BSI ISO 13485 Audit Corrective Action Plan 2026

Organization: AI Labs Group, S.L.
Site reference: 0047909351-000
Audit report ID: 30285725
Audit dates: 2026-02-27 to 2026-03-03
CAP submission deadline: 2026-03-18
Submit to: John.Gonzalez@bsigroup.com and RSCAPS@bsigroup.com

---

NCR 1 - Finding Reference: 2780856-202603-N1 ✅ CLOSED

Section 1 - Details of nonconformity

Field	Value
Process/Area/Department	Core QMS
Standard/Clause no.(s)	ISO 13485:2016 - Clause 4.1.1
NCR classification	Minor
Certificate Reference	MD 792784
Status	CLOSED

Requirement:
The organization shall document a quality management system and maintain its effectiveness in accordance with the requirements of this International Standard and applicable regulatory requirements. The organization shall establish, implement and maintain any requirement, procedure, activity or arrangement required to be documented by this International Standard or applicable regulatory requirements.

Statement of nonconformity:
The Quality management system is not fully maintained because the organization has not:

• Identified, analysed and/or applied the regulatory requirements for determining foreseeable supply shortages and notify applicable stakeholders as per EU 2024/1860 and MDCG 2024-16.
• Updated the list of applicable standards and regulations addressing the new requirements of the PMS and vigilance regulations for Great Britain.

Objective evidence:

1. GP-100 Business Continuity (BCP) and Disaster Recovery plans (DRP) date: 24-02-2026 - Procedure GP-100 does not cover the requirements for EU 2024/1860 and MDCG 2024-16.
2. R-TF-001-005 List of applicable standards and regulations date: 25-02-2026 - Does not include EU 2024/1860, MDCG 2024-16, and UK-PMS and Vigilance Updated regulations.

Section 2 - Auditee planned actions

Containment Action(s)/Correction:

Action	Planned completion date	Actual completion date	Responsibility	Status
Update R-TF-001-005 List of applicable standards and regulations to include: Regulation (EU) 2024/1860 (amending Regulation (EU) 2017/745 as regards transitional provisions for certain medical devices and in vitro diagnostic medical devices) and MDCG 2024-16 (Guidance on prevention and management of critical shortages of medical devices), and UK PMS/Vigilance regulations	2026-03-15	2026-03-08	Saray Ugidos Seman	✅ Completed
Update GP-100 Business Continuity (BCP) and Disaster Recovery plans (DRP) to address supply shortage notification requirements per Regulation (EU) 2024/1860 and MDCG 2024-16 (Guidance on prevention and management of critical shortages of medical devices)	2026-03-25	2026-03-08	Saray Ugidos Seman	✅ Completed

Root cause analysis (5 Whys):

1. Why did it happen? The new EU 2024/1860 regulation and MDCG 2024-16 guidance were not incorporated into the QMS.
2. Why? The regulatory monitoring process did not flag these new requirements for immediate implementation.
3. Why? Our regulatory intelligence process focuses primarily on MDR core requirements and does not have a systematic approach for monitoring supplementary regulations and MDCG guidance.
4. Why? The external document review process (R-001-005) does not include a specific checklist for new EU regulations and MDCG guidance documents.
5. Why? Lack of a formalized process to monitor and assess impact of new MDCG guidance documents on existing QMS procedures.

Root cause: The new EU 2024/1860 regulation and MDCG 2024-16 guidance were published in 2024 but had not yet been incorporated into the QMS documentation (R-TF-001-005 and GP-100). Additionally, UK PMS and Vigilance regulations were not included in the list of applicable standards.

