstream issues it spawned, and a permanent audit-trail row for every status transition. The QES is the regulator-visible link between "a customer phoned" and "a CAPA was closed with effectiveness verified".

Regulatory pathway summary. Supports ISO 13485:2016 §8.2.1 feedback + §8.4 analysis of data + §8.5.2 corrective action + §8.5.3 preventive action; FDA 21 CFR 820.100 CAPA + §820.198 complaint files; MDR Art. 83 PMS plan + Annex III §1.1; MDSAP audit Chapter 4 (Measurement, Analysis, and Improvement); ISO 13485 §7.2.3 customer communication.

Regulatory Specificity

Table 1 — Which regulation applies in which case

Table 2 — Regulatory problem solved

Table 3 — Conformity-assessment pathway impact

Why these regulations are non-negotiable. Without documented triage of every signal, ISO 13485 §8.2.1 is unsatisfied and the NB issues a major non-conformity at surveillance audit — typical recovery 30–60 days and remediation-audit cost. Without RCA and effectiveness verification, FDA 21 CFR 820.100(a)(3)–(a)(6) are open Form-483 items at inspection; persistent CAPA gaps trigger Warning Letters and Consent Decrees. A complaint file without a clear chain to investigation outcome (§820.198(b)) is one of the three findings every FDA inspector specifically looks for under the "complaint handling" inspection technique.

Who uses this module and when. Every employee uses the universal "report a quality event" entry point continuously. The QA Contact triages daily. The QMS Manager reviews open-event ageing weekly and trend statistics monthly. The PRRC sees serious-signal escalations within hours of triage. Internal Auditors drill into QES during the annual internal-audit cycle (ISO 13485 §8.2.3). NB Auditors open it at every surveillance audit and unannounced visit — QES is the second screen they open, immediately after the Technical File.

2.2 Document Control

What this module is, in one paragraph. A controlled document is any document that governs how a regulated activity is performed — an SOP, a Work Instruction, a Policy, a Form Template, a Record, an External Document — and must therefore be versioned, reviewed, approved, dated, distributed, and superseded under enforceable controls. ISO 13485:2016 §4.2.3 (control of documents) and §4.2.4 (control of records) require every document carry a defined status, a defined revision history, a defined approval cadence, and a defined retention period. FDA 21 CFR 820.40 (Document Controls) demands the same plus distribution control. 21 CFR Part 11 and EU GMP Annex 11 then layer on top: any document held electronically must have audit-trail, signature, access-control, and validation rigour. Wrapper’s Document Control gives every document an explicit status (Draft / In Review / Pending Approval / Approved / Effective / Superseded / Archived), an effective-date schedule promoted nightly by an automated job, an append-only FileHistory audit row for every mutation (action / old value / new value / actor / timestamp), and an approval ceremony binding the move to APPROVED to a PIN-signed AuditSignature row hash-chained against the prior signature.

Regulatory pathway summary. Supports ISO 13485:2016 §4.2.3 + §4.2.4 + §4.2.5 (control of records of external origin); FDA 21 CFR 820.40 (Document Controls) + §820.180–186 (Records); 21 CFR Part 11 Subpart B (electronic records) + Subpart C (electronic signatures); EU GMP Annex 11 §4 (validation), §5 (data), §7 (data storage), §9 (audit trail), §10 (change control); MDR Annex II §1.6 (TF document control); MDSAP Chapter 2 (Management Responsibility & Quality System).

Regulatory Specificity

Table 1 — Which regulation applies in which case

Table 2 — Regulatory problem solved

Table 3 — Conformity-assessment pathway impact

Why these regulations are non-negotiable. A document control system that cannot produce, in one click, the exact text in effect on a given date, fails the FDA "inspection-readiness" criterion under 21 CFR 820.180. A document approved without a corresponding 21 CFR Part 11.50 signature manifestation (printed name, date, meaning, signed-by-PIN) is a Part 11 violation per se — Warning Letter material. EU GMP Annex 11 §9 requires the audit trail to record every change to GMP data and is one of the EU GMP inspection’s first-day checks. MDR Annex II §1.6 integrates document control into the Technical File requirement: a TF document referenced without its current revision status is an Annex II §1.6 NB finding.

Who uses this module and when. Document authors create and version daily. Reviewers comment during review cycles (typically 2–4 weeks per revision). Approvers PIN-sign at approval gates. The QMS Manager runs the effective-date dashboard weekly and the periodic-review dashboard quarterly. Internal Auditors sample documents per the §8.2.3 audit-plan rotation. NB Auditors open it daily during the audit week. FDA Inspectors start their inspection with the document-control system — historically the first inspection focus.

