Medical DevicesDesign Controls that stay current.
Agents4DevOps applies user needs, design inputs, software safety class, risk-control links, design reviews, configuration control, verification and validation, and DHF evidence to governed agent workflows inside Azure DevOps. Agents keep the chain connected. Your quality, regulatory and design authorities make every decision.
No card required. Your data stays in your Azure DevOps tenant.
- IEC 62304
- ISO 13485
- ISO 14971
- IEC 62366
- EU MDR
- FDA 21 CFR Part 820
Every change has to stay tied to intended use.
A change to device software is never only a code change. It has to stay connected to intended use, user needs, design inputs and outputs, software requirements, risk controls, verification, validation, configuration, anomalies, and transfer and release evidence. In most teams that chain lives across work items, spreadsheets and documents, and someone rebuilds it by hand before every design review. The workflow also has to keep qualified review in place. An AI output is never a regulatory conclusion, and the process has to make that obvious.
- 01
Links decay between reviews.
A design input is edited in sprint 12, and the tests, risk controls and design outputs that depend on it are not revisited until the next formal review finds the gap.
- 02
Risk lives in a separate file.
Hazards and risk controls sit in a spreadsheet, so nobody can see from the work item which controls a change touches or which verification proves them.
- 03
DHF assembly is a project of its own.
Before an audit, engineers stop delivery to collect approvals, test results and baselines from five places and check that each one is the current version.
- 04
SOUP and anomalies slip through.
Third-party components and open anomalies change quietly, and their safety impact is assessed late, if at all.
Your device context, built into every run.
The Medical Devices pack sets the classification, relationships, standards mapping and gates the agents work to. Nothing is guessed at run time.
- 01 Classification
Device and software context
Software safety class, risk-control relevance, intended use and user population, data and security relevance, and the current design-control stage.
- 02 Traceability model
From user need to DHF
User need to design input and system or software requirement, then design output, risk control, verification and validation, anomaly resolution, transfer and release, and DHF evidence.
- 03 Standards & frameworks
Mapped to the standards you work under
IEC 62304 software lifecycle, ISO 13485 quality management and Design Controls, ISO 14971 risk management, IEC 62366 usability engineering, EU MDR, FDA 21 CFR Part 820 as applicable, and 21 CFR Part 11 for applicable electronic records.
- 04 Lifecycle gates & evidence
Gates your reviewers already hold
Design-input review, architecture and design review, risk review, V&V readiness, anomaly disposition, configuration baseline, transfer and release, and DHF completeness.
The Medical Devices chain, kept intact.
A design input changes. The agent flags the risk-control link, routes review, and confirms the chain is restored.
- User need
- Design input
- Design output
- Risk control
- V&V
- Anomaly resolution
- Transfer/release
- DHF evidence
Where the agents do the work.
Eight workflows the pack is configured for. Each runs on a trigger your team sets and leaves its output on the work item, test plan or wiki page it belongs to.
User needs and design inputs
Turn intended-use needs into testable design and software requirements, with the level, links and acceptance criteria your template expects.
Business Analyst Agent
Software safety and risk linkage
Apply the configured safety class and risk context, then trace hazards to controls, requirements, implementation and evidence.
Requirements Engineer Agent
Design review readiness
Before a formal review, check that inputs, outputs, risks, usability, tests, approvals and open findings are all in place.
Compliance Officer Agent
Verification and validation
Generate and maintain tests, coverage, configurations, deviations, results and acceptance reports, including per-step outcomes in Test Plans.
QA Engineer AgentAnomaly and fix control
Triage anomalies, assess safety and risk impact, validate fixes, analyze regression and keep every link intact.
QA Engineer Agent
Configuration and design change
Maintain baselines and change impact, note the effect on delivered product, update DHF and DMR records, and raise re-verification needs.
Release Manager Agent
Security and SOUP
Triage vulnerabilities, keep the third-party and SOUP inventory current, verify fixes and link the security evidence.