Corrective action(s):

Action	Completion date	Responsibility	Status
1. Add EU 2024/1860 and MDCG 2024-16 to R-TF-001-005 List of applicable standards and regulations	2026-03-08	Saray Ugidos Seman	✅ Completed
2. Add UK PMS and Vigilance regulations to R-TF-001-005	2026-03-08	Saray Ugidos Seman	✅ Completed
3. Update GP-100 to include supply shortage notification requirements per EU 2024/1860 and MDCG 2024-16	2026-03-08	Saray Ugidos Seman	✅ Completed

Effectiveness check:

• Target: R-TF-001-005 and GP-100 are updated and reflect EU 2024/1860, MDCG 2024-16, and UK PMS/Vigilance requirements.
• Monitoring time: Next annual review of applicable standards
• Planned completion date: 2026-12-31
• Responsibility: Saray Ugidos Seman

Closure Information:

Field	Value
Completed by (auditee representative)	Saray Ugidos Seman
Position	Regulatory Affairs Manager
Completion date	2026-03-08
Evidence of closure	See below

Evidence of closure - Document updates:

1. R-TF-001-005 List of applicable standards and regulations:

   • Section: EU Medical device Regulations and GDPR - Added entry 04_08: Regulation (EU) 2024/1860 amending Regulation (EU) 2017/745 as regards transitional provisions for certain medical devices and in vitro diagnostic medical devices
   • Section: EU Guidelines - Added entry 05_17: MDCG 2024-16 Guidance on prevention and management of critical shortages of medical devices
   • New Section: UK Post-Market Surveillance and Vigilance Regulations - Added entries 05_18 and 05_19: UK Medical Devices Regulations 2002 (as amended) - Part IV Post-market surveillance, and MHRA Guidance on vigilance

2. GP-100 Business Continuity (BCP) and Disaster Recovery plans (DRP):

   • Section: Risk Assessment - Added "Supply shortages" as identified risk
   • New Section: Prevention and Management of Critical Supply Shortages - Added complete section addressing Regulation (EU) 2024/1860 and MDCG 2024-16 requirements including: Scope, Supply Shortage Risk Assessment, Notification to Competent Authorities, Notification to Economic Operators and Healthcare Providers, and Records

---

NCR 2 - Finding Reference: 2780856-202603-N2 ✅ CLOSED

Section 1 - Details of nonconformity

Field	Value
Process/Area/Department	Core QMS
Standard/Clause no.(s)	ISO 13485:2016 - Clause 4.1.4
NCR classification	Minor
Certificate Reference	MD 792784
Status	CLOSED

Requirement:
The organization shall manage these quality management system processes in accordance with the requirements of this International Standard and applicable regulatory requirements. Changes to be made to these processes shall be: a) evaluated for their impact on the quality management system; b) evaluated for their impact on the medical devices produced under this quality management system; c) controlled in accordance with the requirements of this International Standard and applicable regulatory requirements.

Statement of nonconformity:
The change control process is not fully implemented, as there is no evidence of the Change records for the change of the Scope of the ISO13485 certificate.

Objective evidence:

1. Client submitted Change Notification to the NB to reduce scope of certificate (Old scope: Design, manufacture and distribution of software to support Health Care Practitioners in the assessment of skin structures and facial palsy → New scope: Design, manufacture and distribution of software to support Health Care Practitioners in the assessment of skin structures).
2. Although the organization sent the notification to the NB, no evidence of R-023-001 record as per GP-023 procedure and T-023-001 Change request template was found.
3. Documents reviewed: GP-023 Change control Management, T-023-001 Change request, R-023-001_005 Change Control created date: 15-02-2026.

Section 2 - Auditee planned actions

Containment Action(s)/Correction:

Action	Planned completion date	Actual completion date	Responsibility	Status
Create retroactive R-023-001 Change Control Record for the certificate scope change notification to NB	2026-03-12	2026-03-08	Saray Ugidos Seman	✅ Completed

Root cause analysis (5 Whys):

1. Why did it happen? The change control record R-023-001 was not created for the certificate scope change.
2. Why? The change was properly communicated to BSI but the internal documentation step was overlooked.
3. Why? The focus was on completing the external notification to BSI within the required timeline.
4. Why? The internal change control record was not created simultaneously with the BSI notification.
5. Why? Human error - the step to create the internal R-023-001 record was missed during the change process.

