# Feature Spec: Regulatory Standards-Grounded Guidance **Status:** Spec — under review **Requested by:** James **Original request:** "should be giving guidance using following standards: FDA CFR 820, FDA CFR 803, FDA CFR 806, FDA Part 11, FDA CFR210 Pharmaceutical, ISO 13485, ISO 14971, EUMDR" --- ## Overview Ask QIEN should be able to ground its ticket guidance in the regulatory standards and regulations that matter to medical device, pharmaceutical, and quality-system customers. The goal is not to turn the product into a regulatory decision-maker. The goal is to help experts and line managers see which standards may be relevant, what kind of evidence or records may be expected, and where an expert should look before responding. This should roll out slowly. Incorporating full regulatory texts, clause-level retrieval, citations, and tenant-specific scope can consume a lot of indexing, LLM, review, and licensing resources if it is done all at once. --- ## Source Set Initial source family: | Source | Current reference | Notes | |---|---|---| | FDA 21 CFR Part 820 | Quality Management System Regulation (QMSR) | FDA states revised Part 820 is titled QMSR and effective February 2, 2026. It aligns more closely with ISO 13485. | | FDA 21 CFR Part 803 | Medical Device Reporting (MDR) | Mandatory reporting requirements for manufacturers, importers, and device user facilities. | | FDA 21 CFR Part 806 | Medical Devices; Reports of Corrections and Removals | Relevant to corrections/removals and recall-related triage. | | FDA 21 CFR Part 11 | Electronic Records; Electronic Signatures | Relevant when electronic records/signatures are part of the workflow or evidence trail. | | FDA 21 CFR Part 210 | Drug CGMP, general | Pharmaceutical current good manufacturing practice general provisions. Part 211 may also be needed for finished pharmaceuticals. | | ISO 13485 | ISO 13485:2016 | ISO lists this as Edition 3, published 2016-03, reviewed and confirmed in 2025. There is not a 2019 edition. | | ISO 14971 | ISO 14971:2019 | Medical device risk management standard, Edition 3, published 2019-12, reviewed and confirmed in 2025. | | EU MDR | Regulation (EU) 2017/745 | European Medical Device Regulation. Include amendment/update monitoring as part of source governance. | Primary references: - FDA QMSR FAQ: https://www.fda.gov/medical-devices/quality-management-system-regulation-qmsr/quality-management-system-regulation-frequently-asked-questions - FDA MDR overview: https://www.fda.gov/medical-devices/medical-device-safety/medical-device-reporting-mdr-how-report-medical-device-problems - FDA recalls/corrections/removals overview: https://www.fda.gov/medical-devices/postmarket-requirements-devices/recalls-corrections-and-removals-devices - FDA Part 11 guidance: https://www.fda.gov/regulatory-information/search-fda-guidance-documents/part-11-electronic-records-electronic-signatures-scope-and-application - FDA drug CGMP overview: https://www.fda.gov/drugs/pharmaceutical-quality-resources/current-good-manufacturing-practice-cgmp-regulations - ISO 13485:2016: https://www.iso.org/standard/59752.html - ISO 14971:2019: https://www.iso.org/standard/72704.html - European Commission medical devices overview: https://health.ec.europa.eu/medical-devices-new-regulations/overview_en --- ## Product Principles 1. **Cite, do not merely assert.** Any standards-grounded recommendation should show source family and clause/section where possible. 2. **Keep expert review in the loop.** The AI can suggest relevant obligations and evidence, but final guidance remains expert-owned. 3. **Use licensed sources correctly.** FDA/eCFR and EU legal materials can be handled differently from ISO standards. ISO documents are copyrighted and should not be ingested or reproduced unless the business has the right license. 4. **Retrieve narrowly.** Do not stuff whole regulations or standards into prompts. Pre-index source material, retrieve small relevant sections, and pass only the necessary excerpts to the LLM. 5. **Version everything.** A response grounded in "ISO 13485" must know which edition/review state was used. Regulatory guidance must survive audits and future updates. 6. **Make tenant scope explicit.** Not every tenant needs device, pharma, US, and EU guidance. The enabled source pack should be tenant-specific. --- ## User Experience ### Expert Ticket View Add a "Regulatory considerations" panel on the expert ticket detail page. Initial behavior: - Shows likely relevant source families, such as `21 CFR Part 803`, `ISO 14971`, or `EU MDR`. - Shows short rationale: why the source may be relevant to this ticket. - Shows cited sections or clause references when retrieval confidence is high. - Labels uncertainty clearly, for example: "Potentially relevant — expert review required." - Provides "Use in draft" affordance so experts can include relevant guidance in the response draft. ### Draft Response Agent The draft response agent can include a short standards-grounded section when regulatory context is enabled for the tenant. Example structure: - "Relevant regulatory considerations" - "Evidence or records to check" - "Suggested expert caveat" - Citations/source references The AI should avoid saying that a report, recall, CAPA, or regulatory submission is definitively required unless the expert confirms the facts. ### Tenant Admin Configuration Add tenant-level toggles later: - Enabled jurisdictions: `US FDA`, `EU` - Enabled sectors: `medical_device`, `pharmaceutical` - Enabled source packs: `cfr_820`, `cfr_803`, `cfr_806`, `part_11`, `cfr_210`, `iso_13485`, `iso_14971`, `eu_mdr` - Citation strictness: `suggestive`, `citation_required`, `expert_only` - Whether regulatory guidance may appear in line-manager-facing responses --- ## Recommended Rollout ### Phase 0 — Source Registry and Scope Model **What ships:** - A static registry of regulatory source families, current