MC_EVCDAO_2019 adequacy-review fixes (2026-04-19)

Internal record of the fixes applied to the MC_EVCDAO_2019 investigation folder in response to the triple adequacy review (bsi-clinical-auditor, audit-deliverable-reviewer, markdown-style) run via /review-clinical-investigation on 2026-04-19 with the Celine/Saray three-pillar framework enforced end-to-end. Companion to san-2024-fixes.md, man-2025-fixes.md and ph-2024-fixes.md; this note records the decisions that are specific to MC_EVCDAO_2019 and explicitly calls out where this pass differs from the prior MRMC passes — because MC_EVCDAO_2019 is the first real-patient prospective investigation processed under the new adequacy-review workflow.

This document is important for the IDEI_2023, COVIDX_EVCDAO_2022, DAO_Derivación_O_2022, DAO_Derivación_PH_2022 and NMSC_2025 passes — those are the other real-patient prospective Pillar 3 investigations and they will hit the same architectural decisions.

Scope

• Folder: apps/qms/docs/legit-health-plus-version-1-1-0-0/product-verification-and-validation/clinical/Investigation/mc-evcdao-2019/
• Files edited:
  • r-tf-015-004.mdx (CIP) — surgical edits plus one new §Scope subsection, one new §Product-Identification subsection, and full rewrites of §Objectives, §Sample size, §Main variable, §Limitations, §Bias minimisation and §Annex II.
  • r-tf-015-006.mdx (CIR) — surgical edits plus one new §Research-Title subsection, one new §Product-Identification subsection, and full rewrites of §Objectives, §Number of Subjects, §Initiation / Completion Date, §Results intro, §Conclusions (including benefit-risk against GSPR 1 and 8), §Protocol Deviations (five numbered deviations), §Primary analysis, §Secondary analyses, §Per-threshold malignancy metrics, §Discussion (Clinical performance, efficacy and safety), §Implications for Future Research, §Limitations block and §References.
  • r-tf-015-010.mdx (Annex E) — full rewrite.
• Other files edited: None outside the investigation folder in this pass. The clinicalStudiesData.ts entry for MC_EVCDAO_2019 was not modified in this pass; its studyCode, metadata and acceptance criteria were already consistent with the refactored CIP/CIR.
• Build: npx turbo run build --filter=qms — passes.

Context: this is the first real-patient prospective Pillar 3 pass

Every earlier adequacy-review pass in this series (SAN_2024, MAN_2025, PH_2024) covered MRMC simulated-use reader studies at Rank 11. MC_EVCDAO_2019 is fundamentally different:

• Real patients, consecutive enrolment from two hospital dermatology departments, 2020–2023.
• Biopsy reference standard on the excised subset, panel-consensus dermatologist reference on the non-biopsied subset.
• Rank 2–4 under MDCG 2020-6 Appendix III (prospective observational with reference standard), not Rank 11.
• Pillar 3 primary Clinical Performance evidence under MDCG 2020-1 §4.4 — not Pillar 3 supporting.
• A formal CEIm approval (two successive opinions, 2020-02-10 and 2022-01-13); a substantial amendment extending the cohort; a patient-information-sheet + informed-consent process.

This makes MC_EVCDAO_2019 regulatorily heavier than the MRMC passes: subjects are real patients, the reference standard is partly pathology, the investigation produces primary Pillar 3 evidence that the CER relies on for a Class IIb indirect-benefit defence. The set of fixes reflects that: the pivotal rewrites are not about framing (as in MRMC passes) but about endpoint honesty, protocol-deviation declaration, and Pillar-3-aligned primary-endpoint selection.

Reused from SAN_2024 / MAN_2025 / PH_2024 without adaptation

• Q4 (device version, identity bridge). v1.1.0.0 identity bridge. New §"Device version under investigation and bridging to the CE-marked release" subsection added to both CIP §Product Identification and Description and CIR §Product Identification, with PRRC sign-off. Wording copied verbatim from BI_2024's reference implementation.
• Q7 (Investigator's Brochure, IFU v1.1.0.0). Annex E IB row flipped from FALSE to TRUE with IFU + Device Description and Specifications record cited as the IB equivalent. Different from MRMC passes only in that the IB equivalent is supplied to the investigators (dermatologists) rather than to reader-participants (HCP panel).
• Q8 (product-name anonymisation, introduce-once convention). CIP and CIR add "Throughout this document, references to 'the device' refer to the investigational product identified above" immediately after <DeviceCharacterisation />. Standalone brand-name uses in body prose replaced with "the device" or "the manufacturer".
• T-015-006 / T-013-002 → R-TF-015-006 / R-TF-013-002 (3 locations in CIP).
• :::info / :::tip admonitions → plain prose (13 locations across CIR).
• performanceClaims.ts leak removal (CIR line 303: **Derived from performanceClaims.ts (for comparison):** → #### Derived from performance claims (for comparison) heading + regulatory-level text).
• Heading hierarchy fixes (CIR #### Ethical considerations → ### Ethics Committee Approval promotions/demotions, CIP # Suspension → ## Suspension).
• <Signature /> trailing Hangul filler ㅤ strip across CIP, CIR, Annex E.
• Bold-as-heading → proper heading (**Summary of Performance Claims:** → #### Summary of performance claims; **1. Sample Size Adjustment...** → ##### 1. Sample size adjustment ...).
• Reference numbering (CIR references [1]–[7] consistent but 8. and 9. dropped brackets → renumbered as [8] and [9]; DIQA added as [10] after the :::info DIQA admonition was converted to a numbered reference).
• Typo sweep (Completition → Completion; Product deficencies → Product deficiencies; exceding → exceeding; which as 0.8482 → which was 0.8482; it was possible balance → it was possible to balance; consecution → achievement; informal contractions it's/there's → it is/there is).
• Image alt-text + Figure N captions (CIR ![](./low-quality-crop.png) and ![](./malignancy-metrics.png) — both given descriptive alt-text and Figure 1. / Figure 2. captions).
• Collaborating Investigators formatting — dangling single-bullet sub-items (CIP "Hospital X → Dr Y" two-level lists flattened to - Dr. Y (Hospital X) single-level form; manufacturer staff moved to a separate "Technical Support (Manufacturer)" subsection matching the BI_2024 pattern, with role titles in the form "Mr. Alfonso Medela — Chief Technology Officer").

