Regulatory Copilot: the eQMS with the regulatory brain

What's inside

Everything a modern eQMS has, plus the regulatory brain it's missing.

Differentiator

AI provenance you can defend

Every AI-touched passage is tagged and stays "suggested" until a human verifies it. Only verified content counts toward readiness, so you always know what the machine wrote and what you approved.

Per-line source: you, AI, or verified
Nothing is "done" until a person signs off
An audit trail that shows your reasoning
Exports show each signer’s role at the time they signed

Verified · you

Intended use matches the cleared predicate's indication.

AI draft · unverified

Proposed substantial-equivalence rationale. Review before it counts.

Edited · you

Low-perfusion limitation flagged for the IFU.

Strategy

Predicate search & pathway strategy

A vetted predicate shortlist in minutes. Every candidate is screened against your intended use, ordered so complete devices outrank accessories and then by technology match, flagged for recalls and adverse events, and linked to the exact page and quote in FDA’s clearance summary. You can see and correct how your intended use was read, and name predicates you already know so they’re always assessed. Then a class-aware pathway assessment, with a Pre-Submission (Pre-Sub) you can prepare and send yourself.

“Why this match” reasoning, factor by factor
Recall / MAUDE safety flags surfaced
Watch a predicate, product code or applicant: new recalls, adverse-event signals and clearances, checked daily and flagged in the app
Predicate lineage (what your predicate cited, and who cites it), De Novo decisions in the search, and filters when the list calls for them
Pathways scored from FDA’s records for your product code, every point sourced; how defensible your predicate is; a device-change (letter to file) questionnaire following FDA’s guidance; and a one-file strategy report
MAUDE trends and reports, a life-cycle view per product code and a recall browser, from FDA’s public data
FDA device guidance tracked daily, new and revised documents flagged where your records cite them, and a weekly FDA digest
Pre-Sub prep with a question-quality check, questions ranked by how much the answer would change your plan
AI wording advice on your intended use against the predicate’s indications, and a simulated reviewer’s likely questions tied to your records: opinions you verify, never approval odds
Ask a platform expert to sign off a record: they get time-limited, read-only-plus-sign-off access, and their sign-off lives in the record
Legal holds that block deleting, obsoleting or unlinking what they cover, and retention rules that list records past their period for you to decide on (nothing is ever deleted automatically)
Comment on any record, document or submission section, mention colleagues and assign follow-ups with a due date; every thread shows whether the thing it discusses is verified
Section-level permissions: an owner can limit who may edit or review each submission section, enforced on the server
For consultants, a personal library of your own templates, SOPs and snippets that you copy into any client workspace, never shared between clients
Every AI edit shown as a diff before it changes anything; redrafts proposed when a record it traces to changes; a quality score for each submission section, with its reasons
A citation cross-check across your package (records, FDA decisions, eCFR sections, guidance titles, standard editions), and every fact in the SE comparison labelled confirmed, claimed, inferred or unknown
Upload your own SOPs and templates and draft new documents in their style; generate a starter set of SOPs and plans for a device, including the post-market surveillance plan, each a draft you review and release
For consultants, one review queue of every AI draft waiting across all your clients; a records-vs-procedure audit that names the clause each finding tests; complaint trends beside MAUDE and your risk file
Ask a cleared device’s 510(k) document a question and get its own words with page numbers; draft point-by-point answers to an FDA deficiency letter that you review before anything is assembled; and a checklist of the 21 CFR Part 801 elements in your label and IFU
PubMed literature saved to each device with its PMID, research memos where every claim cites FDA’s records or a saved abstract, and side-by-side strategy scenarios
A classification rationale PDF to share with investors or clients
A substantial-equivalence comparison with your predicate, each fact cited to its 510(k) summary (PDF + CSV)

Your shortlistTiered

Each candidate is banded strong / plausible / weak, with the differences named rather than smoothed over, and every factual claim linked to its page in FDA’s summary.

Recall flagsMAUDE checkedDifferences shown

The hard part, solved

The submission builder

It pulls the sections it can straight from your modules, lets you import or draft the gaps, then assembles the package: the actual cover letter, IFU and comparison, ready to review. Assemble your 510(k) package and track the review. You file with FDA; we keep the record.

