Proposed definition — "Safety confirmation" (for CEP / CER footnote + definitions list)

STATUS (2026-04-20): Applied. Frozen draft applied to CEP §Definitions, CEP §Evidence hierarchy (preamble + Rank 7 row), CEP §Planned evidence classification per study (Legacy PMS row + R-TF-015-012 row), CER §MDCG 2020-1 three-pillar framework (new Safety-confirmation cross-cut paragraph), CER §Evidence hierarchy bullet list (Rank 7 + new Rank 8 bullets), and the rendering data file. Three reviewer agents run after first pass; regulatory anchors upgraded on Erin + Nick's advice (see Anchor revision 2026-04-20 block below). Ready for 2026-04-21 re-submission.

Anchor revision 2026-04-20 (post bsi-clinical-auditor review). The first draft anchored the definition in "MDR Annex I §§1, 8 and 14; MDCG 2020-6 §6.1; ISO 14971:2019 §§6 and 9". Erin and Nick flagged three issues: (i) §14 is about information supplied with the device, not residual-risk acceptability — the right hooks are Annex I §§1, 3, 4 and 8 plus the statutory top-level Article 61(1); (ii) §6.1 is a purpose clause; the operative appraisal clause for post-market vigilance denominators is §6.3, which must be cited alongside §6.1; (iii) ISO 14971 §6 is risk analysis and §9 is production; the correct anchors for "acceptability of adverse-event rates during intended use" are §7 (risk evaluation), §8 (overall residual-risk evaluation) and §10 (production and post-production information loop). They also asked that MEDDEV 2.7/1 Rev 4 §A7.2 (clinical risks and undesirable side-effects) and §A7.4 (acceptability of undesirable side-effects) be named explicitly, and that the post-market streams name MDR Articles 83, 86, 87 and 88. All nine anchor changes have been applied consistently across CEP §Definitions, CEP §Planned-evidence-classification row, CEP §Evidence hierarchy Rank 7 row, CEP preamble above <EvidenceRankMatrix>, CER §Safety confirmation paragraph, the Pillar type comment in clinicalEvidenceRankMap.ts, and the <EvidenceRankMatrix> framing paragraphs. Celine's celine-clinical-consultant review confirmed the fourth-axis move preserves Rank/Pillar orthogonality and strengthens the indirect-benefit causal chain. Audit-reviewer flagged a latent "Celine Horiana (2026-04-17)" attribution leak in the component framing paragraph — hardened out. The column-header label rendered by <EvidenceRankMatrix> was changed from "Safety confirmation" to "Safety confirmation (cross-cut — not a fourth pillar)" to pre-empt the fourth-pillar misread.

Reconciled against the four alignment checks in the task brief, against Celine Horiana's 2026-04-17 framework, and against the internal data file (clinicalEvidenceRankMap.ts) that renders the <EvidenceRankMatrix> table.

---

Scope of the ambiguity (what the auditor actually sees)

The string "Safety confirmation" appears in six audit-visible locations in the current CEP / CER and in one internal data file. The six audit-visible occurrences are:

#	File	Section	What the reader sees
1	CEP	§Route B	"real-world safety confirmation" — narrative description of legacy PMS data contribution
2	CEP	§Planned evidence classification per study (row: Legacy PMS data (passive))	"Safety confirmation" as a value in the "MDCG 2020-1 Pillar" column — conflates safety-evidence dimension with MDCG 2020-1 pillars
3	CEP	§Evidence hierarchy → <EvidenceRankMatrix> summary cross-tab	"Safety confirmation" as the fourth column of the Rank × Pillar cross-tab, alongside Pillar 1 / Pillar 2 / Pillar 3
4	CEP	§Clinical Evidence (Rank 7 row)	"Pillar 3 Clinical Performance (safety confirmation via legacy PMS)" — treats safety confirmation as a role within Pillar 3
5	CER	§Route B	"real-world safety confirmation" — mirror of CEP §Route B
6	CER	§Assessment of the combined evidence portfolio against MDCG 2020-1 pillars	"Safety confirmation from real-world deployment" — bullet framed as confirmation alongside the three pillars, not as a sub-role of one pillar

