Source Document Verification Audit (2026-04-06)

Responses reference changes that do not exist in source documents

On 2026-04-06, a systematic verification was performed comparing every Item response (response.mdx) against the actual source documents they claim to have updated. Multiple responses describe completed work that has NOT been done in the source documents. If these responses are submitted to BSI without fixing the source documents, BSI will check the referenced sections and find them missing, which is worse than not claiming the change at all.

Deadline: 2026-04-21 (extension from Arancha).

Verification method

Each response was checked against the actual file content using text search in:

• R-TF-015-003 Clinical Evaluation Report (CER)
• R-TF-007-002 Post-Market Clinical Follow-up (PMCF) Plan
• R-TF-028-011 AI Risk Assessment (MDX + JSON data)
• clinicalBenefits.ts (benefits consolidation)

Summary

Area	Verified?	Detail
CER: 3 benefits (7GH, 5RB, 3KX)	YES	clinicalBenefits.ts has 3 benefits with merger notes
CER: Tiered evidence strategy	YES	Section exists at line 704
CER: Evidence coverage by disease category	YES	Section exists at line 732, 7-category matrix present
CER: Acceptance criteria derivation from SotA	YES	Section exists at line 1493, derivation tables present
CER: Summary of clinical benefits achievement	YES	Table exists at line 1557, 3 rows (7GH, 5RB, 3KX)
CER: Predictive values by clinical setting	YES	Section exists at line 1541
CER: Safety benchmarking against SotA	YES	Section exists at line 1668
CER: Justification of sufficiency	YES	Section exists at line 1435, demographics table present
CER: MEDDEV 2.7.1 Rev 4 stages	YES	Section exists at line 230 (Stages 0-4)
CER: Usability section	YES	Lines 1127-1141, full methodology/results/residual risk
CER: Demographics/Fitzpatrick table	YES	Lines 1449-1453, aggregate table present
CER: Equivalence with 4 specific changes	YES	Lines 839-844 (microservices, HL7 FHIR, encryption, DIQA)
CER: Gaps 4 and 5 declared	YES	Lines 1581-1583 in "Need for more clinical evidence"
CER: Legacy PMS data (250,000 reports)	YES	Line 964 references the data
CER: 7 non-serious incidents from PSUR	RESOLVED	PSUR was obsolete (Class IIa/IIb format); CER "Zero complaints" is correct. PSUR moved to deprecated.
CER: MDCG 2020-6 § 6.2.2 citation	RESOLVED	Added 2026-04-07 to CER PMS section
CER: Future-tense PMS language fixed	RESOLVED	CER PMS section rewritten 2026-04-07
PMCF Plan: Section D (D.1, D.2)	RESOLVED	Added 2026-04-07, commit c289ff136
PMCF Plan: Gap 4 and Gap 5 in objectives	RESOLVED	Added 2026-04-07, commit c289ff136
PMCF Plan: Coverage mapping for gaps	RESOLVED	Added 2026-04-07, commit c289ff136
PMCF Plan: Evaluation of similar devices	YES	Section exists at line 94, references SkinVision/DERM etc.
PMCF Plan: Teledermatology clarification	YES	Line 45, info admonition present
AI Risk Assessment: Severity 4 justification	NO	Not in JSON or MDX; see alert below
AI Risk Assessment: Categorised mitigations	NO	Mitigations are flat lists, not design/process/info
AI Risk Assessment: 3-step occurrence chain	NO	Not documented anywhere
AI Risk Assessment: IFU section mapping	NO	Not documented anywhere
AI Risk Assessment: R-TF-013-002 cross-ref	NO	Not documented in MDX

---

ALERT 1: PMCF Plan missing Section D (Activities D.1 and D.2): RESOLVED

Resolved 2026-04-07, commit c289ff136

File: R-TF-007-002-Post-Market-Clinical-Follow-up-PMCF-Plan.mdx (300 lines, ends at line 299)

What the responses say: "We have implemented a comprehensive update... expanded with detailed methodological descriptions for all 11 activities (A.1 through D.2)... two new activities (D.1 and D.2) addressing the evidence coverage gaps."

What the file actually contains: Only Gaps 1-3 and Activities A.1 through C.2.3. The file has NO Section D, NO Activity D.1, NO Activity D.2, NO references to Gap 4 (autoimmune) or Gap 5 (genodermatoses).

Why this is critical: The CER (line 170) says "These are addressed through targeted PMCF activities documented in R-TF-007-002." If BSI checks R-TF-007-002 and finds no D.1/D.2, the CER's gap declarations become unsupported claims, turning "acceptable gap with PMCF" into "unsupported gap," which is a non-conformity.

What must be done: Add Section D with Activities D.1 and D.2 exactly as specified in item-0/issue-6-pmcf.mdx. Also add Gap 4 and Gap 5 to the Specific Objectives section and update the Coverage Mapping.

