R-002-004 Annual management review report

Meeting details

Assistants

Name	Position
Andy Aguilar	General Manager
Taig Mac Carthy	Design & Development Manager
Alfonso Medela	Technical Responsible & PRRC
Giulia Foglia	Quality Manager & PRRC

Place

Online

Date

2025-01-13

Inputs

Company context, quality policy and objectives review

SWOT and CAME analysis

SWOT and CAME analysis has been performed and recorded at the R-002-006 SWOT and CAME analysis.

The most important weaknesses and threats detected come from the fact that the company is very young, the team is still small and that our activity requires us to adapt and comply to many different regulations. In spite of that, we have a differential and validated value proposition and the team is really compromised, with deep knowledge on this value and making an effort on, not only compling with the regulatory requirements, but also with improving our tools to increase the productivity and knowledge. We know that our field has a lot of opportunities for us, as there is a reduced number of specialists in a growing demand scenario.

From these findings we have decided that we are going to implement the following main aspects:

• Certify medical device under MDR 2017/745 (Quality objective #1 of 2025)
• Register medical device in Mexico (Quality objective #2 of 2025)
• Register medical device in Brazil (Quality objective #2 of 2025): finalise the registration process
• Register medical device in USA (Quality objective #2 of 2025)
• Register medical device in Japan (Quality objective #2 of 2025)
• Register medical device in Saudi Arabia (Quality objective #2 of 2025)
• Implement mechanisms for regular customer feedback to improve business development operations (Quality objective #5 of 2025)
• Forge stronger partnerships with pharmaceutical firms to facilitate the use of digital solutions in clinical trials and hospital endorsement
• Perform clinical studies to acquire more clinical evidences related to the claims of our device (as also described in the Necessary updates to Clinical Evaluation section of this report).

Quality policy

The Quality Policy Annex_1_Quality Policy was released in September 2023. We identfied a need of change in the section of the policy where we list the applicable standards. This change will be implemented in the first quarter of 2025 and it is also listed in the Output section of this report as part of the QMS improvements identified for 2025.

Quality objectives

Quality objectives for 2024

2024 objectives are reflected in the R-002-001_Quality objectives list_2024_001 and they are summarized below together with their accomplishment during the year:

1. Certify with a notified body the new Class IIa medical device (92% completion): during 2024 we went through the three round of questions of the technical review and the first round of questions of the clinical review. During the last quarter of 2024, BSI notified us that we could be enrolled in the so called nonconformity pilot trial scheme to accelarate the transition to MDR. According to this scheme, we are going to receive nonconformities about our technical and clinical documentation at the beginning of 2025 and we will have an established period of time to address all nonconformities. In the meantime, we are working on improving the technical and clinical documentation to be ready to address the nonconformities on time.
2. Certification of the AI LABS GROUP's QMS under EN-ISO 13485 by a Notified Body (100% completion): during the first quarter of 2024, we performed the second stage of the ISO 13485 audit with BSI. The outcome was successful (we received 5 minor nonconformities), we addressed and impelmented the minor nonconformities according to our internal process and according to the timelines agreed with BSI. During the third quarter of 2024, we received the IS0 13485 certificate.
3. Register medical device in Mexico, Brazil and USA (40% completion): during 2024, we decided to put the registration in Mexico on hold to give priority to the registration of our medical device in Brazil to align our regulatory roadmap with the commercial opportunities.
   • Registration in Brazil: we appointed an authorised representative based in Brazil, we prepared, in collaboration with the authorised representative, the technical documentation required by ANVISA based on the risk class of our device, we submitted the technical dossier to ANVISA and we expect to receive a feedback from ANVISA during the first quarter of 2025.
   • Registration in US: we established the regulatory strategy to obtain the FDA approval that consists of the 510(k) submission using Dermasensor device as predicate to claim equivalence. We also decided to have a pre-submission meeing with FDA during the first quarter of 2025 to be fully prepared for the submission, we defined the intended use of the device taking into account the predicate device's intended use, and we are currently working on the revision of the software documentation to comply with FDA requirements.
4. Increase in turnover by 2.5X (11.18% completion): the company has kept generating new opportunities and moving conversations forward but the biggest contracts closing dates were moved forward to 2025. The last quarter was the busiest one in terms of invoicing. The team is fully onboarded by the end of the year and working full speed in all sales phases.
5. Product meets customer expectations (20% completion): during the most part of 2024 the customer success manager position was vacant and the business development team had to take the most urgent tasks of this position during the vacancy, therefore surveys were not sent to customers to gather feedback on the use and performance of our device. In the last quarter of 2024 a new customer success manager was hired and started working on the re-definition of customer surveys. The customer surveys have been restructured and the next steps are definining the methodology for sending surveys to current customers, defining significant KPIs, sending the surveys, analysing the results.

