{"id":"iso-standards-readiness","name":"iso-standards-readiness","summary":"ISO 13485医療機器QMS、ISO 14971デバイスリスク管理、ISO/IEC 17025試験・校正ラボ、ISO 15189医療ラボラトリーの管理システムおよび検査能力基準のための準備完了証拠を作成し、構造的にレビューします。","body":"# ISO Standards Readiness Evidence Preparation\n\n## Purpose\n\nUse this skill to organize declared scope, controlled documents, implementation\nrecords, traceability, and readiness evidence for substantive human review against a\nnamed standard. It summarizes process workflows and provides deterministic local\nchecks. It contains no clause text and performs no audit.\n\nThis is a router. `SKILL.md` holds the boundary, the lane discipline, the shared\nworkflow, and the CLI contract. Per-standard depth lives in `references/`.\n\n## Non-negotiable boundary\n\nThis skill cannot:\n\n- certify or accredit anything, issue or validate a certificate, accreditation\n  schedule, or licence, or promise an audit, assessment, or inspection result;\n- determine legal/regulatory applicability, device classification, reportability,\n  conformity route, product authorization, market access, licensure, personnel\n  qualification, or compliance;\n- replace authorized management, the management representative, laboratory director,\n  quality manager, authorized signatory, RA/QA, legal counsel, regulatory/competent\n  authorities, a notified body, an MDSAP Auditing Organization, an accreditation body,\n  an assessor, or a certification body;\n- validate a method, compute or approve measurement uncertainty, establish\n  metrological traceability, set risk-acceptability criteria, or judge whether a risk,\n  decision rule, or reference interval is fit for purpose; or\n- infer implementation, competence, conformity, compliance, or readiness from a\n  template, checklist, filename, keyword, document count, percentage, or script\n  result.\n\nAlways label outputs **draft evidence-preparation material for authorized human\nreview**. Preserve unresolved decisions as blockers rather than resolving them.\n\n## ISO and IEC copyright\n\nISO and IEC standards are copyrighted. Obtain each standard from\n[ISO](https://www.iso.org/standards.html), IEC, an ISO national member, or another\nauthorized source. Do not retrieve, paste, reproduce, or generate clause text.\nSummarize the organization's own process and cite the controlled authorized copy. See\n[ISO copyright](https://www.iso.org/copyright.html). Accreditation-body, CAP, and\nscheme checklists that quote requirements are separately licensed — keep them out of\nshared repositories and prompts too.\n\n## Standards covered\n\nRead the reference file for the standard in play **before** preparing evidence. Each\none carries its own current edition, lane, domain vocabulary, and failure modes.\n\n| Standard | Profile key | Lane | Reference |\n| --- | --- | --- | --- |\n| ISO 13485 medical device QMS | `iso-13485` | Certification | `references/iso-13485.md` |\n| ISO 14971 device risk management | `iso-14971` | No lane of its own | `references/iso-14971.md` |\n| ISO/IEC 17025 testing and calibration laboratories | `iso-17025` | Accreditation | `references/iso-17025.md` |\n| ISO 15189 medical laboratories | `iso-15189` | Accreditation | `references/iso-15189.md` |\n\nA standard absent from this table is out of scope for the bundled checks. Do not\nrepurpose a profile for a standard it does not name — a domain vocabulary borrowed from\na different standard produces a report that looks complete and means nothing.\n\n## Current baseline (read the ledger before any time-sensitive statement)\n\n- **ISO 13485:2016** Edition 3, confirmed after its 2025 systematic review.\n  **EN ISO 13485:2016/A11:2021** is a European amendment, not an ISO international\n  \"Amendment 1:2021.\"\n- **ISO 14971:2019** Edition 3, confirmed in 2025, with **ISO/TR 24971:2020** as its\n  informative guidance companion. There is no ISO 14971 certificate.\n- **ISO/IEC 17025:2017** Edition 3 remains current; no successor edition identified.