versions, jurisdiction, sector, and licensing status. - Tenant config fields for enabled regulatory source packs. - No LLM retrieval yet. **Why start here:** It creates the product/control surface before consuming indexing or LLM resources. **Scope:** S ### Phase 1 — Public Regulatory Source Pack **What ships:** - Ingest and chunk public-source material for FDA CFR families and EU MDR. - Add retrieval against these chunks from ticket text. - Show an expert-only "Regulatory considerations" panel with citations. - Log which chunks were retrieved for each ticket. **Included sources:** FDA 21 CFR Parts 820, 803, 806, 11, 210, and EU MDR. **Excluded for now:** ISO full-text ingestion unless licensed. **Scope:** M ### Phase 2 — Draft Agent Integration **What ships:** - Pass top regulatory excerpts into the response draft agent. - Require the model to separate regulatory context from practical advice. - Add prompt rules to avoid definitive legal/regulatory conclusions. - Track token usage and cost by tenant and source pack. **Scope:** M ### Phase 3 — ISO Standards Support **What ships:** - Integrate ISO 13485:2016 and ISO 14971:2019 only after licensing and permitted-use questions are settled. - Store clause-level metadata and permitted summaries/excerpts. - Add expert-reviewed clause mappings for common scenarios: - complaint handling - risk management updates - CAPA - design changes - supplier quality - production/process nonconformities - post-market surveillance **Scope:** M-L ### Phase 4 — Evaluation and Governance **What ships:** - A regression test set of representative tickets with expected source families and unacceptable assertions. - Expert review workflow for regulatory mappings. - Source update monitoring and re-index jobs. - Monthly report of regulatory feature usage, token cost, retrieval confidence, and expert overrides. **Scope:** M --- ## Data Model Sketch Possible new tables: | Table | Purpose | |---|---| | `regulatory_sources` | Source family metadata: jurisdiction, sector, version, effective date, license status, source URL | | `regulatory_documents` | Specific imported document/version records | | `regulatory_chunks` | Chunk text, section/clause reference, embedding, checksum, source document id | | `tenant_regulatory_profiles` | Enabled source packs and visibility rules per tenant | | `ticket_regulatory_assessments` | Retrieved source families, confidence, rationale, and citation ids for a ticket | | `regulatory_mapping_reviews` | Expert-reviewed mappings and corrections for future retrieval/prompting | If we can avoid new tables in Phase 0, use a static registry first and add persistence when retrieval ships. --- ## AI and Retrieval Design Pipeline: 1. Classify ticket domain: device, pharma, electronic records/signatures, adverse event, correction/removal, quality system, risk management, EU market. 2. Select enabled source packs for the tenant. 3. Retrieve top chunks from those source packs. 4. Optionally rerank retrieved chunks with a cheap model or deterministic keyword boost. 5. Generate expert-facing regulatory considerations with citations. 6. Store retrieval metadata and cited chunk ids. Prompt requirements: - The model must cite the retrieved source id/section for standards-grounded claims. - The model must say when facts are insufficient to determine applicability. - The model must not provide legal advice or claim that a regulatory report/submission is required without expert confirmation. - The model must distinguish between "record to check", "possible reporting path", and "required action". Cost controls: - Precompute embeddings offline. - Cache retrieval results per ticket version. - Limit regulatory chunks per LLM call. - Use source-pack toggles per tenant. - Log token use and cost per tenant, agent, source pack, and ticket. --- ## Risks **Copyright/licensing:** ISO standards cannot be treated like public web text. We need a license strategy before ingesting or showing ISO excerpts. **False authority:** A citation-looking answer can feel more definitive than it is. UI copy and prompts must preserve expert accountability. **Jurisdiction mismatch:** A tenant may operate in the US, EU, both, or neither. Wrong jurisdictional advice could be worse than no advice. **Over-retrieval cost:** Pulling entire standards into every ticket would be expensive and noisy. The feature depends on disciplined chunking and retrieval. **Version drift:** Regulations and guidance change. Source versions need update monitoring and traceability. --- ## Open Questions 1. Do we have, or will we buy, licenses that permit ISO 13485 and ISO 14971 ingestion, embedding, and display of excerpts inside Ask QIEN? 2. Should pharmaceutical scope include only 21 CFR Part 210, or should Part 211 be included from the start for finished pharmaceuticals? 3. Which tenants actually need EU MDR guidance, and should EU MDR ever appear in line-manager-facing responses? 4. Should regulatory guidance be available to all experts, or only admins / regulatory specialists? 5. Should this feature produce only "considerations", or should it eventually create structured outputs such as reportability assessment drafts? 6. What citation standard do we want in responses: section number only, source title + section, or links to official source pages? 7. How much customer-specific SOP content should be retrieved alongside external standards? 8. Who owns expert review of regulatory mappings and eval cases? --- ## Recommendation Build this as a slow-roll capability: 1. Start with source registry and tenant toggles. 2. Add public FDA/EU retrieval for expert-only consideration panels. 3. Integrate carefully into the draft agent. 4. Add ISO support only once licensing and expert-reviewed mappings are settled. This gives useful regulatory awareness without immediately taking on the full cost, licensing, and risk burden of a comprehensive standards engine.