Quality objectives for 2025

The new quality objectives established for 2025 are reflected in the R-002-001_Quality objectives list_2025 and are listed below:

1. Certify the medical device under MDR: this quality objective is the extension of the quality objective 1 set out for 2024 since it was not fully achieved in 2024.
2. Obtain regulatory clearance in new markets: this quality objective is the extension of the quality objective 3 set out for 2024 since it was not fully achieved in 2024 ad it has been reviewed to include the new markets according to the regulatory roadmap established for 2025 (Brazil, USA, Japan, Saudi Arabia and Switzerland).
3. Enhnace cybersecurity: this is a new quality objective and it aims to improve regulatory compliance, customer satisfaction and product quality improvement.
4. Strengthen technical documentation management among the different markets: this is a new quality objectives and it aims to improve regulatory readiness and compliance with each market's requirements.
5. Product meets customer expectations: this quality objective is the extension of the quality objective 5 set out for 2024 since it was not achieved in 2024 due to vacancy of the customer success manager position for most part of the year.

Feedback

We receive feedback from our clients/users by different ways:

1. Direct consults through email, phone calls or contact form at the webpage or medical device. All of them are registered in our tickets management tool (Hubspot) in accordance with the general procedure GP-014 Feedback and complaints.
   • In 2024 we registered 83 tickets: 32 related to technical assistance and 51 related to non-technical questions coming from patients.
   • The majority of the technical assistance tickets are related to the login process, password management and how to see the results of the medical device validated by the doctor.
   • The majority of the non-technical questions are related to medical questions that patients erroneously address to us instead of contacting their assigned doctor.
2. Survey to customers (healthcare professionals across primary and secondary healthcare specialties) to gather data about use and performance: as described in the Quality objectives for 2024 section (quality objective #5), during the most part of 2024 the customer success manager position was vacant and the business development team had to take the most urgent tasks of this position during the vacancy, therefore surveys were not sent to customers to gather feedback on the use and performance of our device. In the last quarter of 2024 a new customer success manager was hired and started working on the re-definition of customer surveys. The new defined surveys will be sent starting from 2025 and results analysed according to new KPIs (this is the quality objective #5 for 2025).
3. Surveys performed at the end of the clinical studies to know the satisfaction of the users during the study: in 2024 we sent one survey at the end of the clinical study LEGIT.HEALTH_SAN_2024 with the following results: six dermatologists, six general practitioners, and three family doctors completed the questionnaire, taking an average of 2 minutes and 38 seconds. Healthcare professionals rated the utility of the data with an average score of 7.3. Dermatologists and general practitioners also rated it 7.3, while family doctors rated it 7. The design and usability of Legit.Health received an average score of 8, with all respondents giving it the same rating, indicating strong consensus.

Treatment of complaints

The processing of customers complaints is carried out in accordance with the general procedure GP-014 Feedback and complaints.