\n- **ISO 15189:2022** Edition 4 replaced the 2012 edition, absorbed the POCT\n  requirements formerly in ISO 22870, and its accreditation transition closed in\n  **December 2025** — implemented, not upcoming.\n- **FDA QMSR** effective and enforced since **2026-02-02**; Part 820 is titled\n  *Quality Management System Regulation*; QSIT is retired in favour of Compliance\n  Program **7382.850**.\n- **MDSAP** current Audit Approach is **MDSAP AU P0002.010**, version date\n  **2026-02-02**.\n- **Accreditation recognition:** Global Accreditation Cooperation Incorporated\n  commenced full operations **2026-01-01**, replacing ILAC and IAF, with its own MRA;\n  former IAF MLA / ILAC MRA outputs stay recognized during the transition.\n- **EU:** use current consolidated MDR/IVDR texts, current OJEU harmonised-standard\n  decisions, current MDCG guidance, and the product-specific conformity route.\n\nRead `references/source-ledger.md` before making any time-sensitive statement. It\nrecords provenance limitations, including which entries still need confirmation against\nthe ISO catalogue.\n\n## Keep the assurance lanes separate\n\nLane confusion, not missing documents, causes most substantive errors here.\nCertification, accreditation, regulator inspection, mandatory licensure, regulatory\naudit programmes, and product conformity assessment are decided by different bodies\nagainst different bases, and none substitutes for another. Two rules that are violated\nconstantly:\n\n- Organizations are **certified**; laboratories are **accredited**. \"ISO 17025\n  certified\" and \"ISO 15189 certified\" are category errors.\n- A certificate never displaces a regulator. ISO 13485 certification does not exempt\n  anyone from FDA inspection, and ISO 15189 accreditation does not satisfy CLIA.\n\nRead `references/assurance-lanes.md` for the full lane table, scope-statement limits,\nand the titling rule.\n\n## Core workflow\n\n### Step 1: Declare the standard, purpose, and authorized owners\n\nName the standard(s), the lane(s) the work supports, and the owners: management\nrepresentative or laboratory director, quality owner, legal/applicability owner,\nprocess or technical owners, approvers, and escalation route. A lane is a declared\ninput, never an inference.\n\n```bash\nPYTHONDONTWRITEBYTECODE=1 python3 scripts/validate_scope_intake.py \\\n  assets/templates/scope-intake-template.json --standard iso-13485\n```\n\nUse the matching template and profile:\n\n| Profile | Template |\n| --- | --- |\n| `iso-13485`, `iso-14971` | `assets/templates/scope-intake-template.json` |\n| `iso-17025` | `assets/templates/laboratory-scope-intake-template.json` |\n| `iso-15189` | `assets/templates/medical-laboratory-scope-intake-template.json` |\n\n`--standard` defaults to `iso-13485`. Every distributed template intentionally fails\nclosed; copy it outside the skill and complete it with controlled organizational\nevidence. Undetermined applicability raises `HUMAN_DECISION_REQUIRED` — leave it as a\nblocker.\n\n### Step 2: Freeze source/version evidence\n\nFor every standard, regulation, guidance, scheme document, audit model, and product\nsource, record publisher, official title, edition/version/date, authorized location,\naccess and currency-review dates, scope/applicability owner, impact assessment, status,\nevidence, and approval.\n\nDo not use search snippets as controlled requirements. Do not silently update an\nincorporated edition when a publisher releases a new one — FDA incorporated a specific\nISO 13485 edition, and a later ISO or EN publication does not change it.\n\n### Step 3: Inventory controlled documents and records\n\nDo not count named procedures or scan keywords. Build an explicit register linking\ndocuments, records, source versions, owners, approvals, effective dates, retention\nbases, training, and change records.\n\n```bash\nPYTHONDONTWRITEBYTECODE=1 python3 scripts/audit_document_records.py \\\n  assets/templates/document-register-template.json\n```\n\nThis check is standard-agnostic. Read `references/evidence-architecture.md` for the\nevidence architecture.