@diottodev/runic 1.0.0 → 1.1.0

package/compliance/mdr-745-specialist/SKILL.md

@@ -0,0 +1,335 @@
+---
+name: "mdr-745-specialist"
+description: EU MDR 2017/745 compliance specialist for medical device classification, technical documentation, clinical evidence, and post-market surveillance. Covers Annex VIII classification rules, Annex II/III technical files, Annex XIV clinical evaluation, and EUDAMED integration.
+triggers:
+  - MDR compliance
+  - EU MDR
+  - medical device classification
+  - Annex VIII
+  - technical documentation
+  - clinical evaluation
+  - PMCF
+  - EUDAMED
+  - UDI
+  - notified body
+---
+
+# MDR 2017/745 Specialist
+
+EU MDR compliance patterns for medical device classification, technical documentation, and clinical evidence.
+
+---
+
+## Table of Contents
+
+- [Device Classification Workflow](#device-classification-workflow)
+- [Technical Documentation](#technical-documentation)
+- [Clinical Evidence](#clinical-evidence)
+- [Post-Market Surveillance](#post-market-surveillance)
+- [EUDAMED and UDI](#eudamed-and-udi)
+- [Reference Documentation](#reference-documentation)
+- [Tools](#tools)
+
+---
+
+## Device Classification Workflow
+
+Classify device under MDR Annex VIII:
+
+1. Identify device duration (transient, short-term, long-term)
+2. Determine invasiveness level (non-invasive, body orifice, surgical)
+3. Assess body system contact (CNS, cardiac, other)
+4. Check if active device (energy dependent)
+5. Apply classification rules 1-22
+6. For software, apply MDCG 2019-11 algorithm
+7. Document classification rationale
+8. **Validation:** Classification confirmed with Notified Body
+
+### Classification Matrix
+
+| Factor | Class I | Class IIa | Class IIb | Class III |
+|--------|---------|-----------|-----------|-----------|
+| Duration | Any | Short-term | Long-term | Long-term |
+| Invasiveness | Non-invasive | Body orifice | Surgical | Implantable |
+| System | Any | Non-critical | Critical organs | CNS/cardiac |
+| Risk | Lowest | Low-medium | Medium-high | Highest |
+
+### Software Classification (MDCG 2019-11)
+
+| Information Use | Condition Severity | Class |
+|-----------------|-------------------|-------|
+| Informs decision | Non-serious | IIa |
+| Informs decision | Serious | IIb |
+| Drives/treats | Critical | III |
+
+### Classification Examples
+
+**Example 1: Absorbable Surgical Suture**
+- Rule 8 (implantable, long-term)
+- Duration: > 30 days (absorbed)
+- Contact: General tissue
+- Classification: **Class IIb**
+
+**Example 2: AI Diagnostic Software**
+- Rule 11 + MDCG 2019-11
+- Function: Diagnoses serious condition
+- Classification: **Class IIb**
+
+**Example 3: Cardiac Pacemaker**
+- Rule 8 (implantable)
+- Contact: Central circulatory system
+- Classification: **Class III**
+
+---
+
+## Technical Documentation
+
+Prepare technical file per Annex II and III:
+
+1. Create device description (variants, accessories, intended purpose)
+2. Develop labeling (Article 13 requirements, IFU)
+3. Document design and manufacturing process
+4. Complete GSPR compliance matrix
+5. Prepare benefit-risk analysis
+6. Compile verification and validation evidence
+7. Integrate risk management file (ISO 14971)
+8. **Validation:** Technical file reviewed for completeness
+
+### Technical File Structure
+
+```
+ANNEX II TECHNICAL DOCUMENTATION
+├── Device description and UDI-DI
+├── Label and instructions for use
+├── Design and manufacturing info
+├── GSPR compliance matrix
+├── Benefit-risk analysis
+├── Verification and validation
+└── Clinical evaluation report
+```
+
+### GSPR Compliance Checklist
+
+| Requirement | Evidence | Status |