We review annually the number of customer complaints (R-002-002_Quality indicators Indicator 33) to ensure they are not increasing dangerously. In 2024 we received 3 customer complaints

Details of the 3 customer complaint are given in the table below:

Customer complaint description	Creation date	Quarter	Action	Action status	CAPA description	CAPA status
The API response for /predict have changed without notice	2024-01-29	Q1	The investigation of the customer complaints revealed that an update of a non-clinical outcome of the medical device had an impact on the API response (not in the performance of the output, rather on the structure of the information returned). The technical team clarified this issue with the affected customer.	Closed	CAPA not required	Not applicable
API endpoint diagnostic_support timed out	2024-09-12	Q3	Investigation of the issue and monitoring the device performance for a long period of time. Investigation outcome: there was a network congestion at specific moments, slowing down the response time Immediate action: we recommended the customer to extend the time-out to solve the issue	Closed	Improve the software architecture to process requests more efficiently and ensure response times are consistent even for high volume peaks	Effectiveness under evaluation
For an image of a lesion diagnosed as melanoma, the model outputs a confidence score of 60% for 'nevus' rather than melanoma.	2024-10-04	Q4	Investigation of the issue and revision of the specific image analysed by the device. Investigation outcome: In reviewing the model's output, melanoma ranks second with a reasonably high confidence of 16.44%. Translating this result into performance metrics, we see a top-1 accuracy of 0% (since the correct category wasn’t the highest probability), but top-3 and top-5 accuracies of 100%, meaning the model included the correct diagnosis within the top 3 and top 5 predictions. Our general performance metrics show that the model achieves 70% top-1, 86% top-3, and 91% top-5 accuracy for melanoma. This also implies that 30% of cases have a different top-1 prediction from the specialist’s diagnosis, though this doesn’t necessarily mean the diagnosis was incorrect. This suggests a misalignment in the customer’s understanding of how the model’s predictions work. Immediate action: communicate with the customer to better explain the outputs provided by the device.	Closed	CAPA not required	Not applicable

Notifications to regulatory authorities

During the year 2024, we notified the following Competent Health Authorities:

1. FDA (USA) for the annual renewal of the small business certification in USA.
2. ANVISA (Brazil) for submitting the technical dossier to obtain ANVISA approval.

No notification for vigliance matters were done during 2024.

Audits

External audits

During 2024 the second stage audit to obtain the ISO 13485 certificate was executed by our appointed Notified Body (BSI Group The Netherlands B.V.). The audit was executed according to the ISO 13485:2016 requirements, MDR 2017/745 Annex IX Chapter I and III requirements to determine the effectiveness of the QMS implemented in accrdance with applicable regulatory requirements. The audit was conducted in a hybrid mode (remote and on-site) in dates February 20 and 21. As a result of the audit, 5 minor nonconformities were raised. The details of the audit outcomes are explained in the audit report stored as part of the QMS.

The table below provides a summary of the nonconformities and their resolution:

NC from audit	Internal NC ID	Correction	Correction Status	CAPA plan	CAPA ID	CAPA Status
The CAPA process is not fully effective	R006001-66	Update the nonconformity template: this means create a template for nonconformity and a separate one for CAPA including all the requirements coming from ISO 13485:2016	Closed	- Review and update the NC/CAPA workflow - Review GP-006 Non-conformities, Corrective and preventive actions to insert the new/updates templates for NC and CAPA and explain the modified process - Validate the new templates for NC and CAPA - Review all existing NC/CAPA records to include the required information according to new/updated templates - Training the team on notification of customer claims to Quality team - Training relevant personnel (all team members) on the new NC/CAPA workflow and process - Review resolution of NC and CAPA (including timing to open NC/CAPA from first detection) as part of the NC/CAPA activity performed quarterly by the Quality Manager.	R006001-67	Efficacy verification
The design and development process is not fully effective	R006001-68	Create a new template for design stage	Closed	- Validate the new template - Review GP-012 Design, Redesign and Development to include the new template for stage review and explain how stage review will be performed - Training relevant personnel on new design process - Schedule internal audit to review the compliance of the design and development process	R006001-69	Efficacy verification
The change control process is not fully effective	R006001-70	- Review and understand the requirements related to QMS changes (concepts of significant/non-significant applied to QMS changes) - Review and improve GP-023 - Change control management to include significant changes of QMS and their notification to regulatory authorities - Review and improve the template for QMS changes	Closed	- Review current QMS changes records to correctly classify the QMS changes as significant or non-significant (and notify Regulatory Authorities accordingly) - Training the relevant personnel on the new change control management process - Conduct a periodic review of regulatory requirements to stay up to date with any new/updated requirements	R006001-71	Closed
The human resources process is not fully effective	R006001-72	Upload missing CV (reviewed and signed) to Factorial	Closed	- Add to the training plan template (T-005-003) a training matrix for the QMS procedures applicable to each job descriptions - Review applicable QMS procedures for each job description and document it in the QMS training matrix - Include the applicable QMS procedures in the onboarding process (add a card in the onboarding Trello for the QMS procedures) - Create a template for documenting the training on QMS procedures to keep evidence of the training - Review GP-005 to include the task of QMS procedures in the onboarding process and to include the new template - Training relevant personnel (all team members) on the new requirements set out in GP-005 - Communicate to the team the importance of keeping CV up to date by adding an explanation in the quality calendar (T-002-005) - Add the activity of updating the CV on a yearly basis in the quality calendar (T-002-005) and schedule a reminder for this activity - Schedule internal audit to verify compliance of the training and human resources process	R006001-73	Efficacy verification
The risk management process is not fully effective	R006001-74	Add risk management policy to risk management procedure (GP-013)	Closed	- Training relevant personnel on the risk management policy added to the procedure GP-013 - Review the risk management record to update the severity incorrectly assigned to certain risks to ensure that the severity assessment aligns with established criteria and is based on accurate and up-to-date information - Training relevant personnel on the definitions of severity scores defined in GP-013 - Schedule internal audit to verify compliance of the risk management process	R006001-75	Efficacy verification

Internal audits

The internal audit was conducted in date September 19, 2024. It was performed by an external company (PS Consulting) according to the requirements of ISO 13485:2016 and MDR 2017/745 Annex IX. As a result of the internal audit, 4 minor nonconformities were raised. The details of the internal audit outcomes can be found in the internal audit report (R-003-005 Internal audit report_2024).

The table below provides a summary of the internal audit findings and their resolution:

Finding from audit	Internal NC ID	Correction	Correction Status	CAPA plan	CAPA ID	CAPA Status
The document control process is not fully effective	R006001-90	Review R-001-001 with the latest versions and approval dates of the documents	Closed	Review quality calendar (R-002-005) to include the activity of updating list of internal documents (R-001-001) as a recurrent activity (once every 2 months)	R006001-94	Efficacy verification
The medical device requirements are not fully identified	R006001-91	- Remove reference of old spanish royal decree and update the procedure (GP-008) with the current decree requirements - Update the quality and regulatory roadmap (R-002-008) - Review the PRRC requirements defined in the royal decree and update them in the procedure and job description, if necessary	Closed	- Add to the quality calendar (R-002-005) the activity of reviewing the quality and regulatory roadmap (R-002-008) at least every 3 months - Add the frequency (quarterly) of revision of R-002-008 Quality and regulatory roadmap to the procedure GP-008	R006001-95	Efficacy verification
The test run environment is not clearly defined in all the tests	R006001-92	Identify the tests which do not contain all the required information	Closed	Review all the test plans and test runs of the DHF to include the missing information about test run environment	R006001-96	Under implementation
The production control process is not fully effective	R006001-93	None (for the reasns explained in the NC document)	Closed	- Review GP-012 to clarify that the software version release shall be done once the software as the required regulatory approval (e.g. CE mark for Europe) - Review template for software version release (T-012-004) to include in the final checklist The medical device has obtained the required regulatory approval (or a similar statement)	R006001-97	Efficacy verification

Monitoring and measurement of processes

Quality indicators review

As it is described at the GP-002 Quality planning procedure we monitor our processes periodically and register this follow up at the R-002-003 Quality indicators record. The performance of each quality process is described below:

• Leadership process: 2 indicators (Indicator 1, 2) out of 3 meet the established target while Indicator 3 doesn't meet its target.
• Design and development process: all the 3 indicators (Indicator 4, 5, 6) meet the established target.
• Sales process: 2 indicators (Indicator 7, 8) meet the established target while Indicator 9 doesn't meet its target.
• Purchase process: all 3 indicators (Indicator 10, 11, 12) meet the established targets.
• Quality control process: all 3 indicators (Indicator 16, 17, 18) meet the established targets.
• Technical assistance process: all 3 indicators (Indicator 19, 20, 21) meet the established targets.
• Post-market surveillance process: all 3 indicators (Indicator 22, 23, 24) meet the established targets.
• Operations process: all 3 indicators (Indicator 25, 2, 27) meet the established target.
• Human resources process: all 3 indicators (Indicator 28, 29, 30) meet the established target.
• Quality management process: 2 indicators (Indicator 32, 33) meet the established target while Indicator 31 doesn't.

The indicators that didn't meet the established targets in 2024 will be monitored during 2025 according to the set frequency (together with all the other indicators) and, in case during the first review their actual values do not meet the target, actions will be defined to keep their performance under control.

Other quality processes

The following activities related to quality processes were implemented during 2024:

• Update of GP-006 procedure to document the new process for handling nonconformity and CAPA: we created 2 different templates, one for nonconformity and one for CAPA and we updated the different stages of the process. We also reviewed the information in the nonconformity and CAPA templates to include required fields such as a statement about criticality, the type of impact (safety, performance, security), a reference to the DHF requirement involved with the issue, a reference to the product version (in case of product nonconformity).
• Migration of DHF from Confluence to GitHub
• Ongoing registration of medical device in Brazil with required updates of the QMS: we creatd a procedure to document the requirements to place our device in the brazilian market and to document the post-market requirements.
• Creation of procedure for United Kingdom (UK) market: we created a procedure to document the requirements to place our device in the UK market and to document the applicable post-market requirements.
• Creation of procedure for United States of America (USA) market: the requirements to place our device in the USA market and to document the applicable post-market requirements.
• Update of GP-005 to include the training on the QMS during onboarding.
• Creation of procedure SP-001-001 to document the eIFU requirements according to the EU Regulation 2021/2226 on electronic IFU for medical devices.
• Creation of procedure for change management (GP-023) to document the change control process for both design and quality changes, including the notification of significant changes to regulatory authorities.
• Creation of procedure SP-012-001 to document the requirements on the Predetermined Change Control Plan (PCCP) to comply with FDA and AI Act requirements.
• Creation of the quality and regulatory roadmap (R-002-008) to document the regulatory strategy in selected countries.
• Creation of responsibility matrix (Annex 1 of GP-001) to define the different roles on the QMS procedures and associate them with the proper job description.
• Creation of the substitution table (Annex 4 of the quality manual) to document which job descriptions can substitute one another in the event of absence, transitions, or changes in the organisation.
• Update of post-market surveillance plan and report to fully comply with requirements set out in MDR 2017/745.
• Update of clinical investigation plan and report to fully comply with requirements set out in MDR 2017/745.

Monitoring and measurement of the product

We establish product verifications throughout the design and development process according to GP-012 Design and developmentto comply with the applicable general safety and performance requirements (GSPR). As we have mentioned in the previous section we have a system in place to monitor the processes and product performance that is described at the GP-002 Quality planning. R-002-003_Quality indicators shows that the product has properly operated during this period, as the quality control results has been satisfactory (Indicator 16), software latest version has been 100% accesible to the users (Indicator 17), it has been disabled only twice (Indicator 20) and the technical assistance issues were related to the initial usage of the product (see previous feedback section) and all of them quickly solved. There have been no incidents or adverse events detected as a result of the actions of the post-market activities during 2024 (Indicators 22 and 23).

Nonconformities and Corrective and preventive actions (NC & CAPAs)

Number of NC & CAPA

During the year 2024 we have registered:

• 13 nonconformities (4 nonconformities related to product, 9 nonconformities related to QMS processes)
• 12 CAPAs (3 CAPAs related to the product, 9 CAPAs related to QMS processes). All the CAPAs opened during 2024 were correcive actions.