Root cause: Human error - the internal change control record R-023-001 was not created at the time of notifying BSI of the certificate scope change, despite GP-023 already describing that such changes require a change control record.

Corrective action(s):

Action	Completion date	Responsibility	Status
1. Create retroactive R-023-001_008 Change Control Record documenting the certificate scope change	2026-03-08	Saray Ugidos Seman	✅ Completed

Effectiveness check:

• Target: All NB notifications and certificate changes have corresponding R-023-001 change control records.
• Monitoring time: Next surveillance audit
• Planned completion date: 2027-03-08
• Responsibility: Saray Ugidos Seman

Closure Information:

Field	Value
Completed by (auditee representative)	Saray Ugidos Seman
Position	Regulatory Affairs Manager
Completion date	2026-03-08
Evidence of closure	See below

Evidence of closure - Document created:

1. R-023-001_008 Change control (new record created):
   • Location: apps/qms/docs/records/GP-023/R-023-001_008.mdx
   • Change name: Reduction of ISO 13485 certificate scope - Removal of facial palsy assessment
   • Change description: Notification to BSI to reduce the scope from "Design, manufacture and distribution of software to support Health Care Practitioners in the assessment of skin structures and facial palsy" to "Design, manufacture and distribution of software to support Health Care Practitioners in the assessment of skin structures"
   • Source of change: Internal business decision to discontinue facial palsy assessment functionality
   • Regulatory impact: Yes - BSI notified (2025-11-20)
   • Implementation date: 2025-12-01
   • Note: Record created retroactively on 2026-03-08 as part of this corrective action

---

NCR 3 - Finding Reference: 2780856-202603-N3

Section 1 - Details of nonconformity

Field	Value
Process/Area/Department	Core QMS
Standard/Clause no.(s)	ISO 13485:2016 - Clause 8.2.1, 8.2.4
NCR classification	Minor
Certificate Reference	MD 792784

Requirement:
8.2.1: The organization shall gather and monitor information relating to whether the organization has met customer requirements. The organization shall document procedures for the feedback process including provisions to gather data from production as well as post-production activities.
8.2.4: The organization shall conduct internal audits at planned intervals to determine whether the quality management system conforms to planned arrangements, requirements of this International Standard, and applicable regulatory requirements.

Statement of nonconformity:
The Post-market procedures are not fully updated to address the new requirements of the PMS and Vigilance regulations for Great Britain.

Objective evidence:

1. R-003-003 Internal Audit plan 2026 date: 13-02-2026 - Audit criteria includes ISO 13485 and MDR, but no UK-MDR criteria to audit PMS and Vigilance procedures.
2. GP-007 Post market surveillance date: 03-11-2025 - No updates for UK requirements.
3. R-TF-007-001 Post-Market Surveillance Plan date: 19-01-2026 - No Lifetime in the PMS plan as required in UK-MDR PMS.
4. GP-004 Vigilance System date: 18-12-2025 - Only Spain in the Vigilance procedure; UK pending to add.
5. 3 years extension Apotech UKRP - UKRP Services date 16-01-2024 - No specified scope and responsibilities for Vigilance and PMS activities as per updated UK-MDR.

Section 2 - Auditee planned actions

Field	Value
Responsible for implementing actions	Saray Ugidos Seman
Position	Regulatory Affairs Manager
Completion date	2026-03-08
Evidence of closure	See below

Containment Action(s)/Correction:

Action	Completion date	Responsibility
Update R-TF-007-001 Post-Market Surveillance Plan to include Lifetime as required by UK-MDR	2026-03-08	Saray Ugidos Seman
Update GP-004 Vigilance System to include UK MHRA notification requirements and timelines	2026-03-08	Saray Ugidos Seman

Evidence of closure - Documents updated:

1. R-TF-007-001 Post-Market Surveillance Plan (updated):

   • Location: apps/qms/docs/legit-health-plus-version-1-1-0-0/post-market-surveillance/R-TF-007-001-Post-Market-Surveillance-PMS-Plan.mdx
   • Added "Device lifetime" section specifying 10-year expected lifetime as required by UK Medical Devices Regulations 2002 (as amended) and MHRA guidance on post-market surveillance
   • Added regulatory references to UK Medical Devices Regulations 2002 and MHRA Guidance on vigilance

2. GP-004 Vigilance System (updated):

   • Location: apps/qms/docs/procedures/GP-004/index.mdx
   • Added section "Incidents occurred in the United Kingdom" including:
     • MHRA reporting channels (Yellow Card Scheme: https://yellowcard.mhra.gov.uk/, email: devices.regulatory@mhra.gov.uk)
     • UK-specific reporting timelines (10 days for death/serious deterioration, 15 days for other serious incidents, 2 days for public health threats)
     • UK Responsible Person (Apotech) notification requirements
     • MHRA contact details (10 South Colonnade, Canary Wharf, London, E14 4PU)

3. R-TF-001-005 List of Applicable Standards and Regulations (updated as part of NCR 1):

   • Location: apps/qms/docs/legit-health-plus-version-1-1-0-0/GSPR/R-TF-001-005-List-of-Applicable-Standards-and-Regulations.mdx
   • Added UK Post-Market Surveillance and Vigilance regulations (codes 05_18 and 05_19):
     • UK Medical Devices Regulations 2002 (SI 2002/618, as amended), Part IV - Post-market surveillance
     • MHRA Guidance on vigilance - medical device incident reporting
   • By including these UK-specific regulations in the formal list of applicable standards (reviewed annually per GP-001), we ensure ongoing monitoring and compliance with UK PMS and Vigilance requirements. This also addresses the audit criteria gap identified in R-003-003.

Pending action:

Action	Planned completion date	Responsibility
Review UKRP contract (Apotech) to clarify scope and responsibilities for UK PMS and Vigilance as per updated UK-MDR	2026-04-30	Saray Ugidos Seman

Root cause analysis (5 Whys):

1. Why did it happen? The PMS and Vigilance procedures did not reflect UK-MDR specific requirements.
2. Why? When updating procedures for EU MDR compliance, UK-specific requirements were not separately addressed.
3. Why? The assumption was made that EU MDR compliance would cover UK requirements post-Brexit.
4. Why? The UK's regulatory divergence from EU MDR was not fully assessed for impact on QMS procedures.
5. Why? Lack of a formal process to monitor and implement UK-specific regulatory requirements separately from EU requirements.

Root cause: Insufficient assessment of UK regulatory divergence from EU MDR and lack of formal process to track UK-specific requirements in both procedures and the list of applicable standards.

Corrective action(s):

Action	Status	Completion date	Responsibility
1. Update R-TF-007-001 to include Device lifetime and UK-MDR regulatory references	Completed	2026-03-08	Saray Ugidos Seman
2. Update GP-004 to include UK MHRA notification section with reporting channels, timelines, and contacts	Completed	2026-03-08	Saray Ugidos Seman
3. Add UK PMS and Vigilance regulations to R-TF-001-005 (completed as part of NCR 1)	Completed	2026-03-08	Saray Ugidos Seman
4. Review and update UKRP contract (Apotech) to clarify scope and responsibilities for UK PMS and Vigilance	Pending	2026-04-30	Saray Ugidos Seman

Effectiveness check:

• Target: All PMS and Vigilance activities comply with both EU MDR and UK-MDR requirements; UK regulations are formally tracked in R-TF-001-005 and reviewed annually; internal audit confirms compliance.
• Monitoring time: Next annual review of applicable standards and next internal audit cycle (Q4 2026)
• Planned completion date: 2026-12-31
• Responsibility: Saray Ugidos Seman

---

NCR 4 - Finding Reference: 2780856-202603-N4

Section 1 - Details of nonconformity

Field	Value
Process/Area/Department	Design and development, including risk management and design controls
Standard/Clause no.(s)	ISO 13485:2016 - Clause 4.2.3, 7.2.3
NCR classification	Minor
Certificate Reference	MD 792784

Requirement:
4.2.3: For each medical device type or medical device family, the organization shall establish and maintain one or more files containing or referencing documents generated to demonstrate conformity to the requirements of this International Standard and compliance with applicable regulatory requirements.
7.2.3: The organization shall plan and document arrangements for communicating with customers in relation to product information, enquiries, customer feedback including complaints, and advisory notices.

