Source Document Verification Audit (2026-04-06)

Responses reference changes that do not exist in source documents

On 2026-04-06, a systematic verification was performed comparing every Item response (response.mdx) against the actual source documents they claim to have updated. Multiple responses describe completed work that has NOT been done in the source documents. If these responses are submitted to BSI without fixing the source documents, BSI will check the referenced sections and find them missing — which is worse than not claiming the change at all.

Deadline: 2026-04-21 (extension from Arancha).

Verification method

Each response was checked against the actual file content using text search in:

• R-TF-015-003 Clinical Evaluation Report (CER)
• R-TF-007-002 Post-Market Clinical Follow-up (PMCF) Plan
• R-TF-028-011 AI Risk Assessment (MDX + JSON data)
• clinicalBenefits.ts (benefits consolidation)

Summary

Area	Verified?	Detail
CER: 3 benefits (7GH, 5RB, 3KX)	YES	clinicalBenefits.ts has 3 benefits with merger notes
CER: Tiered evidence strategy	YES	Section exists at line 704
CER: Evidence coverage by disease category	YES	Section exists at line 732, 7-category matrix present
CER: Acceptance criteria derivation from SotA	YES	Section exists at line 1493, derivation tables present
CER: Summary of clinical benefits achievement	YES	Table exists at line 1557, 3 rows (7GH, 5RB, 3KX)
CER: Predictive values by clinical setting	YES	Section exists at line 1541
CER: Safety benchmarking against SotA	YES	Section exists at line 1668
CER: Justification of sufficiency	YES	Section exists at line 1435, demographics table present
CER: MEDDEV 2.7.1 Rev 4 stages	YES	Section exists at line 230 (Stages 0-4)
CER: Usability section	YES	Lines 1127-1141, full methodology/results/residual risk
CER: Demographics/Fitzpatrick table	YES	Lines 1449-1453, aggregate table present
CER: Equivalence with 4 specific changes	YES	Lines 839-844 (microservices, HL7 FHIR, encryption, DIQA)
CER: Gaps 4 and 5 declared	YES	Lines 1581-1583 in "Need for more clinical evidence"
CER: Legacy PMS data (4,500 reports)	YES	Line 964 references the data
CER: 7 non-serious incidents from PSUR	NO	CER line 968 says "Zero complaints" — see alert below
CER: MDCG 2020-6 § 6.2.2 citation	NO	Not referenced anywhere in the CER — see alert below
CER: Future-tense PMS language fixed	NO	Lines 973 and 977 still use future tense — see alert below
PMCF Plan: Section D (D.1, D.2)	NO	Does not exist — see alert below
PMCF Plan: Gap 4 and Gap 5 in objectives	NO	Only Gaps 1-3 listed — see alert below
PMCF Plan: Coverage mapping for gaps	NO	Not present — see alert below
PMCF Plan: Evaluation of similar devices	YES	Section exists at line 94, references SkinVision/DERM etc.
PMCF Plan: Teledermatology clarification	YES	Line 45, info admonition present
AI Risk Assessment: Severity 4 justification	NO	Not in JSON or MDX — see alert below
AI Risk Assessment: Categorised mitigations	NO	Mitigations are flat lists, not design/process/info
AI Risk Assessment: 3-step occurrence chain	NO	Not documented anywhere
AI Risk Assessment: IFU section mapping	NO	Not documented anywhere
AI Risk Assessment: R-TF-013-002 cross-ref	NO	Not documented in MDX

---

ALERT 1: PMCF Plan missing Section D (Activities D.1 and D.2)

Affects: Item 6a response, Item 6b response, CER Gap 4/5 declarations

File: R-TF-007-002-Post-Market-Clinical-Follow-up-PMCF-Plan.mdx (300 lines, ends at line 299)

What the responses say: "We have implemented a comprehensive update... expanded with detailed methodological descriptions for all 11 activities (A.1 through D.2)... two new activities (D.1 and D.2) addressing the evidence coverage gaps."

What the file actually contains: Only Gaps 1-3 and Activities A.1 through C.2.3. The file has NO Section D, NO Activity D.1, NO Activity D.2, NO references to Gap 4 (autoimmune) or Gap 5 (genodermatoses).

Why this is critical: The CER (line 170) says "These are addressed through targeted PMCF activities documented in R-TF-007-002." If BSI checks R-TF-007-002 and finds no D.1/D.2, the CER's gap declarations become unsupported claims — turning "acceptable gap with PMCF" into "unsupported gap," which is a non-conformity.

What must be done: Add Section D with Activities D.1 and D.2 exactly as specified in item-0/issue-6-pmcf.mdx. Also add Gap 4 and Gap 5 to the Specific Objectives section and update the Coverage Mapping.

Assigned to: Jordi

Specification: Full spec is in item-0/issue-6-pmcf.mdx

ALERT 2: AI Risk Assessment not updated (all 5 Alfonso sub-tasks)

Affects: Item 7 response (all 4 sections)

Files: r-tf-028-011-aiml-risk-assessment.mdx and ai-risk-assessment.json

What the Item 7 response says: "We have updated R-TF-028-011 to document the explicit rationale..." with detailed severity justifications, categorised mitigations (design/process/information), three-step occurrence rate chains, and IFU section mappings for AI-RISK-001, AI-RISK-016, AI-RISK-021.

