@connexum/ai-governance 1.0.0-beta.11

package/dist/esm/packs/eu-mdr-ivdr.js

@@ -0,0 +1,417 @@
+/**
+ * EU MDR + IVDR Compliance Pack
+ *
+ * EU Medical Device Regulation (MDR) 2017/745 and In Vitro Diagnostic
+ * Regulation (IVDR) 2017/746 -- the joint EU medical device regulatory
+ * framework governing placing medical devices and IVDs on the EU market.
+ *
+ * Regulatory authority:
+ *   - MDR Regulation (EU) 2017/745: applicable from 26 May 2021
+ *     (Class I May 2021; Class IIa/IIb/III per transition timeline).
+ *     Replaces Medical Device Directive (MDD) 93/42/EEC and Active
+ *     Implantable Medical Device Directive (AIMDD) 90/385/EEC.
+ *   - IVDR Regulation (EU) 2017/746: applicable from 26 May 2022
+ *     for Class D; Class C (May 2025); Class B (May 2026); Class A
+ *     sterile (May 2026). Replaces IVD Directive 98/79/EC.
+ *   - Both regulations share the same Notified Body / EUDAMED /
+ *     UDI infrastructure and conformity assessment framework.
+ *   - National competent authorities: BfArM (Germany), ANSM (France),
+ *     MHRA (UK -- now separate post-Brexit), etc.
+ *   - MDCG (Medical Device Coordination Group): joint guidance body
+ *     for MDR/IVDR implementation.
+ *
+ * Key distinctions from FDA SaMD (fda-samd.ts):
+ *   - EU: classification by MDR/IVDR classes (I, IIa, IIb, III / A, B, C, D)
+ *     vs FDA: IMDRF SaMD categories (Category I-IV)
+ *   - EU: Notified Body conformity assessment + CE marking
+ *     vs FDA: 510(k) / De Novo / PMA clearance or approval
+ *   - EU: EUDAMED registration database
+ *     vs FDA: FDA GUDID / 510(k) database
+ *   - EU: MDR/IVDR clinical evaluation + PMCF (Post-Market Clinical Follow-Up)
+ *     vs FDA: PCCP (Predetermined Change Control Plan) + real-world evidence
+ *   - UK post-Brexit: MHRA UKCA marking (not CE marking) required for
+ *     Great Britain market; Northern Ireland follows EU rules (CE marking).
+ *
+ * AI/Software as Medical Device (SaMD) under MDR/IVDR:
+ *   - MDCG 2019-16 (rev.1): guidance on qualification and classification
+ *     of software under MDR/IVDR. Software driving or influencing clinical
+ *     decisions may qualify as a medical device.
+ *   - MDCG 2022-2: guidance on medical device standalone software and AI.
+ *   - Learning algorithms: AI/ML models that continuously learn may
+ *     require re-qualification if the change is significant.
+ *   - Cybersecurity: MDCG 2019-16 and ENISA guidance on medical device
+ *     cybersecurity apply to AI SaMD under MDR/IVDR.
+ *
+ * Current state (2026):
+ *   - MDR fully applicable; EUDAMED fully operational.
+ *   - IVDR Class C transition deadline May 2025 passed; Class B and
+ *     A sterile transition May 2026 approaching.
+ *   - Notified Body capacity constraint remains a practical concern
+ *     for conformity assessment timelines.
+ *   - MDCG 2024 AI guidance updates expected on adaptive algorithms.
+ *
+ * @connexum/ai-governance
+ */
+/**
+ * EU MDR + IVDR category classifiers.
+ * Covers medical device classification data, IVD classification data,
+ * clinical evaluation records, post-market surveillance data,
+ * and vigilance reporting.
+ */
+export const EU_MDR_IVDR_CATEGORY_CLASSIFIERS = {
+    MEDICAL_DEVICE_CLASSIFICATION: {
+        references: ['MDR 2017/745 Annex VIII -- classification rules; MDCG 2019-16 software qualification'],
+        classifier: (input) => {
+            if (/\b(?:Class\s+(?:I|IIa|IIb|III)\s+(?:medical\s+device|device)|MDR\s+Class|device\s+classification)\b/i.test(input))
+                return true;
+            if (/\b(?:CE\s+mark(?:ing)?|CE\s+certificate|conformity\s+assessment|Notified\s+Body)\b/i.test(input))
+                return true;
+            if (/\b(?:EUDAMED|UDI|unique\s+device\s+identifier|SRN|single\s+registration\s+number)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    IVD_CLASSIFICATION: {
+        references: ['IVDR 2017/746 Annex VIII -- classification rules; Classes A, B, C, D'],
+        classifier: (input) => {
+            if (/\b(?:Class\s+[ABCD]\s+(?:IVD|in\s+vitro)|IVDR\s+Class|IVD\s+classification)\b/i.test(input))
+                return true;
+            // Unambiguous IVD identifiers -- no anchor needed.