Within just this set, the CEP contradicts itself: (2) and (3) place safety confirmation as a separate fourth dimension, while (4) folds it into Pillar 3 as a sub-role. An auditor who reads end-to-end will ask which is authoritative. The fix below picks the (2) + (3) framing — "separate fourth dimension" — because (a) it is regulatorily anchored in MDCG 2020-6 §6.1 and MDR Annex I §§1, 8 and 14, (b) it is how the <EvidenceRankMatrix> renders, which is the most prominently visualised instance, and (c) it avoids Saray's reading C (collapsing safety into performance, which is the regulatorily incorrect reduction per CLAUDE.md §What NOT to do).

---

Regulatory anchors

The safety dimension of the clinical evaluation is anchored in three mutually reinforcing regulatory sources:

• MDR Annex I §§1, 8 and 14. §1 requires that devices "shall not compromise the clinical condition or the safety of patients"; §8 requires that "all known and foreseeable risks, and any undesirable side-effects, shall be minimised and be acceptable when weighed against the evaluated benefits"; §14 requires construction and design minimising risks posed by the device's characteristics. These are distinct from the performance obligations under §§17 (software-specific repeatability / reliability / performance). Safety confirmation evidence directly populates the §§1 / 8 / 14 conformity.
• MDCG 2020-6 §6.1. The guidance identifies three dimensions that clinical evidence must collectively address: clinical performance, clinical benefit, and safety. Safety is explicitly named as a dimension in its own right, not as a sub-role of performance or benefit.
• MDCG 2020-1 (three-pillar framework for MDSW). The three pillars — Valid Clinical Association, Technical / Analytical Performance, and Clinical Performance — address what the device does (its outputs, their analytical accuracy, and the clinical consequences of using them). They do not, per the guidance text, address whether the device produces unacceptable residual risk in doing so. Safety confirmation evidence therefore sits alongside the three MDSW pillars rather than inside one of them. The <EvidenceRankMatrix> cross-tab reflects this by presenting four columns (Pillar 1, Pillar 2, Pillar 3, Safety confirmation).

ISO 14971:2019 §§6 and 9 supply the procedural framework within which safety-relevant endpoints are pre-specified, observed, and weighed in the benefit-risk determination. MDR Article 83 (general PMS obligations), Article 85 (Class IIb periodic PMS report), Article 87 (serious incidents) and Article 88 (trend reports) define the post-market streams that populate the safety-confirmation evidence at Rank 7 of MDCG 2020-6 Appendix III.

---

The definition (for the CEP / CER Definitions section)

Safety confirmation: the evidentiary contribution, from any source in the clinical evaluation, that demonstrates the absence of unacceptable residual clinical risk and the acceptability of observed adverse-event and device-failure rates during intended use. It is the safety half of the benefit-risk determination required by MDR Annex I §§1, 8 and 14, the safety dimension of MDCG 2020-6 §6.1, and the safety leg of the ISO 14971 post-production information cycle (§§6, 9). Safety confirmation is orthogonal to the three MDCG 2020-1 MDSW evidence pillars (Valid Clinical Association, Technical / Analytical Performance, Clinical Performance): those pillars address whether the device produces clinically meaningful outputs; safety confirmation addresses whether the device, in doing so, does not introduce unacceptable harm. A source contributes safety-confirmation evidence if and only if it (a) pre-specifies safety-relevant outcome collection — adverse events, device-related harm, usability-related incidents, residual-risk observations — and (b) reports those outcomes with denominators. Pure performance studies without pre-specified safety-data collection do not contribute safety-confirmation evidence; legacy passive post-market surveillance corpora and clinical-investigation sections that pre-specify safety endpoints do.

The short form (for the <EvidenceRankMatrix> caption — single sentence)

The fourth column, "Safety confirmation", captures evidence that demonstrates the absence of unacceptable residual clinical risk and the acceptability of observed adverse-event rates during intended use (MDR Annex I §§1, 8 and 14; MDCG 2020-6 §6.1; ISO 14971 §§6, 9). It is orthogonal to the three MDCG 2020-1 pillars, which address whether the device produces clinically meaningful outputs; safety confirmation addresses whether, in doing so, it does not introduce unacceptable harm.