\n\n### Step 4: Review process implementation\n\nAssess controlled procedures **and sampled records** across the domains your profile\ndeclares — the per-standard reference file lists them. Each item needs owner, status,\nevidence IDs, source/version, approval, and open-gap links.\n\nA procedure describing an activity is not evidence the activity happened. Sample\nrecords in every domain you report on, and state what you sampled and what you did not.\n\n### Step 5: Run the focused checks that apply to the lane\n\nDevice lanes (`iso-13485`, `iso-14971`) — risk/design/production/post-market chain:\n\n```bash\nPYTHONDONTWRITEBYTECODE=1 python3 scripts/check_traceability.py \\\n  assets/templates/traceability-matrix-template.json\n```\n\nAll standards — corrective action and effectiveness:\n\n```bash\nPYTHONDONTWRITEBYTECODE=1 python3 scripts/check_capa.py \\\n  assets/templates/capa-record-template.json\n```\n\nAll standards — suppliers and externally provided products and services, including\ncalibration providers, reference-material suppliers, and referral or subcontracted\nlaboratories:\n\n```bash\nPYTHONDONTWRITEBYTECODE=1 python3 scripts/check_supplier_controls.py \\\n  assets/templates/supplier-controls-template.json\n```\n\nPending or ineffective CAPA effectiveness evidence blocks closure. Critical supplier\ncontrols stay blocked until risk-based controls and approvals are evidenced.\n\nNote that `check_traceability.py` concerns design and risk traceability, **not**\nmetrological traceability — the words collide and it is the wrong tool for laboratory\nwork.\n\n### Step 6: Address lane-specific regulator evidence separately\n\nFor the US device lane only:\n\n```bash\nPYTHONDONTWRITEBYTECODE=1 python3 scripts/check_qmsr_transition.py \\\n  assets/templates/qmsr-transition-template.json\n```\n\nReview current Part 820/FDA source basis, supplemental provisions, obsolete QSR/QSIT\nreferences, pre-effective-date records, inspection-accessible management/quality/\nsupplier-audit records, current inspection-process training, complaint and servicing\nrecords, labeling/packaging controls, supplier/software/change evidence, and prohibited\ncertificate-equivalence claims. Do not build an old-820-to-ISO clause map as the\ncurrent control framework.\n\nLaboratory lanes have no equivalent bundled check. CLIA, licensure, and national\ninspection evidence stays with the authorized compliance owner; see\n`references/iso-15189.md`.\n\n### Step 7: Assemble a bounded readiness manifest\n\nCopy the evidence template outside the skill. Use relative paths to local `.json`,\n`.md`, or `.markdown` evidence only, and one declared lane purpose per manifest.\n\n```bash\nPYTHONDONTWRITEBYTECODE=1 python3 scripts/validate_evidence_manifest.py \\\n  /path/to/evidence-manifest.json \\\n  --standard iso-17025 \\\n  --base-dir /path/to/controlled-export \\\n  --verify-files \\\n  --output /path/to/manifest-report.json\n```\n\nThen generate a domain-level gap view against the same profile:\n\n```bash\nPYTHONDONTWRITEBYTECODE=1 python3 scripts/gap_analyzer.py \\\n  /path/to/evidence-manifest.json \\\n  --standard iso-17025 \\\n  --base-dir /path/to/controlled-export \\\n  --verify-files \\\n  --output /path/to/gap-report.json\n```\n\nThe analyzer uses explicit manifest labels. It does not infer evidence from filenames,\nkeywords, or proprietary standard text, and does not calculate a compliance score. A\ndomain absent from `expected_domains` is reported `not-assessed`, which is **not** a\nnot-applicable determination.\n\nRead `references/gap-analysis-checklist.md` for the fail-closed review questions.\n\n### Step 8: Human review and controlled handoff\n\nPresent:\n\n- declared standard, scope, assurance lane(s), and unresolved applicability decisions;\n- the exact source/version baseline;\n- evidence sampled and the limitations of that sample;\n- structural findings grouped by process and risk;\n- actions, change, and CAPA owners with dates;\n- approval state; and\n- the authorized party responsible for the next decision.