/**
 * FDA Software Pre-Cert + SaMD TPLC + AI/ML Action Plan Compliance Pack
 *
 * The FDA Software Pre-Certification (Pre-Cert) Pilot Program (2017–2022,
 * transitioned to ongoing program elements) was an alternative regulatory
 * pathway for SaMD developers. Instead of FDA reviewing every product
 * release, qualified developers earn organizational pre-certification by
 * demonstrating "Excellence" in five domains:
 *
 *   1. Patient Safety
 *   2. Product Quality
 *   3. Clinical Responsibility
 *   4. Cybersecurity Responsibility
 *   5. Proactive Culture
 *
 * Once pre-certified, releases follow streamlined review pathways with
 * continuous post-market real-world performance monitoring. The pilot ended
 * formally in 2022 but its principles inform FDA's current Pre-Submission
 * program, Total Product Lifecycle (TPLC) approach, and the FDA AI/ML SaMD
 * Action Plan. Key ongoing mechanisms:
 *
 *   - Pre-Submission (Q-Sub) program — organizational excellence assessment
 *   - TPLC approach — lifecycle-based regulatory oversight
 *   - FDA AI/ML SaMD Action Plan (Jan 2021) — 5-part roadmap for adaptive AI
 *   - Pre-Determined Change Control Plan (PCCP) — FDA's formalized change
 *     management approach for AI/ML (guidance finalized 2024)
 *   - Algorithm Change Protocol (ACP) — pre-cleared bounded changes for AI/ML
 *
 * SaMD Definition (IMDRF SaMD: Key Definitions N10, 2013):
 *   Software intended to be used for one or more medical purposes that
 *   performs those purposes without being part of a hardware medical device.
 *
 * IMDRF SaMD Risk Categorization (N12, 2014):
 *   Four categories based on state of healthcare situation × significance
 *   of information provided by the SaMD to healthcare decision:
 *     Category I  — Non-serious + inform clinical management
 *     Category II — Serious + inform clinical management OR
 *                   Non-serious + drive clinical management
 *     Category III — Critical + inform clinical management OR
 *                    Serious + drive clinical management OR
 *                    Non-serious + treat/diagnose
 *     Category IV  — Critical + drive or treat/diagnose
 *
 * Customer base: clinical decision support vendors, AI/ML diagnostic
 * developers, digital therapeutics, remote patient monitoring software
 * vendors, EHR-integrated software publishers, continuous glucose monitors,
 * dermatology AI, radiology AI, cardiology AI, mental health app developers.
 *
 * Key regulatory citations:
 *   21 CFR Part 803  — Medical Device Reporting (MDR): 5-day + 30-day windows
 *   21 CFR Part 806  — Reports of Corrections and Removals
 *   21 CFR Part 820  — Quality System Regulation / QMSR (eff. Feb 2026)
 *   21 CFR Part 822  — Post-Market Surveillance
 *   21 U.S.C. §360j(o) — PATCH Act §524B (2023): cybersecurity premarket
 *   FDA Guidance: "Predetermined Change Control Plans for Machine Learning-
 *                  Enabled Medical Devices" (2024)
 *   FDA Guidance: "Artificial Intelligence/Machine Learning (AI/ML)-Based
 *                  Software as a Medical Device (SaMD) Action Plan" (2021)
 *   IMDRF SaMD: Clinical Evaluation (N41, 2017)
 *   FDA Guidance: "Cybersecurity in Medical Devices: Quality System
 *                  Considerations and Content of Premarket Submissions" (2023)
 *
 * Retention:
 *   30-year life-of-device baseline (10950 days). Aligns with FDA 21 CFR
 *   820.180 (quality system records retained for expected life of device or
 *   2 years from date of release — SaMD life expectancy commonly 20-30 years
 *   for embedded clinical-workflow integrations). Matches FDA MDR record
 *   retention (21 CFR 803.18 — minimum 2 years; extended for implant-class
 *   SaMD). Conservative 30-year baseline chosen for life-of-device traceability.
 *
 * Incident reporting (21 CFR 803 MDR):
 *   5 days: deaths, serious injuries, or malfunctions likely to cause/contribute
 *   30 days: other reportable events (standard MDR window)
 *   Conservative baseline: 5-day window (120 hours) applies when patient
 *   safety or serious injury is a reasonable possibility.
 *
 * @connexum/ai-governance
 */
/**
 * FDA SaMD Pre-Cert + TPLC category classifiers.
 *
 * Covers SaMD-specific artefacts:
 *   - PCCP (Pre-Determined Change Control Plan) change records
 *   - ACP (Algorithm Change Protocol) submissions
 *   - Clinical evaluation evidence and intended-use documentation
 *   - Post-market real-world performance signals
 *   - Cybersecurity vulnerability disclosure and SBOM records
 */
export const FDA_SAMD_PRECERT_CATEGORY_CLASSIFIERS = {
    /**
     * PCCP_CHANGE_RECORD — Pre-Determined Change Control Plan change records.
     * Out-of-PCCP-bounds changes require immediate escalation to the PCCP
     * change controller and FDA liaison. AI-generated changes that exceed
     * the pre-cleared modification envelope must be BLOCKED pending PCCP
     * amendment or new 510(k)/De Novo/PMA submission.
     */
    PCCP_CHANGE_RECORD: {
        references: [
            'FDA PCCP Guidance (2024) — Pre-Determined Change Control Plan for ML-Enabled Devices',
            'FDA AI/ML Action Plan (2021) §2 — Algorithm Change Protocol',
        ],
        classifier: (input) => {
            if (/\b(?:pccp|pre.?determined[_\s-]change[_\s-]control[_\s-]plan|algorithm[_\s-]change[_\s-]protocol|acp[_\s-](?:change|submission|record|boundary))\b/i.test(input))
                return true;
            if (/\b(?:out.of.pccp.bounds|pccp[_\s-]amendment|pccp[_\s-]modification[_\s-]envelope|bounded[_\s-]change[_\s-](?:record|exceeded))\b/i.test(input))
                return true;
            if (/\b(?:pre_determined_change|pccp_change_record|algorithm_change_protocol_record)\b/.test(input))
                return true;
            return false;
        },
    },
    /**
     * CLINICAL_EVALUATION_RECORD — Clinical evaluation evidence, intended-use
     * scoping, and IMDRF risk categorization records. Changes to claimed
     * intended use or risk category require clinical evaluation officer and
     * fda-liaison sign-off. AI-generated clinical performance claims require
     * human review before publication.