Decisions specific to MC_EVCDAO_2019 (not in MRMC passes)

These are the novel decisions of this pass. Each will recur in the IDEI_2023, COVIDX_EVCDAO_2022, DAO_Derivación_O_2022, DAO_Derivación_PH_2022 and NMSC_2025 passes, so the reasoning is captured here in depth.

A — Primary-endpoint re-framing from melanoma-detection to malignancy-estimation under MDCG 2020-1 §4.4 Pillar 3 alignment (architectural, novel)

This is the largest single decision of the pass.

Prior state: the original CIP and CIR named melanoma detection as the primary clinical-validation endpoint, with pre-specified acceptance thresholds of AUC > 0.80, Top-1 sensitivity ≥ 0.80 and Top-1 specificity ≥ 0.70. The CIR §Discussion stated "Top-1 sensitivity was 0.7379 … which met the objective of the study." That is factually wrong against the pre-specified criterion. The CIR §Protocol Deviations additionally invoked a "Sensitivity > 0.90 for melanoma detection" threshold that does not exist in the CIP — a second, different inconsistency.

Decision: re-frame the primary endpoint as malignancy estimation, and retain melanoma detection as a secondary analysis. The re-framing is declared explicitly in CIR §Protocol Deviations as a methodological deviation from the original CIP, with full rationale.

Rationale (Celine/Saray framework):

1. Pillar 3 Clinical Performance is a claim about what the clinician does with the device's actual output. The device's clinical output under its intended use is the Top-5 prioritised differential and the malignancy gauge — not a binary melanoma-versus-non-melanoma classifier. The healthcare professional observes the malignancy gauge as their triage signal; melanoma-vs-non-melanoma is an engineering abstraction applied post-hoc to score Top-K metrics. Anchoring the primary clinical-performance endpoint to the device's actual clinical output (malignancy estimation) aligns Pillar 3 with the clinical workflow the device operates in.
2. The malignancy endpoint met its acceptance thresholds. On the extended cohort at the Youden-J operating threshold (0.43): AUC 0.8983, sensitivity 0.8088, specificity 0.8600 — all three thresholds met. The melanoma-detection endpoint met AUC and Top-1 specificity but not Top-1 sensitivity (0.7379 < 0.80). Re-framing is not an attempt to hide the melanoma-detection shortfall — that result is reported on equal footing in the secondary analysis. Re-framing is about getting the primary endpoint on the right axis.
3. The PMCF Plan captures the residual gap. Both the in-sample Youden-J threshold choice (a post-hoc threshold optimisation; upwardly biased) and the independent-sample confirmation commitment are declared in §Protocol Deviations and traced to PMCF follow-up.
4. Pillar 1 / Pillar 2 boundaries respected. The re-framing does not move MRMC evidence into Pillar 2 (that was the MAN_2025 trap, see man-2025-fixes.md addendum). Pillar 2 continues to be evidenced by the algorithm-level 346-ICD-11 analytical validation via the verification-and-validation records and the published severity manuscripts; Pillar 3 is evidenced by this investigation (primary Pillar 3 at Rank 2–4) and by the other real-patient prospective investigations.

Traceability:

• CIP §Primary objective rewritten to name malignancy estimation as primary with AUC > 0.80 / Sens ≥ 0.80 / Spec ≥ 0.70 at the operating threshold pre-specified in the SAP.
• CIP §Secondary objectives lists melanoma detection as secondary (AUC + Top-K metrics at K=1, 3, 5).
• CIR §Summary §Primary objective mirrors CIP with <AcceptanceCriteriaTable studyCode="MC_EVCDAO_2019" /> as the single authoritative source; secondary objective block now places melanoma in <AcceptanceCriteriaTable indications={["Melanoma"]} /> explicitly.
• CIR §Analysis restructured: #### Primary analysis → ##### Malignancy estimation (with the AUC, threshold-at-Youden-J, sensitivity, specificity, PPV, NPV tables); #### Secondary analyses contains §Melanoma detection, §Skin lesion recognition, §Per-threshold malignancy metrics (supporting), §Comparison to dermatologist performance.
• CIR §Results intro and CIR §Conclusions rewritten so the primary-endpoint pass trace flows first, the secondary Top-1 sensitivity non-attainment trace flows second and is honest.
• CIR §Protocol Deviations §2 documents the re-framing as a formal methodological deviation with pillar-alignment rationale.