\n\nNever title the result \"certificate,\" \"accreditation,\" \"compliance report,\" \"audit\npass,\" \"deemed status,\" or \"ready for inspection.\" A suitable title is **Draft evidence\nreview for authorized human assessment**, naming the lane it was prepared for.\n\n## CLI behavior and safety\n\nAll bundled CLIs:\n\n- use the Python standard library only;\n- perform no network requests;\n- accept bounded local JSON; optional evidence verification accepts only bounded local\n  JSON/Markdown;\n- reject symbolic-link inputs, duplicate JSON keys, non-finite numbers, excessive\n  size/nesting/items, and unsafe evidence paths;\n- refuse an unlisted `--standard` value rather than falling back to a default;\n- use no dynamic evaluation, executable deserialization, pickle, or shell execution;\n- refuse to overwrite reports unless `--force` is explicit; and\n- produce deterministic sorted JSON.\n\nTreat the manifest itself as a controlled organizational record. An optional SHA-256\ncomparison detects a local file mismatch only; it does not establish provenance,\nauthenticity, adequacy, or trust in a user-supplied manifest. Values in JSON\n`local_path` and `evidence.location` fields refer to the user's controlled export, not\nto bundled skill resources; unresolved placeholders must never be opened.\n\nExit codes:\n\n- `0`: no structural finding for the supplied fields; **not a compliance, conformity,\n  competence, or accreditation result**;\n- `1`: structural/evidence gaps found;\n- `2`: invalid or unsafe input/output, including an unlisted standard.\n\nRun `python3 scripts/<name>.py --help` for each interface.\n\n## Templates\n\nScope intake, per profile:\n\n- `assets/templates/scope-intake-template.json` — device lifecycle\n- `assets/templates/laboratory-scope-intake-template.json` — testing/calibration\n- `assets/templates/medical-laboratory-scope-intake-template.json` — examinations\n\nShared registers and records:\n\n- `assets/templates/document-register-template.json`\n- `assets/templates/capa-record-template.json`\n- `assets/templates/traceability-matrix-template.json`\n- `assets/templates/supplier-controls-template.json`\n- `assets/templates/evidence-manifest-template.json`\n- `assets/templates/qmsr-transition-template.json` — US device lane only\n\nManagement-system documentation:\n\n- `assets/templates/quality-manual-template.md`\n- `assets/templates/procedures/CAPA-procedure-template.md`\n- `assets/templates/procedures/document-control-procedure-template.md`\n\nEvery template is deliberately `draft`/`pending`, uses placeholders, and includes\nowner/status/evidence/approval fields. Copy and control it; never edit a distributed\ntemplate into a purported approved record.\n\n## References\n\nShared:\n\n- `references/assurance-lanes.md` — what each lane decides, and the titling rule\n- `references/source-ledger.md` — dated authoritative source baseline and provenance\n  limitations\n- `references/evidence-architecture.md` — documentation and record architecture\n- `references/gap-analysis-checklist.md` — fail-closed evidence review questions\n- `references/quality-manual-guide.md` — controlled manual development\n\nPer standard:\n\n- `references/iso-13485.md` — device QMS process/evidence framework, QMSR, MDSAP, EU\n- `references/iso-14971.md` — risk-management chain and the missing-link failure modes\n- `references/iso-17025.md` — laboratory competence, traceability, uncertainty, and\n  decision rules\n- `references/iso-15189.md` — medical laboratories, POCT, reporting, and the CLIA