Pulls from Requirements, Risk, Test runs & DHF
A deterministic package-completeness check before you file (not FDA’s own acceptance screen)
A cybersecurity section shaped like eSTAR’s: the section 524B cyber-device questions, an SBOM reader (CycloneDX or SPDX JSON) and every attachment eSTAR asks for
A standards and citations list read from your records, and the whole package as one ZIP with a hash manifest (not an eSTAR)
FDA user fees and a small-business check, with current fees linked from FDA

Sections sourced9 of 10

Cover letter · from Device profile

SE comparison · from Predicate search

Draft labeling · imported by you

Design workspace

One connected design record, from user need to DHF

Every requirement, output, test, risk and usability task lives in one linked record, with every version kept. Traceability isn't a spreadsheet you rebuild before an audit. It's how the work is stored, so it holds up through every change. Already have a requirements spec? Upload the PDF or Word file and the AI pulls out the requirements it states, each with the exact quote and page, for you to tick and verify.

User needswhat the device must do, for whom

Design inputssystem & software requirements

Design outputsarchitecture, components, SOUP

Verificationtest protocols & logged runs

Validationusability tests; the pivotal study for PMA

Risk management (ISO 14971): hazards, risks and controls link to the inputs they constrain and the tests that prove them.

The same record feeds the DHF, submission readiness and the QMSR gap check. Fix something once and every view reflects it.

You change a requirementREQ-012 · v3 → v4

A new version is saved and everything downstream that was complete is flagged, so nothing silently goes stale.

TEST-021 · SpO₂ accuracy protocolNeeds re-review
RISK-004 · over-reads at low perfusionNeeds re-review

You log a passing test runTEST-021 · run 3

One action closes the chain: the test, the requirement it verifies and the risk it controls all update together.

REQ-012 · SpO₂ accuracyVerified
RISK-004 · over-reads at low perfusionAcceptable, verified

Illustrative example. Record IDs are your own.

Guided risk management

An FMEA-style flow builds the hazard → risk → control chain in one step and derives its status. Your risk plan is kept and locked per device.

Design reviews with phase gates

7 phases for a 510(k), 12 for a PMA. Approval goes through sign-off with a date and attendees, and closing an action item requires evidence.

A DHF compiled from the record

8 elements for a 510(k), 14 for a PMA. Evidence tables are built from your real links, not retyped, then signed off and exported as a PDF binder.

Coverage and sanity checks

See what's verified, what has no completed test, which risks are still unacceptable and what was flagged after a change, ordered by severity.

AI that respects the record

Draft requirements, flag ones that can't be measured and suggest missing links. Every suggestion stays unverified until a person accepts it.

Scoped to your device class

Class II gets the full 510(k) set; Class III adds clinical evidence; a Class I exempt device sees only the minimal records that apply.

Requirements, software (IEC 62304) and usability (IEC 62366) records in one place
Bulk import of existing requirements, brought in as unverified drafts
Traceability matrix export as CSV or PDF, with gaps and flagged items shown, never hidden

The eQMS backbone

The full quality system, too

Document control with Part 11-ready sign-off and release control, training with competency quizzes, CAPA with a postmarket loop, complaint/MDR triage, suppliers, and an Audit center that generates auditor spreadsheets and a QMS state report on demand.

Part 11-ready records & a database-enforced audit trail
QMSR gap check with a tracked list of FDA regulatory changes
Unlimited controlled documents & records
A device Inbox: what’s waiting on each device, most severe first
Ask: answers cited to your own records, or no answer
A cost & timeline estimate using current FDA user fees