     */
    CLINICAL_EVALUATION_RECORD: {
        references: [
            'IMDRF SaMD Clinical Evaluation N41 (2017)',
            'FDA Pre-Cert Excellence Principle 3 (Clinical Responsibility)',
        ],
        classifier: (input) => {
            if (/\b(?:clinical[_\s-]evaluation|intended[_\s-]use[_\s-](?:scoping|statement|change)|imdrf[_\s-](?:risk|category|categorization)|samd[_\s-](?:risk|category))\b/i.test(input))
                return true;
            if (/\b(?:clinical[_\s-]performance[_\s-](?:claim|evidence|data)|real[_\s-]world[_\s-](?:evidence|performance|data)|rwe[_\s-]record|rwp[_\s-]record)\b/i.test(input))
                return true;
            if (/\b(?:clinical_evaluation_record|intended_use_scoping_record|imdrf_n41_evidence)\b/.test(input))
                return true;
            return false;
        },
    },
    /**
     * CYBERSECURITY_SBOM_RECORD — Cybersecurity vulnerability disclosure, SBOM
     * (Software Bill of Materials), and VEX (Vulnerability Exploitability
     * eXchange) records per FDA Premarket Cybersecurity Guidance (2023) and
     * PATCH Act §524B. Unmitigated CRITICAL/HIGH CVEs in the SBOM require
     * immediate escalation. Changes to the SBOM without security review are
     * blocked.
     */
    CYBERSECURITY_SBOM_RECORD: {
        references: [
            'FDA Premarket Cybersecurity Guidance (2023) — SBOM + VEX requirements',
            '21 U.S.C. §360j(o) — PATCH Act §524B (2023)',
        ],
        classifier: (input) => {
            if (/\b(?:sbom|software[_\s-]bill[_\s-]of[_\s-]materials|vex[_\s-](?:record|report|document)|vulnerability[_\s-]exploitability[_\s-]exchange)\b/i.test(input))
                return true;
            if (/\b(?:patch[_\s-]act[_\s-](?:record|compliance|report)|cybersecurity[_\s-](?:vulnerability|disclosure|incident)[_\s-](?:record|report))\b/i.test(input))
                return true;
            if (/\b(?:samd_sbom|samd_vex_record|samd_cybersecurity_incident|patch_act_record)\b/.test(input))
                return true;
            return false;
        },
    },
    /**
     * TPLC_MONITORING_RECORD — Total Product Lifecycle monitoring and real-world
     * performance signal records. Post-market safety signals and performance
     * degradation events require post-market signal detection and escalation.
     * AI-generated post-market reports require QMS-lead and clinical evaluation
     * officer sign-off before submission.
     */
    TPLC_MONITORING_RECORD: {
        references: [
            'FDA Total Product Lifecycle (TPLC) approach',
            'FDA Pre-Cert continuous monitoring + Sentinel Initiative',
        ],
        classifier: (input) => {
            if (/\b(?:tplc[_\s-](?:record|monitoring|signal|report)|total[_\s-]product[_\s-]lifecycle[_\s-](?:record|monitoring))\b/i.test(input))
                return true;
            if (/\b(?:post[_\s-]market[_\s-](?:signal|surveillance|monitoring|performance|safety)[_\s-]record|real[_\s-]world[_\s-]performance[_\s-](?:signal|record|monitoring))\b/i.test(input))
                return true;
            if (/\b(?:sentinel[_\s-](?:signal|report)|rwp[_\s-]monitoring[_\s-]record|tplc_monitoring_record)\b/.test(input))
                return true;
            return false;
        },
    },
    /**
     * MDR_REPORTABLE_EVENT — Medical Device Reporting (MDR) reportable events
     * per 21 CFR Part 803. Deaths, serious injuries, or malfunctions likely
     * to cause patient harm require FDA notification within 5 days (120 hours).
     * Standard reportable events: 30 days. AI systems must never suppress or
     * delay MDR-reportable signals. Immediate escalation to fda-liaison required.
     */
    MDR_REPORTABLE_EVENT: {
        references: [
            '21 CFR Part 803 — Medical Device Reporting (MDR)',
            'FDA Pre-Cert Excellence Principle 1 (Patient Safety)',
        ],
        classifier: (input) => {
            if (/\b(?:mdr[_\s-](?:report|event|filing|notification|submission)|medical[_\s-]device[_\s-]report(?:ing)?[_\s-](?:event|record))\b/i.test(input))
                return true;
            if (/\b(?:patient[_\s-]safety[_\s-](?:signal|event|incident|adverse[_\s-]event)|serious[_\s-](?:injury|adverse[_\s-]event)[_\s-](?:signal|record))\b/i.test(input))
                return true;
            if (/\b(?:mdr_reportable_event|21_cfr_803_report|samd_adverse_event)\b/.test(input))
                return true;
            return false;
        },
    },
};
/**
 * FDA Software Pre-Cert + SaMD TPLC + AI/ML Action Plan Compliance Pack.
 *
 * Pack ID: 'fda-samd-precert'
 * Jurisdiction: United States — FDA CDRH regulatory framework.
 *   Principles inform IMDRF member jurisdictions globally (EU MDR,
 *   Health Canada, TGA, PMDA for AI/ML SaMD).
 *
 * Guard-layer wiring:
 *   - G1-G4 (audit, logging, classification, session): always active
 *   - G5 (supply-chain): always active — PRC provider blocks; SBOM chain
 *   - G6 (approval-queue): always active — PCCP changes; clinical eval; MDR
 *   - G7 (attestation): always active — clinical evaluation officer sign-off;
 *       PCCP change controller attestation; QMS lead attestation
 *   - G8 (anomaly-detector): always active — out-of-PCCP-bounds CRITICAL block;
 *       post-market signal detection; cybersecurity anomaly detection
 *   - G9 (transparency): always active — AI provenance disclosure for SaMD
 *       clinical outputs; TPLC monitoring report provenance
 *
 * Human-in-loop tier:
 *   - T1: Routine QMS records, standard PCCP-bounded changes (qms-lead review)
 *   - T2: Clinical evaluation changes, intended-use scoping changes, PCCP
 *         modifications (clinical-evaluation-officer + fda-liaison sign-off)
 *   - T3: Out-of-PCCP-bounds changes, MDR-reportable events (immediate escalation:
 *         pccp-change-controller + fda-liaison + clinical-evaluation-officer)
 */
export const FDA_SAMD_PRECERT_PACK = {
    categoryClassifiers: FDA_SAMD_PRECERT_CATEGORY_CLASSIFIERS,
    /**
     * PCCP and clinical evaluation records are subject-keyed per SaMD
     * version / algorithm version — traceability to specific model versions
     * is mandatory for FDA PCCP compliance and TPLC accountability.