NC & CAPA can also be divided based on their source:

• internal: when the nonconformity is detected by Legit.Health's employees
• finding from audit: when the nonconformity is detected during internal/external audits
• customer claim: when the issue is detected and communicated by customer.

The following graph shows the percentage of nonconformities based on their sources:

Same analysis has been run for the CAPA opened during 2024 and the results are shown in the following graph:

NC & CAPA area affected

The nonconformities can be divided into nonconformities related to product and nonconformities related to the QMS processes. The following graph shows the distribution of nonconformities based on their type (product or QMS process) together with the details of the QMS process affected by the nonconformities.

We run the same analysis for the CAPA and the result is shown in the following chart:

NC & CAPA status

In our nonconformity process described in the dedicated procedure (GP-006 Nonconformities, Corrective and Preventive Actions) we identified 3 different status that are explained below together with the number of nonconformities for each status.

• Nonconformity reception (0 nonconformities): when we open a nonconformity and we started filling in the information available at the moment of opening the nonconformity, including the immediate correction definition.
• Nonconformity investigation (0 nonconformities): when we investigate the root cause of the nonconformity, we estabish whether a CAPA is required and when the correction is under implementation.
• Solved (13 nonconformities): when the immediate correction is implemented.

All the nonconformities opened during 2024 have been investigated and fully addressed.

The status for CAPA according to our procedure (GP-006 Nonconformities, Corrective and Preventive Actions) are the following (we provide the number of CAPA for each status as well):

• CAPA reception (2 CAPA): when we open a CAPA and we define the CAPA plan.
• Efficacy verification (9 CAPA): when the CAPA plan is fully implemented and we monitor the effectiveness of the implemented corrective (or preventive) actions.
• Impact verification (0 CAPA): when the effectiveness of the implemented actions is successfully verified and we monitor the impact of the actions in terms of regulatory requirements, safety and performance, effectiveness in relation to the intended purpose.
• Solved (1 CAPA): when the CAPA plan is fully implemented and both effectiveness and impact are successfully verified.

NC & CAPA resolution time

For each nonconformity and CAPA we define a due date by which the correction and corrective (or preventive) action shall be implemented.

The followig graphs show the percentage of nonconformity (first graph) and CAPA (second graph) that have been implemented by the due date and the ones not implemented by the due date.

Follow-up actions from previous management reviews

During last year annual review meeting, a few actions to be implemented in 2024 have been identified. They are presented below together with the the activites performed:

• Update the supplier evaluation record (R-010-001_Supplier evaluation) to include a new provider of services (process): the supplier evaluation record has been updated with the evaluation and other information about new approved suppliers.
• Update the quality calendar (R-002-005_Quality calendar) with the foressen quality activities for 2024 (process): the quality calendar has been updated to include all the foreseen quality activities for 2024. The activities have been performed according to the timelines.
• Small business organization renewal (process): the certification for small business in USA has been renewed according to the timelines defined by the FDA. We are waiting for final response from FDA on the statud of the certification.
• Create a separate procedure for clinical investigation (process): this action has not been implemented during 2024 due to low priority of this activity compared to other more urgent activities. During 2025 we will review this activity to understand if it is really needed.
• Perform a gap analysis of the new FDA Quality System Regulation (new requirement): this activity has not been performed in 2024 because the new FDA Quality System Regulation will be officially in place starting from February 2, 2026, therefore we gave priority to other activities.
• Define and explain our regulatory strategy (this requirement is coming from MDR 2017/745) and update the Quality and regulatory roadmap (R-002-008) (new requirement): the regulatory strategy has been added to the procedure GP-008 Product requirements and the quality and regulatory roadmap updated with the defined strategy. Furthermore, during 2024 we created new procedures to document the process and requirements to place our device in the markets defined in the regulatory roadmap.
• Create PCCP (Predetermined Change Control Plan) (new requirement): we created a specific procedure (SP-012-001) to document the requirements coming from FDA and the AI Act and we created the template for the PCCP. During 2025, we will work on the post-market changes that we plan to add in the PCCP. The PCCP document will be one of the documents to submit as part of the technical docuemntation for the 510(k) approval.
• Annual renewal of product registration in AEMPS portal (RPS) (new requirement): after investigating this new requirement coming from the new and current version of the Real Decreto 192/2023, we found out that this requirement is not yet applicable because it is for the new medical device database that AEMPS is working on and that is explain in the new Real Decreto. Therefore, we removed this activity from the quality calendar and from the procedure (GP-008) that describes it.