+|-------------|----------|--------|
+| Safe design (GSPR 1-3) | Risk management file | ☐ |
+| Chemical properties (GSPR 10.1) | Biocompatibility report | ☐ |
+| Infection risk (GSPR 10.2) | Sterilization validation | ☐ |
+| Software requirements (GSPR 17) | IEC 62304 documentation | ☐ |
+| Labeling (GSPR 23) | Label artwork, IFU | ☐ |
+
+### Conformity Assessment Routes
+
+| Class | Route | NB Involvement |
+|-------|-------|----------------|
+| I | Annex II self-declaration | None |
+| Is/Im | Annex II + IX/XI | Sterile/measuring aspects |
+| IIa | Annex II + IX or XI | Product or QMS |
+| IIb | Annex IX + X or X + XI | Type exam + production |
+| III | Annex IX + X | Full QMS + type exam |
+
+---
+
+## Clinical Evidence
+
+Develop clinical evidence strategy per Annex XIV:
+
+1. Define clinical claims and endpoints
+2. Conduct systematic literature search
+3. Appraise clinical data quality
+4. Assess equivalence (technical, biological, clinical)
+5. Identify evidence gaps
+6. Determine if clinical investigation required
+7. Prepare Clinical Evaluation Report (CER)
+8. **Validation:** CER reviewed by qualified evaluator
+
+### Evidence Requirements by Class
+
+| Class | Minimum Evidence | Investigation |
+|-------|------------------|---------------|
+| I | Risk-benefit analysis | Not typically required |
+| IIa | Literature + post-market | May be required |
+| IIb | Systematic literature review | Often required |
+| III | Comprehensive clinical data | Required (Article 61) |
+
+### Clinical Evaluation Report Structure
+
+```
+CER CONTENTS
+├── Executive summary
+├── Device scope and intended purpose
+├── Clinical background (state of the art)
+├── Literature search methodology
+├── Data appraisal and analysis
+├── Safety and performance conclusions
+├── Benefit-risk determination
+└── PMCF plan summary
+```
+
+### Qualified Evaluator Requirements
+
+- Medical degree or equivalent healthcare qualification
+- 4+ years clinical experience in relevant field
+- Training in clinical evaluation methodology
+- Understanding of MDR requirements
+
+---
+
+## Post-Market Surveillance
+
+Establish PMS system per Chapter VII:
+
+1. Develop PMS plan (Article 84)
+2. Define data collection methods
+3. Establish complaint handling procedures
+4. Create vigilance reporting process
+5. Plan Periodic Safety Update Reports (PSUR)
+6. Integrate with PMCF activities
+7. Define trend analysis and signal detection
+8. **Validation:** PMS system audited annually
+
+### PMS System Components
+
+| Component | Requirement | Frequency |
+|-----------|-------------|-----------|
+| PMS Plan | Article 84 | Maintain current |
+| PSUR | Class IIa and higher | Per class schedule |
+| PMCF Plan | Annex XIV Part B | Update with CER |
+| PMCF Report | Annex XIV Part B | Annual (Class III) |
+| Vigilance | Articles 87-92 | As events occur |
+
+### PSUR Schedule
+
+| Class | Frequency |
+|-------|-----------|
+| Class III | Annual |
+| Class IIb implantable | Annual |
+| Class IIb | Every 2 years |
+| Class IIa | When necessary |
+
+### Serious Incident Reporting
+
+| Timeline | Requirement |
+|----------|-------------|
+| 2 days | Serious public health threat |
+| 10 days | Death or serious deterioration |
+| 15 days | Other serious incidents |
+
+---
+
+## EUDAMED and UDI
+
+Implement UDI system per Article 27:
+
+1. Obtain issuing entity code (GS1, HIBCC, ICCBBA)
+2. Assign UDI-DI to each device variant
+3. Assign UDI-PI (production identifier)
+4. Apply UDI carrier to labels (AIDC + HRI)
+5. Register actor in EUDAMED
+6. Register devices in EUDAMED
+7. Upload certificates when available
+8. **Validation:** UDI verified on sample labels