+            if (/\b(?:in\s+vitro\s+diagnostic|companion\s+diagnostic|CDx)\b/i.test(input))
+                return true;
+            // Bare "IVD" must appear alongside a device or regulatory context to avoid
+            // false positives from other packs using the acronym in different senses.
+            if (/\bIVD\b/.test(input) && /\b(?:Class|IVDR|device|diagnostic|reagent|assay|kit)\b/i.test(input))
+                return true;
+            // F-NEW-VERA-PACK-C4-03: "performance evaluation" and "performance data" require
+            // an IVD-context anchor to prevent cross-firing when ISO 23894, NIST AI RMF, or
+            // SG Model AI Gov packs generate "performance evaluation" records for general AI.
+            if (/\b(?:IVD|in\s+vitro|diagnostic)\s+performance\s+(?:evaluation|study|data)\b/i.test(input))
+                return true;
+            if (/\bperformance\s+(?:evaluation|data)\b/i.test(input) &&
+                /\b(?:IVD|in\s+vitro|IVDR|companion\s+diagnostic|CDx|reagent|assay)\b/i.test(input))
+                return true;
+            // F-NEW-VERA-PACK-C4-03: standalone \bPER\b removed -- too broad; overlaps with
+            // Performance Evaluation Report context but also fires on unrelated "per" abbreviations.
+            return false;
+        },
+    },
+    CLINICAL_EVALUATION_DATA: {
+        references: ['MDR Annex XIV -- clinical evaluation; IVDR Annex XIII -- performance evaluation'],
+        classifier: (input) => {
+            if (/\b(?:clinical\s+evaluation|clinical\s+investigation|CER|clinical\s+evidence|PMCF)\b/i.test(input))
+                return true;
+            // F-NEW-VERA-PACK-C4-03: standalone \bPER\b removed (same cross-fire risk as IVD branch).
+            // "performance evaluation" here refers to MDR Annex XIV / IVDR Annex XIII context;
+            // "clinical evaluation" in the preceding line provides sufficient MDR anchor for CER.
+            // "performance evaluation" alone still risks false positives from AI governance packs.
+            if (/\b(?:performance\s+evaluation\s+(?:report|plan)|performance\s+study|performance\s+evaluation)\b/i.test(input) &&
+                /\b(?:MDR|IVDR|IVD|Annex\s+XIV|Annex\s+XIII|clinical\s+evidence|notified\s+body|CE\s+mark|EUDAMED)\b/i.test(input))
+                return true;
+            if (/\bperformance\s+data\b/i.test(input))
+                return true; // still useful in MDR context; less risk than PER
+            if (/\b(?:clinical\s+trial|IDE|investigational\s+device|clinical\s+investigation\s+plan)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    POST_MARKET_SURVEILLANCE: {
+        references: ['MDR Art. 83-86 -- post-market surveillance; IVDR Art. 78-81'],
+        classifier: (input) => {
+            if (/\b(?:post.?market\s+surveillance|PMS\s+plan|post.?market\s+clinical\s+follow.?up|PMCF|PSUR|periodic\s+safety\s+update)\b/i.test(input))
+                return true;
+            if (/\b(?:serious\s+incident|field\s+safety\s+corrective\s+action|FSCA|vigilance\s+report|trend\s+report)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    PHI: {
+        references: ['MDR/IVDR -- patient data in clinical evaluation; GDPR Art. 9(1) -- health data as special category'],
+        classifier: (input) => {
+            if (/\b(?:patient|subject\s+id|MRN|medical\s+record\s+number)\b/i.test(input))
+                return true;
+            if (/\b(?:DOB|date\s+of\s+birth|diagnosis|clinical\s+finding|pathology)\b/i.test(input))
+                return true;
+            if (/\b\d{3}-\d{2}-\d{4}\b/.test(input))
+                return true; // SSN / patient identifiers
+            return false;
+        },
+    },
+    CREDENTIALS: {
+        references: ['EUDAMED access credentials; Notified Body secure access'],
+        classifier: (input) => {
+            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
+                return true;
+            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
+                return true;
