Prepares and structurally reviews readiness evidence for ISO management-system and laboratory-competence standards - ISO 13485 medical device QMS, ISO 14971 device risk management, ISO/IEC 17025 testing and calibration laboratories, and ISO 15189 medical laboratories. Use when organizing declared scope, controlled documents, risk-management files, scope of accreditation, traceability, CAPA, external-provider controls, or bounded local evidence manifests, and when separating ISO certification from laboratory accreditation, FDA QMSR inspection, CLIA certification, MDSAP, and EU MDR/IVDR evidence boundaries. Not for legal applicability, compliance, certification, or accreditation decisions; contains no clause text.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
Prepares and structurally reviews readiness evidence for ISO management-system and laboratory-competence standards - ISO 13485 medical device QMS, ISO 14971 device risk management, ISO/IEC 17025 testing and calibration laboratories, and ISO 15189 medical laboratories. Use when organizing declared scope, controlled documents, risk-management files, scope of accreditation, traceability, CAPA, external-provider controls, or bounded local evidence manifests, and when separating ISO certification from laboratory accreditation, FDA QMSR inspection, CLIA certification, MDSAP, and EU MDR/IVDR evidence boundaries. Not for legal applicability, compliance, certification, or accreditation decisions; contains no clause text.
license
MIT
compatibility
Python 3.11+; bundled CLIs use only the standard library and bounded local JSON/Markdown files, with no network access or credentials.
Use this skill to organize declared scope, controlled documents, implementation
records, traceability, and readiness evidence for substantive human review against a
named standard. It summarizes process workflows and provides deterministic local
checks. It contains no clause text and performs no audit.
This is a router. SKILL.md holds the boundary, the lane discipline, the shared
workflow, and the CLI contract. Per-standard depth lives in references/.
Non-negotiable boundary
This skill cannot:
certify or accredit anything, issue or validate a certificate, accreditation
schedule, or licence, or promise an audit, assessment, or inspection result;
replace authorized management, the management representative, laboratory director,
quality manager, authorized signatory, RA/QA, legal counsel, regulatory/competent
authorities, a notified body, an MDSAP Auditing Organization, an accreditation body,
an assessor, or a certification body;
validate a method, compute or approve measurement uncertainty, establish
metrological traceability, set risk-acceptability criteria, or judge whether a risk,
decision rule, or reference interval is fit for purpose; or
infer implementation, competence, conformity, compliance, or readiness from a
template, checklist, filename, keyword, document count, percentage, or script
result.
Always label outputs draft evidence-preparation material for authorized human
review. Preserve unresolved decisions as blockers rather than resolving them.
ISO and IEC copyright
ISO and IEC standards are copyrighted. Obtain each standard from
ISO, IEC, an ISO national member, or another
authorized source. Do not retrieve, paste, reproduce, or generate clause text.
Summarize the organization's own process and cite the controlled authorized copy. See
ISO copyright. Accreditation-body, CAP, and
scheme checklists that quote requirements are separately licensed โ keep them out of
shared repositories and prompts too.
Standards covered
Read the reference file for the standard in play before preparing evidence. Each
one carries its own current edition, lane, domain vocabulary, and failure modes.
Standard
Profile key
Lane
Reference
ISO 13485 medical device QMS
iso-13485
Certification
references/iso-13485.md
ISO 14971 device risk management
iso-14971
No lane of its own
references/iso-14971.md
ISO/IEC 17025 testing and calibration laboratories
iso-17025
Accreditation
references/iso-17025.md
ISO 15189 medical laboratories
iso-15189
Accreditation
references/iso-15189.md
A standard absent from this table is out of scope for the bundled checks. Do not
repurpose a profile for a standard it does not name โ a domain vocabulary borrowed from
a different standard produces a report that looks complete and means nothing.
Current baseline (read the ledger before any time-sensitive statement)
ISO 13485:2016 Edition 3, confirmed after its 2025 systematic review.
EN ISO 13485:2016/A11:2021 is a European amendment, not an ISO international
"Amendment 1:2021."
ISO 14971:2019 Edition 3, confirmed in 2025, with ISO/TR 24971:2020 as its
informative guidance companion. There is no ISO 14971 certificate.
ISO/IEC 17025:2017 Edition 3 remains current; no successor edition identified.
ISO 15189:2022 Edition 4 replaced the 2012 edition, absorbed the POCT
requirements formerly in ISO 22870, and its accreditation transition closed in
December 2025 โ implemented, not upcoming.
FDA QMSR effective and enforced since 2026-02-02; Part 820 is titled
Quality Management System Regulation; QSIT is retired in favour of Compliance
Program 7382.850.
MDSAP current Audit Approach is MDSAP AU P0002.010, version date
2026-02-02.
Accreditation recognition: Global Accreditation Cooperation Incorporated
commenced full operations 2026-01-01, replacing ILAC and IAF, with its own MRA;
former IAF MLA / ILAC MRA outputs stay recognized during the transition.
EU: use current consolidated MDR/IVDR texts, current OJEU harmonised-standard
decisions, current MDCG guidance, and the product-specific conformity route.
Read references/source-ledger.md before making any time-sensitive statement. It
records provenance limitations, including which entries still need confirmation against
the ISO catalogue.
Keep the assurance lanes separate
Lane confusion, not missing documents, causes most substantive errors here.