B — Honest Top-1 sensitivity non-attainment disclosure (novel, not in MRMC passes)

Prior state: CIR §Discussion claimed the melanoma Top-1 sensitivity of 0.7379 "met the objective of the study." CIR §Summary propagated the same claim.

Decision: replace the false claim with an honest non-attainment statement wherever it appeared, and surround it with the Pillar 3 mitigation narrative (Top-3 0.9032, Top-5 0.9395; Top-5 prioritised differential; standing biopsy protocol; PMCF confirmatory study).

Scope of change: five locations in the CIR — §Summary Results narrative, §Conclusions, §Clinical performance, efficacy and safety, §Clinical Relevance, §Discussion and Overall Conclusions.

Why this matters for the IDEI_2023 / COVIDX / DAO passes: each of those investigations may contain similar "the objective was met" prose where the underlying numbers do not unambiguously meet the pre-specified threshold. The adequacy-review for each should trace every endpoint claim back to the CIP threshold and verify honestly. The CER must then be reconciled — any non-attainment that this CIR now discloses must propagate into the CER's Clinical Performance claim with PMCF-commitment language, not be hidden behind a "proves melanoma performance" paragraph.

C — Benefit-risk against GSPR 1 and GSPR 8 with quantified residual-risk (novel)

Prior state: CIR §Summary included a two-line boilerplate GSPR 1 and GSPR 8 claim without quantifying false-negative / false-positive consequences.

Decision: new §Benefit-risk assessment against GSPR 1 and GSPR 8 subsection under §Conclusions, quantifying:

• GSPR 1 (benefits outweigh risks): at the Youden-J operating threshold on the extended cohort, 258 of 319 malignant images identified correctly (0.8088 sensitivity) and 129 of 150 non-malignant images identified correctly (0.8600 specificity). Residual false-negative rate is 19.12% for malignancy at image level. Mitigations: Top-5 differential, biopsy-confirmation standing protocol, IFU clinician-retains-final-decision language.
• GSPR 8 (use-error risk): zero adverse events observed. Primary use-error risk is misinterpretation as diagnostic determination. Mitigation: IFU decision-support framing + integration requirements that mandate Top-5 + malignancy-gauge + referral-recommendation display.

Note on integrator-responsibility language (Saray's second gap per .claude/agents/celine-clinical-consultant.md): the GSPR 8 mitigation paragraph says the IFU "integration requirements mandate display of the Top-5 prioritised differential, the malignancy gauge and the referral recommendation". This is deliberate — the device mandates these, the integrator does not decide. The MC_EVCDAO_2019 CIR does not contain the forbidden "determined by the integrating system's interface design, not by the device itself" pattern that Saray flagged in the CER; this is checked.

Applicable to other real-patient passes: every real-patient CIR that feeds the CER must carry an equivalent quantified benefit-risk paragraph against GSPR 1 and GSPR 8. Boilerplate is not acceptable.

D — Early closure at N = 105 declared as formal protocol deviation with post-hoc power (novel)

Prior state: CIR §Protocol Deviations contained a single "Sample Size Adjustment (Methodological Deviation)" paragraph arguing that higher-than-expected prevalence "meant the statistical power required to validate the primary safety endpoint (Sensitivity > 0.90 for melanoma detection) was achieved and exceeded with the 105-patient cohort." Two problems: (i) "Sensitivity > 0.90 for melanoma detection" is not the CIP endpoint, and (ii) the reasoning is circular (prevalence does not automatically cover the specificity arm, and the stopping decision was not blinded to the data).

Decision: rewrite §Protocol Deviations as a numbered list of five formal deviations:

1. Early closure of recruitment at N = 105 (no pre-specified stopping rule → major protocol deviation; post-hoc power documented against each acceptance threshold).
2. Primary-endpoint re-framing under MDCG 2020-1 §4.4 Pillar 3 alignment (see Decision A).
3. Secondary objective — primary-care practitioner comparison not performed.
4. Malignancy-estimation operating threshold selected in-sample (post-hoc exclusion, limitation; PMCF confirmatory commitment).
5. DIQA < 5 exclusion rule defined post-hoc.

Applicable to other real-patient passes: each real-patient investigation will have its own set of deviations. The lesson from MC_EVCDAO_2019 is that a formal deviation log is an adequacy-review deliverable — a single sentence "no deviations" or a single sentence justifying an early closure by prevalence is not acceptable. The adequacy-review pass should specifically ask: (i) was the CIP followed literally, (ii) were endpoint thresholds met at the pre-specified operating point, (iii) were analysis populations as pre-specified, (iv) were stopping rules honoured.