lane","author":"@K-Dense-AI","ownerProfile":null,"authorContacts":null,"sourceUrl":"https://github.com/K-Dense-AI/scientific-agent-skills/tree/main/skills/iso-standards-readiness","license":"MIT","category":"review","lang":"en","tokens":3343,"stars":0,"calls30d":1,"claimed":false,"visibility":"public","origin":"crawler","version":"0.1.0","createdAt":"2026-08-22","updatedAt":"2026-08-22","files":[{"path":"assets/templates/capa-record-template.json","size":2979,"sha256":"4cbcd94068ff1bf8bf55c00ae32de2730a4c35be0c3f40110ff184a1d8286845"},{"path":"assets/templates/document-register-template.json","size":2122,"sha256":"c279fc952f4a8e0887800c8202d0b1f2760736cbc9716ee2ed205e973cc3113c"},{"path":"assets/templates/evidence-manifest-template.json","size":2018,"sha256":"6ce142f0b789a0e0b1b52c1c8cf65d250a717ac3adfb2b7104e024bfcbd1d884"},{"path":"assets/templates/laboratory-scope-intake-template.json","size":3422,"sha256":"42e9e54efe82ba9b48cc0950dbde9596ee9165328be81b272a634111623a58db"},{"path":"assets/templates/medical-laboratory-scope-intake-template.json","size":3536,"sha256":"d9d9ce38bf60c7c6bb6fc851f20be1d4157481ed2a35bae9395a2555ab499c6e"},{"path":"assets/templates/procedures/CAPA-procedure-template.md","size":6517,"sha256":"ef153c0e2aebbd56bf287e95e95df180d7659009051a4a078bb4254a0e2c548a"},{"path":"assets/templates/procedures/document-control-procedure-template.md","size":6934,"sha256":"ddc713c443b8ae220195e1171b9200e9264762cffe822f3cdb7aed80b6fc2a9c"},{"path":"assets/templates/qmsr-transition-template.json","size":9622,"sha256":"f66106cb9757025482c6e24716ec44eed59ad3ac841b94a446742edb8c83d2fd"},{"path":"assets/templates/quality-manual-template.md","size":9372,"sha256":"4f5d08269ade8c68532a296be9ec41a830471965ad21abcb3884c1a2ab9c958a"},{"path":"assets/templates/scope-intake-template.json","size":2975,"sha256":"7e23d8edc6efbcbe106b61227805296d4dee0c5204592016ff3d33a8cf82246f"},{"path":"assets/templates/supplier-controls-template.json","size":4323,"sha256":"384cad6425390a25cd2f346d097da5721d396d57fd08422523812ad4763ba6cf"},{"path":"assets/templates/traceability-matrix-template.json","size":4439,"sha256":"75a03fd3fdf94b4398f46880b69ee2a47606faa225ff611d1321631231f1acf0"},{"path":"references/assurance-lanes.md","size":7053,"sha256":"e4f25d072ce024581b9a7df7f386af873fa682eaae9bb25d8c5b989ff75a3ddd"},{"path":"references/evidence-architecture.md","size":13644,"sha256":"13d7e939a764d86e9b877f2e0df41169b78b35297b3df1cc5832ce294ef96d2b"},{"path":"references/gap-analysis-checklist.md","size":19354,"sha256":"ac66607ef06254c54efc0b82ab5c1b78fa99dcea8f959ecf0928c92f8df0a68b"},{"path":"references/iso-13485.md","size":12165,"sha256":"1b19c7a57769bb9bf6f9d076d6a9b5f27523cbcbd25eb5906558cb23843299df"},{"path":"references/iso-14971.md","size":9124,"sha256":"ddd23218cf6dfff76d9edf15189df55068838eac78fb36dd71990c1bccc84e02"},{"path":"references/iso-15189.md","size":11718,"sha256":"b4a2cdc2c40bfc18b57ad4d73175567d10483aa8f1de914449a444f8a71693c7"},{"path":"references/iso-17025.md","size":11307,"sha256":"71ee17f5c3ad7d490e59c2888c0b83889ddf759ef1b1b790eea2e539277ef486"},{"path":"references/quality-manual-guide.md","size":11572,"sha256":"b608197edc3acac8adb6b6df89173ff67938dfc0f0267c69689a1ea769629bb7"},{"path":"references/source-ledger.md","size":19582,"sha256":"832df0e4d9d32ff0671328e1c64ee72ad41bf37abeaa4e57558664a9d718951b"},{"path":"scripts/audit_document_records.py","size":5518,"sha256":"7db553daa1014f851f10a5a2cc6341d65deaa1336b92b7a8ca5b20850f2b857d"},{"path":"scripts/_catalog.py","size":7732,"sha256":"14ad763ebb99fab572cabd86411cd92932f51f01571e52e234337b3d84ad4b2c"},{"path":"scripts/_common.py","size":16379,"sha256":"94af223df12d58dc94132db68bbddb485852b363a79d6e3a8ed2d525bc3cd7aa"}],"requires":{"mcp":[],"tools":["Read Write Bash Glob"]},"safety":{"flags":[{"code":"net.endpoints","kind":"exfiltration","excerpt":"eur-lex.europa.eu, example.invalid, global-aci.org, health.ec.europa.eu, iaf.nu, ilac.org, sys.global-aci.org, webgate.ec.europa.eu","message":"bundled scripts reach 16 external host(s)","severity":"warn"}],"scannedAt":"2026-08-22","hasScripts":true,"networkEndpoints":["eur-lex.europa.eu","example.invalid","global-aci.org","health.ec.europa.eu","iaf.nu","ilac.org","sys.global-aci.org","webgate.ec.europa.eu","www.cap.org","www.cms.gov","www.ecfr.gov","www.fda.gov","www.federalregister.gov","www.imdrf.org","www.iso.org","www.mdsap.global"]}}