+
+### EUDAMED Modules
+
+| Module | Content | Actor |
+|--------|---------|-------|
+| Actor | Company registration | Manufacturer, AR |
+| UDI/Device | Device and variant data | Manufacturer |
+| Certificates | NB certificates | Notified Body |
+| Clinical Investigation | Study registration | Sponsor |
+| Vigilance | Incident reports | Manufacturer |
+| Market Surveillance | Authority actions | Competent Authority |
+
+### UDI Label Requirements
+
+Required elements per Article 13:
+
+- [ ] UDI-DI (device identifier)
+- [ ] UDI-PI (production identifier) for Class II+
+- [ ] AIDC format (barcode/RFID)
+- [ ] HRI format (human-readable)
+- [ ] Manufacturer name and address
+- [ ] Lot/serial number
+- [ ] Expiration date (if applicable)
+
+---
+
+## Reference Documentation
+
+### MDR Classification Guide
+
+`references/mdr-classification-guide.md` contains:
+
+- Complete Annex VIII classification rules (Rules 1-22)
+- Software classification per MDCG 2019-11
+- Worked classification examples
+- Conformity assessment route selection
+
+### Clinical Evidence Requirements
+
+`references/clinical-evidence-requirements.md` contains:
+
+- Clinical evidence framework and hierarchy
+- Literature search methodology
+- Clinical Evaluation Report structure
+- PMCF plan and evaluation report guidance
+
+### Technical Documentation Templates
+
+`references/technical-documentation-templates.md` contains:
+
+- Annex II and III content requirements
+- Design History File structure
+- GSPR compliance matrix template
+- Declaration of Conformity template
+- Notified Body submission checklist
+
+---
+
+## Tools
+
+### MDR Gap Analyzer
+
+```bash
+# Quick gap analysis
+python scripts/mdr_gap_analyzer.py --device "Device Name" --class IIa
+
+# JSON output for integration
+python scripts/mdr_gap_analyzer.py --device "Device Name" --class III --output json
+
+# Interactive assessment
+python scripts/mdr_gap_analyzer.py --interactive
+```
+
+Analyzes device against MDR requirements, identifies compliance gaps, generates prioritized recommendations.
+
+**Output includes:**
+- Requirements checklist by category
+- Gap identification with priorities
+- Critical gap highlighting
+- Compliance roadmap recommendations
+
+---
+
+## Notified Body Interface
+
+### Selection Criteria
+
+| Factor | Considerations |
+|--------|----------------|
+| Designation scope | Covers your device type |
+| Capacity | Timeline for initial audit |
+| Geographic reach | Markets you need to access |
+| Technical expertise | Experience with your technology |
+| Fee structure | Transparency, predictability |
+
+### Pre-Submission Checklist
+
+- [ ] Technical documentation complete
+- [ ] GSPR matrix fully addressed
+- [ ] Risk management file current
+- [ ] Clinical evaluation report complete
+- [ ] QMS (ISO 13485) certified
+- [ ] Labeling and IFU finalized
+- [ ] **Validation:** Internal gap assessment complete

package/compliance/qms-audit-expert/SKILL.md

@@ -0,0 +1,323 @@
+---
+name: "qms-audit-expert"
+description: ISO 13485 internal audit expertise for medical device QMS. Covers audit planning, execution, nonconformity classification, and CAPA verification. Use for internal audit planning, audit execution, finding classification, external audit preparation, or audit program management.
+triggers:
+  - ISO 13485 audit
+  - internal audit
+  - QMS audit
+  - audit planning
+  - nonconformity classification
+  - CAPA verification
+  - audit checklist
+  - audit finding
+  - external audit prep
+  - audit schedule
+---
+
+# QMS Audit Expert
+
+ISO 13485 internal audit methodology for medical device quality management systems.