Changes that could affect the QMS

The list of changes identified and implemented during 2024 are summarised below:

• change in the person responsible for regulatory compliance (PRRC)
• change in the nonconformiy and CAPA process
• migration of DHF from Confluence to Github
• change in regulatory roadmap: addition of ANVISA (Brazil) approval

The changes are documented and detailed in the change control record (R-023-001) stored as part of the QMS.

Recommendations for improvement

During this period we have studied all the recommendations received from the different sources (clients, audits, employees, consultants) and we have implemented all of the useful and relevant for us and for our clients.

We provide the main improvements implemented in 2024 below:

• revision of the nonconformity and CAPA process, documented in GP-006
• revision of the vigilance requirements under MDR, documented in GP-004
• creation of a substitution matrix, documented in Annex 4 of the quality manual
• creation of a responsibility matrix, documented in Annex 1 of GP-001
• creation of a QMS procedure matrix as a reference for the onboarding process for QMS procedures, documented in the record R-005-003
• revision of the templates for the post-market surveillance plan, post-market surveillance report and periodic safety update report (PSUR) and revision of the associated records
• creation of process for the management of changes affecting the QMS, documented in GP-023
• creation of procedure with the process to place devices into the US market, the UK market and the Brazilian market, documented respectively in GP-026, GP-027 and GP-028
• creation of the process for the management of the electronic IFU (eIFU), documented in SP-001-001
• revision of spanish requirements for the maintenance of the product's registry in AEMPS database, documented in GP-008
• improvement of the technical documentation with a special focus on the software requirements and tests documentation, risk management file, clinical investigation reports, clinical evaluation report, IFU, software lifecycle plan and report
• revision of template for Investigator's Brochure to fully comply with the requirements set out in ISO 14155, documented in T-015-005.

New or revised applicable regulatory requirements

One of the activities established in the quality calendar is the revision of regulatory requirements to identify any new/revised requirement that can be applicable to our QMS and/or product.

The table below provides the new/revised regulations, standards, guidances released during 2024 which are applicable to our medical device:

Regulation/Guidance	Update	Date
Regulation (EU) 2024/1860	New EU regulation which amends EU MDR 2017/745 requirements related EUDAMED entry into force	2024-07-09
Regulation (EU) 2024/1689 Artificial Intelligence Act	New EU regulation establishing requirements for AI systems	2024-06-13
Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions (FDA guidance)	New FDA guidance on design changes management for artificial intelligence-enabled device	2024-12-03
Global Unique Device Identification Database (GUDID) (FDA guidance)	Updated FDA guidance on the assignation and management of UDI number for devices FDA-approved in the US	2024-12-17
Guidance on the publication of the clinical investigation reports and their summaries in the absence of EUDAMED (MDCG 2024-15)	New MDCG guidance published on the topic of the publication of clinical investigations in absence of EUDAMED	2024-11
Questions and Answers on vigilance terms and concepts as outlined in the Regulation (EU) 2017/745 and Regulation (EU) 2017/746 (MDCG 2023-3, Rev 1)	First revision of MDCG 2023-3 on vigilance terms clarification	2024-11
Regulation (EU) 2017/745 - application of MDR requirements to ‘legacy devices’ and to devices placed on the market prior to 26 May 2021 in accordance with Directives 90/385/EEC or 93/42/EEC (MDCG 2021-25, Rev 1)	Revision of the guidance on placing legacy devices in the market	2024-10

Specific actions to ensure compliance with the new/revised regulatory requirements are detailed in the regulatory requirements review report (R-002-009) and are also discussed in the section Necessary changes to respond to new or revised applicable regulatory requirements of this report.