+            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
+                return true;
+            return false;
+        },
+    },
+};
+export const EU_MDR_IVDR_PACK = {
+    categoryClassifiers: EU_MDR_IVDR_CATEGORY_CLASSIFIERS,
+    id: 'eu-mdr-ivdr',
+    aliases: ['HC-05'],
+    name: 'EU MDR + IVDR (Medical Device Regulations)',
+    version: '1.0.0',
+    description: 'EU Medical Device Regulation (MDR, 2017/745) and In Vitro Diagnostic Regulation (IVDR, 2017/746) compliance for AI systems (SaMD) placed on the EU market. Covers MDR Class I-III and IVDR Class A-D classification, CE marking via Notified Body conformity assessment, EUDAMED registration, UDI management, clinical and performance evaluation, post-market surveillance (PMS), and vigilance reporting. Distinct from FDA SaMD pack: EU classification rules, CE vs FDA clearance, EUDAMED vs FDA GUDID, PMCF vs PCCP.',
+    authority: 'National competent authorities (e.g., BfArM, ANSM) + Notified Bodies + European Commission + MDCG',
+    industries: ['medical-device', 'ivd', 'digital-health', 'health-it', 'pharma', 'biotech', 'radiology', 'diagnostics', 'surgical-robotics', 'wearable-health'],
+    requiredModules: [
+        {
+            name: 'governance-runtime',
+            required: true,
+            reason: 'Software qualification assessment (MDCG 2019-16); MDR/IVDR class determination gate; change control for AI/ML model updates (significant change re-qualification)',
+            reference: 'MDR Art. 2(1) -- medical device definition; MDCG 2019-16 -- software qualification and classification; MDCG 2022-2 -- AI/ML SaMD',
+        },
+        {
+            name: 'data-classifier',
+            required: true,
+            reason: 'Medical device classification data; IVD classification detection; clinical evaluation data; post-market surveillance data; PHI in clinical records',
+            reference: 'MDR Annex VIII -- classification rules; IVDR Annex VIII -- IVD classification; MDR Art. 10(2) -- quality management system data requirements',
+        },
+        {
+            name: 'audit-integrity',
+            required: true,
+            reason: 'Technical documentation integrity per MDR Annex II/III; clinical evaluation report (CER) tamper-evident records; quality management system (QMS) audit trail; 10-year post-market documentation retention',
+            reference: 'MDR Art. 10(8) -- technical documentation; MDR Annex II/III -- technical documentation content; MDR Art. 83 -- PMS data integrity',
+        },
+        {
+            name: 'attestation-manager',
+            required: true,
+            reason: 'CE certificate tracking; Notified Body conformity assessment records; EUDAMED registration status; QMS EN ISO 13485:2016 certification; authorised representative on file',
+            reference: 'MDR Art. 10(11) -- CE certificate; MDR Art. 13 -- authorised representative; MDR Art. 31 -- EUDAMED registration; ISO 13485:2016 QMS',
+        },
+        {
+            name: 'approval-queue',
+            required: true,
+            reason: 'Serious incident investigation gate; field safety corrective action (FSCA) authorisation; significant change qualification re-assessment approval; PMCF study protocol approval',
+            reference: 'MDR Art. 87 -- serious incident reporting gate; MDR Art. 88 -- trend reporting; MDR Annex XIV -- PMCF protocol; MDCG 2022-2 -- AI/ML change management',
+        },
+        {
+            name: 'event-bus',
+            required: true,
+            reason: 'Vigilance event detection and notification clock: serious incidents 15 days; trends 90 days; serious public health threats 2 days; FSCA reporting to competent authorities',
+            reference: 'MDR Art. 87 -- serious incident notification (15 calendar days); MDR Art. 87(2) -- life-threatening events (< 2 calendar days); MDR Art. 88 -- trend reporting (90 days)',
+        },
+        {
+            name: 'anomaly-detector',
+            required: true,