2.3 Approval Engine + 21 CFR Part 11 Electronic Signature

What this module is, in one paragraph. An electronic signature under 21 CFR Part 11 Subpart C is not a checkbox or a typed name — it is a regulated ceremony binding three elements (the printed name of the signer, the date and time of execution, and the meaning associated with the signature — Approve, Authored, Reviewed, Accepted Responsibility, etc.) to a record in a way that cannot be excised, copied, or falsified. EU GMP Annex 11 §14 imposes the equivalent under EU law. FDA 21 CFR 820.40(b) requires that documents be approved before issue by designated individuals, with the date and signature recorded. Wrapper’s Approval Engine is a single polymorphic mechanism that drives approval for seven object types (Document, Process, Form Template, Form Submission, Traceability Matrix entry, Risk, AI Finding); every approval invokes a PIN ceremony (PIN HMAC-SHA256 hashed per-actor), records a controlled-vocabulary meaning validated against the action being approved (the meaning vocabulary itself is regulated — "Approve" is not interchangeable with "Verify Competence"), and writes the result to an INSERT-only **AuditSignature** ledger with UPDATE and DELETE permissions revoked at the database-grant level. Each signature carries a prev_hash SHA-256 chain to the previous signature — any tampering with a historical signature row breaks the chain forensically.

Regulatory pathway summary. Implements FDA 21 CFR Part 11 Subpart C (electronic signatures) — §11.50 (signature manifestations), §11.70 (signature/record linking), §11.100 (general requirements), §11.200 (electronic-signature components and controls), §11.300 (controls for identification codes/passwords); EU GMP Annex 11 §14 (electronic signatures); MDR Annex IX §2.2 (NB audit of approval procedures); FDA 21 CFR 820.40(b) (review and approval); ISO 13485:2016 §4.1.6 (controls applicable to software — including QMS software itself); EU AI Act Art. 14 (Human Oversight evidence) when applied to AI Finding approvals.

Regulatory Specificity

Table 1 — Which regulation applies in which case

Table 2 — Regulatory problem solved

Table 3 — Conformity-assessment pathway impact

Why these regulations are non-negotiable. 21 CFR Part 11 is the FDA’s single most-cited regulation in Warning Letters concerning electronic records (over 200 citations in the 2020–2024 period). A non-Part-11-compliant approval system in an FDA-regulated company is categorically blocking for both inspection pass and submission acceptance. EU GMP Annex 11 §14 is the EU equivalent and is similarly enforced. MDR Annex IX §2.2 specifies that the NB audits approval procedures including their software implementation — a deficient approval engine is an Annex IX major non-conformity. For AI Findings specifically, EU AI Act Art. 14(4)(b) requires that humans exercising oversight can "decide… not to use the high-risk AI system" — recorded as an approval action with traceable rationale.

Who uses this module and when. Every approver who PIN-signs (Document authors at issue, QA at CAPA closure, Engineering at design freeze, RA at TF approval, PRRC at vigilance submission, AI reviewers at AI-Finding accept/decline). The QMS Manager consumes the signature ledger weekly for audit-readiness review. FDA inspectors test the ledger during Part 11 inspections (random-sample audit-trail walks). NB auditors test the ledger at every surveillance audit.

2.4 Audit Trail (per-entity ObjectJournal)

What this module is, in one paragraph. Audit trails under 21 CFR Part 11.10(e) must be computer-generated, time-stamped, independent, and capable of being copied without altering the original — and they must capture every operator action that creates, modifies, or deletes electronic records, including the prior value, the new value, the action taken, the actor, and the date/time. EU GMP Annex 11 §9 demands the same and requires that the audit trail itself be reviewable. ISO 13485:2016 §4.2.4 + §4.2.5 require that quality records remain legible, identifiable, and retrievable. Wrapper’s per-entity Audit Trail is a separate mechanism from the approval signature ledger — it captures the broader "every-mutation" trail across regulated entities (Documents, Issues, Training assignments, Risk controls, Form Submissions, Approvals themselves) so a regulator can reconstruct, on demand, the exact history of any regulated record from creation to its current state.

Regulatory pathway summary. Implements 21 CFR Part 11.10(e) (audit trail) + §11.10(c) (protection of records); EU GMP Annex 11 §9 (audit trail); ISO 13485:2016 §4.2.4 + §4.2.5 (control of records); MDR Annex IX §2.2 (NB audit of records and traceability); ISO 27001:2022 Annex A 8.15 (logging); SOC-2 CC7.2 + CC7.3 (system monitoring + event response).