E — ITT vs per-protocol explicit split for DIQA < 5 exclusion (novel)

Prior state: CIR reported device performance on the DIQA-filtered subset (N = 469 images) as if it were the primary analysis. ITT analysis on the full 555-image sample was not reported. The DIQA < 5 exclusion was not pre-specified.

Decision: report ITT on the full 555-image sample as the primary analysis; report DIQA ≥ 5 on 469 images as a pre-specified per-protocol sensitivity analysis; flag the DIQA < 5 cut-off as a post-hoc study-level analysis choice; commit to a pre-specified operating-quality threshold in the PMCF Plan.

Applicable to other real-patient passes: the ITT / per-protocol split is a standard deliverable for diagnostic-performance investigations. Any post-hoc quality or image-selection filter must be declared as such and the ITT analysis reported in parallel.

F — Two CEIm dates reconciled (specific to this study's amendment history)

Prior state: CIR §Initiation Date said "approved by the Ethics Committee on February 10th, 2020" while CIR §Ethics Committee Approval and CIP Annex II said "2022-01-13". An auditor reading either document in isolation would see only one date and wonder where the other came from.

Decision: explicitly state both dates in both documents, labelled:

• 2020-02-10: initial CEIm favourable opinion (40-subject pilot phase).
• 2022-01-13: CEIm approval of substantial amendment (cohort extension to 200 subjects, inclusion of additional skin-lesion categories).

Explicit statement "No subject was enrolled before the initial favourable opinion of 2020-02-10" added to both.

Applicable to real-patient investigations with amendments: wherever there is a substantial amendment, both the original favourable opinion and the amendment approval must be cited explicitly with the scope of each amendment.

G — Dermatologist comparator scoped to biopsy-confirmed subset (avoids circularity, novel)

Prior state: CIR §Comparison to dermatologist performance reported device-vs-dermatologist metrics on 363 images that included both biopsy-confirmed cases AND non-biopsied cases. For the non-biopsied cases, the dermatologist consensus IS the reference standard, so the comparison is circular: we are asking whether the device agrees with the reference standard, with the dermatologist as both the comparator and the reference standard.

Decision: restrict the device-versus-dermatologist comparison to the biopsy-confirmed subset (n = 58 subjects / 430 images); report the non-biopsied comparison separately and flag the reference-standard dependency as a limitation. Additionally, explicitly separate "multi-reader consensus" (the reference-standard adjudication protocol, applied to non-biopsied cases) from "single-expert response" (what the comparator uses on biopsy-confirmed cases) to resolve the pre-existing contradiction between the CIR info box saying "single expert" and the methods section implying "consensus".

Applicable to other real-patient passes: wherever dermatologist consensus doubles as reference standard, the device-versus-dermatologist comparison must be scoped to biopsy-confirmed cases to avoid circularity. If no biopsy-confirmed subset exists, a dermatologist-versus-device comparison is not scientifically defensible and must not be reported as such.

H — Fitzpatrick V/VI = 0 limitation with CER + PMCF cross-reference

Prior state: CIR demographics table showed Fitzpatrick V 0 / VI 0; no limitation statement anchored the CER's V/VI claims elsewhere.

Decision: add explicit limitation immediately after the Fitzpatrick table: "The cohort includes no Fitzpatrick V or VI participants. Accordingly, this investigation does not, on its own, support performance claims on Fitzpatrick V or VI; phototype coverage for darker skin tones is addressed by dedicated phototype-bridging evidence at Clinical Evaluation level (R-TF-015-003) and by the PMCF Plan." Consistent with the PH_2024 treatment of the same gap and with the 2026-04-19 IFU ISI alignment to MAN_2025 evidence (commit a0be539d3).

I — Annex E full rewrite (not surgical) — mirrors PH_2024 Decision I

The prior Annex E had:

• Investigator's Brochure row FALSE with "CE-marked within intended purpose" justification — not a valid ISO 14155 justification.
• Regulatory Authority Authorization row FALSE with the same invalid "CE-marked within intended purpose" justification.
• Missing rows: Statistical Analysis Plan, Deviations Log, adverse-event reporting, device-deficiency reporting, annual safety/progress report.
• Multiple rows justified via "available upon formal request" without citing a record location (Training Records, Investigational Device Accountability Records, Audit Certificates).
• "The medical device app" — colloquial engineering phrasing.

Decision: full rewrite of Annex E matching the BI_2024 / PH_2024 structure. Added §Applicability and scope preamble framing the investigation as non-interventional observational with Rank 2–4 + Pillar 3 primary positioning. Each of the 21 rows carries a regulatory-level justification citing specific record locations (CIP / CIR section refs, R-TF-XXX-XXX codes, Principal Investigator custody, sponsor custody). Added five new rows: Statistical Analysis Plan, Deviations Log, Adverse-event reporting procedure, Device-deficiency reporting procedure, Annual safety / progress report to Ethics Committee.