+            reason: 'Post-market surveillance (PMS) trend analysis; serious incident signal detection; AI/ML model performance drift monitoring per PMCF; EUDAMED data reconciliation',
+            reference: 'MDR Art. 83-86 -- post-market surveillance; MDR Art. 88 -- trend reporting obligation; MDCG 2022-2 -- continuous learning AI performance monitoring',
+        },
+        {
+            name: 'supply-chain',
+            required: true,
+            reason: 'Third-party component and software supplier oversight per QMS; subcontractor control per ISO 13485; Notified Body TPRM integration',
+            reference: 'MDR Art. 10(9)(b) -- supplier control; ISO 13485 Clause 7.4 -- purchasing; MDR Annex IX -- technical documentation on supply chain',
+        },
+        {
+            name: 'encryption-layer',
+            required: true,
+            reason: 'Patient data and clinical evaluation records encrypted at rest and in transit; EUDAMED secure access; cybersecurity per MDCG 2019-16 and ENISA medical device guidance',
+            reference: 'MDCG 2019-16 Annex 1 -- cybersecurity for medical devices; MDR Art. 5(5) -- cybersecurity requirements; ENISA medical device cybersecurity guidance',
+        },
+        {
+            name: 'session-persistence',
+            required: true,
+            reason: 'Clinical investigation state persistence; PMCF study lifecycle tracking; post-market surveillance data collection continuity; EUDAMED interaction session management',
+            reference: 'MDR Annex XIV -- PMCF plan and report requirements; MDR Art. 83 -- PMS system data continuity',
+        },
+        {
+            name: 'transparency-injector',
+            required: true,
+            reason: 'SaMD intended purpose disclosure per MDR Art. 2; patient/user information per MDR Annex I; AI/ML transparency in clinical decision support context',
+            reference: 'MDR Art. 2(12) -- intended purpose; MDR Annex I General Safety and Performance Requirements (GSPR) -- information for safety; MDCG 2022-2 -- AI transparency for users',
+        },
+    ],
+    moduleConfig: {
+        'governance-runtime': {
+            imdrfCategoryTrackingRequired: true,
+            softwareQualificationAssessmentRequired: true,
+            significantChangeRequalificationRequired: true,
+            ceMarkingStatusRequired: true,
+            euMdrIvdrClassRequired: true,
+        },
+        'data-classifier': {
+            enabledCategories: ['MEDICAL_DEVICE_CLASSIFICATION', 'IVD_CLASSIFICATION', 'CLINICAL_EVALUATION_DATA', 'POST_MARKET_SURVEILLANCE', 'PHI', 'CREDENTIALS'],
+            phiAction: 'BLOCK',
+            clinicalDataAction: 'WARN',
+        },
+        'audit-integrity': {
+            technicalDocumentationRetentionYears: 10, // MDR Art. 10(8) -- 10 years; 15 for implantables
+            implantableDeviceRetentionYears: 15,
+            clinicalInvestigationRetentionYears: 25,
+            appendOnlyRequired: true,
+            tamperEvidentRequired: true,
+        },
+        'attestation-manager': {
+            ceCertificateTrackingRequired: true,
+            notifiedBodyConformityAssessmentRequired: true,
+            eudamedRegistrationRequired: true,
+            iso13485CertificationRequired: true,
+            authorisedRepresentativeRequired: true,
+            postMarketSurveillancePlanRequired: true,
+        },
+        'approval-queue': {
+            seriousIncidentInvestigationGateRequired: true,
+            fieldSafetyCorrectiveActionApprovalRequired: true,
+            pmcfProtocolApprovalRequired: true,
+            significantChangeApprovalRequired: true,
+        },
+        'event-bus': {
+            seriousIncidentNotificationDays: 15,
+            lifeThreateningEventNotificationDays: 2,
+            seriousPublicHealthThreatNotificationDays: 2,
+            trendReportingDays: 90,
+            fscraNationalCompetentAuthorityNotificationRequired: true,
+        },
+        'anomaly-detector': {
+            postMarketSurveillanceTrendAnalysisRequired: true,
