Regulation
FDA already asked for this. In writing.
Computer Software Assurance was finalised on 24 September 2025 — four steps, risk-based, objective evidence over documentation volume, cloud and hybrid explicitly in scope. Kaelox produces exactly that artefact, generated as the work happens rather than assembled afterwards.
Regulatory positionREF KX-REG-001 · Rev 1.0 · August 2026
| Instrument | Status | What it asks for |
|---|---|---|
| FDA CSA | Final · 24 Sep 2025 | Risk-based assurance. Objective evidence over documentation volume. Cloud and hybrid in scope. Four steps. |
| UK MHRA PMS | In force · 16 Jun 2025 | Declared data-collection methods, faster incident reporting, explicit field safety corrective action criteria |
| FDA QMSR | In force · 2 Feb 2026 | 21 CFR 820 rebuilt around ISO 13485:2016. QSIT withdrawn; CP 7382.850 replaces it |
| FDA §524B | In force | A machine-readable SBOM. A submission can be refused without one |
| FDA PCCP | Final · Dec 2024 | Description of modifications, modification protocol, impact assessment |
| EU MDR | In force | Technical documentation, post-market surveillance and clinical follow-up, EUDAMED, UDI |
| Japan MO-169 | In force | ISO 13485 plus a Seihin Hyojun Sho — a device master file ISO does not require |
| EU AI Act Art. 50, Art. 4 | Live now | Transparency, and AI literacy |
| EU AI Act Art. 14 (Annex I) | 2 Aug 2028 | Human oversight, logging, post-market monitoring. Deferred by the Digital Omnibus — deferred, not withdrawn |
The deferral buys build time, not waiting time. The technical documentation a notified body reads has to describe evidence that accumulated while you were manufacturing, and that cannot be created retrospectively.