Certification, accreditation, regulator inspection, mandatory licensure, regulatory
audit programmes, and product conformity assessment are decided by different bodies
against different bases, and none substitutes for another. Two rules that are violated
constantly:
Organizations are certified; laboratories are accredited. "ISO 17025
certified" and "ISO 15189 certified" are category errors.
A certificate never displaces a regulator. ISO 13485 certification does not exempt
anyone from FDA inspection, and ISO 15189 accreditation does not satisfy CLIA.
Read references/assurance-lanes.md for the full lane table, scope-statement limits,
and the titling rule.
Core workflow
Step 1: Declare the standard, purpose, and authorized owners
Name the standard(s), the lane(s) the work supports, and the owners: management
representative or laboratory director, quality owner, legal/applicability owner,
process or technical owners, approvers, and escalation route. A lane is a declared
input, never an inference.
--standard defaults to iso-13485. Every distributed template intentionally fails
closed; copy it outside the skill and complete it with controlled organizational
evidence. Undetermined applicability raises HUMAN_DECISION_REQUIRED โ leave it as a
blocker.
Step 2: Freeze source/version evidence
For every standard, regulation, guidance, scheme document, audit model, and product
source, record publisher, official title, edition/version/date, authorized location,
access and currency-review dates, scope/applicability owner, impact assessment, status,
evidence, and approval.
Do not use search snippets as controlled requirements. Do not silently update an
incorporated edition when a publisher releases a new one โ FDA incorporated a specific
ISO 13485 edition, and a later ISO or EN publication does not change it.
Step 3: Inventory controlled documents and records
Do not count named procedures or scan keywords. Build an explicit register linking
documents, records, source versions, owners, approvals, effective dates, retention
bases, training, and change records.
This check is standard-agnostic. Read references/evidence-architecture.md for the
evidence architecture.
Step 4: Review process implementation
Assess controlled procedures and sampled records across the domains your profile
declares โ the per-standard reference file lists them. Each item needs owner, status,
evidence IDs, source/version, approval, and open-gap links.
A procedure describing an activity is not evidence the activity happened. Sample
records in every domain you report on, and state what you sampled and what you did not.
Step 5: Run the focused checks that apply to the lane
All standards โ suppliers and externally provided products and services, including
calibration providers, reference-material suppliers, and referral or subcontracted
laboratories:
Pending or ineffective CAPA effectiveness evidence blocks closure. Critical supplier
controls stay blocked until risk-based controls and approvals are evidenced.
Note that check_traceability.py concerns design and risk traceability, not
metrological traceability โ the words collide and it is the wrong tool for laboratory
work.
Review current Part 820/FDA source basis, supplemental provisions, obsolete QSR/QSIT
references, pre-effective-date records, inspection-accessible management/quality/
supplier-audit records, current inspection-process training, complaint and servicing
records, labeling/packaging controls, supplier/software/change evidence, and prohibited
certificate-equivalence claims. Do not build an old-820-to-ISO clause map as the
current control framework.
Laboratory lanes have no equivalent bundled check. CLIA, licensure, and national
inspection evidence stays with the authorized compliance owner; see
references/iso-15189.md.
Step 7: Assemble a bounded readiness manifest
Copy the evidence template outside the skill. Use relative paths to local .json,
.md, or .markdown evidence only, and one declared lane purpose per manifest.
The analyzer uses explicit manifest labels. It does not infer evidence from filenames,
keywords, or proprietary standard text, and does not calculate a compliance score. A
domain absent from expected_domains is reported not-assessed, which is not a
not-applicable determination.
Read references/gap-analysis-checklist.md for the fail-closed review questions.
Step 8: Human review and controlled handoff
Present:
declared standard, scope, assurance lane(s), and unresolved applicability decisions;
the exact source/version baseline;
evidence sampled and the limitations of that sample;
structural findings grouped by process and risk;
actions, change, and CAPA owners with dates;
approval state; and
the authorized party responsible for the next decision.
Never title the result "certificate," "accreditation," "compliance report," "audit
pass," "deemed status," or "ready for inspection." A suitable title is Draft evidence
review for authorized human assessment, naming the lane it was prepared for.
CLI behavior and safety
All bundled CLIs:
use the Python standard library only;
perform no network requests;
accept bounded local JSON; optional evidence verification accepts only bounded local
JSON/Markdown;
refuse an unlisted --standard value rather than falling back to a default;
use no dynamic evaluation, executable deserialization, pickle, or shell execution;
refuse to overwrite reports unless --force is explicit; and
produce deterministic sorted JSON.
Treat the manifest itself as a controlled organizational record. An optional SHA-256
comparison detects a local file mismatch only; it does not establish provenance,
authenticity, adequacy, or trust in a user-supplied manifest. Values in JSON
local_path and evidence.location fields refer to the user's controlled export, not
to bundled skill resources; unresolved placeholders must never be opened.
Exit codes:
0: no structural finding for the supplied fields; not a compliance, conformity,
competence, or accreditation result;
1: structural/evidence gaps found;
2: invalid or unsafe input/output, including an unlisted standard.
Run python3 scripts/<name>.py --help for each interface.
Every template is deliberately draft/pending, uses placeholders, and includes
owner/status/evidence/approval fields. Copy and control it; never edit a distributed
template into a purported approved record.
References
Shared:
references/assurance-lanes.md โ what each lane decides, and the titling rule
references/source-ledger.md โ dated authoritative source baseline and provenance
limitations
references/evidence-architecture.md โ documentation and record architecture