Statement of nonconformity:
The Medical device file of the marketed Legit.Health MDD Class I software is not fully maintained and documented to demonstrate conformity and compliance with applicable regulatory requirements.

Objective evidence:

1. https://apidocs.legit.health/ (access date on 2026-03-02) - IFU Table of contents and CE Logo, General Information – Label not fully compliant with:
2. UE declaration_MDD Declaración de conformidad del fabricante Legit Health - MDD Class I 93/42/EEC Signed by Sheyla Andina Aguilar Robles on 12 October 2020 - Does not reflect information provided in:
3. EUDAMED registered device (ES-MF-000025345): EUDAMED ID code: D-Legit.Health8U / EUDAMED; Name/Trade name(s): Legit.Health [EN]; Reference/Catalogue number: Legit.Health

Section 2 - Auditee planned actions

Field	Value
Responsible for implementing actions	Saray Ugidos Seman
Position	Regulatory Affairs Manager
Completion date	2026-03-08
Evidence of closure	See below

Containment Action(s)/Correction:

Action	Completion date	Responsibility
Update the IFU and Label on apidocs.legit.health to align with EUDAMED registered information	2026-03-08	Saray Ugidos Seman
Review and update MDD Class I device file to ensure consistency across all documentation	2026-03-08	Saray Ugidos Seman

Evidence of closure:

The IFU and Label published on https://apidocs.legit.health/ have been corrected and now display only the information corresponding to the Legacy MDD Class I device (Legit.Health version 2.1), properly aligned with:

• The EUDAMED registration (ES-MF-000025345, EUDAMED ID: D-Legit.Health8U)
• The Declaration of Conformity (R-001-002)
• Council Directive 93/42/EEC (MDD) requirements

The website now correctly displays the CE marking for the MDD Class I device and all label elements are consistent with the approved technical documentation.

Root cause analysis (5 Whys):

1. Why did it happen? The IFU and Label published on the website displayed information that did not match the EUDAMED registered Legacy device.
2. Why? A draft version of the MDR-certified device (Legit.Health Plus) was inadvertently deployed to the production website.
3. Why? The deployment pipeline did not include a verification step to confirm which device version was being published.
4. Why? The website deployment process was not formally included in the device file maintenance procedure.
5. Why? The assumption was that website deployments were separate from regulatory documentation management.

Root cause: Deployment error - a draft version of the MDR device documentation was inadvertently deployed to production, displaying incorrect information for the Legacy MDD device. This was a one-time deployment issue that has been corrected.

Corrective action(s):

Action	Status	Completion date	Responsibility
1. Correct the website to display only the Legacy MDD device Label and IFU	Completed	2026-03-08	Saray Ugidos Seman
2. Verify consistency between website, EUDAMED registration, and Declaration of Conformity	Completed	2026-03-08	Saray Ugidos Seman

Effectiveness check:

• Target: All customer-facing documentation (website, EUDAMED, device file) is consistent and verified during next device file review.
• Monitoring time: Next scheduled device file review
• Planned completion date: 2026-12-31
• Responsibility: Saray Ugidos Seman

---

NCR 5 - Finding Reference: 2780856-202603-N5

Section 1 - Details of nonconformity

Field	Value
Process/Area/Department	Design and development, including risk management and design controls
Standard/Clause no.(s)	ISO 13485:2016 - Clause 7.2.2, 7.3.7
NCR classification	Minor
Certificate Reference	MD 792784

Requirement:
7.2.2: The organization shall review the requirements related to product. This review shall ensure that product requirements are defined and documented, applicable regulatory requirements are met, and the organization has the ability to meet the defined requirements.
7.3.7: Design and development validation shall be performed in accordance with planned and documented arrangements to ensure that the resulting product is capable of meeting the requirements for the specified application or intended use.