Outputs

Necessary improvements to maintain the suitability, adequacy and effectiveness of the QMS and its processes

To maintain the suitability, adequacy and effectiveness of the QMS, the following activities have been identified:

• Small business organization renewal: the FDA small business certificate shall be renewed every year between August 1 and September 30
• Revision of software requirements documentation to ensure compliance with the applicable FDA guidance
• Perform a usability test in compliance with requirements of IEC 62366-1 for both healthcare professionals (HCP) and Information Technology professionals (ITP) in Europe
• Perform a usability test in compliance with requirements of IEC 62366-1 and the applicable FDA guidance (Applying Human Factors and Usability Engineering to Medical Devices) for both healthcare professionals (HCP) and Information Technology professionals (ITP) in USA (to be included as part of the FDA submission)
• Revision of the procedure SP-012-001 Cybersecurity and Transparency Requirements by including the requirements coming from the applicable FDA guidance (Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions)
• Creation of cybersecurity records required for FDA submission
• Revision of DHF test plans and records to fully comply with the requirements set out in IEC 62304
• Creation of procedure to document regulatory requirements to place the medical device in specific country (e.g. Japan, Saudi Arabia)
• Revision of quality policy to update the applicable standards section

Product improvement in relation to customer requirements

The planned and ongoing improvements to the product are mainly focused on improving the robustness of the API connectivity, so the planned changes are related to software architecture.

At the same time, we plan to finalise the device's Instructions for Use (IFU) revision that we started in 2024 to restructure the available information and to provide more details to the end users.

Necessary changes to respond to new or revised applicable regulatory requirements

According to new regulations and new regulatory requirements identified, the following activites shall be implement during 2025 to ensure compliance:

• [USA] Creation of the Predetermined Change Control Plan (PCCP) record to be included as part of the FDA submission
• [USA] Inclusion of updated GUDID requirements in the procedure GP-026 Product requirements for US market to comply with the new version of the FDA guidance on GUDID
• [USA] Assignation and management of UDI number according to the requirements
• [EU] Revision of procedure GP-015 Clinical evaluation to ensure compliance with the new guidance MDCG 2024-15
• [EU] Document requirements of Regulation 2024/1860 in GP-008 Product requirements
• [EU] Fill in EUDAMED modules as soon as they become available and functional
• [EU] Stay up to date with latest news/guidances on the EU Artificial Intelligence (AI) Act (Regulation (EU) 2024/1689) and start the analysis of requirements applicable to devices classified as high-risk class according to the AI Act.

Necessary updates to Risk Management record

The risk management file is updated every time there is a need of change (e.g. new risk identified, probability/severity changes, addition of risk control measures).

We are currently reviewing the risk management file as part of the technical documentation review we are performing to transition to MDR. The main updates are the inclusion of information about the software item associated with each software risk and the information about the software cause. Furthermore, we are improving the information provided to verify the effectiveness of the risk control measures by adding specific reference to the evidence in support of the verification of effectiveness. These updates are originated from the requirements set out in the IEC 62304 (clauses 7.1.1 and 7.1.2).

Necessary updates to Clinical Evaluation

The results of the clinical investigations concluded in 2024 are documented in the clinical investigation reports and added to the clinical evaluation report of the product's technical documentation. The roadmap of the clinical studies is detailed in the document R-TF-015-008 Clinical development plan.

Necessary resources

During the annual review meeting we discussed about the need of resources for 2025 and the details are summarized below:

• Human resources:
  • Quality and regulatory manager
  • Product Marketing
  • Project manager
  • Account manager
  • Business development director
  • Customer success specialist
• Regulatory
  • Identify an authorised representative in Japan and have a contract in place
  • Identify an authorised representative in Saudi Arabia and have a contract in place
  • Identify an authorised representative in Switzerland and have a contract in place.

Signature meaning

The signatures for the approval process of this document can be found in the verified commits at the repository for the QMS. As a reference, the team members who are expected to participate in this document and their roles in the approval process, as defined in Annex I Responsibility Matrix of the GP-001, are:

• Author: JD-004
• Reviewer: JD-001
• Approver: JD-001