+            seriousIncidentSignalDetectionRequired: true,
+            aiModelPerformanceDriftMonitoringRequired: true,
+            realWorldPerformanceMonitoringRequired: true,
+        },
+        'supply-chain': {
+            supplierControlRequired: true,
+            thirdPartyComponentAuditRequired: true,
+            notifiedBodyTprmIntegrationRequired: true,
+        },
+        'encryption-layer': {
+            algorithm: 'aes-256-gcm',
+            encryptionRequiredForClinicalData: true,
+            cybersecurityByDesignRequired: true,
+        },
+        'transparency-injector': {
+            intendedPurposeDisclosureRequired: true,
+            indicationForUseDisclosureRequired: true,
+            aiTransparencyForClinicalUsersRequired: true,
+        },
+    },
+    providerPolicy: {
+        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
+        requiredCapabilities: ['CLINICAL-DATA-RESIDENCY-EU', 'GDPR-PROCESSOR-CONTRACT', 'ISO-13485-COMPATIBLE'],
+        blockReasons: {
+            deepseek: 'PRC National Intelligence Law creates clinical data disclosure risk incompatible with MDR/IVDR technical documentation confidentiality and GDPR/GDPR requirements for patient data.',
+            baidu: 'PRC jurisdiction. No EU adequacy decision. Patient data and clinical evaluation records cannot be transferred to PRC under GDPR Art. 44 or MDR/IVDR data integrity requirements.',
+            alibaba: 'PRC jurisdiction. No EU adequacy decision. Patient data and clinical evaluation records cannot be transferred to PRC under GDPR Art. 44 or MDR/IVDR data integrity requirements.',
+        },
+    },
+    dataPolicy: {
+        scanCategories: ['MEDICAL_DEVICE_CLASSIFICATION', 'IVD_CLASSIFICATION', 'CLINICAL_EVALUATION_DATA', 'POST_MARKET_SURVEILLANCE', 'PHI', 'CREDENTIALS'],
+        categoryActions: {
+            MEDICAL_DEVICE_CLASSIFICATION: 'WARN',
+            IVD_CLASSIFICATION: 'WARN',
+            CLINICAL_EVALUATION_DATA: 'WARN',
+            POST_MARKET_SURVEILLANCE: 'WARN',
+            PHI: 'BLOCK',
+            CREDENTIALS: 'BLOCK',
+        },
+        encryptionRequired: true,
+        encryptionStandard: 'AES-256-GCM',
+        minimumClassification: 'RESTRICTED',
+    },
+    retentionPolicy: {
+        // MDR Art. 10(8): technical documentation retained 10 years post last device on market
+        // MDR Art. 10(8): implantable devices -- 15 years
+        // MDR Annex XV -- clinical investigations: 25 years
+        auditLogRetentionDays: 5475, // 15 years (implantable device maximum)
+        sessionRetentionDays: 3650, // 10 years (standard MDR technical documentation)
+        incidentRetentionDays: 5475,
+        reference: 'MDR Art. 10(8) -- technical documentation: 10 years post last device on market; 15 years for implantable devices; MDR Annex XV -- clinical investigation records: 25 years; IVDR same framework',
+        forceDelete: false,
+        requiresLegalHoldSupport: true,
+        sovereignty: ['eu'],
+    },
+    incidentPolicy: {
+        // MDR Art. 87: serious incidents -- 15 calendar days
+        // MDR Art. 87(2): life-threatening / death -- 2 calendar days (< 10 days in practice)
+        // MDR Art. 87: serious public health threat -- immediately / 2 days
+        notificationDeadlineHours: 48, // 2 days for most serious incidents
+        reference: 'MDR Art. 87(1)(b) -- serious incidents: 15 calendar days; Art. 87(2) -- death or life-threatening: 2 calendar days or less; Art. 87(1)(a) -- serious public health threat: immediately/2 days; IVDR Art. 82 same framework',
+        requiredRecipients: ['national-competent-authority', 'notified-body', 'authorised-representative', 'eudamed-portal'],
+        formalNotificationRequired: true,
+    },
+    validators: [
+        {
+            id: 'eu-mdr-ivdr-qualification',
+            description: 'EU MDR/IVDR software qualification assessment active; AI SaMD classification determined per MDCG 2019-16',
+            reference: 'MDR Art. 2(1) -- medical device definition; MDCG 2019-16 -- software qualification and classification',