SOP-001 released · signed & timestamped

Training quiz · competency recorded

QMS state report · generated

Audit trail · append-only in the database

Capability	Regulatory Copilot	Formwork	Greenlight Guru	Cruxi
ISO 13485 / QMSR document control	●	●	●	—
Part 11-ready e-signatures (password re-entry)	●	● (claims compliant)	●	—
Risk, software, usability (14971/62304/62366)	●	●	●	—
CAPA, complaints/MDR, training, suppliers	●	●	●	—
AI drafting and requirement checks	●	●	●	● (submission drafting)
Predicate search with recall flags and FDA sources	●	—	—	●
AI output linked to exact source page and quote	●	—	No (asks users to verify)	●
Per-record provenance and human verification status	●	—	—	—
Class-aware pathway strategy (510(k)/PMA/exempt)	●	—	—	Partial (classification)
Pre-Sub prep	●	—	—	—
eSTAR / submission assembly	Readiness by eSTAR section + eSTAR data file (you file)	—	—	● (18 sections)
DHF + live traceability matrix	●	Partial	●	—
Multi-client consultant workspaces and a cross-client dashboard	●	—	—	Agency credits
Validation report, migration, support	Planned	●	●	Optional expert review
Clinical evidence (EDC)	—	—	●	—
Price	Founding cohort	Free; $119/mo; $599/mo	~$15–60K/yr + onboarding	$1,000/submission, $200/service, or $500/mo

Trust & security

Regulated work needs a tool you can defend.

The controls a device company's quality team and a buyer's security review ask about, with honest status, because we don't claim what isn't in place yet.

AI you can defend in an audit

Every AI passage carries its source and a record of who verified it.

Source-cited outputs, not black-box text
Nothing counts as done until a person signs off

Data integrity & Part 11-ready records

Signature meaning, immutable versions, and a database-enforced tamper-evident audit trail.

Signature meaning, signer and timestamp bound to the exact revision released
Append-only audit trail, enforced by the database itself, not by the app
Re-authentication at signingIn place

Security & compliance

Encryption in transitIn place
Encryption at restHosting platform
Workspace isolation enforced at the database levelIn place
Role-based access (4 roles, 20 permissions)In place
Access you can end: dates, revoke on the next request, a record of who had itIn place
IP allow-list per workspaceIn place
Single sign-on (OpenID Connect: Okta, Microsoft Entra ID, Google Workspace)In place
SOC 2 Type IIPlanned
ISO 27001Planned

Your data is yours

No lock-in. Standard formats, so nothing is trapped in a proprietary blob.

Traceability matrix (CSV + PDF)
QMS records (CSV) and the DHF binder (PDF)
Verification record, per-document certificate and classification rationale (PDF)
PDF exports carry your firm’s name and logo
Whole-workspace and audit-trail exportIn place
Read-only MCP connector, so Claude and other AI clients can read what you canIn place

Software validation (GxP)

For a regulated environment the tool itself must be validated for its intended use. Ours is not yet, and we say so.

QMS state report: describes your records, and is not a validation package
IQ / OQ / PQ validation packagePlanned

Radical honesty

The trust signal that matters most in regulatory work.

Exports show the file as it truly stands, gaps included
We never fabricate content to fill a hole

Security posture reflects current status as of October 2026. SOC 2 Type II and ISO 27001 are planned ahead of paid pilots, and nothing above is claimed as complete before it is. Read the full trust page.

FAQ

Questions, answered.

Is this an eQMS or a submission tool?

Both. Regulatory Copilot runs a full ISO 13485 / FDA QMSR quality system (controlled documents, sign-off and release, training, CAPA, risk, usability) and adds the regulatory strategy and FDA submission workflow that a standalone eQMS leaves to you.

Does it work for Class I, II, and III devices?

Yes. The whole workflow is class-aware: a Class II device runs the 510(k) path, Class III runs PMA, and a Class I device collapses to registration & listing. De Novo is not selectable in the app yet. Pick a class in the demo above to see the difference.

How does the AI stay trustworthy?

Every AI-drafted passage is tagged and stays unverified until a human reviews it, and only verified content counts toward your readiness. Where the AI reads an FDA document, the claim is linked to the page and quote it came from. The provenance and every signature are captured in an append-only audit trail that the database itself enforces, and if a suggested rewrite would drop a number or a record ID it is withheld rather than applied.

Can it actually generate my submission?