     */
    subjectKeyedCategories: [
        'PCCP_CHANGE_RECORD',
        'CLINICAL_EVALUATION_RECORD',
        'MDR_REPORTABLE_EVENT',
        'TPLC_MONITORING_RECORD',
    ],
    id: 'fda-samd-precert',
    aliases: ['fdaSamdPrecert', 'samd', 'software-as-medical-device'],
    name: 'FDA Software Pre-Cert + SaMD TPLC + AI/ML Action Plan',
    version: '1.0.0',
    description: 'FDA Software Pre-Certification (Pre-Cert) Pilot Program (2017–2022) principles ' +
        'plus ongoing FDA Total Product Lifecycle (TPLC) approach, AI/ML SaMD Action Plan ' +
        '(2021), and Pre-Determined Change Control Plan (PCCP) guidance (2024). Covers the ' +
        'five Pre-Cert Excellence Principles: (1) Patient Safety — risk management, MDR ' +
        'signals, post-market safety monitoring; (2) Product Quality — QMS alignment with ' +
        'ISO 13485 + IEC 62304; (3) Clinical Responsibility — clinical evaluation, intended- ' +
        'use scoping, performance claims per IMDRF N41; (4) Cybersecurity Responsibility — ' +
        'FDA Premarket Cybersecurity Guidance (2023), SBOM, VEX, PATCH Act §524B; ' +
        '(5) Proactive Culture — continuous improvement, root cause analysis, FDA transparency. ' +
        'TPLC + AI/ML provisions: continuous post-market monitoring, real-world performance + ' +
        'safety signal detection, Algorithm Change Protocol (ACP) for pre-cleared bounded ' +
        'changes, PCCP for formalized AI/ML change management. IMDRF SaMD risk categorization ' +
        '(Category I–IV). CRITICAL behavioral validator for out-of-PCCP-bounds change ' +
        'immediate-escalation — no compensating control path. 30-year life-of-device retention ' +
        '(10950 days). 5-day FDA MDR notification (21 CFR 803 — deaths, serious injuries, ' +
        'malfunctions). Reviewer tier: FDA-recognized SaMD Lead Auditor / RAC (Regulatory ' +
        'Affairs Certification — Devices). PRC providers blocked: FDA Pre-Cert cybersecurity- ' +
        'responsibility + supply-chain provisions incompatible with PRC data localisation law. ' +
        'Sister packs: FDA 21 CFR 820 (QSR/QMSR), IEC 62304, ISO 13485, ISO 14971, HIPAA.',
    authority: 'U.S. Food and Drug Administration (FDA), CDRH; references IMDRF SaMD framework ' +
        '(IMDRF N10 Key Definitions 2013; N12 Risk Categorization 2014; N41 Clinical Evaluation ' +
        '2017) + FDA AI/ML-Based SaMD Action Plan (January 2021) + Pre-Determined Change Control ' +
        'Plan (PCCP) Guidance (2024) + FDA Premarket Cybersecurity Guidance (2023) + PATCH Act ' +
        '§524B (2023) + 21 CFR Parts 803, 806, 820, 822',
    industries: [
        'samd-developer',
        'clinical-decision-support',
        'ai-ml-diagnostics',
        'digital-therapeutics',
        'remote-patient-monitoring',
        'ehr-integrated-software',
        'medical-device-software',
    ],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'FDA Pre-Cert Excellence Principle 1 (Patient Safety) enforcement mandatory for ' +
                'all SaMD AI operations — every AI-generated clinical output must pass patient ' +
                'safety gate. IMDRF SaMD risk categorization (§N12) governs action thresholds: ' +
                'Category IV SaMD is blocked for unverified AI-generated recommendations. PCCP ' +
                'change control (2024 guidance) enforced — no AI-generated model change proceeds ' +
                'outside pre-cleared PCCP envelope without pccp-change-controller verification. ' +
                'Algorithm Change Protocol (ACP — AI/ML Action Plan §2) required for bounded ' +
                'changes. TPLC monitoring active — post-market real-world performance tracking. ' +
                'Cybersecurity incident reporting (PATCH Act §524B + FDA 2023 guidance) active. ' +
                'MDR 5-day safety signal escalation enforced (21 CFR 803). Out-of-PCCP-bounds ' +
                'change triggers immediate escalation with no compensating control path.',
            reference: 'FDA Pre-Cert Excellence Principles 1–5; FDA PCCP Guidance (2024); ' +
                'FDA AI/ML Action Plan (2021) §2 ACP; 21 CFR Part 803 MDR; IMDRF N12 Risk Categorization',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident records for SaMD lifecycle artefacts: PCCP change records and ' +
                'ACP submissions (PCCP Guidance 2024 — traceability to pre-cleared modification ' +
                'envelope required); clinical evaluation evidence (IMDRF N41 — clinical performance ' +
                'claims require audit trail for FDA review); MDR-reportable event records (21 CFR ' +
                '803.18 — minimum 2-year MDR record retention; 30-year life-of-device baseline ' +
                'applied); TPLC post-market monitoring records; SBOM and VEX records (FDA 2023 ' +
                'cybersecurity guidance); algorithm version history (AI/ML Action Plan — algorithm ' +
                'change traceability). Required for FDA Pre-Submission (Q-Sub) organisational ' +
                'excellence assessment, FDA audit packages, and IMDRF clinical evaluation evidence.',
            reference: '21 CFR 803.18 — MDR record retention; FDA PCCP Guidance (2024) — PCCP change traceability; ' +
                'IMDRF N41 — clinical evaluation evidence; FDA AI/ML Action Plan (2021) — algorithm version history',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'SaMD category signal detection: PCCP change record identification (PCCP Guidance ' +
                '2024 — out-of-bounds detection triggers CRITICAL escalation); clinical evaluation ' +
                'record classification (IMDRF N41 — clinical performance claim detection for human ' +
                'review gate); MDR reportable event detection (21 CFR 803 — patient safety signal ' +
                'identification, 5-day escalation path); TPLC monitoring record classification (FDA ' +
                'TPLC approach — post-market performance signal classification); SBOM/VEX record ' +
                'detection (FDA Premarket Cybersecurity Guidance 2023 — PATCH Act §524B compliance); ' +
                'IMDRF risk category (I–IV) SaMD output classification for autonomous action thresholds.',
            reference: 'IMDRF N12 Risk Categorization; FDA PCCP Guidance (2024); 21 CFR Part 803 MDR; ' +
                'FDA AI/ML Action Plan (2021); FDA Premarket Cybersecurity Guidance (2023)',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'FDA Pre-Cert Cybersecurity Responsibility (Excellence Principle 4) + PATCH Act ' +
                '§524B supply-chain security requirements. SBOM maintenance and verification: ' +
                'AI-generated code or model updates must be evaluated against the SBOM for supply- ' +
                'chain risk. Third-party component vulnerability tracking (VEX records). PRC- ' +
                'jurisdiction LLM provider blocking: FDA Pre-Cert cybersecurity-responsibility ' +
                'provisions are incompatible with PRC data localisation law (CSL/DSL) for SaMD ' +
                'development environments. Vendor qualification for clinical AI component vendors. ' +