+
+---
+
+## Table of Contents
+
+- [Audit Planning Workflow](#audit-planning-workflow)
+- [Audit Execution](#audit-execution)
+- [Nonconformity Management](#nonconformity-management)
+- [External Audit Preparation](#external-audit-preparation)
+- [Reference Documentation](#reference-documentation)
+- [Tools](#tools)
+
+---
+
+## Audit Planning Workflow
+
+Plan risk-based internal audit program:
+
+1. List all QMS processes requiring audit
+2. Assign risk level to each process (High/Medium/Low)
+3. Review previous audit findings and trends
+4. Determine audit frequency by risk level
+5. Assign qualified auditors (verify independence)
+6. Create annual audit schedule
+7. Communicate schedule to process owners
+8. **Validation:** All ISO 13485 clauses covered within cycle
+
+### Risk-Based Audit Frequency
+
+| Risk Level | Frequency | Criteria |
+|------------|-----------|----------|
+| High | Quarterly | Design control, CAPA, production validation |
+| Medium | Semi-annual | Purchasing, training, document control |
+| Low | Annual | Infrastructure, management review (if stable) |
+
+### Audit Scope by Clause
+
+| Clause | Process | Focus Areas |
+|--------|---------|-------------|
+| 4.2 | Document Control | Document approval, distribution, obsolete control |
+| 5.6 | Management Review | Inputs complete, decisions documented, actions tracked |
+| 6.2 | Training | Competency defined, records complete, effectiveness verified |
+| 7.3 | Design Control | Inputs, reviews, V&V, transfer, changes |
+| 7.4 | Purchasing | Supplier evaluation, incoming inspection |
+| 7.5 | Production | Work instructions, process validation, DHR |
+| 7.6 | Calibration | Equipment list, calibration status, out-of-tolerance |
+| 8.2.2 | Internal Audit | Schedule compliance, auditor independence |
+| 8.3 | NC Product | Identification, segregation, disposition |
+| 8.5 | CAPA | Root cause, implementation, effectiveness |
+
+### Auditor Independence
+
+Verify auditor independence before assignment:
+
+- [ ] Auditor not responsible for area being audited
+- [ ] No direct reporting relationship to auditee
+- [ ] Not involved in recent activities under audit
+- [ ] Documented qualification for audit scope
+
+---
+
+## Audit Execution
+
+Conduct systematic internal audit:
+
+1. Prepare audit plan (scope, criteria, schedule)
+2. Review relevant documentation before audit
+3. Conduct opening meeting with auditee
+4. Collect evidence (records, interviews, observation)
+5. Classify findings (Major/Minor/Observation)
+6. Conduct closing meeting with preliminary findings
+7. Prepare audit report within 5 business days
+8. **Validation:** All scope items covered, findings supported by evidence
+
+### Evidence Collection
+
+| Method | Use For | Documentation |
+|--------|---------|---------------|
+| Document review | Procedures, records | Document number, version, date |
+| Interview | Process understanding | Interviewee name, role, summary |
+| Observation | Actual practice | What, where, when observed |
+| Record trace | Process flow | Record IDs, dates, linkage |
+
+### Audit Questions by Clause
+
+**Document Control (4.2):**
+- Show me the document master list
+- How do you control obsolete documents?
+- Show me evidence of document change approval
+
+**Design Control (7.3):**
+- Show me the Design History File for [product]
+- Who participates in design reviews?
+- Show me design input to output traceability
+
+**CAPA (8.5):**
+- Show me the CAPA log with open items
+- How do you determine root cause?
+- Show me effectiveness verification records
+
+See `references/iso13485-audit-guide.md` for complete question sets.
+
+### Finding Documentation
+
+Document each finding with:
+
+```
+Requirement: [Specific ISO 13485 clause or procedure]
+Evidence: [What was observed, reviewed, or heard]
+Gap: [How evidence fails to meet requirement]
+```
+
+**Example:**
+```
+Requirement: ISO 13485:2016 Clause 7.6 requires calibration
+at specified intervals.
+
+Evidence: Calibration records for pH meter (EQ-042) show
+last calibration 2024-01-15. Calibration interval is
+12 months. Today is 2025-03-20.
+
+Gap: Equipment is 2 months overdue for calibration,
+representing a gap in calibration program execution.
+```
+
+---
+
+## Nonconformity Management
+
+Classify and manage audit findings:
+
+1. Evaluate finding against classification criteria
+2. Assign severity (Major/Minor/Observation)
+3. Document finding with objective evidence
+4. Communicate to process owner
+5. Initiate CAPA for Major/Minor findings
+6. Track to closure
+7. Verify effectiveness at follow-up
+8. **Validation:** Finding closed only after effective CAPA
+
+### Classification Criteria
+
+| Category | Definition | CAPA Required | Timeline |
+|----------|------------|---------------|----------|
+| Major | Systematic failure or absence of element | Yes | 30 days |
+| Minor | Isolated lapse or partial implementation | Recommended | 60 days |
+| Observation | Improvement opportunity | Optional | As appropriate |
+
+### Classification Decision
+
+```
+Is required element absent or failed?
+├── Yes → Systematic (multiple instances)? → MAJOR
+│   └── No → Could affect product safety? → MAJOR
+│       └── No → MINOR
+└── No → Deviation from procedure?