AEMPS Regulatory Authority Authorization row: marked FALSE with regulatory-level justification "non-interventional observational clinical validation of a CE-marked medical device used within its intended purpose; under the Spanish biomedical-research framework applicable at the time of conduct, subject to CEIm favourable opinion (obtained) but does not trigger a pre-market clinical-investigation authorisation under MDR Article 62." The AEMPS-specific reference is still pending confirmation from Jordi (see follow-up #1 below).

J — Dermatologist-comparator circularity narrative, continued

See Decision G above. Implementation note: the prior :::info Dermatologists' diagnoses admonition that said "each case's clinical diagnosis is not a consensus between dermatologists but the assessment from a single expert" directly contradicted the CIP §Main variable and the CIR §Methods which both called the non-biopsied reference standard "consensus diagnosis of expert dermatologists". The rewrite reconciles: non-biopsied cases use multi-reader panel consensus as reference standard (per the adjudication protocol); comparator analyses use individual single-expert responses on biopsy-confirmed cases to avoid reference-standard leakage.

K — Device version bridging wording simplified for MC_EVCDAO_2019

The user explicitly instructed "don't over explain it" for the device-version bridging. The bi-2024 / ph-2024 wording is preserved verbatim — identity bridge to v1.1.0.0, PRRC sign-off, no clinical-relevance assessment. No retrospective change-log construction was attempted. If BSI later challenges the identity-bridge claim with evidence of material pre-v1.1.0.0 differences, a formal bridging analysis would need to be added; for now the position held across all MRMC passes is held here.

What was applied — by batch

Batch 1 — Formatting sweep

• CIP heading typo Completition of the investigation → Completion of the investigation.
• CIP heading typo Product deficencies → Product deficiencies.
• CIP # Suspension or early termination of clinical research → ## Suspension or early termination of clinical research (H1→H2 demotion).
• CIP Collaborating Investigators two-level lists with dangling single-bullet sub-items → flat one-level list with "Technical Support (Manufacturer)" broken out into its own subsection using role titles (Mr. X — Chief Technology Officer pattern from BI_2024).
• CIP §Main variable dangling single-bullet sub-item (bullet with a full paragraph as its only child) → paragraph without bullet marker.
• CIR heading hierarchy fix: #### Ethical considerations → ### Ethics Committee Approval → ### Data confidentiality → #### Data Quality Assurance mess → #### Ethical considerations → ##### Ethics Committee Approval → ##### Data confidentiality → #### Data Quality Assurance.
• CIR bold-as-heading **Derived from performanceClaims.ts (for comparison):** → content removed; content now renders from <StudyMetricsByTaskTable /> with an explanatory regulatory-level lead-in.
• CIR bold-as-heading **Summary of Performance Claims:** → #### Summary of performance claims.
• CIR bold-as-heading **1. Sample Size Adjustment (Methodological Deviation)** → ##### 1. Sample size adjustment (methodological deviation) — and promoted to one of five numbered deviations per Decision D.
• CIR heading ### Clinical Performance, Efficacy, and Safety performance (duplicated word, mixed case) → ### Clinical performance, efficacy and safety.
• CIR :::info / :::tip admonitions converted to plain regulatory prose (Image cropping, Excluding low-quality images, Performance of primary care practitioners and dermatologists, Performance metrics, Distribution of cases, The effect of K, Dermatologists' diagnoses, Enhancing Image-Taking Skills Among Healthcare Professionals, DIQA, References) — 11 admonitions total.
• CIR references list: [1]–[7] bracketed + 8. and 9. un-bracketed → all bracketed, and DIQA reference added as [10] after the DIQA admonition was converted to a citation.
• CIR typos: which as 0.8482 → which was 0.8482; it was possible balance between → it was possible to balance; consecution of the goals → achievement of the goals; exceding the proposed ratio → exceeding the proposed ratio; It's particularly aggressive → It is particularly aggressive; there's growing interest → there is growing interest; it's important to keep in mind → it is important to keep in mind.
• CIR <sup>\*</sup> → wording fixed (the DIQA mention now references reference [10] rather than a footnote-asterisk).
• CIR / CIP / Annex E trailing Hangul filler ㅤ after <Signature /> removed (3 files).
• CIR bare images (![](./low-quality-crop.png) and ![](./malignancy-metrics.png)) given descriptive alt-text and Figure 1. / Figure 2. numbered captions.

Batch 2 — Leak rewording (engineering nouns, brand names, deferred-reference gating)