                'PATCH Act §524B requires manufacturers to maintain a plan for identifying and ' +
                'addressing post-market cybersecurity vulnerabilities in a timely manner.',
            reference: 'FDA Premarket Cybersecurity Guidance (2023) — SBOM + VEX; 21 U.S.C. §360j(o) — PATCH Act §524B; ' +
                'FDA Pre-Cert Excellence Principle 4 (Cybersecurity Responsibility)',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'FDA SaMD lifecycle requires formal approval gates for: PCCP bounded changes (PCCP ' +
                'Guidance 2024 — pccp-change-controller + qms-lead sign-off); out-of-PCCP-bounds ' +
                'changes (CRITICAL escalation — pccp-change-controller + fda-liaison + clinical- ' +
                'evaluation-officer immediate review); clinical evaluation changes and intended-use ' +
                'modifications (IMDRF N41 — clinical-evaluation-officer + fda-liaison sign-off); ' +
                'MDR reportable events (21 CFR 803 — fda-liaison + qms-lead sign-off before ' +
                'submission, 5-day deadline); algorithm version changes under ACP (AI/ML Action ' +
                'Plan §2 — qms-lead approval before deployment); cybersecurity vulnerability ' +
                'remediation (PATCH Act §524B — cybersecurity-incident-coordinator sign-off).',
            reference: 'FDA PCCP Guidance (2024); IMDRF N41 (2017); 21 CFR Part 803; FDA AI/ML Action Plan (2021)',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'FDA SaMD attestation requirements: clinical evaluation officer attestation for ' +
                'clinical performance claims and intended-use statements (IMDRF N41); PCCP change ' +
                'controller attestation for bounded model updates (PCCP Guidance 2024 — attestation ' +
                'that change remains within pre-cleared modification envelope); QMS lead attestation ' +
                'for TPLC post-market monitoring reports; FDA liaison attestation for MDR submissions ' +
                '(21 CFR 803 — certifying completeness and accuracy of MDR); cybersecurity incident ' +
                'coordinator attestation for PATCH Act §524B vulnerability disclosures; proactive ' +
                'culture attestation — root cause analysis sign-off (Pre-Cert Principle 5).',
            reference: 'IMDRF N41 (2017) — clinical evaluation attestation; FDA PCCP Guidance (2024) — PCCP change attestation; ' +
                '21 CFR 803 — MDR certification; FDA Pre-Cert Principle 5 (Proactive Culture)',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'FDA SaMD records must persist for the full life-of-device retention baseline ' +
                '(30 years / 10950 days). PCCP change records (PCCP Guidance 2024) must remain ' +
                'traceable across the full device lifecycle — algorithm version history supports ' +
                'post-market review and FDA audit. MDR records: 21 CFR 803.18 minimum 2 years; ' +
                'life-of-device extended retention applied. Clinical evaluation evidence (IMDRF N41) ' +
                'must remain available for FDA inspections and Q-Sub programme assessments. TPLC ' +
                'post-market monitoring data must persist for regulatory review. AI/ML model version ' +
                'history with performance metrics: AI/ML Action Plan requires traceability of ' +
                'algorithm changes across the full TPLC.',
            reference: '21 CFR 803.18 — MDR record retention; 21 CFR 820.180 — QSR records: life of device; ' +
                'FDA PCCP Guidance (2024) — PCCP change record traceability; IMDRF N41 — clinical evidence retention',
        },
        {
            name: 'anomaly-detector',
            required: true,
            reason: 'Real-time detection of out-of-PCCP-bounds AI/ML changes (PCCP Guidance 2024 — ' +
                'CRITICAL immediate escalation to pccp-change-controller + fda-liaison; no ' +
                'compensating control path). Post-market safety signal detection: adverse event ' +
                'signals, unexpected performance degradation, real-world evidence divergence from ' +
                'clinical evaluation claims (FDA TPLC — MDR 5-day escalation trigger). Cybersecurity ' +
                'vulnerability detection: unmitigated CRITICAL/HIGH CVEs in SBOM (PATCH Act §524B — ' +
                'cybersecurity-incident-coordinator escalation). Clinical performance drift detection: ' +
                'real-world performance falls outside pre-specified bounds (AI/ML Action Plan — ACP ' +
                'boundary monitoring). Algorithm behavioural anomaly detection for SaMD outputs.',
            reference: 'FDA PCCP Guidance (2024) — out-of-bounds anomaly; 21 CFR Part 803 MDR — safety signal detection; ' +
                'PATCH Act §524B — cybersecurity anomaly; FDA AI/ML Action Plan (2021) — ACP boundary monitoring',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'AI-generated SaMD output provenance disclosure to clinical evaluation officers, ' +
                'FDA-recognized SaMD Lead Auditors, RAC (Regulatory Affairs Certification — Devices) ' +
                'holders, and FDA liaisons. Required for TPLC monitoring reports used in FDA Pre- ' +
                'Submission assessments — AI-generated analytical content must be disclosed and ' +
                'attested by a qualified signatory. FDA Pre-Cert Excellence Principle 2 (Product ' +
                'Quality) + Principle 5 (Proactive Culture): transparency of AI involvement in QMS ' +
                'documentation is expected in FDA organisational excellence assessments. IMDRF N41 ' +
                'clinical evaluation evidence must clearly identify AI-generated vs human-authored ' +
                'analysis. Provenance disclosure on every AI output used in a regulatory submission.',
            reference: 'FDA Pre-Cert Excellence Principles 2 + 5; IMDRF N41 (2017) — clinical evaluation evidence quality; ' +
                'FDA AI/ML Action Plan (2021) — transparency provisions',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'FDA SaMD lifecycle event routing: out-of-PCCP-bounds change event (PCCP Guidance ' +
                '2024 — CRITICAL immediate escalation: pccp-change-controller + fda-liaison + ' +
                'clinical-evaluation-officer); MDR reportable event (21 CFR 803 — 5-day deadline ' +
                'routing: fda-liaison + qms-lead + clinical-evaluation-officer); post-market safety ' +
                'signal event (FDA TPLC — post-market signal detection routing); algorithm version ' +
                'deployment event (AI/ML Action Plan §2 — ACP boundary verification routing); SBOM ' +
                'critical CVE event (PATCH Act §524B — cybersecurity-incident-coordinator routing); ' +
                'real-world performance degradation event (FDA Pre-Cert continuous monitoring); ' +
                'IMDRF Category IV output event (IMDRF N12 — immediate clinical evaluation officer ' +
                'review routing for highest-risk SaMD decisions).',