What the files actually contain:

• The MDX file is a thin wrapper that renders <AIRiskAssessmentTable /> from the JSON data. It has no prose sections for individual risk justifications.
• The JSON (ai-risk-assessment.json) has generic mitigation lists as flat arrays. There is NO categorisation into design/process/information. There is NO severity rationale (why 4 not 5). There is NO occurrence rate derivation chain. There is NO IFU mapping.
• ai-risk-assessment-UPDATED.json is identical to the original for these three risks — no changes have been made.

What must be done: Either:

• (a) Add structured fields to the JSON schema (severity_justification, mitigation_categories, occurrence_chain, ifu_mapping) and populate them, plus update the React component to render them, OR
• (b) Add dedicated prose sections to the MDX file below the <AIRiskAssessmentTable /> component for each of the three audited risks.

Assigned to: Alfonso (all 5 sub-tasks)

The 5 sub-tasks:

1. Document severity 4 justification (why not 5) — with ISO 14971 Annex C, MDCG 2020-1 VCA, MEDDEV A7.3 grounding and sensitivity analysis
2. Categorise mitigations per risk as design / process / information
3. Add occurrence rate rationale with 3-step chain (data source → appraisal method → derived value) per risk
4. Map each residual risk to the specific IFU section where it is communicated
5. Document cross-reference between R-TF-028-011 and R-TF-013-002 risk scales

ALERT 3: CER PMS section contradicts responses and PSUR

Affects: Item 3a response, Item 3b response

File: R-TF-015-003-Clinical-Evaluation-Report.mdx, lines 960-979

What the responses say: "7 non-serious incidents and zero serious incidents, CAPAs, or FSCAs" and "grounded in MDCG 2020-6 § 6.2.2."

What the CER actually says (line 968-971):

• "Zero complaints regarding the safety or clinical performance of the device."
• "Zero Serious Incidents or reportable adverse events."
• "Zero CAPAs related to algorithmic performance."
• "Zero FSCAs or product recalls."

Three problems:

1. The CER says "Zero complaints" but the PSUR documents 7 non-serious incidents (4 customer complaints + 3 internal NCs). This is a factual inconsistency between technical documentation files — BSI will compare the CER against the PSUR.
2. MDCG 2020-6 § 6.2.2 is NOT cited anywhere in the CER. The responses claim this citation grounds the use of legacy PMS data, but it doesn't exist.
3. Lines 973 and 977 still use future tense ("Moving forward, once on the market..."; "there are currently no retrospective PMCF data") — directly contradicting the strategy of using legacy PMS data as current evidence.

What must be done:

1. Correct lines 968-971 to reflect the PSUR data: 7 non-serious incidents, zero serious incidents.
2. Add explicit citation of MDCG 2020-6 § 6.2.2 as the regulatory basis for using legacy device PMS data.
3. Rewrite lines 973-979 to remove future-only framing and acknowledge the legacy PMS data as current clinical evidence per Article 2(48).

Assigned to: Taig

ALERT 4: Physician surveys not integrated anywhere

Affects: Item 3b response (sufficiency argument)

Status: To Do — Very High priority — Assigned to Jordi

The BSI meeting (2026-03-25) and the internal debrief both identify physician surveys from 4 years of deployment as critical real-world evidence. Nick specifically asked for evidence that the device improves outcomes in actual clinical workflows.

The kanban has i3b_surveys as Very High priority but no response or CER section addresses this. The Item 3b response references PMS data (incident counts) but NOT the physician questionnaires as a separate evidence stream.

This is one of the strongest available evidence sources and BSI explicitly asked for it.

ALERT 5: Per-paper analysis prose not written

Affects: Item 3a response (clinical data analysis)

Status: To Do — Very High priority — Assigned to Jordi

Erin said: "Really what I'm looking for here is the analysis of what was done, what were the limitations, what was the methodology, what devices were included... it's not enough to just say this is the paper."

The CER has structured tables and a reconciliation section, but the per-study analytical prose (methodology assessment, limitations discussion, device version used) that Erin specifically asked for has not been written.

ALERT 6: PMCF activity pruning not done

Affects: Item 6a response

Status: To Do — High priority — Assigned to Jordi

BSI said the PMCF plan is "overwhelming" with too many activities. The plan currently has Activities A.1 through C.2.3 (11 activities for Gaps 1-3) plus the FDA activities (C.2.1-C.2.3). Erin asked for activities not linked to specific gaps to be removed.

The Item 6a response says activities have been linked to gaps, but it does not mention removing unlinked ones. The PMCF plan still contains all original activities.

Cross-reference to kanban

The kanban board in index.mdx has been updated on 2026-04-06 to reflect these findings. The new BLOCKED column contains items where the response exists but the source document has NOT been updated. These must be resolved before submission.