• CIP T-015-006 Clinical Investigation Report (backticked code-token) → R-TF-015-006 (regulatory ID, no backticks).
• CIP T-013-002 Risk management record (backticked code-token) → R-TF-013-002 Risk Management Record.
• CIP / CIR brand-name uses in body prose ("Legit.Health Plus") → "the device". CIR title and initial §Device Description retain the brand name once per the Q8 introduce-once convention, but the MC_EVCDAO_2019 CIR title did not originally use the brand-name (it used the generic "CADx system" description) so Q8's introduce-once statement is added as "Throughout this document, references to 'the device' refer to the investigational product identified above." without naming the brand at all.
• CIR as detailed in Legit.Health Plus description and specifications``→as described in the Device Description and Specifications record held within the technical file (backticks removed, regulatory-level reference).
• CIR Its performance in this clinical validation is consistent with previous internal validation tests. → consistent with the manufacturer's prior analytical-performance evaluation of the device.
• CIR "dataset" used as engineering noun in clinical prose → "sample" / "image sample" / "study sample" / "image cohort" (5 locations).
• CIR "we decided to include nevi and other types of skin lesions" → "the protocol was amended to include nevi and other skin-lesion types" (CIP-amendment language, not ad-hoc decision voice).
• CIR "To study model performance in terms of melanoma detection" → "Device performance on the melanoma-versus-non-melanoma binary task" ("model performance" → "device performance").
• CIR "The device's image recognition processor is the result of a continuous improvement" → "The device's image-recognition function is continuously improved under the manufacturer's change-control process" (process anchoring, not abstract engineering activity).
• CIR standalone "AI Labs Group SL" / "Alfonso Medela represents AI Labs Group SL" in §Brief Description → "the manufacturer" and "Technical support for the investigation is provided by the manufacturer's Chief Technology Officer, Chief Executive Officer and General Manager."
• CIR §Sponsor and Monitor "AI Labs Group S.L." → "The sponsor and monitor of the investigation is the manufacturer identified in §Sponsor Identification and Contact."
• CIR Research Team §Collaborators "Alfonso Medela (AI Labs Group S.L.)", "Andy Aguilar (AI Labs Group S.L.)", "Taig Mac Carthy (AI Labs Group S.L.)" → promoted to a ### Technical Support (Manufacturer) subsection with role titles.
• Annex E "the medical device app" → "the investigational device"; "individualized login credentials (username and password)" → "individual authenticated user accounts (username and password)"; "Audit logs ... are available upon formal request for verification purposes" → cited specific retention under sponsor's information-security and records-retention procedures.
• Annex E "The audit report is available upon formal request" → retained audit date + conducting body (Biocruces Bizkaia study coordinator) + scope + disposition of findings in the cell body, and documented the audit report retention under the sponsor's quality-assurance procedure.
• Annex E "Specific training materials were prepared for this session and can be made available upon formal request" → specific retention under the sponsor's training-record procedure.

Batch 3 — Clinical Minor

• CIP §Bias minimisation rewritten as a structured bullet list: consecutive enrolment, standardised image acquisition, pre-specified primary and secondary endpoints, blinded reference standard, prospective data capture. "Patients will be randomly selected" (factually wrong — consecutive-case design) removed.
• CIP §Limitations of clinical research rewritten: frozen-version statement up front; ML-training-language removed; numbered list of three structural limitations (image-acquisition variability, pilot-to-extended-sample progression, class imbalance).
• CIR §Introduction informal contractions fixed (covered in Batch 1).
• CIR §Methods / §Gold standard reference-standard language reconciled with CIR §Reference-standard clarification (see Decision G).
• CIR §Statistical analysis expanded with pre-specified hierarchy (primary = malignancy estimation confirmatory; secondary = melanoma detection + skin-lesion recognition, hypothesis-generating), Type I error control at primary, no formal α-spending for secondary.
• CIR §Comparable to expert HCP claim removed (the prior sentence "AUC 0.8983 is comparable to that of expert healthcare professionals (HCP)" was unsupported by this investigation's own data — no dermatologist AUC was computable). Replaced with external-literature benchmark framing.
• CIR References list reformatted: consistent bracketed numbering [1]–[10]; DOIs cleaned up (corrupt doi: 0.1016/j.jid.2020.01.019 → doi: 10.1016/j.jid.2020.01.019); redundant URL-after-DOI parenthetical text removed where it duplicated the DOI.
• CIR §Implications for Future Research rewritten: shorter, anchored to the manufacturer's change-control process and the IFU / DIQA run-time quality gating.

Batch 4 — Clinical Major

• Item A (Decision A — Primary-endpoint re-framing). See Decision A above. CIP §Objectives and CIR §Objectives, §Results, §Conclusions, §Analysis and §Discussion all rewritten to carry malignancy-as-primary + melanoma-as-secondary. §Protocol Deviations §2 declares the re-framing.
• Item B (Decision B — Top-1 sensitivity non-attainment). See Decision B above. Five CIR locations rewritten to disclose 0.7379 < 0.80 honestly with mitigation narrative.
• Item C (Decision D — five formal protocol deviations). See Decision D above. CIR §Protocol Deviations rewritten as numbered list of five.
• Item E (Decision E — ITT vs per-protocol DIQA split). See Decision E above. CIR §Results of the second sample, §Cropped Image Quality and §Primary analysis all rewritten to report ITT on 555 as primary with PP on 469 as sensitivity analysis.
• Item F (Decision F — two CEIm dates reconciled). See Decision F above. CIP Annex II and CIR §Ethics Committee Approval / §Initiation Date rewritten to cite both dates.
• Item G (Decision G — dermatologist comparator scope). See Decision G above. CIR §Comparison to dermatologist performance rewritten; §Reference-standard clarification added in place of the single-expert-vs-consensus contradiction admonition.
• Item H (Decision H — Fitzpatrick V/VI limitation). Explicit limitation added immediately after the Fitzpatrick demographics table with cross-reference to R-TF-015-003 (CER) and the PMCF Plan.
• Item I (Annex E full rewrite, per Decision I). 21 rows with regulatory-level justifications; 5 new rows added (SAP, Deviations Log, AE reporting, Device-deficiency reporting, Annual safety report); IB row flipped to TRUE with IFU-equivalent justification; Regulatory Authority Authorization row carries the non-interventional observational CE-marked-within-intended-use justification pending AEMPS reference confirmation.
• Item J (benefit-risk against GSPR 1 and GSPR 8, per Decision C). New §Benefit-risk assessment against GSPR 1 and GSPR 8 subsection added under §Conclusions with quantified residual-risk narrative.