Regulatory Specificity

Table 1 — Which regulation applies in which case

Table 2 — Regulatory problem solved

Table 3 — Conformity-assessment pathway impact

Why these regulations are non-negotiable. An audit trail that fails the "independent of operator" criterion under 21 CFR Part 11.10(e) is treated by FDA inspectors as effectively no trail — a Warning Letter trigger. A trail without prior/new value capture (only "modified by X at Y") fails the "reconstruct prior states" test under EU GMP Annex 11 §9 at EU GMP inspection. For ISO 27001:2022 Annex A 8.15, missing logs for privileged operations are a stage-2 audit finding that blocks certification.

Who uses this module and when. Auditors open the trail at every record-level investigation. QMS Manager samples trails during the §8.2.3 internal-audit cycle. Information Security Officer consumes the trail as one input to SOC-2 evidence (alongside the system-level logs). FDA inspectors and NB auditors test the trail at every audit.

2.5 Project Management

What this module is, in one paragraph. Every regulated artefact must be scoped — to a device, to a programme, to an organisation — so that "which device does this belong to?" never goes unanswered at audit. ISO 13485:2016 §7.1 (Planning of product realisation) requires that the manufacturer plan and develop the processes needed for product realisation, including determining the verification, validation, monitoring, measurement, inspection, and test activities specific to that product. FDA 21 CFR 820.30(b) (Design and Development Planning) requires a Design Plan describing or referencing the design and development activities, defining responsibility, identifying and describing the interfaces. Wrapper’s Project Management layer scopes Issues, Risks, Technical Files, Traceability Matrices, Training assignments, and CAPA records to a Project (the device-programme container) and surfaces a project summary view with member roster, status gauges, and direct links into the scoped TF / Matrix / Risk / Issue inbox.

Regulatory pathway summary. Supports ISO 13485:2016 §7.1 + §7.3.2 (design and development planning); FDA 21 CFR 820.30(b) + §820.20(b)(3) (organisation responsibility); MDR Annex II §3 (manufacturing information including process design); ISO 13485 §5.5.1 (responsibility and authority).

Regulatory Specificity

Table 1 — Which regulation applies in which case

Table 2 — Regulatory problem solved

Table 3 — Conformity-assessment pathway impact

Why these regulations are non-negotiable. Without a structured Design Plan referencing the design and development activities, FDA 21 CFR 820.30(b) is open at inspection — historically one of the top-five design-controls Form-483 citations. MDR Annex II §3 Technical File requires manufacturing-information that ties to the device — without a Project-scoped TF, the dossier fails Annex II §3 evidence.

Who uses this module and when. Engineering lead daily during development. RA Lead at submission planning. QMS Manager during the §8.2.3 audit cycle. NB auditor at TF assessment.

2.6 User / Role / Permission / Organisation

What this module is, in one paragraph. A regulated multi-tenant SaaS must satisfy two distinct access-control regimes: 21 CFR Part 11.10(d) + Part 11.300 (access controls) for FDA-regulated electronic records, and EU GMP Annex 11 §12 (security) for EU GMP-regulated activities. Beyond regulatory access control, ISO 27001:2022 Annex A 5.15–5.18 + 8.2–8.5 demand a managed information-security access-control regime, and SOC-2 CC6 (Logical and Physical Access Controls) demand evidence of provisioning, deprovisioning, privileged-access review, and authentication strength. Wrapper’s User / Role / Permission model is multi-tenant (every regulated row carries organization_id), authenticated through a security service registry with PIN-based ceremonies for regulated approvals, and permissioned at URL-path-keyed granularity — access is granted to specific endpoints rather than to abstract features, which is the auditor-defensible model. Active organisations are enumerated for all scheduled jobs and recomputations.

Regulatory pathway summary. Supports 21 CFR Part 11.10(d) + Part 11.300; EU GMP Annex 11 §12; ISO 27001:2022 Annex A 5.15–5.18, 8.2–8.5; SOC-2 CC6.1–CC6.8; ISO 13485:2016 §5.5.1 (responsibility and authority); MDR Annex IX §2.2 (NB audit of access procedures).

