MedTech Software as a Medical Device

Software changes, with release evidence

Connect software requirements, risk controls, test results and release review.

Mapped to your IEC 62304 process Hazard log kept with the code Evidence pack with every release

SaMD compliance workspace on DeX

Pipeline running Example data

Product compliance home

Readiness at a glance

Retina screening AI · v3.2.0 liveClass IIa

v3.2.0Current version

4Open risks

91%Evidence complete

Next release · v3.3.0

Scope and change assessmentApproved

Build and verificationRunning

Clinical and quality reviewNext

Incoming changes

AI scope check

Software requirements

Hazard log · linked controls

HZ-02Missed referable case
Control RC-03 · sensitivity floorLinked

HZ-05Result from poor-quality image
Control RC-06 · quality gateLinked

HZ-07Result traced to wrong model
No verified control yetGap

Select a requirement to highlight the hazard and control it links to.

Task map progress · v3.3.0

Model pipeline

12/12

Quality gate

8/10

Result display

3/6

Requirement	Tests	Result
SRS-014	24 / 24	Passed
SRS-021	17 / 18	1 failed · routed back
SRS-030	4 / 9	Running

Security findings

image-decode 2.1 · known vulnerabilityFix queued

Secrets scanClean

unit tests 214 passed
security review complete
● QA agent: SRS-021 edge case failed
routed back to build for fix

Evidence checklist · v3.3.0

Trace matrix complete for all requirements
Hazard log updated and controls verified
Component inventory and security scan attached
Model performance report for the retrained model

Change assessment: Model update within the existing intended purpose and class. Hazard HZ-02 re-verified.

Reviewer sign-offs

TLTechnical leadSigned

QLQuality leadSigned

CSClinical safety officerPending

Release blocked until every reviewer signs.

Release pack · v3.3.0

Version and release notesIncluded

Change assessmentIncluded

Test evidence by requirementIncluded

Component inventoryIncluded

Updated hazard logIncluded

Component	Version	Vulnerabilities
inference-runtime	4.8.1	None
image-decode	2.1.3	Patched
web-framework	5.2.0	None
crypto-lib	3.0.9	None

Model sensitivity by week · v3.2.0Drift alert

SensitivityAlert threshold

0.4%Error rate, 7 days

2Open alerts

Proposed fix awaiting approval

Agent: Sensitivity fell below 0.90 on images from one camera model. Proposed fix: CHG-115, recalibrate preprocessing for that camera.

Nothing changes in production without approval.

Why SaMD teams struggle

Shipping fast is hard when every change needs paperwork

On top of that, UK rules for medical software are shifting towards oversight across the whole lifecycle.

44Recommendations to MHRA from the National Commission, September 2026

LifecycleOversight replacing one-off pre-market assessment

StagedAuthorisation, with regulation by function

TodayWith DeX

DocumentationWritten after the build for the audit. Rarely matches what shipped.Generated by the pipeline with every build.

Every releaseEach change needs a slow, inconsistent regulatory assessment.An agent drafts the impact. You decide.

StandardsIEC 62304, ISO 14971, usability and a QMS, often with no regulatory hire.Outputs mapped to your IEC 62304 process.

AI modelsUpdates and drift need evidence static processes can't give.Model version, metrics and drift alerts tracked.

NHS adoptionDTAC and a clinical safety case, on top of device rules.Hazard log and safety case kept with the code.

SecurityBuyers want an SBOM, vulnerability handling and deployment proof.SBOM and vulnerability scan in every release pack.

Device scopeHard to tell which functions are in the regulated device.A scope register splits regulated from non-regulated.

What DeX does

Build records and review responsibilities

DeX already builds software with human approval at every stage. For SaMD, each output maps to the deliverables your quality system needs.

What DeX produces Human approval between stages

InputProblem statement
OutputSRS
OutputFunctional spec
OutputTask map
OutputCode
OutputTests
OutputDeployment

Mapped to your lifecycle deliverables. A release evidence pack comes out of every build.

1 pack per build

Starting fresh

New build

Build a new SaMD product or module on DeX. The evidence trail is written as you go.

Build on DeX
Evidence as you go

Already shipping

Existing product

Bring your code and documents. We rebuild the trace, list the gaps, then run future releases through the pipeline.

Import
Rebuild trace
List gaps
Governed releases

You stay the legal manufacturer. You own the quality system, the intended purpose and every release decision.

From change request to release

Follow a change from request to live release

Select a stage to see the handoff between agents, your reviewers and your cloud.

SaMD delivery pipeline

Completed handoffUpcomingFeedback loop

DeX agentsCheck, build, test, package

Your teamApprove and sign off

Your cloudRun and monitor

TriggerYour team

Trigger

Hands off toScope

What's included

Tools for software delivery and review

Scope

Scope register

What the device does, its class, and which functions are regulated.

Requirement-to-test trace

Generated by the pipeline for every build.

Document

Lifecycle document set

SRS, architecture, design, test plans and reports, mapped to IEC 62304.

Hazard log and safety case

Risks, controls and evidence kept alongside the code.

Release

Change impact assessment

Agent drafts the regulatory and risk impact. You decide.

Release evidence pack

One export per release, for the technical file and customers.

Secure

SBOM and security checks

Component inventory, dependency and vulnerability scanning.

Model governance

Model version, training data reference, metrics and drift alerts.

Operate

Controlled deployment

To your cloud, with approval gates and rollback.

Post-market feed

Incidents and performance data sent to the DeX post-market hub.

Who it's for

Built for teams shipping regulated software

Daily users

Engineering leadsProduct managersQA and RA leadsClinical safety officers

Contributors

Data scientists and ML engineersDevOps and securityUsability and clinical

Decision makers

CTOCEO or founderHead of Quality and Regulatory

External

Approved body reviewersNHS digital and procurementInformation governance leads

Best fit

Teams building clinical software

Digital health start-ups and scale-ups

AI diagnostics and decision-support developers

Device makers adding apps or connected software

NHS trust and university spin-outs