            reference: 'FDA PCCP Guidance (2024) — PCCP event; 21 CFR Part 803 MDR — 5-day event deadline; ' +
                'PATCH Act §524B — SBOM CVE event; FDA AI/ML Action Plan (2021) — ACP event routing',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            imdrfCategorizationRequired: true,
            pccpChangeControlRequired: true,
            algorithmChangeProtocolRequired: true,
            clinicalEvaluationRequired: true,
            intendedUseScopingRequired: true,
            tplcMonitoringActive: true,
            realWorldPerformanceTrackingActive: true,
            aimlActionPlanAlignmentActive: true,
            postMarketSignalDetectionActive: true,
            outOfPccpBoundsImmediateEscalationRequired: true,
            cybersecurityIncidentReportingActive: true,
        },
        'approval-queue': {
            pccpBoundedChangeApprovalRequired: true,
            outOfPccpBoundsImmediateEscalationRequired: true,
            clinicalEvaluationChangeApprovalRequired: true,
            mdrReportableEventApprovalRequired: true,
            algorithmVersionDeploymentApprovalRequired: true,
            cybersecurityVulnerabilityRemediationApprovalRequired: true,
            humanInLoopTierRoutine: 'T1',
            humanInLoopTierClinicalChange: 'T2',
            humanInLoopTierOutOfPccpBounds: 'T3',
        },
        'attestation-manager': {
            clinicalEvaluationOfficerAttestationRequired: true,
            pccpChangeControllerAttestationRequired: true,
            qmsLeadAttestationRequired: true,
            fdaLiaisonMdrAttestationRequired: true,
            cybersecurityIncidentCoordinatorAttestationRequired: true,
            rootCauseAnalysisAttestationRequired: true,
        },
        'supply-chain': {
            sbomMaintenanceRequired: true,
            vexRecordMaintenanceRequired: true,
            prcProviderBlockRequired: true,
            vendorClinicalAiQualificationRequired: true,
            patchActCybersecurityPlanRequired: true,
        },
        'anomaly-detector': {
            outOfPccpBoundsImmediateEscalationRequired: true,
            postMarketSafetySignalDetectionRequired: true,
            cybersecurityCveDetectionRequired: true,
            clinicalPerformanceDriftDetectionRequired: true,
            algorithmBehaviouralAnomalyDetectionRequired: true,
        },
        'transparency-injector': {
            aiGeneratedClinicalOutputProvenanceDisclosureRequired: true,
            aiGeneratedRegulatorySubmissionContentDisclosureRequired: true,
            humanSignatoryAttestationForFdaSubmissionsRequired: true,
        },
        'event-bus': {
            outOfPccpBoundsChangeEventsActive: true,
            mdrReportableEventRoutingActive: true,
            postMarketSafetySignalEventsActive: true,
            algorithmVersionDeploymentEventsActive: true,
            sbomCriticalCveEventsActive: true,
            realWorldPerformanceDegradationEventsActive: true,
            imdrfCategoryIvOutputEventsActive: true,
        },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: ['SAMD-READY', 'FDA-PRE-CERT-COMPLIANT', 'CLINICAL-AI-GOVERNANCE'],
        blockReasons: {
            deepseek: 'PRC-jurisdiction LLM providers cannot meet FDA Pre-Cert cybersecurity-responsibility ' +
                '+ supply-chain provisions for SaMD development. FDA Premarket Cybersecurity Guidance ' +
                '(2023) and PATCH Act §524B require SaMD manufacturers to maintain a cybersecurity ' +
                'plan that addresses supply-chain risk. PRC data localisation law (National Security ' +
                'Law / CSL / DSL) creates an unresolvable conflict with FDA supply-chain security ' +
                'provisions: routing SaMD development data, clinical evaluation evidence, PCCP ' +
                'records, and algorithm version history through PRC-jurisdiction services exposes ' +
                'safety-critical SaMD IP to Chinese government access obligations under CSL Article ' +
                '37 and DSL Article 36. FDA Pre-Cert Excellence Principle 4 (Cybersecurity ' +
                'Responsibility) explicitly requires control over the full development supply chain.',
            baidu: 'PRC-jurisdiction LLM; FDA Pre-Cert cybersecurity-responsibility provisions require ' +
                'supply-chain security controls incompatible with PRC CSL/DSL data localisation ' +
                'obligations. SaMD clinical evaluation data, PCCP change records, and algorithm ' +
                'version history constitute FDA-regulated technical documentation that must remain ' +
                'under verifiable non-PRC data sovereignty. IMDRF risk categorization records and ' +
                'MDR-reportable event analysis must be protected from government access obligations ' +
                'under PRC CSL Article 37 and DSL Article 36 that conflict with FDA patient safety ' +
                'data protection requirements. FDA Pre-Cert Principle 4 supply-chain provisions ' +
                'and PATCH Act §524B cybersecurity plan requirements cannot be met.',
            alibaba: 'PRC-jurisdiction LLM; SaMD development data subject to FDA Pre-Cert cybersecurity- ' +
                'responsibility provisions (Excellence Principle 4) and PATCH Act §524B cannot be ' +
                'routed through PRC data jurisdiction. Clinical evaluation evidence (IMDRF N41), ' +
                'PCCP records (FDA 2024 guidance), and AI/ML model version history for patient- ' +
                'facing SaMD are safety-critical regulatory records requiring data sovereignty outside ' +
                'PRC jurisdiction. PRC CSL Article 37 and DSL Article 36 government access ' +
                'obligations are incompatible with FDA patient data protection and supply-chain ' +
                'security requirements. FDA SBOM and VEX records (FDA Premarket Cybersecurity ' +
                'Guidance 2023) must be maintained under non-PRC data infrastructure.',
        },
    },
    dataPolicy: {
        scanCategories: [
            'PCCP_CHANGE_RECORD',
            'CLINICAL_EVALUATION_RECORD',
            'CYBERSECURITY_SBOM_RECORD',
            'TPLC_MONITORING_RECORD',
            'MDR_REPORTABLE_EVENT',
        ],
        categoryActions: {
            // Out-of-PCCP-bounds: BLOCK — no compensating control path
            PCCP_CHANGE_RECORD: 'BLOCK',
            // MDR reportable events: BLOCK — immediate escalation, no delay path
            MDR_REPORTABLE_EVENT: 'BLOCK',
            // Clinical evaluation: REVIEWED — clinical evaluation officer sign-off required
            CLINICAL_EVALUATION_RECORD: 'REVIEWED',
            // SBOM/VEX: REVIEWED — cybersecurity incident coordinator review
            CYBERSECURITY_SBOM_RECORD: 'REVIEWED',
            // TPLC monitoring: REVIEWED — qms-lead review before regulatory submission
            TPLC_MONITORING_RECORD: 'REVIEWED',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'RESTRICTED',
    },
    retentionPolicy: {
        /**
         * 30-year life-of-device baseline (10950 days).