Assigned to: Jordi

Specification: Full spec is in item-0/issue-6-pmcf.mdx

ALERT 2: AI Risk Assessment not updated (all 5 Alfonso sub-tasks)

Affects: Item 7 response (all 4 sections)

Files: r-tf-028-011-aiml-risk-assessment.mdx and ai-risk-assessment.json

What the Item 7 response says: "We have updated R-TF-028-011 to document the explicit rationale..." with detailed severity justifications, categorised mitigations (design/process/information), three-step occurrence rate chains, and IFU section mappings for AI-RISK-001, AI-RISK-016, AI-RISK-021.

What the files actually contain:

• The MDX file is a thin wrapper that renders <AIRiskAssessmentTable /> from the JSON data. It has no prose sections for individual risk justifications.
• The JSON (ai-risk-assessment.json) has generic mitigation lists as flat arrays. There is NO categorisation into design/process/information. There is NO severity rationale (why 4 not 5). There is NO occurrence rate derivation chain. There is NO IFU mapping.
• ai-risk-assessment-UPDATED.json is identical to the original for these three risks; no changes have been made.

What must be done: Either:

• (a) Add structured fields to the JSON schema (severity_justification, mitigation_categories, occurrence_chain, ifu_mapping) and populate them, plus update the React component to render them, OR
• (b) Add dedicated prose sections to the MDX file below the <AIRiskAssessmentTable /> component for each of the three audited risks.

Assigned to: Alfonso (all 5 sub-tasks)

The 5 sub-tasks:

1. Document severity 4 justification (why not 5): with ISO 14971 Annex C, MDCG 2020-1 VCA, MEDDEV A7.3 grounding and sensitivity analysis
2. Categorise mitigations per risk as design / process / information
3. Add occurrence rate rationale with 3-step chain (data source → appraisal method → derived value) per risk
4. Map each residual risk to the specific IFU section where it is communicated
5. Document cross-reference between R-TF-028-011 and R-TF-013-002 risk scales

ALERT 3: CER PMS section contradicts responses and PSUR RESOLVED (2026-04-07)

Resolved: 2026-04-07 after internal meeting

Root cause: The "7 non-serious incidents" came from R-TF-007-003 (PSUR), which is an obsolete document. The PSUR uses a Class IIa/IIb format that does not apply to the legacy device (Class 1 under MDD). Saray confirmed in the 2026-04-07 meeting that the PSUR should be deleted and the legacy device's PMS report should use the PMS report format (Class 1).

Actions taken:

1. PSUR (R-TF-007-003) moved to deprecated/ folder to prevent future confusion.
2. CER PMS section (lines 973-979) rewritten: added MDCG 2020-6 § 6.2.2 citation, fixed future-tense language, acknowledged legacy PMS data as clinical evidence per Article 2(48).
3. Item 3a and 3b responses corrected: all references to "7 non-serious incidents" replaced with "zero complaints regarding clinical safety or performance."
4. Item 7 message-for-alfonso corrected: PSUR reference replaced with PMS data reference, deprecation note added.
5. CER "Zero complaints" line (968) is correct, confirmed by Saray.

Remaining: The legacy device needs a proper PMS report in Class 1 format. This is a separate task, not a blocker for the current responses.

ALERT 4: Physician surveys not integrated anywhere

Affects: Item 3b response (sufficiency argument)

Status: To Do, Very High priority, Assigned to Jordi

The BSI meeting (2026-03-25) and the internal debrief both identify physician surveys from 4 years of deployment as critical real-world evidence. Nick specifically asked for evidence that the device improves outcomes in actual clinical workflows.

The kanban has i3b_surveys as Very High priority but no response or CER section addresses this. The Item 3b response references PMS data (incident counts) but NOT the physician questionnaires as a separate evidence stream.

This is one of the strongest available evidence sources and BSI explicitly asked for it.

ALERT 5: Per-paper analysis prose not written

Affects: Item 3a response (clinical data analysis)

Status: To Do, Very High priority, Assigned to Jordi

Erin said: "Really what I'm looking for here is the analysis of what was done, what were the limitations, what was the methodology, what devices were included... it's not enough to just say this is the paper."

The CER has structured tables and a reconciliation section, but the per-study analytical prose (methodology assessment, limitations discussion, device version used) that Erin specifically asked for has not been written.

ALERT 6: PMCF activity pruning not done

Affects: Item 6a response

Status: To Do, High priority, Assigned to Jordi

BSI said the PMCF plan is "overwhelming" with too many activities. The plan currently has Activities A.1 through C.2.3 (11 activities for Gaps 1-3) plus the FDA activities (C.2.1-C.2.3). Erin asked for activities not linked to specific gaps to be removed.

The Item 6a response says activities have been linked to gaps, but it does not mention removing unlinked ones. The PMCF plan still contains all original activities.

Cross-reference to kanban

The kanban board in index.mdx has been updated on 2026-04-06 to reflect these findings. The new BLOCKED column contains items where the response exists but the source document has NOT been updated. These must be resolved before submission.