+    ├── Yes → Recurring? → MAJOR
+    │   └── No → MINOR
+    └── No → Improvement opportunity? → OBSERVATION
+```
+
+### CAPA Integration
+
+| Finding Severity | CAPA Depth | Verification |
+|------------------|------------|--------------|
+| Major | Full root cause analysis (5-Why, Fishbone) | Next audit or within 6 months |
+| Minor | Immediate cause identification | Next scheduled audit |
+| Observation | Not required | Noted at next audit |
+
+See `references/nonconformity-classification.md` for detailed guidance.
+
+---
+
+## External Audit Preparation
+
+Prepare for certification body or regulatory audit:
+
+1. Complete all scheduled internal audits
+2. Verify all findings closed with effective CAPA
+3. Review documentation for currency and accuracy
+4. Conduct management review with audit as input
+5. Prepare facility and personnel
+6. Conduct mock audit (full scope)
+7. Brief personnel on audit protocol
+8. **Validation:** Mock audit findings addressed before external audit
+
+### Pre-Audit Readiness Checklist
+
+**Documentation:**
+- [ ] Quality Manual current
+- [ ] Procedures reflect actual practice
+- [ ] Records complete and retrievable
+- [ ] Previous audit findings closed
+
+**Personnel:**
+- [ ] Key personnel available during audit
+- [ ] Subject matter experts identified
+- [ ] Personnel briefed on audit protocol
+- [ ] Escorts assigned
+
+**Facility:**
+- [ ] Work areas organized
+- [ ] Documents at point of use current
+- [ ] Equipment calibration status visible
+- [ ] Nonconforming product segregated
+
+### Mock Audit Protocol
+
+1. Use external auditor or qualified internal auditor
+2. Cover full scope of upcoming external audit
+3. Simulate actual audit conditions (timing, formality)
+4. Document findings as for real audit
+5. Address all Major and Minor findings before external audit
+6. Brief management on readiness status
+
+---
+
+## Reference Documentation
+
+### ISO 13485 Audit Guide
+
+`references/iso13485-audit-guide.md` contains:
+
+- Clause-by-clause audit methodology
+- Sample audit questions for each clause
+- Evidence collection requirements
+- Common nonconformities by clause
+- Finding severity classification
+
+### Nonconformity Classification
+
+`references/nonconformity-classification.md` contains:
+
+- Severity classification criteria and decision tree
+- Impact vs. occurrence matrix
+- CAPA integration requirements
+- Finding documentation templates
+- Closure requirements by severity
+
+---
+
+## Tools
+
+### Audit Schedule Optimizer
+
+```bash
+# Generate optimized audit schedule
+python scripts/audit_schedule_optimizer.py --processes processes.json
+
+# Interactive mode
+python scripts/audit_schedule_optimizer.py --interactive
+
+# JSON output for integration
+python scripts/audit_schedule_optimizer.py --processes processes.json --output json
+```
+
+Generates risk-based audit schedule considering:
+- Process risk level
+- Previous findings
+- Days since last audit
+- Criticality scores
+
+**Output includes:**
+- Prioritized audit schedule
+- Quarterly distribution
+- Overdue audit alerts
+- Resource recommendations
+
+### Sample Process Input
+
+```json
+{
+  "processes": [
+    {
+      "name": "Design Control",
+      "iso_clause": "7.3",
+      "risk_level": "HIGH",
+      "last_audit_date": "2024-06-15",
+      "previous_findings": 2
+    },
+    {
+      "name": "Document Control",
+      "iso_clause": "4.2",
+      "risk_level": "MEDIUM",
+      "last_audit_date": "2024-09-01",
+      "previous_findings": 0
+    }
+  ]
+}
+```
+
+---
+
+## Audit Program Metrics
+
+Track audit program effectiveness:
+
+| Metric | Target | Measurement |
+|--------|--------|-------------|
+| Schedule compliance | >90% | Audits completed on time |
+| Finding closure rate | >95% | Findings closed by due date |
+| Repeat findings | <10% | Same finding in consecutive audits |
+| CAPA effectiveness | >90% | Verified effective at follow-up |
+| Auditor utilization | 4 days/month | Audit days per qualified auditor |