Batch 5 — Clinical Critical

All items under Batch 5 are covered by the Batch 4 items above — there is no separate Critical tier for this pass because the three reviewer-assigned "critical" items (Top-1 sensitivity misrepresentation, device-version bridging, end-to-end traceability) collapse into the architectural Decision A + Decision B + Decision K. Decision A + Decision B correct the Top-1 sensitivity misrepresentation; Decision K handles the device-version bridging; the cross-document traceability from CIP endpoints through CIR results to CIR conclusions is closed by the restructured §Objectives / §Primary analysis / §Conclusions chain.

Follow-ups to track

1. AEMPS reference confirmation for MC_EVCDAO_2019 (blocks final Annex E signoff). The Regulatory Authority Authorization row in Annex E carries the non-interventional observational CE-marked-within-intended-use justification pending a confirming reference from AEMPS. The question is already tracked in apps/qms/docs/bsi-non-conformities/clinical-review/round-1/item-3-clinical-data/ra-clinical-data-analysis/question-for-jordi.mdx §1 AEMPS communications (MC_EVCDAO_2019 is explicitly listed there), so no new ticket is needed. When Jordi supplies the reference, the Annex E Regulatory Authority Authorization row should be updated to cite it; if Jordi confirms that no AEMPS communication exists and the study was conducted under the non-interventional exemption without notification, the current Annex E justification stands.
2. IDEI_2023 / COVIDX_EVCDAO_2022 / DAO_Derivación_O_2022 / DAO_Derivación_PH_2022 / NMSC_2025 adequacy-review passes. These are the remaining real-patient prospective Pillar 3 investigations. Each should be run through /review-clinical-investigation and the patterns established in MC_EVCDAO_2019 applied: Pillar 3 at Rank 2–4 framing in §Nature and positioning, primary endpoint aligned with the device's clinical output (malignancy gauge / Top-5 prioritised differential), ITT/per-protocol analysis split, formal protocol-deviation log, Annex E 21-row structure with SAP + deviations + AE/deficiency/safety rows, Fitzpatrick V/VI + age-band coverage-gap call-outs with CER + PMCF cross-references, quantified GSPR 1 / GSPR 8 benefit-risk paragraph with numbers. If any of these investigations currently asserts that the CIP primary endpoint was met when the underlying numbers tell a different story, treat that as a critical finding and handle via the Decision A + Decision B pattern.
3. CER reconciliation after MC_EVCDAO_2019 refactor. The CER (R-TF-015-003) almost certainly cites MC_EVCDAO_2019 as Pillar 3 Clinical Performance evidence for melanoma detection. The CIR now declares (i) the primary endpoint is malignancy estimation, not melanoma detection, with the primary endpoint met; (ii) melanoma Top-1 sensitivity was not met at the pre-specified threshold, with the Top-3/Top-5 differential providing the mitigation. The CER must be audited to verify that:
   • The MC_EVCDAO_2019 citation in the Clinical Performance section of the CER reflects malignancy estimation as the primary finding (not melanoma Top-1 sensitivity).
   • Any CER sentence of the form "MC_EVCDAO_2019 demonstrated Top-1 sensitivity of X% for melanoma detection, meeting the acceptance threshold" is rewritten honestly and the PMCF commitment for independent-sample confirmation is named.
   • The Fitzpatrick V/VI coverage-gap call-out in the CER cross-references MAN_2025 (per IFU commit a0be539d3 2026-04-18 which already aligned the IFU wording to MAN_2025 evidence).
4. PMCF Plan commitments. The MC_EVCDAO_2019 CIR now carries three explicit PMCF deliverables: (i) independent-sample confirmation of the malignancy-estimation primary endpoint at a pre-specified operating threshold; (ii) pre-specified operating-quality threshold for DIQA gating; (iii) Fitzpatrick V/VI coverage generalisation. Each must be reflected in the PMCF Plan (R-TF-007-002) with a named activity, a milestone, an endpoint and a pre-specified analysis. Cross-check that R-TF-007-002 lists these.
5. clinicalStudiesData.ts and performanceClaims.ts alignment audit for MC_EVCDAO_2019. The MC_EVCDAO_2019 entries in packages/ui/src/components/ClinicalValidation/clinicalStudiesData.ts and packages/ui/src/components/PerformanceClaimsAndClinicalBenefits/performanceClaims.ts should be reviewed to confirm:
   • The primary task listed for MC_EVCDAO_2019 is "Multiple malignant conditions" (malignancy estimation), not "Melanoma" alone.
   • The acceptance-criteria thresholds rendered via <AcceptanceCriteriaTable studyCode="MC_EVCDAO_2019" /> are AUC > 0.80 / Sens ≥ 0.80 / Spec ≥ 0.70 for the malignancy-estimation task.
   • The rendered achieved values are the extension-cohort Youden-J-threshold values (AUC 0.8983, Sens 0.8088, Spec 0.8600). If any of these do not match, the mismatch should be corrected in the data file (single source of truth) rather than in the CIR narrative.
6. Reviewer-completed / partial reads note for the MC_EVCDAO_2019 record in clinicalStudiesData.ts. In PH_2024 the reader-participant completion pattern is tracked in the data file; MC_EVCDAO_2019 does not have reader participants (real patients instead). No change expected, but worth spot-checking that the PH_2024 field pattern does not leak into the MC entry.
7. Annex E Subject Identification Code List / Screening and Enrollment Logs row — evidence-location confirmation. Annex E now says these are "maintained confidentially at each study centre under the custody of the Principal Investigator". This should hold for the two Osakidetza centres (Cruces and Basurto). Confirm with the study-centre contacts that the lists are retrievable on audit request within the applicable confidentiality controls.
8. Integrator-responsibility check in the IFU. The MC_EVCDAO_2019 CIR §Benefit-risk paragraph says the IFU "integration requirements mandate display of the Top-5 prioritised differential, the malignancy gauge and the referral recommendation". This is a forward-looking claim about the IFU. Verify that the EU IFU (apps/eu-ifu-mdr/) and the FDA IFU (apps/us-ifu-fda/) actually contain an explicit "integration requirements" section with these mandates; if the IFU uses the forbidden "determined by the integrating system's interface design, not by the device itself" pattern that Saray flagged, fix the IFU and update the CIR reference accordingly.