It lays your readiness out in the 16 sections of FDA’s eSTAR a 510(k) fills, answers what it can from your records, reads the lab and test reports only you hold (quoting the page each answer comes from), drafts narrative sections for your review, and exports a data file for eSTAR’s own Import Data, with your attachments. Two things it deliberately does not claim: that import has not yet been verified in eSTAR itself, and its completeness check is not FDA’s technical screening. FDA runs its own, and passing ours predicts nothing about it. Then it links out to the CDRH Portal. We transmit nothing to FDA. You file, and the app records the tracking number you were given and tracks the review clock from it.

Can I get my data out?

Yes, and in standard formats: the traceability matrix as CSV and PDF, your QMS records as CSV (a summary, or every field), and the DHF as a PDF binder, with open gaps shown and flagged rather than hidden. A workspace owner can also export the whole workspace as one ZIP: JSON, CSV, readable copies of every document revision, every uploaded file checked against its checksum, and an index to find your way around. Its complete audit trail is in it too, as CSV. Your data is never deleted because you stopped paying. Coming the other way, from another eQMS or a spreadsheet? Import CAPAs, complaints, training records and suppliers from a CSV: you see a preview of every row first, and records already here are skipped, never overwritten.

Can my client or an outside reviewer see the records?

Yes, without an account. A workspace owner creates a read-only link to one device: its verification record, classification rationale, traceability matrix and audit trail, generated fresh each time. The link expires after 7, 14 or 30 days, can be revoked at any time, and every view and download is recorded in your audit trail.

Can I try anything without an account?

Yes. The FDA classification lookup: describe a device or type its product code, and it shows FDA's own classification records (class, regulation, review panel and typical pathway). It is FDA's published classification, not a determination for your device. And the predicate search: a product code and a few words give the devices FDA has cleared under that code, ranked by name, as a starting list. Four short checks walk through FDA’s own criteria, with the guidance cited: Special 510(k), De Novo, 513(g) and Breakthrough designation. They screen; they don’t decide. And Learn has plain-language explainers on each pathway and the outlines of our quality-system templates. None of it uses AI or needs a sign-up.

Can I use it from Claude or another AI assistant?

Yes. Create a personal API token on your profile and add the read-only connector (it speaks the Model Context Protocol, MCP) to Claude or any MCP client. It reads devices, design records, documents, the submission package and quality records, and sees exactly what you can see in the app, nothing more. Each record still says whether it was AI-drafted and whether a person has verified it. The connector can’t change anything.

Does it work with Slack or Microsoft Teams?

Yes, for workspace updates: an owner connects a channel with an incoming webhook and picks what goes there, such as FDA watch alerts, guidance changes and items falling due. Each post is one line and a link back; record contents never leave the app, and anything addressed to one person stays in their own Updates.

Does it connect to Jira?

Yes. An owner connects your Jira Cloud site, and anyone who works on CAPAs and complaints can create a Jira issue from one or link an existing issue. Each linked issue’s status shows beside the record and is refreshed daily; it never closes anything here, because closing a CAPA still needs its effectiveness evidence.

Can I import documents from Google Drive?

Yes, where your workspace has it switched on: pick a Google Doc, PDF or Word file in Google’s own picker, and it’s read exactly like an upload, with each requirement it finds proposed as an AI draft for you to check. We can only see the file you pick. SharePoint and Box aren’t connected yet.

Is the tool itself validated?

Not yet, and we will not pretend otherwise. A software-validation package (IQ/OQ/PQ), the artifact a buyer’s quality team asks for, is planned and not available. The Audit center’s QMS state report describes your records; it is not that package. If you need vendor validation evidence before you can adopt a tool, tell us and we will tell you honestly where it stands.

Who's behind it?

One person: a medtech regulatory practitioner who has been through the predicate and submission process many times, at a device startup and two of the largest device companies in the world, with a biomedical-engineering background behind the science and the standards. The tool is built from how submissions actually get done, not how a generic document system imagines it.

The design record that becomes your submission.

An eQMS keeps your paperwork. It doesn't get you to market.

Which pathway?

Which predicate?

Now assemble it

Your device's FDA class reshapes the whole workflow.