         * Aligns with FDA 21 CFR 820.180 (quality system records retained
         * for expected life of device or 2 years from date of release for
         * device — SaMD life expectancy commonly 20-30 years for embedded
         * clinical-workflow integrations). MDR records: 21 CFR 803.18
         * minimum 2 years; extended to life-of-device for continuity.
         * PCCP records and algorithm version history: full device lifecycle
         * per PCCP Guidance (2024). Conservative 30-year baseline.
         */
        sovereignty: ['us'],
        auditLogRetentionDays: 10950, // 30 years — life-of-device baseline (FDA 21 CFR 820.180)
        sessionRetentionDays: 10950,
        incidentRetentionDays: 10950,
        reference: '21 CFR 820.180 — Quality system records: life of device or 2 years from release date. ' +
            '21 CFR 803.18 — MDR records: minimum 2 years from MDR submission date. ' +
            'FDA PCCP Guidance (2024) — PCCP change records: full device lifecycle traceability. ' +
            'FDA AI/ML Action Plan (2021) — algorithm version history: full TPLC traceability. ' +
            'Conservative 30-year (10950 days) life-of-device baseline applied for SaMD.',
    },
    incidentPolicy: {
        /**
         * FDA MDR (21 CFR Part 803) reporting windows:
         *   5 calendar days (120 hours): deaths, serious injuries, or SaMD
         *     malfunctions that have caused or contributed to, or may cause
         *     or contribute to, a death or serious injury (21 CFR 803.53).
         *   30 calendar days (720 hours): other reportable events — SaMD
         *     malfunctions that if they were to recur, would likely cause or
         *     contribute to a serious injury or death (21 CFR 803.50).
         *
         * Conservative baseline: 120 hours (5 days) applies to patient safety
         * events. This is the shortest statutory FDA MDR window and aligns with
         * FDA Pre-Cert Patient Safety Excellence Principle 1.
         */
        notificationDeadlineHours: 120, // 5 days — FDA MDR 21 CFR 803.53 patient safety window
        reference: '21 CFR 803.53 — MDR: 5-calendar-day report for deaths, serious injuries, ' +
            'or malfunctions likely to cause/contribute to a death or serious injury. ' +
            '21 CFR 803.50 — MDR: 30-calendar-day report for other reportable events. ' +
            'FDA Pre-Cert Excellence Principle 1 (Patient Safety) — immediate signal escalation. ' +
            'PATCH Act §524B (2023) — cybersecurity vulnerability disclosure timeline.',
        requiredRecipients: [
            'ciso',
            'qms-lead',
            'clinical-evaluation-officer',
            'cybersecurity-incident-coordinator',
            'fda-liaison',
            'pccp-change-controller',
        ],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'samd-imdrf-categorization',
            description: 'IMDRF SaMD risk categorization established and documented per IMDRF N12 (2014): ' +
                'SaMD classified into one of four categories based on (a) significance of the ' +
                'information provided — inform, drive, or treat/diagnose clinical management — ' +
                'and (b) state of the healthcare situation — non-serious, serious, or critical; ' +
                'Category IV (critical + drive/treat) is the highest-risk classification; ' +
                'categorization documented in the SaMD Definition Statement; categorization ' +
                'rationale reviewed and approved by a clinician or clinical evaluation officer; ' +
                'Category IV AI/ML outputs require human-in-loop review before clinical action; ' +
                'IMDRF categorization is the risk baseline that governs all downstream regulatory ' +
                'pathway decisions (510(k), De Novo, PMA) and PCCP scope determination. Missing ' +
                'or undocumented IMDRF categorization is a CRITICAL finding — it is the foundation ' +
                'of all SaMD Pre-Cert organisational excellence assessment criteria.',
            reference: 'IMDRF SaMD: Possible Framework for Risk Categorization (N12, 2014)',
            check: 'samd_imdrf_categorization',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'samd-patient-safety-excellence',
            description: 'Patient Safety Excellence (Pre-Cert Principle 1) program established and ' +
                'operational: risk management process active covering the full SaMD lifecycle ' +
                '(design, development, post-market); adverse event / MDR-reportable event ' +
                'detection process documented and tested; patient-reported outcome (PRO) capture ' +
                'mechanism operational for SaMD with patient-facing outputs; post-market safety ' +
                'signal monitoring active (FDA TPLC — Sentinel Initiative integration where ' +
                'applicable); safety culture indicators tracked (near-miss reporting, corrective ' +
                'action closure rate); patient safety policy documented and signed by top management; ' +
                'safety signal escalation path tested: 5-day MDR submission pathway verified; ' +
                'AI/ML output safety monitoring: model drift or unexpected behaviour triggers ' +
                'patient safety review before continued deployment.',
            reference: 'FDA Pre-Cert Excellence Principle 1 (Patient Safety)',
            check: 'samd_patient_safety_excellence',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'samd-product-quality-excellence',
            description: 'Product Quality Excellence (Pre-Cert Principle 2) program established: QMS ' +
                'documented and operational, aligned with ISO 13485:2016 (or QMSR 21 CFR Part ' +
                '820 eff. Feb 2026) and IEC 62304 (software lifecycle processes for medical ' +
                'device software); software lifecycle process documentation complete (SOUP list, ' +
                'unit test coverage, regression test cadence, configuration management); design ' +
                'history file (DHF) maintained; device master record (DMR) maintained; software ' +
                'architecture documentation (IEC 62304 §5.3); software safety classification ' +
                '(IEC 62304 Classes A/B/C) documented with rationale; continuous integration / ' +
                'automated test coverage metrics tracked; code review process active for all ' +
                'model code; product quality metrics reviewed at management review.',
            reference: 'FDA Pre-Cert Excellence Principle 2 (Product Quality) + ISO 13485 + IEC 62304',
            check: 'samd_product_quality_excellence',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'samd-clinical-responsibility',
            description: 'Clinical Responsibility (Pre-Cert Principle 3) program established: clinical ' +
                'evaluation plan and report documented per IMDRF N41 (2017); clinical performance ' +
                'data collected, analysed, and maintained for all marketed SaMD; intended-use ' +
                'statement precisely scoped — distinguishes SaMD medical purpose from wellness use; ' +
                'patient population, clinical setting, and user type explicitly defined; clinical ' +
                'claims supported by clinical evidence (analytical validation + clinical validation); ' +
                'labelling reviewed for accuracy and completeness; post-market clinical follow-up ' +
                '(PMCF) plan active where clinical data gaps exist; clinician advisory process ' +
                'established for intended-use changes; clinical evaluation report updated at each ' +