DevOps Engineer AgentDHF and audit evidence
Audit Design Controls traceability, list the gaps, and assemble current, source-linked evidence for qualified review.
Compliance Officer Agent
Fifteen roles, configured for device work.
The supplied catalog includes these role configurations for Medical Devices. Add one to a project with Use, and Compatibility Alignment maps it to your process template.
Requirements Engineer Agent
Keeps user needs, design inputs, risk controls and tests linked, and runs suspect-link analysis when an input changes.
PlanBusiness Analyst Agent
Formalizes intended-use needs into testable design inputs with the safety class and risk context attached.
TestQA Engineer Agent
Maintains V&V tests and coverage, triages anomalies for safety impact, and records step results in Test Plans.
GovernCompliance Officer Agent
Audits Design Controls traceability and assembles DHF evidence for your quality team to review.
Medical Devices roles in the catalog
- Acceptance Coordinator
- Business Analyst
- Compliance Officer
- Configuration Manager
- Engineering Manager
- Product Owner
- Project Manager
- QA Engineer
- Requirements Engineer
- Risk Manager
- Security Engineer
- Software Architect
- Team Assistant
- Technical Writer
- Test Engineer
A design input changes.
A requirements engineer edits REQ-207, a design input for dose-timing alerts. The condition on the agent's trigger matches, so the run starts. It reads the input, its safety class and risk-control relevance, then traces the affected design outputs, code, SOUP, tests, usability evidence, open anomalies, approvals and released versions. It finds a risk control whose verification predates the change and a usability test that no longer matches the wording. It creates the change and re-verification actions on the right items and opens a task for the named approver. Once the approver responds, it checks that the traceability chain is whole again and writes a full run record to the Job Explorer.
run started · REQ-207 design input updated
class C context · 2 risk controls in scope
tracing: 3 outputs · 2 SOUP · 9 tests
finding: RC-14 verified before change
checkpoint · re-verification needs approval
verified · traceability chain restored
- ✓ Design outputs linked
- ! Risk controls verified
- ✓ SOUP impact assessed
- ! Usability evidence current
- ✓ Approvals and baseline
People own the decisions.
Agents prepare classifications, trace links, draft tests and assemble evidence. Your quality, regulatory, risk, clinical, usability, software and design authorities keep responsibility for software safety class, risk acceptability, design approval, validation conclusions, regulatory submissions and release. With Required Approval on, a run stops at a checkpoint and opens a task for the named person, who can answer, attach files, approve, edit or reject. A rejected draft writes nothing.
[ Trusted by Microsoft and industry leaders ]
Medical Devices questions.
It can prepare a classification from your configured logic and the evidence on the item. Qualified personnel review and approve it. The agent never records a class as final on its own.
It maintains links and assembles source evidence for the DHF. Your organization stays responsible for document control, completeness, approval and regulatory acceptability.
Yes, as support. It maintains risk records, controls, traceability, implementation evidence and reports in Azure DevOps. Risk decisions stay with your authorized team.
Yes. Attach your SOPs, templates and terminology as knowledge, or turn on Bring Your Own Data so the agent retrieves from your uploaded documents, Azure DevOps queries and wiki pages during the run. Edit its instructions in plain English and keep every version with rollback.
No. Agents run inside your Azure DevOps environment on the same security and trust model as Copilot4DevOps, and your project data is not used to train models. Every run leaves a record of its trigger, actions, approvals, output and verification result.
No. Workflows support standards-aligned activities and evidence. The software does not make a certification decision or guarantee compliance. That stays with your organization and its regulators.
Credits are $0.01 each and pooled across your organization, with no per-user fees. A rule-shaped check, such as required trace links on every design input, can run as an Execution Agent at a flat 4 credits. Agents pause cleanly at zero.
Bring a real design change to the demo.
Start a free trial with 2,000 credits, no card required. Or book a 30-minute demo with a requirement, hazard, test or evidence gap from your own project, and watch the classification, trace, checkpoint and run record live.