Regulatory Specificity

Table 1 — Which regulation applies in which case

Table 2 — Regulatory problem solved

Table 3 — Conformity-assessment pathway impact

Why these regulations are non-negotiable. 21 CFR Part 11.10(d) is enforced at every Part 11 inspection — a system without operation-specific authority checks is a Warning Letter risk. SOC-2 CC6 is one of the 9 mandatory criteria in every SOC-2 Type-2 attestation; failure on CC6 fails the attestation. ISO 27001:2022 Annex A 5.15 is one of the four most-commonly-cited Annex A findings at stage-2 audit.

Who uses this module and when. Information Security Officer runs quarterly access reviews. HR + IT drive provisioning/deprovisioning. QMS Manager holds the role-mapping policy. SOC-2 auditor + ISO 27001 auditor sample access logs at every attestation cycle.

2.7 Notification + Todo

What this module is, in one paragraph. Regulatory clocks and approval queues do not announce themselves — if the user is not notified, the deadline is missed. MDR Art. 87 imposes a 15-day clock for serious-incident reporting (2 days for serious public-health threats, 10 days for death/serious deterioration); FDA 21 CFR 803.50 imposes 30-day MDR clocks; ISO 13485:2016 §5.5.3 (Internal Communication) requires that the QMS communicate the effectiveness of the QMS internally. Wrapper’s Notification + Todo layer is a two-pronged user nudge: an in-app notification bell (real-time) and a personal /todo list (aggregated). The expiry-notification scheduler walks per-record schedules (configurable days-from-due) and dispatches both channels daily, deduplicated so the same user is not pinged twice for the same trigger.

Regulatory pathway summary. Supports MDR Arts. 87–92 reporting-clock visibility; FDA 21 CFR 803.50/.53/.56 reporting clocks; ISO 13485:2016 §5.5.3 (internal communication); ISO 13485 §8.5.2 + FDA 21 CFR 820.100 (CAPA-cycle reminders); ISO 13485 §6.2 (training reminders).

Regulatory Specificity

Table 1 — Which regulation applies in which case

Table 2 — Regulatory problem solved

Table 3 — Conformity-assessment pathway impact

Why these regulations are non-negotiable. Missing a 15-day MIR window under MDR Art. 87(3) is the single most-cited competent-authority non-conformance in EU device vigilance; persistent breach can suspend a CE certificate under MDR Art. 95. FDA Form-483 observations on CAPA dwelling at investigation stage routinely cite §820.100 (Corrective and Preventive Action) — late closure is a top-three FDA inspection finding.

Who uses this module and when. Every user, continuously. The PRRC monitors vigilance-clock notifications hourly during open MIR windows. The QMS Manager uses /todo aggregation weekly to see workload and SLA risk.

2.8 Scheduled Job Framework

What this module is, in one paragraph. Periodic regulatory work — checking certificate expiry, promoting documents to Effective on schedule, fanning out re-training assignments, scanning for trend events, advancing periodic processes, recomputing the Regulatory Health Score — must run unattended and reliably. IEC 62304 §6.2 (Software Maintenance Process) requires that a defined maintenance process exist for software-of-medical-device, including scheduled activities. ISO 13485:2016 §7.5.6 (Validation of Processes) requires that any process whose output cannot be fully verified by subsequent inspection be validated — periodic-job processes need that validation evidence. MDR Art. 83 (PMS Plan) requires ongoing post-market activities including periodic data collection and analysis — operationally enabled by scheduled jobs. Wrapper runs 12 scheduled jobs daily / weekly / hourly with consistent characteristics: each job iterates active organisations, per-organisation failures are logged and never abort the loop, every job action writes to the appropriate Log so the work is auditable.

Regulatory pathway summary. Operationalises IEC 62304 §6.2 (software maintenance); ISO 13485 §7.5.6 (process validation); MDR Art. 83 (PMS plan execution); ISO 13485 §8.2.4 (monitoring and measurement of processes); FDA 21 CFR 820.70(g) (production and process controls — automation).

Regulatory Specificity

Table 1 — Which regulation applies in which case

Table 2 — Regulatory problem solved

Table 3 — Conformity-assessment pathway impact

Why these regulations are non-negotiable. ISO 13485 §7.5.6 is one of the most-cited stage-2 audit findings — automated processes without validation evidence fail the clause. IEC 62304 §6.2 is mandatory for any software-of-medical-device classified as SaMD — without a documented maintenance process, the device cannot be CE-marked.

Who uses this module and when. DevOps / SRE monitor execution daily. QMS Manager consumes the per-org per-job log monthly for process-monitoring evidence. NB auditor samples scheduler runs during NB software audit.