                'significant algorithm change (ACP / PCCP boundary assessment triggers re-evaluation).',
            reference: 'FDA Pre-Cert Excellence Principle 3 (Clinical Responsibility) + IMDRF SaMD Clinical Evaluation N41 (2017)',
            check: 'samd_clinical_responsibility',
            failSeverity: 'HIGH',
        },
        {
            id: 'samd-cybersecurity-responsibility',
            description: 'Cybersecurity Responsibility (Pre-Cert Principle 4) program established per FDA ' +
                'Premarket Cybersecurity Guidance (2023) and PATCH Act §524B: SBOM (Software Bill ' +
                'of Materials) maintained, current, and in machine-readable format (SPDX or CycloneDX); ' +
                'VEX (Vulnerability Exploitability eXchange) records maintained for all SaMD ' +
                'components; vulnerability disclosure policy published; coordinated vulnerability ' +
                'disclosure (CVD) process operational (ISO/IEC 29147); total product lifecycle ' +
                'cybersecurity maintenance plan documented (PATCH Act §524B requirement); unmitigated ' +
                'CRITICAL/HIGH CVEs trigger immediate cybersecurity-incident-coordinator escalation; ' +
                'security risk management process (NIST Cybersecurity Framework or ISO 27001 aligned); ' +
                'penetration testing cadence documented; network interface and API security controls ' +
                'documented; SBOM updated on every SaMD release or significant component change.',
            reference: 'FDA Pre-Cert Principle 4 + FDA Premarket Cybersecurity Guidance (2023) + SBOM + VEX + 21 U.S.C. §360j(o) PATCH Act §524B',
            check: 'samd_cybersecurity_responsibility',
            failSeverity: 'HIGH',
        },
        {
            id: 'samd-proactive-culture',
            description: 'Proactive Culture (Pre-Cert Principle 5) program established: continuous improvement ' +
                'process active — metrics tracked, reviewed, and acted upon at regular intervals; ' +
                'root cause analysis (RCA) process operational for all adverse events, near-misses, ' +
                'and quality escapes; corrective and preventive action (CAPA) system operational; ' +
                'transparency with FDA maintained — proactive engagement with FDA on significant ' +
                'safety signals, algorithm performance issues, and intended-use changes; management ' +
                'commitment to safety culture documented and evidenced (safety culture survey, ' +
                'executive participation in safety reviews, open-reporting non-punitive policy); ' +
                'pre-submission (Q-Sub) engagement planned for significant algorithm changes; ' +
                'lessons-learned process feeds back into development and quality processes.',
            reference: 'FDA Pre-Cert Excellence Principle 5 (Proactive Culture)',
            check: 'samd_proactive_culture',
            failSeverity: 'MEDIUM',
        },
        {
            id: 'samd-tplc-monitoring',
            description: 'Total Product Lifecycle (TPLC) monitoring program established per FDA TPLC ' +
                'approach: post-market monitoring plan documented covering the full device ' +
                'lifecycle from first-in-human deployment through end-of-life; monitoring data ' +
                'sources defined (EHR integration data, user feedback, adverse event reports, ' +
                'customer complaint records, real-world performance metrics); monitoring frequency ' +
                'and thresholds specified; monitoring outputs reviewed at defined intervals by ' +
                'clinical evaluation officer and QMS lead; monitoring triggers for CAPA, PCCP ' +
                'reassessment, or FDA engagement clearly defined; TPLC monitoring report format ' +
                'documented and tested for FDA Pre-Submission readiness; monitoring data ' +
                'infrastructure compliant with 21 CFR Part 11 (electronic records and signatures).',
            reference: 'FDA Total Product Lifecycle (TPLC) approach',
            check: 'samd_tplc_monitoring',
            failSeverity: 'HIGH',
        },
        {
            id: 'samd-real-world-performance',
            description: 'Real-World Performance (RWP) tracking and Real-World Evidence (RWE) program ' +
                'established per FDA Pre-Cert continuous monitoring framework: RWP metrics ' +
                'defined (sensitivity, specificity, AUC, F1, calibration metrics — appropriate ' +
                'to the clinical task); RWP data collection from deployed SaMD instances active; ' +
                'RWP compared to pre-market analytical and clinical validation performance; ' +
                'performance drift thresholds defined — breach triggers clinical evaluation officer ' +
                'review and potential PCCP/ACP reassessment; real-world data (RWD) sources ' +
                'identified, access arrangements documented, and data quality assessed per FDA ' +
                'RWE framework; RWP monitoring report generated at defined intervals (minimum ' +
                'annual for SaMD in IMDRF Category III or IV); RWP reporting to FDA when ' +
                'performance falls outside pre-specified bounds.',
            reference: 'FDA RWE/RWD framework + FDA Pre-Cert continuous monitoring',
            check: 'samd_real_world_performance',
            failSeverity: 'HIGH',
        },
        {
            id: 'samd-aiml-action-plan-alignment',
            description: 'FDA AI/ML SaMD Action Plan (January 2021) alignment established across all five ' +
                'action areas: (1) Good Machine Learning Practice (GMLP) — 10 principles implemented ' +
                '(multi-stakeholder approach, data management, re-training governance, performance ' +
                'monitoring, human factors); (2) Transparency — intended use, data characteristics, ' +
                'performance metrics publicly disclosed for high-risk AI/ML SaMD; (3) Real-World ' +
                'Performance — RWP monitoring program active (cross-reference samd-real-world- ' +
                'performance validator); (4) Regulatory Science — participation in FDA-recognised ' +
                'benchmarks and datasets where applicable; (5) Patient Engagement — patient ' +
                'perspectives integrated into SaMD design, validation, and monitoring. GMLP ' +
                'alignment documented for each AI/ML SaMD version. Action Plan alignment ' +
                'reviewed at each major algorithm change.',
            reference: 'FDA AI/ML-Based SaMD Action Plan (Jan 2021)',
            check: 'samd_aiml_action_plan_alignment',
            failSeverity: 'HIGH',
        },
        {
            id: 'samd-pccp-change-control',
            description: 'Pre-Determined Change Control Plan (PCCP) established per FDA PCCP Guidance ' +
                '(2024): PCCP document prepared and included in (or referenced by) the premarket ' +
                'submission (510(k), De Novo, or PMA); PCCP describes the SaMD modifications ' +
                'anticipated (modification protocol), methods for developing the modifications ' +
                '(development protocols), and performance evaluation protocols; modification ' +
                'envelope precisely defined — changes within scope do not require a new ' +
                'premarket submission; changes outside the PCCP envelope require a new ' +
                'submission before implementation (CRITICAL block); PCCP version-controlled ' +
