Quality and regulatory engineering
Faurenis keeps its quality system in the repository as machine-checked registries: 126 requirements, 129 hazards, 121 mitigations and 52 verifications, traced to each other and to the code. The engineering lifecycle is mapped to IEC 62304, risk management to ISO 14971 and the design history to ISO 13485, and every AI feature carries a written intended purpose. Regulatory classification is a legal determination that has not been made; the platform is built as if the stricter outcome applies.
QMS registries
- Requirements
- 126
- Hazards
- 129
- Mitigations
- 121
- Verifications
- 52
- Release gates
- 3
- Monitoring signals
- 16
- Post-market signals
- 12
- Design-history sections
- 8
Each registry is a JSON file with a schema under docs/qms/. The trace matrix links hazards to mitigations, mitigations to verifications, and verifications to the test commands that run them; several of those commands are fail-closed npm wrappers named after their verification ids, so a renamed or deleted test breaks the trace visibly rather than silently.
Standards mapping
- IEC 62304 (software lifecycle)
- How the engineering maps to it
- Planned stages, a design-history index, segregation of deterministic engines from AI drafting, traceable verification
- ISO 14971 (risk management)
- How the engineering maps to it
- Hazard registry with mitigations and verifications; per-feature hazard acceptance packages
- ISO 13485 (quality management)
- How the engineering maps to it
- Design history file sections, change control, complaint and adverse-event workflow, post-market surveillance register
- EU MDR and EU AI Act
- How the engineering maps to it
- A classification memo recording hypotheses pending legal review; the AI feature registry with intended purpose and automation level per feature
- GDPR
- How the engineering maps to it
- DPIAs, a sub-processor register, a PHI data map, a retention policy, erasure engineered for backups
| Standard | How the engineering maps to it |
|---|---|
| IEC 62304 (software lifecycle) | Planned stages, a design-history index, segregation of deterministic engines from AI drafting, traceable verification |
| ISO 14971 (risk management) | Hazard registry with mitigations and verifications; per-feature hazard acceptance packages |
| ISO 13485 (quality management) | Design history file sections, change control, complaint and adverse-event workflow, post-market surveillance register |
| EU MDR and EU AI Act | A classification memo recording hypotheses pending legal review; the AI feature registry with intended purpose and automation level per feature |
| GDPR | DPIAs, a sub-processor register, a PHI data map, a retention policy, erasure engineered for backups |
Claims discipline
A test scans every user-facing string in the client, server and shared code — interface copy, AI prompts, generated exports — against a matrix of forbidden claim patterns — diagnosing, deciding for the clinician, validation claims, automated clinical outputs and outcome guarantees — in English and Croatian. Approved exceptions are listed explicitly. This specification passes it.
Release gates
- Pull-request gate
- Scope
- Every merge
- Runs
- RLS and scoped-access lints, raw-token lint, file-size and any-count ratchets, clinical mock-import gate, dependency audit, typecheck, the instrumented test suite with coverage thresholds, both production builds
- Production release gate
- Scope
- Promotion to production
- Runs
- Everything above plus the Tier-1 evidence benchmark
- Feature hazard acceptance
- Scope
- Per clinical feature
- Runs
- Hazard acceptance packages for operatory, Perio, dispatch, dictation tray and other clinical changes
| Gate | Scope | Runs |
|---|---|---|
| Pull-request gate | Every merge | RLS and scoped-access lints, raw-token lint, file-size and any-count ratchets, clinical mock-import gate, dependency audit, typecheck, the instrumented test suite with coverage thresholds, both production builds |
| Production release gate | Promotion to production | Everything above plus the Tier-1 evidence benchmark |
| Feature hazard acceptance | Per clinical feature | Hazard acceptance packages for operatory, Perio, dispatch, dictation tray and other clinical changes |
docs/qms/regulatory/features/docs/compliance/tests/compliance/medicalClaimsContract.test.tsscripts/medical-release-gate.mjs