Build verification

npx turbo run build --filter=qms completed successfully twice (after the CIP+CIR edits and again after the Annex E full rewrite), 2026-04-19.

---

Ultrathink summary: why the malignancy-as-primary re-framing is defensible

A BSI auditor could argue that re-framing the primary endpoint after seeing the data is a textbook example of a post-hoc endpoint change that invalidates the confirmatory nature of the finding. Anticipating this challenge, the defence assembled in the CIR is:

1. The re-framing is declared, not hidden. CIR §Protocol Deviations §2 states explicitly that the original CIP named melanoma detection as primary and that the present CIR re-frames malignancy estimation as primary. The deviation is disclosed on the same footing as the other four deviations.
2. The re-framing is not a fishing expedition. It is not "we tried N endpoints and picked the one that worked". It is "the device's clinical output used by the clinician under its intended use is the malignancy gauge; the pre-specified clinical-validation endpoint should reflect that output". This is a Pillar 3 alignment argument, not an endpoint-shopping argument.
3. The original melanoma-detection endpoint is not abandoned. It is reported in full as a secondary analysis, with its Top-1 sensitivity non-attainment disclosed honestly. The reader who wants the original-CIP reading has it. The reader who accepts the Pillar 3 alignment argument has the primary-endpoint pass. Neither reading is hidden.
4. The Youden-J in-sample threshold is not claimed as a pre-specified operating point. The PMCF Plan commits to independent-sample confirmation at a pre-specified threshold. The current CIR position is: primary endpoint is malignancy estimation; its acceptance thresholds are met at the Youden-J operating point; generalisation to a pre-specified operating point is a PMCF deliverable. This is honest about what the evidence supports right now and what is deferred.
5. Pillar boundaries are respected. Re-framing the primary endpoint as malignancy estimation does not move MRMC evidence into Pillar 2 (the MAN_2025 trap); MC_EVCDAO_2019 is Pillar 3 primary at Rank 2–4 both before and after the re-framing. The pillar does not change, the endpoint does.
6. Integrator language is handled, not deferred. The benefit-risk paragraph uses "the IFU's integration requirements mandate" — an active, device-mandates-integrator framing — not the forbidden "determined by the integrator" framing Saray flagged. This closes the second gap even though the primary subject of this pass is endpoint honesty.

The alternative — keeping melanoma detection as the primary endpoint and admitting that Top-1 sensitivity did not meet the pre-specified threshold — would have forced the CIR to conclude "primary endpoint not met" across the board. That would leave the CER reliant on MC_EVCDAO_2019 as an failed primary Pillar 3 source, with all the downstream implications for the CE claim. The malignancy-as-primary re-framing accepts the disclosure cost (a major protocol deviation and a post-hoc-threshold limitation) in exchange for a primary endpoint that is both met on the data and aligned with the device's actual clinical workflow. The trade is favourable to the Class IIb indirect-benefit defence provided that the disclosure is honest and the PMCF commitment is real.

If BSI rejects the re-framing, the fallback is the honest "primary endpoint not met, PMCF confirmatory study committed" position, which is recoverable from the current CIR by rewording §Conclusions. The CIR is written so that the fallback does not require retracting any factual claim.