                'and dated; PCCP amendment process documented for when anticipated changes ' +
                'evolve beyond the original envelope; pccp-change-controller designated with ' +
                'authority to approve bounded changes and escalate out-of-bounds changes.',
            reference: 'FDA Pre-Determined Change Control Plan (PCCP) Guidance (2024)',
            check: 'samd_pccp_change_control',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'samd-algorithm-change-protocol',
            description: 'Algorithm Change Protocol (ACP) established per FDA AI/ML Action Plan §2: ACP ' +
                'documents the types of algorithm modifications that are pre-approved (bounded ' +
                'within PCCP envelope) vs. those requiring new regulatory review; ACP covers: ' +
                '(a) algorithm architecture changes (pre-approved range specified); (b) training ' +
                'data updates (acceptable sources, preprocessing requirements, retraining triggers); ' +
                '(c) performance threshold updates (acceptable drift range before re-validation ' +
                'required); (d) intended-use boundary changes (not permitted under ACP alone — ' +
                'requires clinical evaluation update and potentially new premarket submission); ' +
                'ACP-compliant changes documented in a change log with performance evidence; ' +
                'ACP-exceeding changes automatically escalated to pccp-change-controller for ' +
                'out-of-PCCP-bounds assessment. ACP integrated with PCCP as the technical ' +
                'implementation of the PCCP modification protocol.',
            reference: 'FDA AI/ML Action Plan §2 (Algorithm Change Protocol)',
            check: 'samd_algorithm_change_protocol',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'samd-clinical-evaluation',
            description: 'Clinical evaluation process established per IMDRF SaMD Clinical Evaluation N41 ' +
                '(2017): clinical evaluation plan documented (scope, methods, acceptance criteria, ' +
                'timeline, roles); analytical validation completed (verify the SaMD correctly ' +
                'processes input data — lock + algorithm verification); clinical validation ' +
                'completed (verify SaMD achieves its intended purpose in the target population ' +
                'and use environment); clinical performance data collected, analysed, and reported ' +
                'in a Clinical Evaluation Report (CER); CER includes: study design, patient ' +
                'population, reference standard, performance metrics, limitations; CER updated ' +
                'for each significant algorithm change (ACP / PCCP boundary assessment); clinical ' +
                'evaluation officer designated and accountable for CER accuracy; independent ' +
                'clinical expert review documented for Category III and IV SaMD.',
            reference: 'IMDRF SaMD Clinical Evaluation N41 (2017)',
            check: 'samd_clinical_evaluation',
            failSeverity: 'HIGH',
        },
        {
            id: 'samd-intended-use-scoping',
            description: 'Intended-use scoping process established per FDA SaMD intended-use determination ' +
                'and IMDRF risk categorization framework: intended use statement precisely scoped — ' +
                'clearly identifies the medical purpose (inform / drive / treat/diagnose clinical ' +
                'management), the target patient population, the clinical condition being addressed, ' +
                'and the healthcare setting; out-of-scope uses explicitly defined (off-label use ' +
                'prevention labelling); indications for use (IFU) consistent with clinical evaluation ' +
                'evidence; intended-use change process: any modification to intended use triggers ' +
                'clinical evaluation officer review, IMDRF risk category reassessment, and ' +
                'potentially a new regulatory submission; user type and competency requirements ' +
                'documented (professional use vs consumer use boundary); intended-use statement ' +
                'version-controlled in the Device Master Record (DMR).',
            reference: 'FDA SaMD intended-use determination + IMDRF SaMD risk categorization (N12)',
            check: 'samd_intended_use_scoping',
            failSeverity: 'HIGH',
        },
        {
            id: 'samd-post-market-signal-detection',
            description: 'Post-market signal detection system established per FDA Sentinel Initiative ' +
                'principles and FDA Pre-Cert continuous monitoring framework: automated signal ' +
                'detection process monitors deployed SaMD outputs for unexpected patterns, ' +
                'performance degradation, demographic bias emergence, or adverse event clustering; ' +
                'signal thresholds defined based on pre-market clinical validation performance ' +
                'bounds; signals reviewed by clinical evaluation officer within defined SLA; ' +
                'validated signals escalate to QMS CAPA process and, where MDR-reportable, ' +
                'to fda-liaison within the 5-day MDR window; signal detection covers: ' +
                '(a) accuracy / sensitivity / specificity drift; (b) unexpected patient outcome ' +
                'correlations; (c) system failure patterns; (d) user error patterns; ' +
                '(e) demographic performance disparities; signal database maintained for ' +
                'TPLC reporting and FDA pre-submission support.',
            reference: 'FDA Sentinel Initiative + FDA Pre-Cert continuous post-market monitoring',
            check: 'samd_post_market_signal_detection',
            failSeverity: 'HIGH',
        },
        {
            id: 'samd-behavioral-validator-out-of-pccp-bounds-change',
            description: 'Behavioral validator: detects AI/ML model changes that exceed the Pre-Determined ' +
                'Change Control Plan (PCCP) modification envelope for any governed SaMD. Any ' +
                'AI-generated model update, retraining result, architecture modification, or ' +
                'performance-threshold change that falls outside the pre-approved PCCP scope ' +
                'is an ABSOLUTE CRITICAL BLOCK with NO compensating control path. ' +
                'Out-of-PCCP-bounds changes represent unreviewed modifications to a cleared or ' +
                'approved medical device — deploying them without a new premarket submission ' +
                'constitutes a device adulteration violation under 21 CFR 820. The out-of-PCCP- ' +
                'bounds event triggers immediate escalation to: pccp-change-controller, ' +
                'fda-liaison, clinical-evaluation-officer, qms-lead, ciso, and ' +
                'cybersecurity-incident-coordinator. Deployment is suspended pending PCCP ' +
                'amendment review or new regulatory submission. This is the highest-severity ' +
                'SaMD governance event — equivalent to a Class I recall trigger for software. ' +
                'No bounded-change exception, no time-pressure override, no senior-engineer ' +
                'bypass: out-of-PCCP-bounds is an absolute block.',
            reference: 'FDA Pre-Determined Change Control Plan Guidance (2024) — PCCP modification envelope; ' +
                'behavioral validator: out-of-PCCP-bounds-change immediate-escalation',
            check: 'behavioralValidator_samd_out_of_pccp_bounds_change',
            failSeverity: 'CRITICAL',
        },
    ],
};
//# sourceMappingURL=fda-samd-precert.js.map