+            check: 'eu_mdr_ivdr_qualification_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'eu-mdr-ivdr-ce-marking',
+            description: 'CE certificate and Notified Body conformity assessment on file for MDR Class IIa/IIb/III and IVDR Class B/C/D devices',
+            reference: 'MDR Art. 10(11) -- CE marking; MDR Annex IX -- Notified Body conformity assessment',
+            check: 'attestation_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'eu-mdr-ivdr-eudamed',
+            description: 'EUDAMED registration active; UDI assigned and registered for all devices in scope',
+            reference: 'MDR Art. 31 -- EUDAMED registration; MDR Art. 27 -- UDI system',
+            check: 'eu_mdr_ivdr_eudamed_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'eu-mdr-ivdr-vigilance',
+            description: 'Vigilance event detection and reporting wired: 2-day clock for life-threatening events, 15-day for serious incidents, 90-day trend reporting',
+            reference: 'MDR Art. 87 -- serious incident notification; MDR Art. 88 -- trend reporting; IVDR Art. 82',
+            check: 'incident_reporting',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'eu-mdr-ivdr-pms',
+            description: 'Post-market surveillance (PMS) system active; PMCF/PMPF plan in place; trend analysis running',
+            reference: 'MDR Art. 83-86 -- post-market surveillance obligations; MDR Annex XIV -- PMCF; IVDR Annex XIII -- PMPF',
+            check: 'post_market_monitoring',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'eu-mdr-ivdr-technical-docs',
+            description: 'Technical documentation retained with tamper-evident integrity for 10 years (15 for implantables)',
+            reference: 'MDR Art. 10(8) -- technical documentation retention; MDR Annex II/III -- technical documentation',
+            check: 'audit_trail_exists',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'eu-mdr-ivdr-change-management',
+            description: 'Significant change qualification gate active; AI/ML model updates re-assessed for MDR/IVDR classification impact',
+            reference: 'MDR Art. 10(14) -- significant change notification; MDCG 2022-2 -- AI/ML change management',
+            check: 'change_management_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'eu-mdr-ivdr-clinical-evaluation',
+            description: 'Clinical evaluation report (CER) or performance evaluation report (PER) current; PMCF data feeding back into CER',
+            reference: 'MDR Annex XIV -- clinical evaluation; IVDR Annex XIII -- performance evaluation; MDR Art. 61 -- clinical evaluation',
+            check: 'eu_mdr_ivdr_clinical_evaluation_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'eu-mdr-ivdr-phi-protection',
+            description: 'Patient data and PHI in clinical records blocked and encrypted; GDPR processor obligations met',
+            reference: 'MDR/IVDR + GDPR Art. 9 -- health data as special category; MDR Art. 10 data protection requirements',
+            check: 'data_classifier_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'eu-mdr-ivdr-cybersecurity',
+            description: 'Medical device cybersecurity controls active per MDCG 2019-16 and ENISA guidance',
+            reference: 'MDR Art. 5(5) -- cybersecurity; MDCG 2019-16 Annex 1 -- cybersecurity checklist; ENISA medical device cybersecurity',
+            check: 'encryption_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'eu-mdr-ivdr-authorised-rep',
+            description: 'EU authorised representative on file for non-EU manufacturers; QMS ISO 13485 certification active',
+            reference: 'MDR Art. 11 -- authorised representative obligations; MDR Art. 10(9) -- QMS (ISO 13485)',
+            check: 'subservice_registry_active',
+            failSeverity: 'HIGH',
+        },
+    ],
+};
+//# sourceMappingURL=eu-mdr-ivdr.js.map