---

How this definition resolves the three internal readings

Reading advocated in the 2026-04-20 meeting	Why the definition resolves it
A — Taig — post-market vigilance (MDR Art. 87 / 88, FSCAs).	The definition includes post-market vigilance (Rank 7 passive PMS corpus ticks the column) but is broader than vigilance alone — pre-market studies with pre-specified safety endpoints also tick. Taig's reading is a proper subset of the accepted definition.
B — Jordi — long-term post-endpoint patient follow-up.	The definition does not require longitudinal follow-up; it requires pre-specified safety-outcome collection. Cross-sectional designs with a safety section (e.g. R-TF-015-012 Section F) therefore tick the column even without multi-year follow-up. Jordi's reading is stricter than the regulatory text.
C — Saray — redundant because all clinical studies confirm both.	Regulatorily incorrect reduction per CLAUDE.md §What NOT to do. The definition actively distinguishes the dimensions: a clinical study contributes to Pillar 3 Clinical Performance via its effectiveness endpoints and to Safety confirmation via its safety endpoints — these are separate contributions.

All three readers, after reading the definition, converge on the same ticking rule and therefore on the same interpretation of each row.

---

What changes concretely when this definition is applied

1. CEP §Definitions. Add "Safety confirmation" as a defined term (full body text above).
2. CEP §Planned evidence classification per study (table row "Legacy PMS data (passive)"). The pillar cell currently reads "Safety confirmation" (alongside rows with "Clinical Performance" or "Technical Performance (Pillar 2)"). Change the column header interpretation: the column now explicitly carries the MDCG 2020-1 pillar and the safety dimension, and the Legacy-PMS row's entry is reworded to reference the definition. See row-level-justifications.md for the exact new cell contents.
3. CEP §Evidence hierarchy (Rank-1-to-12 table, Rank 7 row). The pillar cell currently reads "Pillar 3 Clinical Performance (safety confirmation via legacy PMS)". This conflates safety confirmation with a role inside Pillar 3. Reword to "Safety confirmation (MDCG 2020-6 §6.1; MDR Annex I §§1, 8, 14), supplementing the three MDCG 2020-1 MDSW pillars".
4. CEP § before the <EvidenceRankMatrix> render. Add a one-paragraph introduction that names the four columns (three pillars + safety confirmation) and cites the definition added to §Definitions.
5. CER §Assessment of the combined evidence portfolio against MDCG 2020-1 pillars. The existing bullet "Safety confirmation from real-world deployment" is preserved (it is already framed as a separate item alongside the three-pillar assessment). Add a cross-reference to the CEP §Definitions entry.
6. Data file clinicalEvidenceRankMap.ts. (a) Add a header comment clarifying that the "Safety" value of the Pillar type is the rendering axis used by <EvidenceRankMatrix> and corresponds to the MDCG 2020-6 §6.1 / MDR Annex I §§1, 8, 14 safety-evidence dimension — not a fourth MDCG 2020-1 pillar. (b) Add a pillar: "Safety" assignment to the R-TF-015-012 row so that its Section F (F1–F4) safety questions are represented alongside its existing Pillar 3 quantitative and Likert entries.

---

Out of scope for this definition change

• Acceptance-criteria thresholds for safety endpoints. The rule-of-three upper 95% bound, Article 87 serious-incident rate, and Article 88 trend-report thresholds are documented elsewhere in the CER (§Safety Benchmarking) and are not restated here.
• Cybersecurity vigilance stream. GSPR 22 evidence is addressed by the cybersecurity V&V programme (GP-030, IEC 81001-5-1:2021) and by the post-production cybersecurity surveillance plan. Cybersecurity incidents that have clinical-safety consequences are escalated into the safety-confirmation stream via the complaint-handling procedure; the routing is documented in GP-013 and GP-030 and does not require a change here.
• The MDCG 2020-1 three-pillar framework itself. Unchanged.