fda-510k-audit

name

fda-510k-audit

description

Use when auditing a medical-device software codebase for FDA 510(k) submission readiness, checking regulatory documentation and engineering evidence against FDA software guidance, or finding gaps in design controls, IEC 62304, ISO 14971, cybersecurity (SBOM, §524B), QMSR, human factors, or labeling. Keywords - 510(k), SaMD, premarket submission, substantial equivalence, device software functions, gap analysis.

FDA 510(k) Software-Device Audit

Audit a medical-device software codebase for FDA 510(k) submission readiness, then produce a traceability checklist, a gap report, and a remediation backlog.

This is an internal gap-analysis aid, not regulatory or legal advice. See references/disclaimer.md.

When to use

Use when a user wants to assess a software-device repository against FDA 510(k) software requirements, find documentation/process/engineering gaps, or prepare for a submission.

How the skill is organized

• references/00-device-profile-guide.md — read FIRST; how to classify the device and set audit depth.
• references/01-regulatory-strategy.md … 10-labeling.md — one regulatory domain each. Read the domain file when auditing that domain.
• codebase-evidence-map.md — where engineering evidence lives and how to read evidence-index.json.
• templates/ — output scaffolds (device profile, checklist, report, backlog).
• scripts/scan-repo.py — run to collect repo evidence.

Audit workflow

Paste this checklist into your working notes and complete it in order:

• 1. Device profile. Read references/00-device-profile-guide.md. Interview the codebase and user; write the completed profile to <target>/regulatory/device-profile.md using templates/device-profile.md. If a profile already exists, refresh it. Gate: do not proceed without a profile.
• 2. Map the codebase. Run python3 scripts/scan-repo.py <target> --out <target>/evidence-index.json.
• 3. Audit domains 01–10. For each domain, read its reference file and compare its "Required artifacts" against the device profile (for depth), evidence-index.json, and the repo. Record each item as a row in templates/traceability-checklist.md (Status + Severity). Domains are independent and may be delegated to parallel subagents.
• 4. Score. Roll up per-domain readiness into the checklist Summary table.
• 5. Write the gap report from the checklist using templates/gap-report.md; embed references/disclaimer.md at the top.
• 6. Derive the backlog using templates/remediation-backlog.md; every Critical/Major gap becomes a task.
• 7. Self-check against the rubric below before declaring done.

Completeness rubric (step 7)

• Every domain 01–10 has checklist rows or is explicitly marked N-A with a reason.
• Every Critical and Major gap has a backlog item.
• The gap report embeds the disclaimer.
• AI/ML and human-factors depth matches the device profile (no over-auditing low-risk functions).
• The device profile exists in the target project and every domain's depth reflects it.