package/dist/esm/packs/eu-mdr-ivdr.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"eu-mdr-ivdr.js","sourceRoot":"","sources":["../../../src/packs/eu-mdr-ivdr.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAKH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAwB;IACnE,6BAA6B,EAAE;QAC7B,UAAU,EAAE,CAAC,sFAAsF,CAAC;QACpG,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,sGAAsG,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpI,IAAI,qFAAqF,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnH,IAAI,sFAAsF,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpH,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,kBAAkB,EAAE;QAClB,UAAU,EAAE,CAAC,sEAAsE,CAAC;QACpF,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,gFAAgF,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC9G,mDAAmD;YACnD,IAAI,6DAA6D,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC3F,2EAA2E;YAC3E,0EAA0E;YAC1E,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,yDAAyD,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAChH,iFAAiF;YACjF,gFAAgF;YAChF,kFAAkF;YAClF,IAAI,8EAA8E,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC5G,IAAI,wCAAwC,CAAC,IAAI,CAAC,KAAK,CAAC;gBACpD,uEAAuE,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrG,gFAAgF;YAChF,yFAAyF;YACzF,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,wBAAwB,EAAE;QACxB,UAAU,EAAE,CAAC,iFAAiF,CAAC;QAC/F,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,sFAAsF,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpH,0FAA0F;YAC1F,mFAAmF;YACnF,sFAAsF;YACtF,uFAAuF;YACvF,IAAI,kGAAkG,CAAC,IAAI,CAAC,KAAK,CAAC;gBAC9G,sGAAsG,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpI,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC,CAAC,kDAAkD;YAC1G,IAAI,wFAAwF,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACtH,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,wBAAwB,EAAE;QACxB,UAAU,EAAE,CAAC,6DAA6D,CAAC;QAC3E,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,2HAA2H,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzJ,IAAI,yGAAyG,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACvI,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,GAAG,EAAE;QACH,UAAU,EAAE,CAAC,oGAAoG,CAAC;QAClH,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,6DAA6D,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC3F,IAAI,uEAAuE,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrG,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC,CAAC,4BAA4B;YAClF,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,WAAW,EAAE;QACX,UAAU,EAAE,CAAC,yDAAyD,CAAC;QACvE,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,qEAAqE,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnG,IAAI,2DAA2D,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzF,IAAI,4CAA4C,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC1E,OAAO,KAAK,CAAC;QACf,CAAC;KACF;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAkE;IAC7F,mBAAmB,EAAE,gCAAgC;IACrD,EAAE,EAAE,aAAa;IACjB,OAAO,EAAE,CAAC,OAAO,CAAC;IAClB,IAAI,EAAE,4CAA4C;IAClD,OAAO,EAAE,OAAO;IAChB,WAAW,EACT,6fAA6f;IAC/f,SAAS,EAAE,mGAAmG;IAC9G,UAAU,EAAE,CAAC,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,iBAAiB,CAAC;IAE7J,eAAe,EAAE;QACf;YACE,IAAI,EAAE,oBAAoB;YAC1B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,mKAAmK;YAC3K,SAAS,EAAE,kIAAkI;SAC9I;QACD;YACE,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,oJAAoJ;YAC5J,SAAS,EAAE,8IAA8I;SAC1J;QACD;YACE,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,2MAA2M;YACnN,SAAS,EAAE,mIAAmI;SAC/I;QACD;YACE,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,2KAA2K;YACnL,SAAS,EAAE,sIAAsI;SAClJ;QACD;YACE,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,iLAAiL;YACzL,SAAS,EAAE,wJAAwJ;SACpK;QACD;YACE,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,4KAA4K;YACpL,SAAS,EAAE,0KAA0K;SACtL;QACD;YACE,IAAI,EAAE,kBAAkB;YACxB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,kKAAkK;YAC1K,SAAS,EAAE,qJAAqJ;SACjK;QACD;YACE,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,oIAAoI;YAC5I,SAAS,EAAE,oIAAoI;SAChJ;QACD;YACE,IAAI,EAAE,kBAAkB;YACxB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,wKAAwK;YAChL,SAAS,EAAE,qJAAqJ;SACjK;QACD;YACE,