Statement of nonconformity:
The review of requirements related to product is not fully effective as the organization does not demonstrate evidence that the Instructions for Use and Labels published on the company website are verified or validated against the approved technical documentation before being made available to customers.

Objective evidence:

1. T-001-006 IFU and Label Validation
2. R-TF-001-006 IFU and Label Validation - Section 4 IFU Validation, Section 5 Labelling requirements verification - Verification method in phase 5 of D&D - Section 4 and 5 not applied correctly for labels and IFU published in the webpage.
3. R-TF-12-026 Product Validation Phase 5 Checklist - Section 13.1 Labelling and Instructions for Use - No R-TF-12-026 records found for the Class 1 MDD Device.

Section 2 - Auditee planned actions

Field	Value
Responsible for implementing actions	Saray Ugidos Seman
Position	Regulatory Affairs Manager
Completion date	2026-03-08
Evidence of closure	See below

Containment Action(s)/Correction:

Action	Completion date	Responsibility
Perform IFU and Label validation for MDD Class I device using R-TF-001-006 template	2026-03-08	Saray Ugidos Seman

Evidence of closure - Document created:

1. R-TF-001-006 IFU and Label Validation - Legacy MDD Device (new record created):
   • Location: apps/qms/docs/records/GP-001/Legacy MDD/R-TF-001-006-IFU-and-Label-Validation.mdx
   • Device: Legit.Health (version 2.1) - Class I per MDD 93/42/EEC
   • EUDAMED ID: D-Legit.Health8U
   • SRN: ES-MF-000025345
   • Content: Complete Label validation (11 requirements verified) and IFU validation (14 requirements verified) per MDD 93/42/EEC Annex I, Section 13
   • Verification against: EUDAMED registration, Declaration of Conformity (R-001-002), and published website content (https://apidocs.legit.health/)
   • Validation result: All requirements verified as compliant; all documentation sources are consistent
   • Note: Record created retroactively on 2026-03-08 as part of this corrective action

Root cause analysis (5 Whys):

1. Why did it happen? The IFU and labels published on the website were not formally verified/validated against approved technical documentation.
2. Why? The MDD Class I device, being a legacy device (pre-MDR), was not subjected to the same D&D validation rigor as newer products.
3. Why? The assumption was that self-declared MDD Class I devices have reduced documentation requirements.
4. Why? QMS procedures do not clearly define validation requirements for legacy MDD devices that were placed on market before MDR.
5. Why? Lack of specific guidance in QMS for maintaining legacy MDD device documentation to the same standard as MDR devices.

Root cause: QMS procedures do not clearly define IFU/Label validation requirements for legacy MDD Class I devices, leading to missing validation records for the legacy device.

Corrective action(s):

Action	Status	Completion date	Responsibility
1. Create R-TF-001-006 IFU and Label Validation record for the Legacy MDD device	Completed	2026-03-08	Saray Ugidos Seman

Effectiveness check:

• Target: Legacy MDD device has complete IFU and Label validation record; website content verified against approved documentation.
• Monitoring time: Next device file review cycle
• Planned completion date: 2026-12-31
• Responsibility: Saray Ugidos Seman

---

Summary Table

NCR	Finding Reference	Clause	Status	Completion Date
1	2780856-202603-N1	4.1.1	Closed	2026-03-08
2	2780856-202603-N2	4.1.4	Closed	2026-03-08
3	2780856-202603-N3	8.2.1, 8.2.4	Closed	2026-03-08
4	2780856-202603-N4	4.2.3, 7.2.3	Closed	2026-03-08
5	2780856-202603-N5	7.2.2, 7.3.7	Closed	2026-03-08

---

Completed by (auditee representative):
Name: Saray Ugidos Seman
Position: Regulatory Affairs Manager
Date: 2026-03-08