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,sKAAsK;YAC9K,SAAS,EAAE,+FAA+F;SAC3G;QACD;YACE,IAAI,EAAE,uBAAuB;YAC7B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,oJAAoJ;YAC5J,SAAS,EAAE,wKAAwK;SACpL;KACF;IAED,YAAY,EAAE;QACZ,oBAAoB,EAAE;YACpB,6BAA6B,EAAE,IAAI;YACnC,uCAAuC,EAAE,IAAI;YAC7C,wCAAwC,EAAE,IAAI;YAC9C,uBAAuB,EAAE,IAAI;YAC7B,sBAAsB,EAAE,IAAI;SAC7B;QACD,iBAAiB,EAAE;YACjB,iBAAiB,EAAE,CAAC,+BAA+B,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,KAAK,EAAE,aAAa,CAAC;YACxJ,SAAS,EAAE,OAAO;YAClB,kBAAkB,EAAE,MAAM;SAC3B;QACD,iBAAiB,EAAE;YACjB,oCAAoC,EAAE,EAAE,EAAE,kDAAkD;YAC5F,+BAA+B,EAAE,EAAE;YACnC,mCAAmC,EAAE,EAAE;YACvC,kBAAkB,EAAE,IAAI;YACxB,qBAAqB,EAAE,IAAI;SAC5B;QACD,qBAAqB,EAAE;YACrB,6BAA6B,EAAE,IAAI;YACnC,wCAAwC,EAAE,IAAI;YAC9C,2BAA2B,EAAE,IAAI;YACjC,6BAA6B,EAAE,IAAI;YACnC,gCAAgC,EAAE,IAAI;YACtC,kCAAkC,EAAE,IAAI;SACzC;QACD,gBAAgB,EAAE;YAChB,wCAAwC,EAAE,IAAI;YAC9C,2CAA2C,EAAE,IAAI;YACjD,4BAA4B,EAAE,IAAI;YAClC,iCAAiC,EAAE,IAAI;SACxC;QACD,WAAW,EAAE;YACX,+BAA+B,EAAE,EAAE;YACnC,oCAAoC,EAAE,CAAC;YACvC,yCAAyC,EAAE,CAAC;YAC5C,kBAAkB,EAAE,EAAE;YACtB,mDAAmD,EAAE,IAAI;SAC1D;QACD,kBAAkB,EAAE;YAClB,2CAA2C,EAAE,IAAI;YACjD,sCAAsC,EAAE,IAAI;YAC5C,yCAAyC,EAAE,IAAI;YAC/C,sCAAsC,EAAE,IAAI;SAC7C;QACD,cAAc,EAAE;YACd,uBAAuB,EAAE,IAAI;YAC7B,gCAAgC,EAAE,IAAI;YACtC,mCAAmC,EAAE,IAAI;SAC1C;QACD,kBAAkB,EAAE;YAClB,SAAS,EAAE,aAAa;YACxB,iCAAiC,EAAE,IAAI;YACvC,6BAA6B,EAAE,IAAI;SACpC;QACD,uBAAuB,EAAE;YACvB,iCAAiC,EAAE,IAAI;YACvC,kCAAkC,EAAE,IAAI;YACxC,sCAAsC,EAAE,IAAI;SAC7C;KACF;IAED,cAAc,EAAE;QACd,gBAAgB,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,CAAC;QAClD,oBAAoB,EAAE,CAAC,4BAA4B,EAAE,yBAAyB,EAAE,sBAAsB,CAAC;QACvG,YAAY,EAAE;YACZ,QAAQ,EAAE,qLAAqL;YAC/L,KAAK,EAAE,kLAAkL;YACzL,OAAO,EAAE,kLAAkL;SAC5L;KACF;IAED,UAAU,EAAE;QACV,cAAc,EAAE,CAAC,+BAA+B,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,KAAK,EAAE,aAAa,CAAC;QACrJ,eAAe,EAAE;YACf,6BAA6B,EAAE,MAAM;YACrC,kBAAkB,EAAE,MAAM;YAC1B,wBAAwB,EAAE,MAAM;YAChC,wBAAwB,EAAE,MAAM;YAChC,GAAG,EAAE,OAAO;YACZ,WAAW,EAAE,OAAO;SACrB;QACD,kBAAkB,EAAE,IAAI;QACxB,kBAAkB,EAAE,aAAa;QACjC,qBAAqB,EAAE,YAAY;KACpC;IAED,eAAe,EAAE;QACf,uFAAuF;QACvF,kDAAkD;QAClD,oDAAoD;QACpD,qBAAqB,EAAE,IAAI,EAAE,wCAAwC;QACrE,oBAAoB,EAAE,IAAI,EAAE,kDAAkD;QAC9E,qBAAqB,EAAE,IAAI;QAC3B,SAAS,EAAE,iMAAiM;QAC5M,WAAW,EAAE,KAAK;QAClB,wBAAwB,EAAE,IAAI;QAC9B,WAAW,EAAE,CAAC,IAAI,CAAC;KACpB;IAED,cAAc,EAAE;QACd,qDAAqD;QACrD,sFAAsF;QACtF,oEAAoE;QACpE,yBAAyB,EAAE,EAAE,EAAE,oCAAoC;QACnE,SAAS,EAAE,4NAA4N;QACvO,kBAAkB,EAAE,CAAC,8BAA8B,EAAE,eAAe,EAAE,2BAA2B,EAAE,gBAAgB,CAAC;QACpH,0BAA0B,EAAE,IAAI;KACjC;IAED,UAAU,EAAE;QACV;YACE,EAAE,EAAE,2BAA2B;YAC/B,WAAW,EAAE,0GAA0G;YACvH,SAAS,EAAE,uGAAuG;YAClH,KAAK,EAAE,kCAAkC;YACzC,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,wBAAwB;YAC5B,WAAW,EAAE,uHAAuH;YACpI,SAAS,EAAE,oFAAoF;YAC/F,KAAK,EAAE,oBAAoB;YAC3B,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,qBAAqB;YACzB,WAAW,EAAE,mFAAmF;YAChG,SAAS,EAAE,gEAAgE;YAC3E,KAAK,EAAE,4BAA4B;YACnC,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,uBAAuB;YAC3B,WAAW,EAAE,8IAA8I;YAC3J,SAAS,EAAE,4FAA4F;YACvG,KAAK,EAAE,oBAAoB;YAC3B,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,iBAAiB;YACrB,WAAW,EAAE,+FAA+F;YAC5G,SAAS,EAAE,wGAAwG;YACnH,KAAK,EAAE,wBAAwB;YAC/B,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,4BAA4B;YAChC,WAAW,EAAE,mGAAmG;YAChH,SAAS,EAAE,kGAAkG;YAC7G,KAAK,EAAE,oBAAoB;YAC3B,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,+BAA+B;YACnC,WAAW,EAAE,kHAAkH;YAC/H,SAAS,EAAE,4FAA4F;YACvG,KAAK,EAAE,0BAA0B;YACjC,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,iCAAiC;YACrC,WAAW,EAAE,kHAAkH;YAC/H,SAAS,EAAE,qHAAqH;YAChI,KAAK,EAAE,wCAAwC;YAC/C,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,4BAA4B;YAChC,WAAW,EAAE,gGAAgG;YAC7G,SAAS,EAAE,qGAAqG;YAChH,KAAK,EAAE,wBAAwB;YAC/B,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,2BAA2B;YAC/B,WAAW,EAAE,kFAAkF;YAC/F,SAAS,EAAE,qHAAqH;YAChI,KAAK,EAAE,mBAAmB;YAC1B,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,4BAA4B;YAChC,WAAW,EAAE,mGAAmG;YAChH,SAAS,EAAE,yFAAyF;YACpG,KAAK,EAAE,4BAA4B;YACnC,YAAY,EAAE,MAAM;SACrB;KACF;CACF,CAAC"}